Peter Stokes is at the center of a significant breach involving a luxury retailer, where he allegedly employed a range of sophisticated tactics—including VPNs, ngrok tunnels, and rotating IP addresses across Estonia, New York, and Thailand—to obscure his digital footprint. However, his efforts proved futile when the FBI subpoenaed Microsoft’s telemetry data, uncovering a single 64-bit string—g:6755467234350028—that consistently tracked his Windows installation. This identifier, known as the Global Device Identifier (GDID), is present on his device in the same manner it exists on the machines of Windows’ 1.6 billion users. The revelation of GDID has sparked fresh concerns regarding the potential for covert user tracking at the operating system level.
What GDID Actually Does – And Why There’s No Off Switch
Court records indicate that GDID remains persistent across Microsoft services without any user-facing controls. According to the DOJ complaint, GDID is described as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device.” Notably, it survives operating system updates but resets upon a full reinstallation. However, if a user reinstalls Windows and signs back into the same Microsoft Account, activation records and OneDrive synchronization can reasonably reconnect the user to their previous identity, as analyzed by privacy advocates at PrivacyGuides.
Unfortunately, disabling GDID is not an option. The activation scripting community, Massgrave, concluded that attempts to remove it would disrupt Windows activation and the functionality of Universal Windows Platform (UWP) applications. Prior to this case, Microsoft had only referenced GDID in a single obscure Azure Monitor schema, leaving it unaddressed in consumer-facing privacy documentation.
For users concerned about their privacy, while there is no toggle to disable GDID, there are steps to minimize the data linked to it:
- Use a local account. Opt out of the Microsoft Account login during setup. This choice limits the identity connections between GDID and services like OneDrive, Outlook, and Xbox.
- Minimize diagnostic telemetry. Navigate to Settings > Privacy & security > Diagnostics & feedback, and set data collection to the minimum while disabling “Send optional diagnostic data.”
- Cut Activity history and swap your browser. Disable Activity history under Privacy & security. While this will affect features like Phone Link and cloud clipboard, it will also reduce cross-device timeline logging. For sensitive browsing, consider using Firefox or a hardened version of Chromium instead of Edge, as analyses suggest Edge may contribute URL-level data to Microsoft logs associated with GDID.
- Reinstall carefully. A clean reinstall generates a new GDID, but true separation is only achieved by avoiding re-linking to the same Microsoft Account on the same hardware. If issues arise during this process, dedicated troubleshooting resources are available to assist.
The VPN Problem Nobody Told You About
Relying on a VPN for privacy on Windows is akin to wearing a mask in a store that has already scanned your fingerprint at the entrance. While VPNs can obscure your IP address from destination sites, they do not prevent Microsoft from logging combinations of GDID, IP address, and URL at the operating system level. In Stokes’ case, the same GDID was detected accessing his Apple, Facebook, and Snapchat accounts across various countries, aligning with travel photos he shared publicly, as reported by Tom’s Hardware and Cybernews.
Privacy researchers have characterized GDID as functioning “more like a covert tracking beacon than a typical advertising ID,” according to discussions on the PrivacyGuides forum. For journalists, activists, or anyone with significant privacy concerns, security experts advise against using Windows for sensitive tasks—particularly given the potential risks posed by a purpose-built surveillance application. Unlike Windows, Linux does not operate with a closed, vendor-controlled device ID that feeds into a proprietary cloud telemetry system.
While Apple and Google provide user-facing options to reset advertising identifiers, Windows lacks any equivalent feature for GDID. For many users, this reality is unsettling. For those facing genuine risks, it may serve as a compelling reason to reconsider their choice of operating system entirely.
