GDID Windows – Cut the tracker that follows you even under VPN

Windows has a hidden tag, and commenters are asking why nobody is panicking

TLDR: The article says Windows may carry a hidden account-linked label that can survive tricks like using a VPN and keep pointing back to you. Commenters are split between outrage, skepticism about how police got the label, and the classic "fine, I’m switching to Linux" meltdown.

Windows users just got a fresh reason to side-eye their laptops. The article claims that even if you hide behind a virtual private network, or VPN, Windows can still carry a persistent label called a GDID that gets tied to your Microsoft account and can be handed to authorities. The writer says deleting it from the computer doesn’t really work, because it simply comes back from Microsoft’s servers like a bad ex sliding into your messages. Cue the comment section: instant alarm, conspiracy math, and the usual "just use Linux" sermon.

The loudest reaction was pure disbelief. One commenter flat-out asked, "How is this not a bigger deal", which pretty much sums up the thread’s mood. Another went full detective and questioned the missing piece in the story: if Microsoft can match a machine to a history of internet addresses, how did investigators get the tag in the first place? That sparked the classic internet split between the panicked camp and the skeptical camp demanding receipts. Then came the hardware paranoia: one user guessed Microsoft may be linking “new” tags to “old” ones anyway by recognizing the same machine parts after a reinstall, which is the kind of theory that makes privacy people want to throw their router out the window.

And yes, the meme energy arrived right on schedule. The top-drive-by take was basically: obvious workaround, leave Windows and go to Linux. But even that came with a nervous twist, because commenters immediately wondered whether Linux systems also have their own version of a hidden ID. In other words, the real drama wasn’t just "Microsoft tracking". It was the much messier comment-war question: is there actually any escape, or are we all just arguing over which operating system spies with better vibes?

Key Points

  • The article describes GDID as a 64-bit PUID tied to a Microsoft account when a Windows session is opened.
  • In the author's Windows 11 Pro VM test, the GDID could be read from the registry using a PowerShell command.
  • Deleting the local registry entry did not permanently remove the GDID; the same identifier returned after Microsoft Store activity.
  • The article says disabling standard Windows telemetry did not stop GDID availability or reporting, which it attributes instead to Connected Devices Platform and Delivery Optimization services.
  • As a mitigation, the article proposes disabling relevant services and blocking Microsoft endpoints via the hosts file, with DoSvc disabled through the registry rather than the normal service manager.

Hottest takes

"Obvious workaround to get off windows and use Linux" — SV_BubbleTime
"How is this not a bigger deal" — Razengan
"How did FBI get the GDID in the first place" — sorenjan
Made with <3 by @siedrix and @shesho from CDMX. Powered by Forge&Hive.