The fact that a .cia does not contain a rom header, which is unique to every cartridge. This is how they track online activity in games for the 3DS, although they're only present in .3ds roms and on cartridges themselves.
Don't rule the possibility out though, im sure Nintendo can do something if they cared (which they obviously dont, we've been fine for almost 2 years now)
If you use a .3ds/.3dz file you can inject a private header (you can get a header from your own cartridge thats unique if you dump the whole game from the GW launcher or some other backup tool) into a "backup" of some sort. We have however, seen cases of online bans with people using .3ds files with public headers. As this is the case, everyone should be using their own private one from a game they bought at a store. You can use the same private header on all of your .3ds games also.
You can use Gateway ROM Patcher to inject/export ROM headers. There might be another tool, i dont know though cause this one does the job cleanly.