Windows stores your entire website visit history even if you deleted it

Court documents in the criminal case against a 19-year-old alleged member of the Scattered Spider hacker group unexpectedly sparked a new wave of debate about Windows privacy. The case materials revealed that, at the FBI’s request, Microsoft provided data associated with the unique device identifier Global Device Identifier (GDID). This information allowed investigators to match a specific computer with visits to particular web pages, activity times, IP addresses, and other events.

It was this detail that drew broad public attention: many users believed Microsoft did not link online activity to a specific device in such a detailed way.

What happened

The case concerns an investigation into 19-year-old Peter Stokes, whom U.S. authorities consider a member of the well-known cybercrime group Scattered Spider. According to investigators, the group was engaged in social engineering, corporate network intrusions, and extortion.

During the investigation, the FBI requested information from Microsoft related to the Global Device Identifier (GDID). According to court documents, the company was able to provide data that made it possible to determine:

which device was used;

which internet resources were visited;

the exact time of visits;

IP addresses;

use of specific services and tools;

other Windows telemetry.

It was thanks to the comparison of this data that investigators were able to link a specific computer to the suspect’s actions.

What GDID is

Global Device Identifier is an internal unique identifier for a Windows installation used by Microsoft for telemetry, diagnostics, licensing, and the operation of various cloud services.

The existence of GDID itself is not a secret. However, before the publication of the court documents, it was hardly discussed that this identifier could be used for such detailed correlation of a device’s internet activity in the context of investigations.

Does Microsoft really record all websites?

Here it is important to separate facts from sensational headlines.

The court documents do not state that Microsoft stores a complete history of every website visited by every Windows user.

The case materials only show that Microsoft was able to provide investigators with information related to the internet activity of a specific device, including visits to certain pages with timestamps. Exactly how this information was obtained — solely through Windows telemetry, Microsoft browser services, account synchronization, or a combination of several sources — has not been publicly disclosed.

That is why claims such as “Windows records absolutely every website for every user” are not yet confirmed by official documents.

Does VPN help?

One of the most discussed points was that using a VPN, according to the case materials, did not prevent the device and internet activity from being linked.

The explanation is fairly simple.

A VPN hides your IP address from websites and your internet provider, but it does not disable the operating system’s built-in telemetry. If Windows itself or related Microsoft services send diagnostic data, a VPN does not prevent that information from being transmitted to the company.

Therefore, a VPN cannot be considered a tool for complete anonymity.

Why this raised so many questions

The story has once again brought up the long-standing issue of the volume of Windows telemetry.

Information security experts have been pointing out for years that modern versions of Windows collect a significant amount of diagnostic information. Microsoft explains this as necessary for improving security, finding bugs, supporting licensing, and enhancing service quality.

However, this court case for the first time shows in such detail how such data can be used by law enforcement in criminal investigations.

What this means for ordinary users

At the moment, there is no evidence that Microsoft maintains a public database of the complete website visit history of all Windows users.

Nevertheless, the court materials showed that the company is able to provide investigators with significantly more information about a device’s activity than many previously assumed.

For users, this is another reminder that a VPN is not a universal privacy protection tool. It hides network routing, but does not stop the built-in telemetry of the operating system and cloud services if they are enabled. Therefore, the level of privacy depends not only on using a VPN, but also on the settings of Windows itself, the browser, and the Microsoft account.