[hyperrail]

In a sense it doesn't matter how the global ID is used now. The fact that it exists allows it to be used in ways like what you describe, either by a malicious (?) Microsoft itself or by a malicious third-party attacker.

I'm familiar with these global IDs because I routinely used the Windows telemetry system as part of my work on the Windows core at Microsoft. We had strong policies on how and when we could access or use data for a single device as identified by global ID.

But ultimately, these policies will have a "government or court order" exception in reality even if not in theory, just like in most other consumer software observability systems. The Windows difference is simply the breadth of data that is intentionally collected by Microsoft or can be identified by any Microsoft-controlled IDs. That difference is huge in potential impact but very small conceptually.

[challenger-derp]

Are there limits on what kinds of websites can request for a visitor's global ID information?

Must a website direct the user to log into their MS account before it is able to get a hold of the user's global ID information?

[hyperrail]

As far as I know, no browser for Windows allows sites to read the computer's telemetry global ID at all.