- Microsoft confirmed the existence of a Global Device Identifier (GDID) in a Windows installation linked to a Microsoft Account. It cannot be disabled without affecting activation and Microsoft Store apps.
- The FBI used the GDID, which persists across VPNs and locations, to track a hacking suspect by correlating it with IP addresses and online activity across multiple services and countries.
- Privacy researchers raise concerns about GDID due to lack of user consent, activation dependence, limited documentation, and potential for tracking across reinstalls when using the same Microsoft Account.
- Users can mitigate tracking by using a local account, disabling diagnostic data and personalized ads, and turning off cloud search, but GDID itself cannot be fully disabled without breaking Windows functionality.
- GDID operates on about 1.6 billion Windows devices without user-facing controls, and legal requests can compel Microsoft to share associated activity data with law enforcement.