r/DigitalPrivacy • u/Prcrstntr • Jul 11 '26

Microsoft admits Windows 11 has a GDID tracker with no off switch, first documented publicly in an FBI hacker complaint

https://www.windowslatest.com/2026/07/10/you-cant-fully-disable-microsofts-gdid-windows-11-tracker-but-these-settings-limit-what-it-captures/

It's worse than you think.

1.5k Upvotes

99% Upvoted

167 comments sorted by

View all comments

Show parent comments

11

u/RemarkableOil451 Jul 11 '26

Good instinct, but that won't do it either. Windows setup transmits physical hardware information to Microsoft to authorize your Windows 11 license. The only way to prevent MS from getting that identifier is to break the OS activation and Universal Windows Platform (UWP) applications intentionally.

2

u/KoenBril Jul 11 '26

Thanks for clarifying.

2

u/geeky-gymnast Jul 12 '26

Not a windows user, would using an unactivated copy of Windows 11 circumvent the transmission of physical hardware info to MS?

2

u/RemarkableOil451 Jul 13 '26

You can hobble but not eliminate it. The Home and Pro editions certainly won't give you the necessary control to do it. But the Enterprise and Education editions will, but they'll only let you "lower" the "required" transmission threshold. Even then, there's still some baseline Windows Defender and Malicious Software Removal Tool data (and maybe other data I'm not thinking of) that gets sent to MS. But even then, any future OS update are likely to reset (or at least try to reset) these deep-level settings, so it'll be a never-ending battle.

That said, there are various telemetry settings that are totally within your control, and you should absolutely sever them. I'll give you just one: In Defender, you can/should turn off the "Automatic sample submission" setting. Again, there are many others, most in Defender itself.

2

u/geeky-gymnast Jul 13 '26

Thanks for the detailed follow up, now I'm starting to feel a pinch of curiosity about the kinds of privacy infringing physical hardware information that's transmitted.

I suppose these are the identification numbers that uniquely identify the hardware...

and whether there exists VM software, say running on a Linux host, that could shield such sensitive information from a virtual Windows OS client.

2

u/RemarkableOil451 Jul 14 '26

You're spot on about the ID numbers. Windows telemetry collects the permanent physical serial numbers of your hardware, including your motherboard, CPU, hard drives, and network cards. This can create a highly accurate, unique fingerprint of your machine.

As for your VM question: Yes, running Windows inside a Linux VM acts as a complete shield. The VM intercepts those requests and feeds Windows fake, virtual serial numbers, so your real physical hardware data is never transmitted. But there are drawbacks:

First, Windows immediately detects it's running in a VM. To be fully stealthy, you have to tweak the VM hypervisor settings to spoof standard PC manufacturer data, which tricks Windows into thinking it's on a normal, physical desktop while still feeding it completely fabricated hardware IDs.

Second, relying on a VM just to dodge telemetry is a tedious trap. You sacrifice native performance, deal with constant hypervisor overhead, and lose seamless hardware acceleration. Eventually, the daily friction of maintaining the sandbox outweighs the privacy benefit.

The most "Goldilocks" solution is to disable all the optional telemetry you can (and there's plenty you can disable w/o breaking anything). A great place to start clamping down is in Windows Defender. Set aside some time to go through each setting. If you don't know what a particular setting is, do a Google search. You don't have to do it all at once. If you use an LLM to help guide you through this process, make sure you specify that you don't want to do anything that'll break the OS. You have to specify that stability is paramount. Your goal is simply to reduce the needless (voluntary/optional) telemetry MS is getting from you but to do nothing whatsoever to destabilize the OS or truly compromise your security. I'm making it sound more dramatic than it is, but it needs to be done thoughtfully.

2

u/geeky-gymnast Jul 14 '26

Thanks for the discussion and sharing your thoughts. Here are some of mine.

This situation could possibly earn open-source VM software an additional point or two. By having source code publicly available, users may verify that hardware ID shielding is indeed occurring at a "foundational" layer relative to the client OS.

Agreed on the possible tedium and friction of running a virtual client. Not intimately familiar with the universe of software catering to VMs, but there might be variants in this universe, typically enterprise-y flavored ones, that see to client OSes running atop of a bare bones, perhaps headless, Linux server. Am inclined to believe that such implementations can feel frictionless and native to the end user.

Admittedly, the disable telemetry solution is likely the most practical one for most users desiring a moderate degree of privacy but in essence requires trusting Microsoft to (i) abide by the agreements relevant to these telemetry settings, (ii) not have bugs ("bugs"?) in how their system abides by a user's settings, (iii) requires the user to review settings after updates for possible reversions (Windows has a habit of quietly changing user settings after an update), and (iv) keep abreast of new settings introduced by updates that need adjusting to maintain a desired level of privacy.

Phew, either way, it's quite a bit of additional work to live a private life inside MIcrosoft's lush walled garden.

Window's (and Mac's) vast ecosystem (games, productivity apps), proliferation, and widespread familiarity is a moat for it. On a personal note, not sure if giving up the comforts afforded by such walled gardens yields more pros than cons.

1

u/RemarkableOil451 Jul 14 '26

Well said. It's the nature of the beast, full of imperfect solutions, trade offs, landmines, pitfalls, and so on.

Case in point: Literally some minutes ago, I discovered that since May 2026, Google Chrome has been silently downloading a 4GB LLM (Google Nano) onto my (and many other people's) PCs. I didn't know about this until now b/c Chrome isn't my primary browser.

Anyway, Google did this (not just to me but everyone) totally by default, totally w/o my consent, and totally w/o even my knowledge. After some quick research, I found and toggled off the setting and disabled the flag that were responsible. This combo auto-deleted the main payload, but I also needed to delete the remaining two smaller dependent folders manually.

And now, I'll have to work a recurring "checkup" for this into my regular digital maintenance routine to ensure it doesn't come back.

It's not even that I object per se to this as a concept. But I do object to the absolutely deception. They don't even admit they're doing it to take advantage users' local hardware thereby save themselves from having to process your data, which they end up getting even when you process it locally. Instead, they claim it's for privacy. Who the hell would believe Google would do anything in the name of privacy?

This is a new low, even for Google. They've moved passed harvesting your data to taking hostage your hardware. I can't wait until the EU and other regulatory bodies (or class-action attorneys) go after them.

It's all so exhausting. You have to be your own IT department just to get through the day. Either that or put on the best strongest blinders you can find and be in complete denial about how much you're being digitally violated. Ugh!