The Windows Device Identifier: What GDID Is and Why You Cannot Change It

What the researchers described

Analysts at ZeroTrace Lab published work in July 2026 on an identifier they call GDID, the global device identifier that Windows systems register with Microsoft. Their account is that every Windows installation since Vista, on first connection to the internet, registers a 64-bit Passport Unique ID with login.live.com. It is stored in the registry as plain hexadecimal text.

Microsoft associates that identifier with descriptions of your hardware and with device certificates backed by the TPM, the security chip present in modern PCs. The identifier appears in traffic to the Microsoft Store, in activation checks, in the Windows Notification Service, and in telemetry.

The researchers examined whether it can be changed. The registry values can be replaced, and the certificates protected by Windows’ data protection interface can be replaced. The obstacle is the TPM’s endorsement key, whose private half never leaves the chip and cannot be extracted or rewritten. Fully impersonating a different device would require relaying TPM challenges to another physical machine, which they describe as an unsolved problem.

They also note that this identifier has been used in law enforcement investigations to link a device to a person, citing US v. Peter Stokes.

The words behind the jargon

That summary contains half a dozen terms that mean nothing unless you already work in security, so translating them is the sensible first move. None of the underlying ideas are hard. The vocabulary is just unfamiliar, and unfamiliar vocabulary is what makes a topic feel more sinister than it is.

The registry is Windows’ central settings store. Picture a filing cabinet where every program keeps its preferences, from your desktop wallpaper to the licence key for your office software. You can open it yourself with a built-in tool called Registry Editor, though there is rarely a good reason to.

Telemetry means the automatic reporting a program does about itself. When Windows crashes and shows you a message about sending information to Microsoft, that report is telemetry. It also covers quieter things: which features you opened, how long your machine took to start, whether an update installed cleanly.

A TPM is a small chip on your computer’s motherboard whose only job is holding secrets. The full name is Trusted Platform Module. It keeps cryptographic keys in a form that resists being copied out, even by someone who takes the machine apart with proper equipment. Windows 11 requires one, which is why a lot of perfectly good older PCs were told they could not upgrade.

An endorsement key is the particular secret that the chip manufacturer places inside during production. Every TPM gets its own. The private half is designed never to leave the chip, and software can ask the chip to prove it holds that key without ever seeing the key itself.

Attestation is that proof in action. Your PC says, in effect, “I am the machine I claim to be, and here is a signature from my chip to demonstrate it.” The service on the far end checks the signature against what the chip manufacturer published. Nobody has to take the software’s word for anything.

Term	What it means in plain words	Where you have already met it
Registry	Windows’ central store of settings	Any time a program remembers a preference between restarts
Telemetry	Automatic reports a program sends about itself	The “reporting this problem” message after a crash
TPM	A chip that holds secrets and will not hand them over	The Windows 11 upgrade check that failed on older PCs
Endorsement key	The chip’s factory-fitted secret, unique to that chip	Nothing visible; it works underneath everything else
Attestation	The chip signing a statement that proves which machine this is	Disk encryption that only opens on your own laptop
Device identifier	The name Microsoft’s services use for your machine	Store purchases that follow the computer, not the hard drive

Put those pieces together and the picture is a machine with a hardware-backed name it can prove, plus a company recording that name alongside what the machine does. Each individual piece exists for ordinary reasons. The combination is what people find uncomfortable, and reasonably so.

What happens the first time you switch on a new PC

Descriptions of device registration stay abstract, which makes them easy to imagine as either sinister or trivial depending on your mood that day. The actual sequence is mundane, and walking through it once removes most of the mystery.

You take a laptop out of its box and press the power button. Setup asks for your language, then your keyboard layout, then your wireless network. That network step is the moment your computer first speaks to Microsoft. Before it, the machine has an identity that nobody has heard. After it, the identity is registered and the services that depend on it start working.

Three things follow from that picture, and each one changes how the story reads.

Start with the split between the device identifier and your Microsoft account. Your machine gets a name whether or not you sign in to anything. Signing in is the separate step that attaches a person to that name, and unlike the registration itself, you control it.

Notice next that the identifier is doing visible, useful work. Activation confirms your copy of Windows is licensed for this computer rather than copied from a friend’s. The Store needs it so an app you paid for installs on your machine and stays installed after a repair. Update delivery uses it so Microsoft can send the patches matching your hardware instead of every patch ever written for every PC.

Then consider what the diagram leaves out. Websites do not receive this identifier. Your browser never sends it. An advertising network has no way to ask for it. The traffic carrying it runs between your PC and Microsoft’s own services, which turns out to be the single most useful fact for judging how much of your attention this deserves.

None of that makes registration optional. You cannot decline it and keep a working Windows installation, because the identity that makes tracking possible is the same identity that makes licensing work, and Microsoft has no commercial reason to separate the two.

What this does and does not mean

The reasonable reaction sits between two overreactions, and both are common.

The first overreaction is that this is a secret backdoor. It is not particularly secret. Device identifiers are a normal part of how operating systems handle activation, licensing, store purchases, and update delivery, and Microsoft documents that devices are identified. Apple and Google do comparable things on their platforms. A system that lets you buy an application once and install it on your machine needs to know which machine it is.

The second overreaction is that this is nothing to think about. A permanent, hardware-bound identifier that is reported to a single company and appears across multiple network services is a genuinely strong tracking primitive, considerably stronger than a cookie or an advertising ID, because those can be cleared and this cannot.

The practical distinction is who can see it. Websites you visit do not get this identifier. It travels between your PC and Microsoft’s services, so the parties with access are Microsoft, anyone Microsoft shares with, and anyone who compels disclosure through legal process. That is a much smaller set than the advertising industry, and it is not an empty set.

An analogy that holds up

Analogies in security writing tend to collapse the moment anyone leans on them, and this one survives enough weight to be worth using. Think about the identifiers attached to a car.

A number plate is public, changeable and shallow. Anyone in the car park can read it, and when the car is sold the plate can be transferred or swapped. That is roughly a cookie: visible to everybody, trivial to replace, worth very little on its own.

The vehicle identification number stamped into the chassis behaves differently. It went on at the factory, altering it means cutting metal and committing an offence, and it stays with the car through every resale, repair and export. Almost nobody encounters it during ordinary life. Your mechanic reads it, your insurer holds it, the licensing authority keeps it on file, and the police can ask any of them about it. Permanent identity, small and mostly official audience.

Your PC’s device identifier sits in that second category. Passers-by, meaning the websites you visit, never see it. The platform vendor sees it, the licensing system depends on it, and an authority with the right paperwork can ask about it.

The analogy also carries the right emotional register, which matters more than it sounds. Almost nobody lies awake because their car has a chassis number, since the situations where it counts are rare and mostly involve theft or a serious investigation. Nor does anyone sensible pretend the number means nothing. Exactly the kind of permanent marker you would want if your car were stolen, and exactly the kind you would not want if you needed to drive somewhere without it being provable three years later.

Where the comparison finally breaks is speed and scale. Checking a chassis number takes a physical inspection or a query about one specific vehicle. Device identifiers arrive automatically and continuously, from hundreds of millions of machines, attached to records of what each machine was doing at the time. The permanence is comparable. The volume belongs to a different category altogether.

Why reinstalling does not help

People often assume that wiping a machine resets its identity, and for most software-level identifiers that is true.

The TPM is what breaks the assumption. It is a physical chip on the motherboard holding a key that was placed there during manufacture. A fresh installation of Windows generates new software identifiers and then binds them to attestations from that same chip, which means the new installation can be linked to the old one. Changing the software leaves the hardware anchor untouched.

Removing the drive and installing a different one does not change it either, since the TPM is soldered to the board rather than living on storage. Realistically, the identifier is a property of the physical computer for its lifetime.

That permanence is deliberate and serves purposes people generally want: it stops stolen licences being reused endlessly, allows a stolen laptop to be recognised, and underpins disk encryption that unlocks only on the machine that encrypted it. The same property makes it durable for tracking.

What could go wrong

Abstract risk is almost impossible to weigh, so it helps to look at specific situations where a permanent device identity changes an outcome. Some of these are uncomfortable. None of them are everyday occurrences, and that is part of the point.

The secondhand laptop. Someone sells a three-year-old machine through a marketplace listing. The buyer wipes the drive and installs Windows fresh, exactly as recommended. The hardware identity carries across regardless. If the previous owner did something that later attracts official attention, records held by Microsoft point at a machine now sitting in a stranger’s living room. Investigators do check ownership histories, so this rarely ends badly, and it demonstrates cleanly how a device identity and a human being can come apart.

The shared family computer. Four people use one PC in the kitchen. Each has a separate Windows profile and separate accounts. To any service identifying the machine rather than the person, those four are a single entity. A pattern of activity that looks bizarre for one individual is often just four ordinary lives overlapping on one keyboard.

The person leaving a controlling relationship. Someone sets up a new email address and a new phone number, then keeps using the laptop they already own because replacing it costs money they do not have. The device identity survives all of that. If the former partner originally set the machine up, or ever had the Microsoft account password, features built for families and lost devices can surface more than anyone intended. Registry editing solves nothing here. A different machine, or at minimum a full account separation performed from somewhere else entirely, is the answer.

The reporter and the confidential source. A journalist opens an anonymous tip on their work laptop. The browser session is encrypted and the messaging tool is sound. Underneath, the machine still carries a name registered against an employer’s licence and reported during routine Windows traffic. Comparing activity timestamps against device records is a well understood technique, and no browser privacy feature touches it.

What connects these four is that the identifier almost never acts alone. Its power comes from combination:

• An identifier plus a signed-in account gives a name and often a payment card.
• An identifier plus a network address gives a location, or at least a household.
• An identifier plus timestamps gives a pattern of when someone is awake and working.
• An identifier plus a second device on the same connection links two machines to each other.

On its own, the identifier says only that a particular computer existed and connected to something. Sitting next to any one of those companions, it starts to say who was probably at the keyboard. That gap between “a machine” and “a person” is where most of the real argument lives, in courtrooms and in your own risk assessment alike.

Who should actually care

For most readers, this belongs in the category of things worth knowing rather than things worth acting on. If your threat model is advertisers, scammers, and opportunistic criminals, this identifier is not how they will find you. They use cookies, email addresses, phone numbers, and data brokers, none of which involve your TPM.

The people for whom this matters are those whose safety depends on a device not being linkable to them: journalists protecting sources, people escaping domestic abuse, activists in hostile jurisdictions, and anyone whose adversary can compel a large company to answer questions.

If you are in that group, the honest answer is that hardening Windows is the wrong approach. The identifier is bound to hardware and reported by the operating system, so the fix is at that level too.

Use a different machine for the sensitive activity, ideally one bought with cash and never used for anything connected to your identity. Consider an operating system that does not do this: a Linux distribution installed on a machine with the TPM disabled in firmware, or a live system such as Tails that runs from a USB stick and writes nothing. Keep the sensitive machine off networks that also carry your ordinary traffic, since a home connection links devices regardless of what they report.

That is a real change in how you work, and it is proportionate only if your situation genuinely calls for it.

Working out whether this applies to you

Deciding honestly which group you belong to is harder than it sounds, because privacy writing encourages everyone to picture themselves as a target. Most readers are not targets in the relevant sense, and saying so plainly is more useful than flattery. The questions below sort the situation in about a minute.

The first question does most of the work. Being annoyed by tracking is a legitimate feeling and a poor basis for planning, because annoyance points you at whatever you most recently read about rather than at whatever is most likely to hurt you. Safety depending on non-linkability is a specific condition. Either someone would take action against you if they identified the machine, or they would not.

The second question separates two very different opponents. An ex-partner, a colleague, a landlord, a stalker who found you through a data broker: none of them can send a legal demand to Microsoft and receive an answer. Their route to you runs through guessed passwords, shared accounts, physical access to your devices, and information you posted yourself. Hardening those is achievable in an evening and will help far more than anything involving a motherboard.

A government, a prosecutor, or a company with a serious legal department is a different opponent, because the records exist and the process to obtain them exists too. Against that opponent, configuration changes inside Windows are cosmetic. The chip keeps answering.

Two honest caveats belong with this diagram. Situations change, and someone in the harmless-adversary branch today can find themselves elsewhere after a job change, a move, or a piece of writing that attracts attention. Preparing hardware in advance is easier than doing it in a hurry. Equally, a great many people convince themselves they are in the bottom branch when they are not, and end up spending weekends on registry tweaks instead of on the password reuse that will actually cost them.

How this shows up in an investigation

The court reference in the research is worth explaining, because it makes the abstract concrete and shows both the usefulness and the limits of this kind of evidence.

Investigators frequently have activity on one side and a suspect on the other, with the problem of connecting them. A device identifier appearing in service records lets them show that the same physical machine was involved in both. If a Microsoft account was signed in on that machine, and the account has a name and a payment card attached, the chain runs from activity to hardware to person.

That is genuinely useful for investigating serious crime, and it is the same property that makes it a risk for people whose adversary is a government they have good reason to fear. The technology does not distinguish between those cases. A durable, hardware-anchored identifier held by a company that responds to legal process is exactly as effective for a legitimate investigation as for an illegitimate one, and which sort you face depends on where you live rather than on what you did.

It is also worth being clear about what such evidence does not establish. It links a machine, not a person. Households share computers, machines get sold, and identifiers persist across ownership changes. Treating a device identifier as identifying an individual is a common overreach, and defence arguments in these cases frequently turn on precisely that gap.

Comparing this to the tracking you actually meet

Putting the risk in proportion means comparing it against the tracking that affects ordinary browsing, because they are frequently confused.

Cookies are set by websites, visible to you, clearable in one click, and increasingly restricted by browsers. Advertising identifiers on phones are resettable in settings and can be switched off. Browser fingerprinting, which infers identity from your configuration, is harder to escape and still degrades as your setup changes. All of these are visible to the advertising industry, meaning thousands of companies.

The device identifier described here resists all three: you cannot clear it, cannot reset it, and cannot escape it by changing your configuration, because it is anchored in hardware. Its audience, though, is essentially one company and whoever compels them. Stronger in durability, far narrower in reach.

For deciding what to do, the audience matters more than the durability. Most people’s realistic privacy harms come from the many-companies category: data brokers assembling profiles, advertisers following you between sites, breaches at companies holding your information. Those are addressed by browser settings, an ad blocker, a password manager, and care about what you sign up for. None of that work is wasted, and none of it touches the TPM.

Four kinds of identifier, side by side

Laying the four categories out in one table makes the trade-off visible in a way that paragraphs do not. Two questions decide how much any identifier should worry you: how many parties can see it, and whether you can get rid of it. Notice as you read down the table that the two answers pull in opposite directions.

	Cookie	Advertising ID	Browser fingerprint	Device identifier
Who can see it	The site you visit plus its partners	Apps on your phone and the ad networks behind them	Any site that runs a script	Microsoft and anyone who compels Microsoft
Roughly how many companies	Thousands	Thousands	Thousands	One, plus legal process
Can you clear it	Yes, in one click	Yes, reset or switch off in settings	Partly, by changing your setup	No
How long it survives	Until you clear your browser	Until you reset it	Until your configuration drifts	The life of the machine
Follows a Windows reinstall	No	Not applicable	No	Yes
Realistic harm for most people	Targeted ads, profiling, price differences	Targeted ads, app profiling	Persistent profiling across sites	Very little, unless compelled disclosure is a threat to you
Where to fix it	Browser settings and an ad blocker	Phone settings	A hardened browser, or accepting the loss	Different hardware or a different operating system

Read that table row by row and a pattern appears. The identifiers you can clear are the ones thousands of companies can see. The identifier nobody can clear is visible to one company. Most privacy advice concentrates, correctly, on the left three columns, because that is where the volume of harm sits for anyone whose adversary is commercial rather than legal.

The right-hand column deserves a different kind of respect. Its reach is narrow and its permanence is absolute, which makes it a poor tool for advertising and an excellent one for investigation. Nobody is going to sell you shoes because of your TPM. Somebody might, given a court order, place your specific computer at a specific service on a specific evening three years ago.

That asymmetry explains why sensible people disagree about how much this matters. Someone assessing it as an advertising problem concludes it is irrelevant, and they are right. Someone assessing it as an investigative problem concludes it is the most durable identifier on the machine, and they are also right. Both are describing the same table from different rows.

What you can reasonably do on an ordinary PC

If you simply want less data flowing to Microsoft without changing operating systems, several settings help, and it is worth being clear that none of them remove the identifier.

During installation, choose a local account rather than a Microsoft account. Windows makes this deliberately awkward, and on recent versions the reliable route is to disconnect from the network during setup, at which point the local account option appears. A local account means your device identity is not directly associated with an email address, a name, and a purchase history, which is a meaningful reduction even though the device identifier still exists.

In Settings, under Privacy & security, set Diagnostic data to the required level rather than optional, turn off tailored experiences, and turn off the advertising ID. Under Diagnostics & feedback, delete the diagnostic data currently held.

Those changes reduce the volume and richness of what is sent. The device identifier still accompanies activation, Store, and update traffic, because those services need it to function.

Setting up Windows without a Microsoft account

The local account advice above is the highest-value change available to an ordinary user, so it deserves more than one sentence. Microsoft has made the route progressively more awkward across Windows 11 releases, and the exact wording moves around with feature updates. Treat what follows as the shape of the process rather than a script that will match your screen word for word.

Two things are worth arranging before you begin. Decide how you will recover the password, because a local account has no cloud reset and nobody at Microsoft can let you back in. And if the machine will use BitLocker disk encryption, plan to save the recovery key somewhere yourself, since Windows normally stores that key in your Microsoft account and a local account leaves it nowhere to go.

1. Begin setup with the network cable unplugged and wireless switched off, using the aeroplane mode key if your laptop has one.
2. Work through language, region and keyboard layout as normal.
3. At the network screen, look for a link reading “I don’t have internet” or a button offering to continue with limited setup. Choosing it tells Windows to carry on offline.
4. Windows then offers to create an account for this device. Type a username. Something short and generic works best, because this name becomes part of your user folder path and is annoying to change afterwards.
5. Set a password and answer the security questions. Nobody verifies that the answers are true, so treat them as three more passwords and store them in your password manager.
6. Decline the optional prompts that follow: location, Find my device, advertising ID, tailored experiences and optional diagnostic data. Say no to each one; you can turn any of them back on later.
7. Finish setup, sign in, then connect to your network. Registration happens at that point rather than earlier, and it happens with no person attached to it.

Some builds refuse to continue offline at all. The fallback is to complete setup with a Microsoft account created for the purpose, then switch afterwards through Settings > Accounts > Your info > Sign in with a local account instead. Be clear-eyed about the limitation: the association between that account and the device is recorded during the first connection, and switching later does not delete what was already written down.

Choosing a local account costs you real conveniences, and pretending otherwise would be dishonest. You give up OneDrive folder syncing, settings that follow you between PCs, Find my device, Phone Link pairing, and the automatic backup of your BitLocker recovery key. Store apps still work, though each purchase now requires signing in to that app rather than to the whole machine.

What you gain is narrower than people hope and larger than nothing. The device identifier stays exactly where it was. The strength of its link to you changes: rather than a full name, an email address, a purchase history and a card number sitting beside it in one company’s records, there is a computer with a username you invented.

Walking through the privacy settings, one screen at a time

The Settings advice in the previous section covers the three toggles that matter most, and a fuller pass takes about fifteen minutes. Menu names shift slightly between Windows versions, so search the Settings app by keyword if a heading has moved. Every item below is reversible, and none of them break anything.

1. Settings > Privacy & security > General. Turn off all four toggles here. One of them is the advertising ID; the others control locally relevant content, app-launch tracking used to order search results, and suggested content inside Settings itself.
2. Settings > Privacy & security > Speech. Switch off online speech recognition unless you dictate regularly. Windows keeps working with the offline engine.
3. Settings > Privacy & security > Inking & typing personalisation. Turn this off. It builds a personal dictionary from what you type and stores it in your account.
4. Settings > Privacy & security > Diagnostics & feedback. Set diagnostic data to the required level rather than optional. Turn off tailored experiences. Then use Delete diagnostic data to clear what has already been collected, and set feedback frequency to never.
5. Settings > Privacy & security > Search permissions. Turn off cloud content search for both your Microsoft account and any work account, and clear the device search history.
6. Settings > Privacy & security > Activity history. Turn off the option to store activity history on this device.
7. Settings > Privacy & security > App permissions > Location. Switch location off entirely, or leave it on and revoke it app by app. Weather and maps are usually the only entries with a genuine claim to it.
8. Settings > Personalisation > Device usage. Clear every box. These selections shape which suggestions and adverts Windows shows you.
9. Settings > System > Notifications. Open the additional settings at the bottom and turn off suggestions, tips and the welcome experience after updates.
10. The web dashboard. Sign in at account.microsoft.com/privacy and delete the browsing, search, location and app activity already stored against your account. This is a separate store from anything on the machine, and clearing settings locally does not clear it.

Fifteen minutes of clicking buys you a real reduction in how much detail leaves the machine and how much of it is retained. Optional diagnostic data is by far the richest of these streams, and turning it down removes the bulk of what Microsoft would otherwise hold about your usage patterns.

Two limits are worth stating so the exercise is not oversold. The device identifier continues to accompany activation, Store and update traffic, since those services cannot work without knowing which machine is asking. And a feature update occasionally resets a toggle or introduces a new one, so it pays to repeat this pass once a year rather than treating it as done forever.

If you decide you need a separate machine

For readers who came out of the decision tree in the bottom branch, the work looks different, and it starts with hardware rather than settings. The goal is a computer that was never associated with your name and never shares a context with your ordinary life.

Buying matters more than configuring. A used laptop paid for in cash, collected in person, from a seller who never learned your name is the cleanest starting point, and older hardware has the incidental advantage of a firmware menu that still lets you switch the security chip off. Anything bought online with a card, delivered to your address, arrives already linked to you, and no amount of subsequent hardening undoes the delivery record.

Once you have the machine, a live operating system removes most of the remaining problem. Tails is the best known option: it boots from a USB stick, runs entirely in memory, routes its network traffic through Tor, and forgets the session when you shut down. Because it writes nothing to the internal drive, the computer underneath stays untouched. There is an optional encrypted Persistent Storage area on the same stick for files and settings you genuinely need between sessions, and every category you enable there trades a little of the amnesia for convenience. Running Tails inside a virtual machine on your normal computer undermines the design, since the host can observe the memory the guest was relying on to forget.

Habits carry the rest of the weight, and this is the part people underestimate.

• Never sign in to a personal account from the sensitive machine, not once, not to check something quickly.
• Keep it off the network your ordinary devices use, since a home connection ties everything on it together no matter what each device reports.
• Do not carry it and your phone to the same places at the same times, because location patterns correlate devices as effectively as any identifier.
• Resist the temptation to use it for anything convenient. Mixed-purpose machines leak through the mixing.

The pattern here is worth stating plainly: technical measures buy you a clean starting point, and behaviour decides whether the starting point survives contact with a normal week. Most failures in this area are not cryptographic. Somebody checked their regular email once because it was late and they were tired.

Questions people ask

The same handful of questions come up whenever this topic surfaces, and several of them rest on a reasonable but incorrect mental model of how the pieces fit together.

Does a VPN help?

Not with this. A VPN hides which network you are connecting from, so the service sees the VPN provider’s address instead of your home one. The identifier travels inside the connection rather than being derived from the address, so it arrives intact at the far end. A VPN is useful for other things, including public wi-fi and hiding traffic from your internet provider, and it does nothing about a hardware identity.

Does reinstalling Windows help?

It resets the software identifiers and leaves the hardware anchor untouched, so the new installation can be tied back to the old one through the chip. Reinstalling remains a good idea after a malware infection or before selling a machine. As a way to start fresh in the eyes of Microsoft’s records, it falls short.

Can I just turn off the TPM?

Sometimes, in your firmware settings, though the consequences are larger than most people expect. Windows 11 requires a TPM for supported operation, BitLocker uses it to hold your encryption key, and Windows Hello depends on it for fingerprint and face sign-in. Switching it off on a Windows machine you rely on daily usually creates more problems than it solves. Doing it on a dedicated machine that will run Linux is a reasonable step.

Is Linux really different?

Yes, in the specific sense that matters here. A typical Linux installation has no equivalent registration step, contacts no vendor on first boot, and holds no account tied to a payment method. Your hardware still has serial numbers and your network still has an address, so this is a reduction rather than an escape. The difference is that nobody is systematically collecting and storing the association.

Does this affect my phone?

Your phone does something comparable and arguably more thorough. Apple and Google both identify devices with hardware-backed keys for the same reasons: activation, app purchases, theft recovery and fraud prevention. Phones add location history, a permanently attached radio identity and a mobile network operator who knows exactly which tower you are near. If device-level identification worries you on a PC, the phone in your pocket deserves at least as much thought.

Should I be worried about Windows 11 specifically?

The identifier described here goes back to Vista, so it is not new to Windows 11. What Windows 11 changed is the TPM requirement, which turned a feature many older machines lacked into something present on every supported PC. Coverage went from partial to universal.

What about my work laptop?

Assume your employer’s IT department can already see far more than this identifier reveals, because managed devices report inventory, installed software, and often browsing activity by design. That arrangement is usually disclosed in an acceptable use policy you signed. The practical advice is unchanged and unglamorous: keep personal activity off work hardware.

Can I see the identifier myself?

Windows shows a Device ID under Settings > System > About, though that value is a different thing from the identifier the researchers describe, and looking at either one changes nothing. Curiosity is fine. Editing registry values in the hope of resetting your device identity is a well-travelled dead end, since the chip on the motherboard will keep answering the same way it always has.

A checklist you can finish in an afternoon

Reading about privacy produces a pleasant feeling of having done something, which is why a short list of actual tasks is more useful than another explanation. Work through the first list whoever you are. The second list only makes sense if the decision tree put you in the bottom branch.

For everyone:

• Install an ad blocker in your browser and turn on the strictest tracking protection your browser offers.
• Move every password into a password manager and change any password you have used in more than one place.
• Turn on two-factor authentication for your email account first, since email recovery is the key to everything else.
• Run the ten-step Settings pass described above, ending with the web privacy dashboard.
• Check whether your main email address appears in known breaches, and change what it tells you to change.
• On your next PC, or your next clean install, set it up with a local account.

If your situation is genuinely sensitive:

• Separate your activities into contexts and decide which ones need a different machine.
• Acquire that machine in a way that leaves no purchase record connected to you.
• Put Tails on a USB stick and practise using it before you need it under pressure.
• Arrange network access that does not run through your home connection.
• Write down the rules you will follow on the sensitive machine, then follow them when it is inconvenient.
• Assume you will slip at some point, and plan what recovery looks like rather than assuming it will not happen.

Nothing on the first list involves your TPM, and that is the honest summary of this whole subject for the overwhelming majority of readers. The device identifier is real, permanent and worth understanding. The things most likely to harm you this year are a reused password and a company you trusted losing your data.

The general point worth keeping

Hardware-bound identifiers are becoming the norm across every platform, and they exist because they solve real problems: licensing, theft recovery, encryption, and fraud prevention all work better when a device has a stable identity. The same property that makes them useful makes them permanent, and permanent identifiers cannot be cleared the way a cookie can.

The right response is proportionality rather than alarm. Know that your computer has an identity it reports to its operating system vendor. Understand that this is a different exposure from web tracking, with a different and much smaller set of parties able to see it. And if your circumstances mean that exposure genuinely matters, solve it by choosing different hardware and a different operating system, because no configuration change inside Windows reaches the chip on the motherboard.