A default Windows 11 installation sends significant diagnostic and telemetry data to Microsoft. This is documented by Microsoft itself in the Windows privacy documentation. What ships enabled out of the box includes:
Required diagnostics: device info, hardware, capabilities, whether apps are working correctly, basic error reports. Cannot be turned off entirely.
Optional diagnostics: which apps you run and for how long, browsing patterns in Edge, more detailed error data. Can be disabled in Settings.
Advertising ID: a per device identifier used for personalized ads across Microsoft apps.
Microsoft account integration: nudges you to sign in and syncs settings, files, and browser data across devices.
OneDrive: auto backs up Documents, Pictures, and Desktop by default on new installs.
Copilot and Recall (where enabled): can process on device data. Recall specifically screenshots your screen at intervals.
Location services: tracks physical location.
SmartScreen: sends file hashes and URLs to Microsoft for reputation checking.
Search indexing: local index of files, and optionally sends search queries to Bing.
Note
This is automated data collection, not a person watching your screen. But privacy advocates argue the volume and defaults are excessive.
Practical steps to reduce telemetry:
Settings, Privacy and security, Diagnostics and feedback: switch to Required only, turn off tailored experiences.
Sign in with a local account instead of a Microsoft account (this is harder to do on Home edition but still possible).
Turn off the advertising ID in Settings, Privacy, General.
Review App permissions for camera, microphone, location.
Tools like O&O ShutUp10++ or W10Privacy expose many of these toggles in one place. Read what each setting does before applying it, since aggressive settings can break features you actually use.
Every modern device carries multiple persistent identifiers that have nothing to do with your IP address. These are how ad networks track you across apps and sessions even when you clear cookies or change networks.
Android: the Advertising ID (AAID), the Google Services Framework ID (GSF ID), the Android ID (SSAID), and device level identifiers like the IMEI on cellular devices. The GSF ID (sometimes casually called the GDID) is created when you first sign in to a Google account and persists across factory resets on many devices.
iOS: the IDFA (Identifier for Advertisers) and the IDFV (Identifier for Vendors). Apple's App Tracking Transparency lets you deny IDFA access to apps.
Windows: hardware IDs derived from the motherboard, disk, and network adapter, plus the Microsoft Advertising ID.
Browsers: cookies, localStorage, and browser fingerprints (see the fingerprinting article below).
Reality
A VPN changes your IP address. It does not change any of these identifiers. If you're signed in to Google, Meta, or an app using an ad SDK, that platform still knows exactly which device you're using regardless of what your IP looks like.
Encrypts traffic between your device and the VPN server, so your ISP and anyone snooping on your local Wi-Fi cannot see the contents of your requests.
Hides your real IP address from the sites you visit (they see the VPN's IP instead).
Can help bypass geographical restrictions.
What a VPN does not do:
Make you anonymous.
Stop browser fingerprinting.
Protect against malware already on your device.
Prevent tracking once you log in to accounts (Google still knows it's you).
Protect against valid legal processes served on the VPN provider.
Remove device identifiers like GSF ID or IDFA.
Encrypt anything on the far side of the VPN exit node.
Note
A VPN shifts trust from your ISP to the VPN provider. That can be a real improvement if the provider genuinely doesn't log, but you're still trusting somebody.
Mullvad has a good technical reputation, publishes audits, accepts anonymous payment, and does not require an email address. Their DAITA feature (defense against AI-guided traffic analysis) is a research direction, not a magic invisibility cloak.
Proton VPN is similar in intent, open source clients, and audited. Both are reasonable picks. Neither makes you anonymous.
A packet is a small chunk of data with a header describing where it's going and where it came from. Networks send data by splitting it into packets, routing each one across the network, and reassembling them at the destination.
When you open a website like example.com, roughly this happens:
Your device does a DNS lookup to convert example.com into an IP address like 93.184.216.34.
It opens a TCP connection to that IP on port 443 (HTTPS). This is a three way handshake.
Inside the TCP connection it does a TLS handshake to establish encryption.
It sends an HTTP request over the encrypted tunnel.
The server responds with HTML, which your browser renders.
What HTTPS encrypts:
The URL path (/search?q=cats)
The request headers (including cookies)
The request body
The response body
What HTTPS does not encrypt:
The destination IP address
The destination port
The size and timing of packets
The domain name in most cases (visible via SNI, unless you use Encrypted Client Hello, which is still rolling out)
Mullvad Browser (a fork of Tor Browser without Tor) tries to make all its users look identical to reduce fingerprinting. It helps, but the smaller the user population is, the more that population itself becomes a signal.
Google, Meta, and Amazon combine fingerprinting with logged in account data. Once you're signed in, fingerprinting is used less for identification and more for confirmation.
"A VPN makes me anonymous." False. See the VPN article above.
"Incognito mode hides me from everyone." False. It hides history from other people using your device. Your ISP, the sites you visit, your employer's network, and anything you log in to still see you.
"HTTPS encrypts everything." False. It encrypts the request contents. The destination, timing, and packet sizes are still visible.
"Deleting cookies removes all tracking." False. Fingerprinting, device IDs, and logged in account data all persist.
"Changing my IP changes my identity." False. See device IDs and fingerprinting.
"MAC addresses identify me across the internet." False. MAC addresses don't leave your local network. Routers don't forward them.
"Hackers can find my house from my IP." False. See the social section on IP addresses.
"The FBI is coming for me because I got in an argument in Discord." False. Law enforcement has finite resources and prioritizes actual crimes with actual victims. Petty online drama does not clear that bar.
Rough comparison. Details change over time, so verify current defaults.
Firefox: strong tracking protection by default, container tabs, independent of Google or Apple. Made by Mozilla, which is a nonprofit but funded mostly by Google search deals.
Brave: Chromium based, built in ad and fingerprinting blocking, private windows with Tor. Ships with crypto and ads features you may or may not want.
Chromium: the open source base of Chrome, Edge, Brave, Opera, and Arc. Lacks the anti tracking features Chrome has stripped out or Brave has added.
Chrome: tightly integrated with Google accounts. Convenient. Google is an advertising company.
Safari: good defaults (Intelligent Tracking Prevention, hidden email relay via iCloud+), locked to Apple devices, controlled by another huge company with its own ads interests.
Mullvad Browser / Tor Browser: designed for anti fingerprinting. Slower and some sites will break.
A strong password is long and unpredictable. "Password123" is weak. "correct horse battery staple" is stronger. A random 20 character string from a password manager is stronger still.
Rules that actually matter:
Length beats complexity. 16+ random characters or 5+ random words.
Never reuse passwords across sites. When one site is breached, attackers try that password everywhere.
2FA requires a second factor beyond your password, so a stolen password alone doesn't unlock your account.
SMS: better than nothing, but vulnerable to SIM swap attacks. Avoid for high value accounts.
Authenticator app (TOTP): Aegis, Authy, Google Authenticator, 1Password, Bitwarden. Codes are generated on device, not sent over the network. Much stronger than SMS.
Hardware security keys: YubiKey, Google Titan, or any FIDO2 key. Phishing resistant. Best available option.
Passkeys: a newer standard that replaces passwords with device backed cryptography. Growing support across platforms.
Most software updates include security patches for issues that have already been publicly disclosed. Once a patch ships, the patch itself often tells attackers what to target on unpatched systems.
A zero day is a vulnerability that is being exploited before a patch exists. Those are rare and expensive. What actually breaks most people are old, patched vulnerabilities on machines that were never updated.
Reality
Updating is not glamorous but it is by far the highest impact security practice for a normal user.