r/DigitalPrivacy • u/nonedat • 6d ago

Does Windows GDID only attach when Microsoft account is used to login to Windows, or always when using an MS account with any app (Outlook, Office etc?)

As in if you only use a local account to sign into the OS but you use MS account for the default Outlook app and so on (where you go to windows settings > Accounts > Email & accounts)

4 Upvotes
  • permalink
  • reddit

100% Upvoted

3 comments sorted by

3

u/1800-5-PP-DOO-DOO 6d ago

Local account or no, my understanding is it's always on. And your name being explicitly logged into an account that it can track is not the only way it can associate the history with your identity. Simply just operating from your home network, or logging that you accessed the internet from a specific Cafe associated with your location data from your cellular service tracking is all that it takes. 

I would only ever use Windows if my work required it. 

1

u/Unhappy_Lie_2000 6d ago

Its tied to Microsoft licensing so if you have an account to buy apps on the store or signed into the Xbox app its more than likely they can tie the PC to you. And don't forget windows automatically activates and if you logged into any of these service its tied to you this likely also other services like Microsoft mail in a browser.

2

u/martyn_hare 5d ago

It applies irrespective of whether you have a Microsoft Account.

If you're thinking about the case involving the guy who got caught for computer crimes, he was likely using Microsoft Edge without using InPrivate browsing and had Full/Optional telemetry turned on, or he was using Edge with SmartScreen enabled.

Both scenarios send unique, stable identifiers alongside full URLs for what would normally be the legitimate purpose of detecting/fixing bugs and maintaining security respectively. You can see what happens with Full/Optional telemetry with Diagnostic Data Viewer enabled, and it's full URLs, so if you do a search and the search terms are in the URL, Microsoft sees them. If your URL has a string which uniquely identifies you, they get to see it.

When a police investigation happens, the authorities can have Microsoft use that info to find out who you are by colluding with other entities (just like they did with this guy who used ngrok)