Microsoft confirmed the existence of a Global Device Identifier (GDID) in a Windows installation linked to a Microsoft Account. It cannot be disabled without affecting activation and Microsoft Store apps.
The FBI used the GDID, which persists across VPNs and locations, to track a hacking suspect by correlating it with IP addresses and online activity across multiple services and countries.
Privacy researchers raise concerns about GDID due to lack of user consent, activation dependence, limited documentation, and potential for tracking across reinstalls when using the same Microsoft Account.
Users can mitigate tracking by using a local account, disabling diagnostic data and personalized ads, and turning off cloud search, but GDID itself cannot be fully disabled without breaking Windows functionality.
GDID operates on about 1.6 billion Windows devices without user-facing controls, and legal requests can compel Microsoft to share associated activity data with law enforcement.