Windows 11 GDID — Microsoft’s Global Device ID — runs silently on your machine whether you want it to or not, and no single settings toggle makes it stop. That blunt reality came into sharp focus in 2026 when an FBI complaint revealed that GDID had been used to trace a Scattered Spider suspect across VPNs and IP changes, demonstrating just how persistent and precise this identifier really is. The good news is that, while you cannot eliminate GDID entirely, the right combination of privacy settings does meaningfully reduce what it captures and reports.
What Is GDID and Why Does It Exist?
The Global Device ID is a persistent, hardware-linked identifier that Windows 11 assigns to your device and attaches to diagnostic and telemetry data sent back to Microsoft. Unlike a browser cookie that clears when you log out, GDID survives reinstalls, user account changes, and VPN tunnels. It is tied to the physical hardware profile of the machine itself.
Microsoft’s stated purpose for GDID is to improve reliability: by correlating crash reports, update outcomes, and feedback submissions to a single device, engineers can spot patterns that anonymous data would obscure. The identifier is visible in the Windows Feedback Hub — navigate to Feedback Hub > Settings > Device Information to see your own GDID. That transparency is deliberate, but what happens with the data once it leaves your PC is far less visible to ordinary users.
Critically, Microsoft has confirmed that GDID cannot be disabled if your device is set up with a Microsoft account. Even on local accounts, the identifier persists at a level below the standard privacy toggles in Settings.
GDID Privacy Tracking vs. Standard Telemetry — What’s the Difference?
Standard Windows telemetry and GDID privacy tracking are related but not identical. Understanding the difference is key to knowing which settings actually do anything useful.
-
Required diagnostic data — always collected, includes basic device health, crash reports, and hardware information. GDID is embedded here. You cannot opt out of this tier on a standard Windows 11 installation.
-
Optional diagnostic data — a broader sweep including browsing behaviour in Microsoft apps, app usage frequency, and inking/typing diagnostics. This tier can be turned off, and doing so reduces the volume of data tied to your GDID.
-
Advertising ID / personalisation data — a separate layer that links app behaviour to your Microsoft account for targeted advertising. This is independent of GDID but often lumped together in privacy discussions.
-
Feedback frequency and location access — supplementary signals that can enrich GDID-linked records. Both are user-controllable.
The distinction matters because disabling optional telemetry does not silence GDID — it only narrows the dataset that gets attached to it. Microsoft’s official guidance on configuring Windows diagnostic data confirms that required diagnostic data — and therefore GDID — cannot be turned off on consumer editions of Windows 11.
Which Privacy Settings Actually Limit Windows 11 Tracking?
None of these settings eliminate GDID, but several substantially cut the richness of data linked to your device identifier. Work through them in order for the most impact.
1. Switch Diagnostic Data to Required Only
Go to Settings > Privacy & security > Diagnostics & feedback and set diagnostic data to Required diagnostic data. This stops the optional sweep of app usage patterns, typing samples, and browsing activity in Edge and other Microsoft apps. It is the single most impactful change you can make for Windows telemetry reduction.
2. Disable the Advertising ID
Navigate to Settings > Privacy & security > General and toggle off Let apps use my advertising ID. This does not affect GDID directly, but it severs the link between your device identifier and personalised ad targeting — a meaningful privacy gain for everyday users.
3. Turn Off Personalised Experiences and Suggested Content
On the same General page, disable Show me suggested content in the Settings app and Let Windows improve Start and search results by tracking app launches. These signals feed the Microsoft account profile tied to your machine’s GDID.
4. Switch Off Location for Microsoft Services
Head to Settings > Privacy & security > Location. If you do not need location services for apps, disable them at the system level. Location data associated with your GDID creates a timestamped movement record — removing this significantly limits what Microsoft can infer about your physical context.
5. Disable Activity History
Under Settings > Privacy & security > Activity history, uncheck Store my activity history on this device. Turning this off prevents Windows from building a timeline of files opened, apps used, and websites visited — data that would otherwise enrich GDID-linked records in Microsoft’s cloud.
6. Revoke App Permissions Selectively
Review Settings > Privacy & security > App permissions. Pay particular attention to microphone, camera, contacts, and call history. Each permission granted is a potential data stream attached to your GDID profile.
7. Limit Feedback Frequency
In Settings > Privacy & security > Diagnostics & feedback, set feedback frequency to Never. Feedback submissions are explicitly linked to GDID — this is how Microsoft matches crash reports to individual devices. Eliminating automatic feedback requests reduces that association.
Why GDID Persists Even After Disabling Windows Telemetry
This is the part that frustrates privacy-conscious users most. You can toggle off optional diagnostic data, disable the advertising ID, and block every app permission — and GDID is still there, still reporting required diagnostics to Microsoft’s servers.
The reason is architectural. GDID sits below the application layer that Settings controls. It is generated at a firmware and operating system level, not by a user-space service that the standard privacy UI can reach. Microsoft’s own documentation describes it as a component of “required diagnostic data,” meaning Windows 11 Home and Windows 11 Pro users on standard licences have no supported mechanism to remove it.
For enterprise environments, Group Policy and Mobile Device Management (MDM) tools offer more granular control. IT administrators can push a policy that sets diagnostic data to the lowest permissible level — but even at the enterprise “Security” tier on Windows 11 Enterprise or Education editions, some required data including the device identifier continues to flow. Windows telemetry at the “Security” level is the most restrictive, and it is only available on those specific editions, not on Home or standard Pro licences.
The FBI’s use of GDID in the Scattered Spider case — publicly documented in 2026 — made clear that this identifier is durable enough to survive the kind of operational security measures most individuals assume would protect them. A persistent, hardware-level device ID that survives VPNs and IP rotations is not a small thing, and it is worth understanding exactly what you are dealing with before deciding how much effort to invest in limiting it.
Should You Consider a Different Windows Edition?
If GDID privacy tracking is a serious concern, the Windows 11 edition you run matters. Windows 11 Enterprise and Education editions, deployed through an organisation’s IT infrastructure, support the “Security” diagnostic data level — the most restrictive tier Microsoft offers. Consumer editions (Home and Pro on a standard setup) do not offer this level.
For individuals, the practical option is ensuring you run a genuine, properly licensed copy of Windows 11 so that all future privacy-related patches and policy updates reach your machine promptly. A pirated or improperly activated installation will not receive cumulative updates reliably, meaning any privacy improvements Microsoft ships — and it has shipped several — may never arrive. At Shop Key Online, you can pick up a genuine Windows 11 Pro Retail licence from €17.95, with instant email delivery and a lifetime-valid activation key.
It is also worth noting that some of the most effective hardening steps against GDID-style tracking — such as blocking telemetry endpoints at the router or firewall level — require a stable, genuine Windows installation that does not generate unexpected network traffic from unpatched vulnerabilities. For a broader view of why keeping your Windows 11 licence legitimate matters from a security perspective, see our analysis of the Windows 11 zero-day exploits uncovered at Pwn2Own 2026.
Practical Summary: What GDID Privacy Tracking Lets You Control
To consolidate everything above, here is a clear breakdown of what is and is not within your control as a standard Windows 11 user.
-
You CAN turn off: Optional diagnostic data, the advertising ID, personalised experiences, activity history, location services, app permissions, and feedback submissions.
-
You CANNOT turn off: Required diagnostic data (which includes GDID), the base device identifier itself, or the transmission of minimal crash and health data to Microsoft’s servers.
-
Enterprise-only options: Security-level diagnostic data policy (Windows 11 Enterprise/Education via MDM or Group Policy), which reduces but does not eliminate required data flows.
The realistic target for most users is not zero data collection — that is not achievable on a standard Windows 11 installation — but a meaningfully reduced footprint that limits the richness and granularity of what gets attached to your GDID each day.
FAQ
Can I delete or reset my Windows 11 GDID?
No — at least not through any supported method on consumer editions of Windows 11. Microsoft has confirmed that the Global Device ID cannot be changed or disabled on devices set up with a Microsoft account, and even on local accounts the identifier persists at a level below standard privacy controls. Resetting or reinstalling Windows does not generate a new GDID, as it is tied to the underlying hardware profile.
Does switching to a local account reduce GDID tracking?
Partially. Using a local account instead of a Microsoft account disconnects your GDID from your Microsoft profile, which reduces the richness of data Microsoft can associate with your identity. However, the GDID itself continues to exist and required diagnostic data continues to be transmitted. It is a worthwhile step, but it is not a complete solution for Windows 11 tracking concerns.
Is Windows 11 GDID the same as the advertising ID?
No. The advertising ID is a separate, user-resettable identifier used for personalised ad targeting across apps. GDID is a persistent, hardware-level device identifier embedded in diagnostic telemetry. You can disable the advertising ID entirely in Settings; you cannot disable GDID on a consumer Windows 11 edition. Both contribute to your overall data profile, so it is worth turning off the advertising ID even though it does not affect GDID.
Does VPN use protect against GDID tracking?
No — and the Scattered Spider FBI case proves it. GDID is transmitted as part of telemetry data, not as a network-level identifier, so VPNs that mask your IP address do nothing to prevent GDID from identifying your device in Microsoft’s records. Network-level privacy tools address a different layer of the stack than the one GDID operates on.
Which Windows 11 settings have the biggest impact on limiting what GDID captures?
Switching diagnostic data to Required only (under Settings > Privacy & security > Diagnostics & feedback) has the largest single impact, as it strips out the optional data sweep that would otherwise be attached to your GDID. Disabling activity history, location services, and the advertising ID each contribute further reductions. Used together, these five changes substantially narrow your Windows telemetry footprint even though they cannot silence GDID itself.
Are there third-party tools that can block Windows telemetry?
Some third-party utilities claim to block Microsoft telemetry endpoints at the host-file or firewall level, and blocking the endpoints GDID reports to does prevent that specific data from reaching Microsoft’s servers. However, Microsoft has been known to add new telemetry endpoints over time, and some tools that modify system files or services can cause Windows Update instability. If you use such tools, ensure your core Windows installation is genuine and fully updated before applying additional hardening.
