A US court filing has put a little-known Windows tracking identifier in the spotlight - and set off a wave of alarming headlines claiming that "privacy is dead" and that not even a VPN can protect you. The identifier is real, the court case is real, and the privacy questions are worth taking seriously. But the scariest version of the story is also the least accurate. Here is what actually happened, and what a VPN does and does not do about it.
What GDID actually is
GDID - short for Global Device Identifier, and technically a "Device PUID" (Passport Unique ID) - is a 64-bit number that Windows assigns to your installation the first time you sign in with a Microsoft Account. A background service (wlidsvc) requests it from Microsoft's login servers and stores it locally, in your own registry, in plain text. Microsoft's Connected Devices Platform then reads that value and stamps it onto activity your PC reports back to Microsoft.
In other words, it is a stable, per-device fingerprint tied to your Microsoft Account. Security researchers who reverse-engineered it found that it cannot be fully switched off, though some of the syncing services around it can be disabled, and that reinstalling Windows generates a fresh identifier. None of this is a secret backdoor - it is ordinary telemetry plumbing - but most people have never heard of it.
How it helped trace a hacker
The reason it is suddenly news is a criminal case. US prosecutors charged Peter Stokes, a 19-year-old dual US-Estonian citizen, as an alleged member of the notorious Scattered Spider hacking crew, following an intrusion at a luxury retailer in May 2025. According to the filing, Microsoft's records tied a persistent Windows device ID first to the account the attackers used, and then to Snapchat, Apple and Facebook accounts that prosecutors attribute to Stokes.
The device kept appearing on the same IP addresses at the same times as those personal accounts - in Tallinn in mid-2024, then New York, then Thailand in early 2025, a trail that lined up with his travel records. He was arrested in Finland on an Interpol notice and extradited to the United States. For investigators, it was a clean way to connect an anonymous intruder to a real person.
Does this really mean a VPN is useless?
This is where the headlines overreach. A VPN hides your real IP address from the websites you visit and from your internet provider, and encrypts your traffic on the network. It does exactly that here too. What a VPN has never claimed to do is stop your own operating system from reporting an identifier that is tied to an account you personally logged into.
The deanonymisation in this case did not come from breaking a VPN. It came from correlation: the same device identifier showing up alongside personal Microsoft, Snapchat, Apple and Facebook logins, over and over, until the pattern pointed at one individual. A VPN changes the IP those services see; it does not unlink the device from the accounts, and it cannot help once you sign into your own identity on the same machine you use for everything else. The honest lesson is the one we keep coming back to: a VPN is one layer of privacy, not a cloak of total anonymity. It is the same reality that let police deanonymise the users of a "no-logs" criminal VPN, and the same limit behind why tying a real identity to your connection quietly ends anonymity no matter what tunnel you use.
What you can actually do
You cannot delete GDID outright, but you can reduce how much it sees. Using a local Windows account instead of a Microsoft Account avoids linking the device identifier to a personal cloud identity in the first place. Reputable outlets that examined the mechanism note that the Connected Devices Platform services (CDPSvc and CDPUserSvc) can be disabled to cut the constant syncing, at the cost of some cross-device features. And the broader principle stands: keep the machine where you sign into your real accounts separate from anything you want to keep private, because no network tool can undo an identity you volunteered to your operating system.
