Most people assume that turning on a VPN makes them private online. Hide your IP, encrypt your traffic, job done. But there’s a category of tracking that VPNs were never designed to stop, and Microsoft has been quietly doing it for years. According to IPVanish, unsealed court records have revealed how Microsoft’s internal telemetry can link your online activity and changing IP addresses back to a single physical computer using something called a Global Device Identifier, or GDID. That’s a problem worth understanding.
What is a GDID and why should you care?
The Global Device Identifier is a unique 16-digit code assigned to your machine when you install Windows or sign into a Microsoft account. This isn’t a browser cookie you can clear. It lives at the operating system level, below the browser, below your VPN client, below everything you’d normally think to clean up.
Every time Windows runs background tasks, syncs data, or checks for updates, it sends reports back to Microsoft servers. Those reports include your GDID. So Microsoft can, over time, build a detailed log of system events tied to a specific Windows installation. That includes which IP addresses were active on the device and when.
The VPN blind spot
A VPN does real, useful things. It hides your real IP address from websites, encrypts traffic so your ISP can’t read it, and keeps people on public Wi-Fi from snooping on your connections. None of that is fake or overstated.
But a VPN operates at the network layer. It doesn’t touch how your operating system runs internally. Windows telemetry processes run directly on your physical PC, and when they report back to Microsoft, they log whatever IP address is currently active on the device, whether that’s your home IP or a VPN server IP. Switch to a VPN, and Windows just logs the new IP alongside the same GDID. Over time, both addresses get linked back to the same device. Your VPN changed your address. It didn’t change your identity.
To be clear about what GDID tracking actually is and isn’t: websites you visit don’t have access to your GDID. Advertisers can’t use it to target you. Your ISP has no visibility into it. This is an internal Microsoft telemetry system. But for users who don’t want their operating system correlating their browsing sessions and IP addresses into a persistent profile, that distinction offers limited comfort.
How remote browser isolation breaks the link
IPVanish’s answer to this is the IPVanish Secure Browser, which uses a technology called Remote Browser Isolation. The concept is straightforward: move your web browsing off your physical computer entirely.
When you open a session, a temporary Linux container spins up on a remote cloud server. Websites load there, not on your PC. Web scripts execute there. Your computer only receives an encrypted visual stream of what’s happening in that container. When you close the browser, the container is destroyed along with everything in it.
Because the actual web activity is happening in the cloud, Windows telemetry running on your machine has nothing to log. It sees a connection to the Secure Browser service and nothing more. DNS resolution also happens in the cloud, so there’s no local record of which domains you visited.
The security benefits go beyond GDID. Since web pages load in an isolated cloud environment, malicious scripts and drive-by downloads run in that container rather than on your hard drive. Browser fingerprinting attempts only see generic cloud server specifications, not your actual hardware profile. And since session data is stored temporarily in the cloud and wiped on exit, there are no local cookies, no cache, no browsing history.
- Malware runs in the cloud container, not your machine
- No local cookies, cache, or browsing history after the session ends
- Advertisers see cloud server specs, not your real hardware fingerprint
- DNS resolution happens remotely, leaving no local trace of domains visited
What this means in practice
IPVanish Secure Browser is available through the IPVanish desktop app on Windows and macOS, through direct web access, and as a browser extension for Chrome, Firefox, and Edge. The company is positioning it as the privacy layer that sits on top of a VPN, not a replacement for one.
That framing is honest. A VPN still matters for what it actually does. But the idea that a VPN alone makes you private on a Windows machine is genuinely incomplete. Microsoft’s telemetry is persistent, runs in the background, and operates entirely outside the network layer a VPN controls. Remote browser isolation is one of the few architectural approaches that actually addresses this at its root. Whether you trust IPVanish to run that cloud infrastructure is a separate question worth asking, but the underlying problem they’re solving is real.