Short answer
Yes — and it requires no special permission. The blockchain is a public ledger. Anyone can look up any address's entire history: balance, every transaction in and out, counterparty addresses, timestamps, gas paid. Etherscan, Blockchain.com, Mempool.space — all free, no account needed. The bigger question is what "tracked" means: passive lookups by anyone, or active deanonymization by chain-analytics firms.
What "anyone" can see
Paste any Bitcoin or Ethereum address into a block explorer:
- Current balance, denominated in BTC/ETH and converted USD
- Every transaction ever, with timestamps
- Counterparty addresses for each transaction
- Token holdings (for Ethereum), NFTs owned, ERC-20 balances
- Smart-contract interactions, approvals granted
What they can't see directly: who owns the address. The pseudonymity layer is the gap between "address" and "real-world identity."
How that gap closes
Chain-analytics firms — Chainalysis, Elliptic, TRM Labs — operate commercial scale link-graph databases. They combine on-chain history with off-chain data sources: KYC records from cooperating exchanges, leaked customer databases, OSINT, and dust attacks (small "tagging" transactions sent to suspect addresses).
If you've deposited from a US-regulated CEX (Coinbase, Kraken, Gemini) to your self-custody wallet, your KYC identity is linked to your address in Chainalysis's database. From there, the address-graph expansion to your other addresses follows naturally.
Who actually looks
Three categories. Law enforcement (FBI, IRS Criminal Investigation, Treasury's FinCEN) routinely contract with Chainalysis to deanonymize specific addresses. Exchanges screen incoming deposits against sanction lists and "high-risk" address tags. Bad actors identify large balances on public addresses and target them for phishing or physical extortion (the "wrench attack").
What reduces exposure
Three practical habits. Generate fresh receive addresses for each transaction (Bitcoin wallets do this automatically; Ethereum requires manual address rotation). Don't link KYC identity to long-term holding addresses — use a clean wallet that receives from exchange only, then transfers to your "cold" address. Avoid posting screenshots or social-media boasts that show your address.
For most US holders, full anonymity is impractical and unnecessary. Aim for "not findable by casual web search" rather than "untraceable by FBI."
Further reading: Address, Dusting attack.