A unique identifier called a GDID — Global Device Identifier — is quietly assigned to every Windows computer the moment you sign into a Microsoft account. It logs every website you visit, timestamps included, and it can't be erased. Not by clearing your history. Not by wiping your hard drive. Not even by reinstalling Windows.
And the FBI has already used it to track a suspect across four countries.
The case involved Peter Stokes, an alleged member of the Scattered Spider hacking group, whose specific GDID — g:6755467234350028 — was used by the FBI to trace his online activity through VPN connections, proxy servers, and across stops in Estonia, New York, Thailand, and other countries over approximately eight months.
Microsoft's own representative described the GDID as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device across certain Microsoft services and scenarios." Which is a very polished way of saying they put a permanent tracking number on your computer and didn't tell you about it.
Here's what makes this different from your standard "tech company collects data" story. The GDID is generated the moment Windows provisions with a Microsoft Account. It's created through a chain of services — wlidsvc requests a Device PUID from login.live.com, then Connected Devices Platform registers it into Microsoft's Device Directory Service. It lives in your registry at HKCU\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties. Microsoft logs full URLs visited with timestamps, all tied to your GDID and your Microsoft account. One user can have multiple GDIDs linked through their account, OneDrive, and activation history.
You cannot disable it without breaking Windows activation and Microsoft Store apps. There are no user-facing controls. No toggle in Settings. No public documentation from Microsoft explaining what it does. Approximately 1.6 billion Windows users worldwide are affected.
In the Stokes case, the FBI matched his GDID accessing an ngrok signup page on May 12, 2025, at 19:21 UTC. Three hours later, the same GDID accessed a victim retailer's website through a Tzulo VPN proxy. Cross-referencing IP addresses linked to Stokes's Snapchat, Facebook, Apple, and Ubisoft accounts filled in the rest. His own Snapchat photos matched hotel bookings and travel timelines.
The man was using a VPN. Didn't matter.
Security researcher Matthew Hickey characterized Windows as "surveillance software." That's not a fringe take when the operating system is quietly logging every URL you visit, attaching it to a permanent identifier you didn't ask for and can't remove, and making it available to law enforcement through a standard subpoena.
Now, the usual crowd will say this is fine because it caught a hacker. We got the bad guy. And sure — nobody's losing sleep over an alleged cybercriminal getting tracked down. But the infrastructure that caught Peter Stokes doesn't only work on Peter Stokes. It works on the 1.6 billion other people running Windows, too. Every journalist. Every activist. Every person who Googled something embarrassing at 2 a.m. All logged, all timestamped, all sitting on a Microsoft server waiting for a legal request.
Apple and Google maintain device-level identifiers too. But both platforms offer visible controls — ways to limit or reset what's tracked. Windows doesn't. Microsoft built a system with no off switch, buried it in the registry, skipped the documentation, and only confirmed it existed after the FBI cited it in a federal filing.
The mitigation advice from security researchers tells you everything you need to know about the scale of the problem: use a local account instead of a Microsoft Account, disable optional diagnostics, turn off personalized ads, review Activity History settings. And for anyone in a "high-risk situation"? Use Linux with Tor instead of a Windows VPN.
When the security advice for using a mainstream operating system is "stop using the mainstream operating system," the product isn't a tool. It's a liability.
The Fourth Amendment was written for a world where the government had to come to your door. Now they just send a subpoena to Redmond.
