Microsoft confirms Windows GDID tracker: here's how it works

Windows has a tracker that can't be erased: the GDID the FBI is already using against you

In July 2026, an FBI court document revealed what many had long suspected: Microsoft assigns every Windows installation a Global Device Identifier (GDID) that survives updates and only changes when the system is reinstalled. The revelation came through a case against an alleged member of the Scattered Spider cybercrime group, where investigators used this identifier to link incivil activity to a specific machine, even when the user was using a VPN or proxy. The GDID is sent to Microsoft's servers during the installation process itself, and from then on, telemetry transmits it continuously.

What is the GDID and why is it different?

Unlike cookies or browser fingerprinting, the GDID operates at the operating system level. It is generated per installation, not per hardware: if you wipe your drive and reinstall Windows, you get a new GDID. But until you do, every request to Microsoft services —whether from Edge, SmartScreen or Defender— carries that identifier embedded in it. There is no simple switch to turn it off; the existing privacy options limit telemetry but do not stop the GDID from being sent. As a technical analysis put it, "a VPN hides your home IP, but not an identifier that Windows sends inside its own requests."

Linux has its own trail too

The debate is not exclusive to Windows. Distributions like Debian generate an /etc/machine-id that many applications use for tracking. Some variants, such as Devuan, renew it on every reboot, but most do not. On top of this comes your device's digital fingerprint: browser, fonts, time zone, GPU... As one participant noted, "don't use the same PC to pull off crimes and then log into Facebook," because they already have you.

Implications and myths

The GDID is not an "eternal physical fingerprint": it changes when you reinstall. But the FBI used it to correlate URLs, IPs and accounts, proving that this piece fits into a larger puzzle. It didn't "break" the VPN either: it simply bypassed it, because the identifier travels inside Windows' legitimate traffic. The uncomfortable question is how long Microsoft had been collecting this data without clearly disclosing it. With the wave of cybercrime cases, it is likely that other agencies will do the same. The irony: those who complain most about state surveillance often use Windows, the very system that willingly hands your identity over to servers in Redmond.

---

The unsettling detail: while the security community digests the impact, the prosecutor in the Scattered Spider case already has a conviction. For the average user, the only real defense is reinstalling the system periodically... or switching to an operating system that doesn't send your digital DNA out every few minutes.