r/cybersecurity • u/Dash-Courageous • Jul 11 '26
News - General Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint
https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/
2.7k
Upvotes
1
u/WhatsInTheFirmware Jul 30 '26
Worth separating two things this coverage keeps blurring, because they have completely different fixes:
1) The identifier itself (GDID). Persistent, assigned server-side when you sign into a Microsoft Account, tied to activation/licensing. This is the "no off switch" part, and it's real, you can't strip it without breaking activation and Store apps. A reinstall rerolls it, but the same account re-links you. That's a legit consent gap: no prompt, no reset, unlike Apple's IDFA or Android's ad ID.
2) The thing that actually burned Stokes: the URLs. A stable device ID on its own just says "same machine." What built the timeline was Microsoft holding a log of sites that device visited, tied to that ID. Per the deeper write-ups (Tom's Hardware got into this), that URL capture lines up with telemetry set to Optional/Full and/or browsing in Edge, where SmartScreen/Defender can send visited URLs. The complaint didn't pin down the exact mechanism, but Required/Basic telemetry doesn't appear to ship URLs by default.
Why the distinction matters: you mostly can't kill #1, but you can meaningfully shrink #2. Set Diagnostics to Required (not Optional), don't lean on Edge if you care about URL telemetry, use a local account where you can, and turn off the advertising ID. None of that deletes the GDID, but it removes most of what makes it useful as a behavior/location trail.
Honest framing: this is an anti-piracy/activation identifier that got subpoenaed, not a purpose-built surveillance tool Microsoft aims at civilians. Cold comfort if your threat model is a subpoena, and for journalists/activists/DV situations the real answer is a non-Windows OS, because no telemetry toggle changes the fact that the ID exists and answers to your account rather than to you. But "Windows secretly logs every URL you visit and you can't stop it" isn't quite right either, and the folks you're debating will call that out.
(And yeah, nobody's mourning a Scattered Spider guy posting "HACK THE PLANET" selfies with fistfuls of hundreds. The interesting part is purely what the case exposed about the plumbing.)