Windows as Spyware? The GDID Tracker You Can’t Turn Off

Background

The GDID (Global Device Identifier) is a persistent, device-level identifier designed to uniquely identify a Windows installation across Microsoft’s services. It became public not through documentation or a privacy notice, but through a court filing: after the FBI subpoenaed Microsoft in a hacking case, the telemetry logs handed over contained the suspect’s GDID along with the websites he had visited from his main Windows machine. Despite using VPNs, remote connections and rotating IP addresses, the 19-year-old was fingerprinted through his device’s GDID, a rare public look at how the identifier works.

This landed on top of a long-running privacy debate often summarised as ‘Windows is spyware.’ Windows collects diagnostic telemetry in two tiers (Required and Optional), assigns every user an advertising ID, keeps an activity history, and, with the 2024/2025 updates, added Copilot and Recall, which can capture screenshots of everything on screen. Many of these features are opt-out rather than opt-in and buried in sub-menus, and independent tests have shown a fresh Windows install contacting Microsoft and third-party ad servers before the user opens a browser.

What we observed

The privacy problem with GDID is less about the ID existing and more about consent, control and transparency:

• No off switch, no consent: the GDID cannot be turned off without breaking core Windows functionality, users are never asked to agree to it, and Microsoft only confirmed its existence publicly after a court forced the issue.
• It is genuinely persistent: reinstalling Windows generates a new GDID but does not erase the old one from Microsoft’s systems, and a separate identifier stored in the hardware survives even a clean install, so wiping the machine does not give you a clean slate.
• It works as designed to de-anonymise: in the FBI case it linked a specific person to a specific PC despite VPNs and IP rotation. That is the double edge. The same mechanism that helped catch a real criminal silently fingerprints every law-abiding user, with none of the accountability we expect from tracking.
• The sharing is opaque: by researchers’ accounts there is no public policy on when Microsoft discloses GDID data, no known opt-out, and no transparency report covering GDID disclosures, so users cannot see how often, or to whom, it is handed over.
• It sits on a wider collection surface: Required telemetry cannot be fully disabled outside Enterprise/Education/LTSC editions, the advertising ID enables cross-app tracking, and Recall (now opt-in after backlash) can turn your screen history into a searchable database of every password, message and document you view.

How the GDID de-anonymised a user

VPNs and IP rotation hide your network address, not your device. The GDID identifies the machine itself, underneath all of that.

Attribution

To be fair and accurate: this is not malware, and Microsoft has stated, legitimate purposes for these identifiers, diagnostics and reliability, licensing and anti-fraud, and identifying a device to its own services. The word ‘spyware’ is a provocation, not a technical classification. But the privacy criticism stands on solid ground: a permanent identifier with no consent, no opt-out, no transparency reporting and opaque disclosure practices behaves, from the user’s side, a lot like tracking software, and users deserve to make that trade-off knowingly rather than discover it in a court filing.

Confidence: 88%.

The identifier that caught a hacker hiding behind VPNs is the same one fingerprinting every ordinary Windows PC, silently, permanently, with no off switch.

Detection

Copy-ready hunting query:

# Windows privacy hardening -- reduces what is collected (does NOT remove the GDID)
# 1) Diagnostics: set to Required-only (Home/Pro cannot fully disable telemetry)
#    Settings > Privacy & security > Diagnostics & feedback > Diagnostic data = OFF (Optional)
#    Also turn OFF 'Tailored experiences' and 'View diagnostic data'.
# 2) Kill the advertising ID and cross-app tracking
#    Settings > Privacy & security > General > turn all four toggles OFF (ad ID, etc.)
# 3) Activity history and location
#    Settings > Privacy & security > Activity history = OFF ; Location = OFF
# 4) Recall (Copilot+ PCs) -- keep it OFF / remove it
#    Settings > Privacy & security > Recall & snapshots = OFF
#    Optional-feature removal:  Disable-WindowsOptionalFeature -Online -FeatureName Recall
# 5) Enterprise/Education/LTSC only -- the strongest telemetry control:
#    Group Policy: Computer Config > Admin Templates > Data Collection > Allow Diagnostic Data = 'Diagnostic data off (Security)'
#    (equivalent registry: HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection\AllowTelemetry = 0 -- only honoured on Enterprise/Education)
#
# Reality check: none of the above removes the GDID or the hardware identifier.
# They reduce the *volume* of data tied to it, not the identifier. For a real
# anonymity requirement, use policy-controlled Enterprise/LTSC or a different OS.

Recommendations

• Do the free, high-impact settings first: set diagnostic data to Required-only, turn off the advertising ID and tailored experiences, disable activity history and unnecessary location access, and keep Recall off (or remove it). This cuts a large share of routine collection in minutes.
• Know the hard limits: on Windows Home and Pro you cannot fully disable Required telemetry, and no setting removes the GDID or the hardware-level identifier. Treat ‘privacy hardening’ as reducing exposure, not achieving anonymity.
• If you need real control, change the tier: only Enterprise, Education and LTSC editions honour the ‘Diagnostic data off (Security)’ policy, for privacy-sensitive fleets, standardise on those and enforce it via Group Policy / MDM.
• Address it at the network too: use a filtering DNS or firewall to limit telemetry and ad endpoints where feasible, and segment or isolate sensitive machines, but be aware Microsoft hard-codes some telemetry destinations, so this is mitigation, not a cure.
• Match the OS to the threat model: if your requirement is genuine anonymity or high-assurance privacy, a VPN over Windows is not enough because the OS itself is the identifier, consider a privacy-focused Linux distribution or a dedicated, compartmentalised device for that work.