Windows 11 Has a Tracker You Can't Fully Turn Off - Meet GDID
Okay this one's wild. A federal complaint against an alleged Scattered Spider hacker just outed a Windows tracking ID most people (including me, honestly) had never heard of: the GDID, or Global Device Identifier.
Here's the gist. When you sign into Windows with a Microsoft Account, a server assigns your PC a permanent ID number. It's stored locally in your registry, read by background services like Phone Link and cloud clipboard, and stamped onto activity your PC reports back to Microsoft, including update sharing data. It survives Windows updates. Reinstalling gets you a new one, but Microsoft's own filing admits a single account can rack up multiple GDIDs over time, easily linked back together.
In this case, the FBI used it to trace a 19-year-old hacker's device across VPNs, proxy servers, and three countries, tying it to logins on his Snapchat, Apple, and gaming accounts over eight months. He got caught, no complaints there. But the case exposed something most of the 1.6 billion Windows users never consented to or even knew existed. No prompt, no visible reset, unlike Apple or Android's ad identifiers.
You can't fully kill it without breaking activation, but you can shrink what it captures:
- Use a local account instead of a Microsoft Account where possible
- Turn off optional diagnostic data under Settings > Privacy & security > Diagnostics & feedback
- Disable personalized ads/recommendations under Privacy & security > Recommendations & offers
- Turn off Cloud Content Search under Privacy & security > Search
None of this makes the GDID disappear, it just answers to your Microsoft Account instead of you. Kind of unsettling that this only became public because a court forced Microsoft's hand.
Sources:Windows Latest