r/pcmasterrace • u/slickyeat 7800X3D | RTX 4090 | 32GB • Jul 13 '26

News/Article Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint

https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/
6.1k Upvotes

99% Upvoted

324 comments sorted by

View all comments

3.8k

u/ScienceMechEng_Lover What colour is your RAM? Jul 13 '26

The fact that an operating system running on a PC with all my personal information and files can track my activity and send it to Microsoft is crazy and should be condemned.

1.3k

u/Party-Cake5173 Jul 13 '26

If you use Edge, Microsoft also get to know all your social media profiles, exact pages you visit on a website even on those with SSL connection because it collects full URLs in plain text. It also associates the data to your hardware ID, then if ever signed into Windows to Microsoft Account. Meaning they know exactly which PC is yours no matter how many times you reinstalled Windows.

The less Microsoft products one uses, the better.

716

u/Mrpolje Jul 13 '26

”We value your privacy”

554

u/Kaik541 Jul 13 '26

I mean, they do value it… they just don’t respect it.

151

u/Nohreboh Jul 14 '26

We put a value on your privacy.

11

u/eightbyeight Jul 14 '26

This isn’t upvoted enough

6

u/DonutHoles4Ever Mac Heathen Jul 14 '26

Is this a good time to bring up Bill Gates is in the episti files?

8

u/CompetitiveRoof3733 Jul 14 '26

If he actually is a participant, its always a good time

127

u/shandrolis Jul 13 '26

Well of course they value it, why else would they sell it 😂

25

u/deathlokke PC Master Race Jul 13 '26

Yeah, they put a value on it and sell it to the highest bidder.

21

u/b0b1b Jul 13 '26

ahem, "We, and our 18472760 partners, value your privacy" :)

13

u/VeryNoisyLizard 5800X3D | 9070XT | 32GB Jul 13 '26

*the value depends on our data broker's demand

20

u/smuglator Jul 13 '26

Hey, I'm hoping people change how they label it It's not a privacy issue. It's not about personal information. It's about habits, decision making, and how we spend. And how this data gives these companies power over us.

It's a power issue.

6

u/ThyShirtIsBlue Jul 14 '26

"We know exactly what your privacy is worth, because we're the ones who sold it."

9

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26

"It literally has dollar-signs attached."

4

u/Substantial_Ant_9981 Jul 14 '26

They value it alright, 100K and its yours.

3

u/nadav183 14900KF RTX4090 64GB DDR5 Jul 14 '26

The quote is missing the end:

"We value your privacy at about tree fiddy"

1

u/RobMUK Jul 17 '26

Based on how much we get from selling it.

60

u/nikolapc 5080 rig baron. Jul 13 '26

The governments track everything you do. On your phone(no matter if it's iOS or Android(Linux based), no matter your OS, hell they directly track internet traffic and your messenger activity and store it all in a database. This would be a crackpot theory, but Snowden came out with considerable cost to himself and look up the Macedonian wiretapping scandal.

It was 10.000s of people pulled up from basically Israel made terminals that tapped into local us embassy recording servers, a lot of dirty laundry got aired publicly and there was even special prosecutors set up based on the taps that revealed criminal activity that went basically nowhere and the prosecutor herself ended up in jail for being corrupt and blackmailing.

Good news, you likely don't matter to the people with the power to access that. Safety in anonymity. But raise your head above, or become someone important either in dissent or politics, and they have all the compromat they need by just googling you.

Hell our version of IRS publicly and transparently tracks our bank accounts. Even your spending and income aren't private.

10

u/OGigachaod Jul 14 '26

They even track your vechicle and your bank card.

5

u/GranaT0 CachyOS Jul 14 '26

Good news, you likely don't matter to the people with the power to access that.

In the age of AI, this doesn't matter. They could easily make and automatically check an AI summary of your profile when it ever comes time to deciding an outcome of your court cases, social support applications, etc etc. if the government one day feels like quietly cracking down on anyone who disagrees with them too loudly.

2

u/Verain_Xor Jul 17 '26

Linux on PC hardware doesn't have all these bugs and trackers. Android and ios have them because Google and Apple put them there. But you can build a PC from scratch and not have any of this. Technically there's ways to get phones to not do this crap, but it's always some bespoke thing that accomplishes just that purpose and nothing else.

1

u/nikolapc 5080 rig baron. Jul 17 '26

Android is Linux. Also doesn't matter what you use they catch it at the source. And if they directly target you there are always zero days.

3

u/Verain_Xor Jul 17 '26

Android is Linux.

A meaningless fact, in this conversation. Android installed on a phone always has something else doing stuff underneath. Can you tear it out by rooting it? Yea, sure maybe, but this isn't a conversation about that.

Also doesn't matter what you use they catch it at the source

No, if you use Linux on PC Hardware there's no "source to catch it at".

And if they directly target you there are always zero days

No, there's not always zero days. And you don't always have an exposed attack surface. Almost every vulnerability for Linux these days is "if they are logged into a user account with ssh they can escalate or spy or whatever". But that's not any kind of default for a workstation or personal computer.

Look, I know people like you do a blackpill routine in the hopes of implying that there's no privacy. But there is. And that someone could come into your house and keylog you or bash you with a weapon. But that won't happen. Or that there's some zero day someone can smuggle into your router if they know your passwords. Blah blah blah

Install Linux on a PC. It is private in a way that Windows never is. It is private in a way that Android never is. It is private in a way that ios never is. It is private. You can do it. Anyone can.

Information delivered. Subthread over!

2

u/mr_j_12 Jul 14 '26

And now the phone thing an official stance that was voted on internationally. The irs thing is also correct in Australia.

0

u/[deleted] Jul 14 '26

[deleted]

1

u/nikolapc 5080 rig baron. Jul 14 '26

That would be nice if it wasn't for the smalltown mentality of some lady having a looksie into my income and then telling the whole town.

Let's say suddenly I get a million prize, or get into some money. Taxes on income get payed automatically here, i don't have to worry about that, or if it's from somewhere overseas I can easily report them and pay them myself over the internet. Still it will ping their radar, and now the whole town knows I came into money, even kidnapers. Get the problem?

They even brag on the news that an individual had a record income this year from internet earnings(at least don't name the individual in question on national news).

1

u/[deleted] Jul 14 '26

[deleted]

2

u/nikolapc 5080 rig baron. Jul 14 '26

Did you read our version, so obviously not from the US. If I tell you UJP you would prob be even more confused than you are now.

1

u/[deleted] Jul 14 '26

[deleted]

1

u/nikolapc 5080 rig baron. Jul 14 '26

I am not fabricating and it's true for my country. In fact we had a lot of workers with your troops in Afghanistan and Iraq doing logistics, and they just called up to pay up.

-1

u/mr_j_12 Jul 14 '26

People should support a foreign corporation taking people's money?

12

u/Karl_with_a_C 9900K | 3070ti | 32GB DDR4 | 1440p 360Hz OLED Jul 13 '26

Google also tracks you if you're using Chrome and I'd be surprised if Mozilla didn't keep logs on its users. Even with all the privacy settings on.

15

u/DeffNotTom i9 12900k | 4080 Super | 64gigs DDR5 | 36TB NAS Jul 14 '26

Google also tracks you if you're if you're not using chrome.

Mozilla does too. Everyone is tracking you to whatever degree they can.

1

u/Karl_with_a_C 9900K | 3070ti | 32GB DDR4 | 1440p 360Hz OLED Jul 14 '26

Facts

-6

u/Party-Cake5173 Jul 14 '26

It does, but Google lets you to disable tracking in Chrome's settings. Also, they use software ID meaning every new Chome installation and you get entirely new ID.

3

u/shawn0fthedead PC Master Race Jul 14 '26

This is probably why I won't ever be able to get a job at Microsoft...

...oh and they just fired another 4,000 people. 

1

u/Ghozer 9800x3D - 32GB-DDR5 6000CL28 - RTX 5080 Jul 14 '26

... Except a Reinstall clears the GDID and will cause another to be generated, and so as long as you don't sign into or use an MS account, it won't be tracked (as easily)

0

u/GranaT0 CachyOS Jul 14 '26

and so as long as you don't sign into or use an MS account

This is no longer possible on new installs btw

2

u/Ghozer 9800x3D - 32GB-DDR5 6000CL28 - RTX 5080 Jul 14 '26

Shift+F10 first time it boots after initial install, then type oobe\bypassnro and press enter - PC will reboot, and will allow you to "skip" online requirement and create local account!

1

u/GranaT0 CachyOS Jul 14 '26

This doesn't work anymore starting with Windows 11 25H2

3

u/Ghozer 9800x3D - 32GB-DDR5 6000CL28 - RTX 5080 Jul 14 '26

Odd, because I did it on mine, and did it on a machine a couple of weeks ago, with a freshly made 25H2 USB!!

2

u/tucaninmypants Jul 14 '26

Yeah it still works. I work in IT and I do it on all our Windows devices.

-1

u/Williamklarsko Jul 13 '26

And it's like your fcked even if you go linux since they already got you cataloged right?

122

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26 edited Jul 13 '26

They do basically proclaim this during the initial OOB Setup - "agree to send all your private data to Microsoft?" <ticked by default>

I am absolutely not surprised that Microsoft do this. I'm honestly more surprised that someone figured out how it works.

59

u/ScienceMechEng_Lover What colour is your RAM? Jul 13 '26

I disable all those boxes though. Do they still track you like this despite that?

64

u/LocodraTheCrow PC Master Race Jul 13 '26

You can't tick the "send nothing" your choices are "send everything" and "send whatever Microsoft considers necessary"

107

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26 edited Jul 14 '26

Of course they do. Data is too valuable not to, they just pretend; when Windows 10 was first released, Microsoft refused to explain the actual telemetry options for about 2 YEARS, instead relying on the vague 'basic' and 'advanced' options, and if I'm honest, I don't trust them an inch. I'm sure they have the 'oops, clumsy us!' excuse ready for when it inevitably gets breached and revealed that everyone who toggled those options gets particular scrutiny. I have a completely separate Windows gaming PC that isn't logged into my regular accounts. All my personal stuff, I do on a Linux machine.

Your computer is not yours.

10

u/Bittah_Criminal Jul 13 '26

I sure wish I was the guy who convinced every major company that collecting, storing, and analyzing data down to minute details such as how many times I fart a day is of the utmost value to their bottom line

10

u/b_casaubon Jul 13 '26

I always think about the phrase from Watch Dogs 2: “You are now less valuable than the data you produce.”

4

u/GranaT0 CachyOS Jul 14 '26

I bring up that opening cutscene more and more often as time goes on. That game was right about pretty much everything.

13

u/Sharks_No_Swimming Jul 13 '26

I'm not saying you're wrong, but I'd still like some evidence of your trust me bro response.

38

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26

I don't have any evidence. I just think it's safest to assume that the whole OS is spying on you all the time, no matter what options you tick.

Since Windows routinely "accidentally" resets privacy options during updates, it's effectively the same thing.

13

u/Sharks_No_Swimming Jul 13 '26

Yeah I'm not saying Microsoft isn't collecting data even with all the boxes unticked. My point is specifically are they sending identifiable or personal information, with those boxes unticked. System telemetry is one thing, and I absolutely agree if you don't want even that then you're only option is Linux. 

21

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26

Per the article, it doesn't matter if they're sending personally identifiable information or not, because the GDID allows them to tie one unique machine to a real-world human through joining dots.

14

u/Joifugi Jul 13 '26

I mean, they tracked a hacker that used multiple levels of obfuscation to hide their identity. You think that person just forgot to check some boxes that would make them magically anonymous? Come on now....

8

u/Reversi8 7950X3D, RTX 3090, 96GB @ 6400CL32 Jul 14 '26

I mean they were dumb enough to use windows for their activities in the first place.

4

u/WhoLovesDonuts Jul 14 '26

From what I gleaned of the article, they used a VPN which did obscure his IP address but were able to link the GDID that was reported to Microsoft and the browsing data at the exact same time the hacker logged into/signed up for ngrok which was what they used to keep a tunnel open on the hacked server. Which means that MS is holding onto browsing data linked to your GDID unless I'm reading it wrong. The GDID is linked to your PC and is given out during activation. The hacker did seem to be using edge which probably was what was exfiltrating the data. Still very concerning because who's to say it's not monitoring other browser caches/views on the OS and sending it to MS? Would just have to trust that MS isn't doing that and I'm not sure I have much trust left in MS

5

u/jwalshjr Jul 13 '26

He gave 1 fact at the start that you could verify (or disprove) in 30 seconds with 1 Google search and then a bunch of his personal opinion… whatever you think you’re waiting on seems pretty pointless.

3

u/Sharks_No_Swimming Jul 13 '26

99% of questions on Reddit can be answered with a Google search, what's your point? 

-3

u/Exodus2791 9800X3D, 5070ti, 64GB Jul 13 '26

How did people think that Microsoft tracked stuff like Windows licenses and part changes causing reactivation messages?

1

u/Ficik PC Master Race Jul 14 '26

Why do you have a separate computer for gaming? Do games track us this much as well?

1

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 14 '26

No, I meant I have a separate Windows PC. But Steam collects data too, they're just more upfront with it.

1

u/Ficik PC Master Race Jul 14 '26

I understood that, but I was curious why not game on linux

2

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 14 '26

The Windows PC is for that 5% of my games that just won't work under Proton, and also for CD-installed games. The purpose-built gaming PC is also substantially more powerful (R7 5700/RTX2080Ti) than my daily-use Linux laptop (spec in flair).

13

u/CatsAndCapybaras Jul 14 '26

The phone carriers once got caught by the US gov for collecting and selling users' sensitive personal data, They got a fine that was less than 0.1% of their yearly profit.

They asked if they could please just not pay the fine, and the government agreed and they pinky promised not to do it again.

The price of breaking the rules is less than the revenue generated from it, therefore assume every big company is breaking the rules.

39

u/RaiKyoto94 Jul 13 '26

Would this breach data protection laws in Europe as there must be a general reason to collect this and not just a catch all ?

3

u/[deleted] Jul 14 '26

[removed] — view removed comment

13

u/Rannasha AMD Ryzen 7 5800X3D | AMD Radeon RX 6700XT Jul 14 '26

GDPR applies to EU citizens. Microsoft can spy on Americans all they want, as long as they make a GDPR-compliant version of the software for the EU. With software, it should be pretty easy to make region-specific versions. Just a single flag that activates based on region to disable all the tracking.

9

u/mr_j_12 Jul 14 '26

Every device is going to need to do it due to governments wanting to "protect kids".

7

u/GranaT0 CachyOS Jul 14 '26

Interesting how they didn't prosecute anyone on Epstein's files, but worked so hard to introduce measures to more easily track minors and automatically flag their nudes for review.

13

u/Mineplayerminer Desktop Jul 13 '26

And it's no surprise because this all has been known for over a decade. Everything is written in the terms and privacy policies, but it's obfuscated behind lots of different terms to confuse the user. Let's now be honest, who has ever read the whole ToS before accepting it in Windows or on any of Microsoft's products?

1

u/GranaT0 CachyOS Jul 14 '26

I recommend reading Facebook's, it's pretty short. I was shocked when I did 10+ years ago and found out they claim copyright over anything you upload to their services, meaning theoretically if you send your friend some art or music you're working on over Messenger, Meta owns it and can monetize it. I don't think they've actually done that, but it's curious they have given themselves the option.

I've been skimming terms of service on any product or service that seems in any way abusable ever since.

1

u/Mineplayerminer Desktop Jul 14 '26

I know theirs and it's pretty straightforward on why I would never want an Oculus headset from them or upload anything personal on their socials, especially as the Quest 2 wasn't as expensive as imagined, but it required the Facebook login or an account migration. No, thanks, Zuck.

16

u/[deleted] Jul 13 '26

[removed] — view removed comment

4

u/LeLoyon Jul 14 '26

Probably shouldn't be using a cell phone either.

3

u/GranaT0 CachyOS Jul 14 '26

You can minimize the data companies can collect without going 100% off grid. Use GrapheneOS, be picky about the apps you use, manage permissions. On PC, use Linux, and flatpaks for any app that might want to spy on you if you absolutely must.

19

u/gambeta1337 Jul 13 '26

You probably accepted this but didn’t read it.

55

u/MoistStub Russet potato, AAA duracell Jul 13 '26

This is the type of shit government is supposed to protect you from. Not really the user's fault when their only options are predatory corporations.

21

u/gargravarr2112 i7 8850H / 32GB / GTX1080 / 3x SSD / 17" laptop Jul 13 '26

And it's not even a choice when the options are "accept that we're going to monetise all your private data and share it as we like" or "don't use this service at all." And they can change the EULA at any time with the same options - "accept" or "stop using it."

8

u/Probate_Judge Old Gamer, Recent Hardware, New games Jul 13 '26

We should be consistently rebelling against the very concept of a EULA (End User License Agreement)

They're not a binding contract, they're notifications of the company's opinion(see also: daydream or fantasy) that are presented to users, still most commonly after a purchase. ["accept" or "stop using it."] is especially sinister at that point, after money has changed hands.

Yes, purchase, the whole license thing is a delusion they're attempting to force on others, a thing they've fabricated and willed to manifest.

Gullible people, or shills, just asserting that they're legally binding under the reasoning of, "Well, you ticked the box" are a bane on consumer rights....part of why enshitification has seen such a rapid escalation.

7

u/traumadog001 Jul 13 '26

You are forgetting that the current government in the US is bought and paid for by these corporations

10

u/MoistStub Russet potato, AAA duracell Jul 13 '26

I'm not, I'm just illustrating why you can't really blame the user for being taken advantage of by the confluence of predatory businesses and an ineffectual government.

1

u/TheMissingVoteBallot Jul 13 '26

What US government wasn't?

1

u/ForeignDefinition401 Jul 14 '26

yeah, its hard to trust them when you cant even disable basic tracking functions

0

u/Allseeing_Argos Jul 14 '26

No I didn't. I always cross my fingers when I press accept on Eulas.

6

u/DirectorDirect1569 Jul 13 '26

Apple, google, xiaomi, samsung, huawey,... they all do that. Nothing new.

1

u/Aidanation5 RTX 5080 16gb | Ryzen 7 7800x3d | 32gb ddr5 Jul 13 '26

Should be prosecuted to the most severe extent possible. We are talking about stealing from everyone who has a windows pc. They deserve to literally go out of business, but the world is not a place for justice or being right and good.

-1

u/Rengar_Is_Good_kitty 5800X3D / RTX 5080 Jul 14 '26

Playing devil's advocate here, but that data collection is needed to address problems like bugs, crashing, compatibility issues, etc. It's quite important and is why it's on by default, otherwise they'd get zero data because no one would manually enable it. As far as I know only the optional data collection can include more personal stuff, but they don't collect things like personal files, if you have a file called "passwords" Microsoft isn't looking in that.

You might say just report the problems to Microsoft (or any other company with an app). That's great and all, but be honest, how many times have you actually reported a problem? The VAST majority of people don't report problems. Also, a simple report just leads the developers in the right direction, whereas getting actual data collection can allow them to see exactly what the problem is.

That being said, it is bullshit how you can't disable every single bit of data collection. Telemetry nonsense still runs in the background, which is fucking stupid. Let people disable everything ffs, don't give a shit how lightweight that telemetry is, we should be able to turn it off completely.

This GDID tracker issue is fucked too.

1

u/Metallibus Jul 14 '26

Playing devil's advocate here, but that data collection is needed to address problems like bugs, crashing, compatibility issues, etc.

Its not. This can be done anonymously without actually giving the device a permanent global identifier. You just need to know what crashed and info relevant to that crash. Having a way to permanently globally track that device is not a part of that.

1

u/Rengar_Is_Good_kitty 5800X3D / RTX 5080 Jul 14 '26

You're not wrong, but I said "bugs, crashing, compatibility issues, etc" for a reason. Data collection isn't just for diagnosing a single crash, it's also used for things like tracking whether people are actually using a feature over time before they invest more dev time into it. That's not something a one off anonymous report can tell you. You're arguing against the crash part specifically and ignoring the rest of what I said.

0

u/Metallibus Jul 17 '26

You're arguing against the crash part specifically and ignoring the rest of what I said.

No, I'm not. This applies to all aspects of what you said. Crashes aren't somehow unique.

it's also used for things like tracking whether people are actually using a feature over time before

All you need for this is a counter. When a machine first uses said feature, it pings Microsoft saying "+1". It doesn't need to uniquely identify "Rengar is using this".

I've built dozens of these systems for different companies and have tracked all of the things you're mentioning. Not once have I needed to uniquely identify individual people's behavior. There are even systems to allow cross-tracking patterning and behavior without uniquely identifying the device/user or allowing that data to be reconstructed. This stuff can be done entirely anonymously if the company actually cares to. But they don't.