How it works

Does a VPN make you anonymous? The Global Device ID case, explained (2026)

7 min readupdated July 7, 2026Русская версия

A common myth: switch on a VPN and you are anonymous. In reality a VPN covers one thing - the network layer. It replaces your IP address and encrypts traffic up to the server. Everything your operating system, browser and apps reveal about you through other channels stays untouched. A US criminal case from July 2026 showed what that means in practice: investigators identified a user through a Windows identifier while three separate VPN services were running at once.

What happened, and what a Global Device ID is

According to the case materials, the FBI requested data from Microsoft tied to a Global Device Identifier - a persistent ID for a Windows installation, linked to a Microsoft account and usually abbreviated to GDID. It is not a hardware serial number: reinstalling Windows produces a new GDID, while system updates leave it unchanged. The identifier belongs to the OS and the account, not to the physical machine.

The key detail: the GDID did not leak through the VPN. It left over the operating system telemetry channel, outside the tunnel. A VPN routes network traffic; it has no control over which identifiers the OS sends to its own cloud services.

Why three VPNs did not help

The VPNs hid the IP address and the entry point, and that part worked. The deanonymization came from somewhere else:

An OS identifier outside the tunnel. The GDID went to Microsoft services through telemetry - a channel a VPN does not intercept.
Correlation with real accounts. The same identifier and IP address turned up in the user’s personal accounts - social media, gaming platforms - and investigators matched them by time and address.
Poor operational security (OPSEC). Anonymous activity and personal services ran in the same session on the same system. That mix of anonymous and personal is what failed, not the VPN.

The lesson is not that VPNs are useless. It is narrower than that: a VPN covers the network layer, but not identity at the OS and account level. These are separate privacy layers, and neither one substitutes for the other.

What affects anonymity besides your IP address

Deanonymization rarely happens at the network layer. More often it comes from identifiers the device hands over by itself:

OS identifiers and telemetry - GDID, advertising IDs, crash reports, diagnostic data from Windows and mobile systems.
Accounts - signing in to personal Google, Microsoft, social or gaming services in the same session immediately ties that activity to a name.
Browser fingerprint - fonts, canvas, screen resolution, User-Agent. It can single you out with no cookies at all.
DNS and WebRTC leaks - queries and your local IP can travel outside the tunnel when the configuration is wrong.
Metadata and behavior - time zone, system language, hours of activity, typing style.

Practical ways to improve privacy

Keep identities apart. Never sign in to personal accounts in the same session you use for anonymous activity.
Reduce OS telemetry. Limit Windows diagnostic data and turn off the advertising identifier.
Check for leaks. Confirm there are no DNS or WebRTC leaks - an online test takes a minute.
Isolate the environment. Use a separate browser profile or a virtual machine for sensitive work.
Keep the VPN in its place. It masks your IP and protects traffic on open networks - necessary, but not sufficient on its own.

One technical correction. Viral summaries of this case describe the GDID as a 128-bit identifier assembled from hardware serial numbers. That is wrong: the identifier is tied to a Windows installation and an account rather than to fixed hardware, and it changes when the system is reinstalled.

Anonymity online is not a single switch. It is several independent layers. A VPN covers the network layer well: it hides your IP address, encrypts traffic and protects you on public Wi-Fi. Identity at the OS, account and browser level is on you - keep sessions separate and keep telemetry in check.