In a recent case involving Peter Stokes, the complexities of digital privacy have come to the forefront. Stokes allegedly employed a range of sophisticated methods—including VPNs, ngrok tunnels, and rotating IP addresses across Estonia, New York, and Thailand—to obscure his identity during a breach at a luxury retailer. However, his efforts proved futile when the FBI subpoenaed Microsoft’s telemetry data, uncovering a singular 64-bit string—g:6755467234350028—that tracked his Windows installation across various locations. This identifier, known as the Global Device Identifier (GDID), is present on devices in the same manner it exists on the machines of Windows’ 1.6 billion users. The revelation of GDID has sparked new concerns regarding the potential for covert user tracking at the operating system level.
What GDID Actually Does – And Why There’s No Off Switch
Court records indicate that GDID remains persistent across Microsoft services without any user-facing controls.
The Department of Justice’s complaint characterizes GDID as “a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device.” This identifier withstands operating system updates but resets only upon a complete reinstallation. However, if a user reinstalls Windows and signs back into the same Microsoft Account, the activation records and OneDrive synchronization can effectively reconnect the user to their previous identity, as analyzed by privacy advocates.
Unfortunately, disabling GDID is not an option. The activation scripting community, Massgrave, concluded that attempts to remove GDID could disrupt Windows activation and render Universal Windows Platform (UWP) applications inoperable. Prior to this case, Microsoft had only mentioned GDID in a single, obscure Azure Monitor schema reference, leaving consumers unaware of its existence. There is no toggle to disable it, not even a hidden one.
While users cannot eliminate the GDID fingerprint, they can take steps to minimize the data associated with it:
- Use a local account. By opting out of Microsoft Account login during setup, users can limit the connections between GDID and services like OneDrive and Outlook.
- Minimize diagnostic telemetry. Adjust settings under Privacy & security to collect minimal data and disable optional diagnostic data transmission.
- Cut Activity history and swap your browser. Disabling Activity history may limit some functionalities, but it can also reduce the data logged by Microsoft. For sensitive browsing, consider using alternatives like Firefox or a secure Chromium variant.
- Reinstall carefully. A clean reinstall can generate a new GDID, but true separation requires avoiding re-linking to the same Microsoft Account on the original hardware.
The VPN Problem Nobody Told You About
Relying on a VPN for privacy on Windows is akin to wearing a mask in a store that has already scanned your fingerprint at the entrance.
While VPNs can obscure a user’s IP address from destination sites, they do not prevent Microsoft from logging combinations of GDID, IP address, and URL at the operating system level. In Stokes’ case, the same GDID was linked to his access of accounts on platforms such as Apple, Facebook, and Snapchat across multiple countries, correlating with publicly shared travel photos.
Privacy researchers have described GDID as functioning “more like a covert tracking beacon than a typical advertising ID.” For journalists, activists, or individuals facing significant privacy threats, security experts strongly advise against using Windows for sensitive tasks. Unlike Windows, Linux does not operate with a closed, vendor-controlled device ID that feeds into a proprietary cloud telemetry system. Furthermore, while Apple and Google provide user-facing options to reset advertising identifiers, Windows offers no equivalent for GDID, leaving many users with an unsettling reality to consider. For those at heightened risk, this may be a compelling reason to reevaluate their choice of operating system.
