OS telemetry refers to the automatic collection and transmission of data about system performance, usage patterns, and errors from operating systems to their developers. While intended to improve software reliability and user experience, it raises significant privacy concerns across platforms.
Privacy and Security Risks
Scope of Data Collection: Users often perceive the data collected—such as hardware details, application usage, system crashes, and even file metadata—as excessive and unnecessary.
Lack of Transparency: Many users are unaware of exactly what data is being gathered, how it is used, or whether it is shared with third parties.
Potential for Abuse: Even anonymized data can be re-identified through cross-referencing, especially in large datasets. There is also risk of misuse if data is compromised in a breach.
Data Sovereignty: For organizations in regulated industries (e.g., government, healthcare), data residency laws may be violated if telemetry is sent to servers outside their jurisdiction.
Platform-Specific Examples
Windows: Microsoft collects diagnostic data at multiple levels (Basic, Enhanced, Full). While some data is anonymized, the system can still link information to individual devices. Disabling telemetry is possible but incomplete—"shadow telemetry" from core services like licensing and updates often persists. Tools like Group Policy or third-party apps (e.g., CCleaner, Spybot) can help reduce data flow.
macOS: Apple claims to use differential privacy and anonymization, but data is still collected and tied to Apple ID accounts. Users have limited control over what is shared.
Android/iOS: Google and Apple collect extensive telemetry by default. While Apple emphasizes privacy, both companies retain access to user behavior data.
Linux (Ubuntu): A notable exception—Ubuntu’s telemetry is opt-in, open-source, and transparent. It collects only non-personal hardware and software configuration data, stored locally and sent only with explicit user consent. This model is praised as a privacy-friendly alternative.
Mitigation Strategies
Adjust Privacy Settings: Reduce telemetry levels in OS settings (e.g., Windows Privacy & Security > Diagnostics & Feedback).
Use Third-Party Tools: Tools like GlassWire (network monitoring), CCleaner (cache cleanup), or custom scripts can limit data leakage.
Consider Alternatives: Privacy-focused users may opt for Linux distributions like Ubuntu (with telemetry disabled) or BSD, which offer greater control and transparency.
Legal Rights: Under GDPR and similar laws, users can request access to, correction of, or deletion of their telemetry data via Microsoft’s Privacy Dashboard.
Key Takeaway: While telemetry improves system stability and development, complete privacy control is difficult on mainstream OSes like Windows. Ubuntu stands out as a transparent, user-controlled model, demonstrating that effective telemetry can coexist with strong privacy.
What is Telemetry?
Windows OS monitors and debugs information about the user's running applications. This is called instrumentation. Gathering remote information that is collected by instrumentation is what is called Telemetry.
As the product is not opensource, one can legitimately think of the worse. But to keep the answer as objective as possible, I prefer to quote from Windows 10 feedback, diagnostics, and privacy: FAQ:
As you use Windows, we collect performance and usage information that helps us identify and troubleshoot problems as well as improve our products and services. We recommend that you select Full for this setting.
Basic information is data that is vital to the operation of Windows. This data helps keep Windows and apps running properly by letting Microsoft know the capabilities of your device, what is installed, and whether Windows is operating correctly. This option also turns on basic error reporting back to Microsoft. If you select this option, we’ll be able to provide updates to Windows (through Windows Update, including malicious software protection by the Malicious Software Removal Tool), but some apps and features may not work correctly or at all.
Enhanced data includes all Basic data plus data about how you use Windows, such as how frequently or how long you use certain features or apps and which apps you use most often. This option also lets us collect enhanced diagnostic information, such as the memory state of your device when a system or app crash occurs, as well as measure reliability of devices, the operating system, and apps. If you select this option, we’ll be able to provide you with an enhanced and personalized Windows experience.
Full data includes all Basic and Enhanced data, and also turns on advanced diagnostic features that collect additional data from your device, such as system files or memory snapshots, which may unintentionally include parts of a document you were working on when a problem occurred. This information helps us further troubleshoot and fix problems. If an error report contains personal data, we won’t use that information to identify, contact, or target advertising to you. This is the recommended option for the best Windows experience and the most effective troubleshooting.
Note that only on Enterprise Edition one can turn that feature off totally. On Windows 10 Home and Professional, for instance, it can be set only it to Basic.
UPDATE 1:
Is this information specific to the telemetry service or just general information that Windows collects? I've had problems in tying up what's telemetry (which was back-ported to win8/7) and what's general data passed back to MS.
Telemetry is a main part of Diagnostics Tracking Service available in Windows 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1, Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows Server 2012 R2 Standard and Windows 10. The quoted paragraphs concern the Diagnostics Tracking Service mechanism in which other modules, apart from Telemetry, are included.
Diagnostics Tracking Service consists mainly in these files:
- telemetry.asm-windowsdefault.json
- diagtrack.dll
- utc.app.json
- utcresources.dll
As you can see Telemetry is a JSON file that is used to describe the data sent back and forth between Windows machine (client) and server.
If you are curious about the details, you can see its content when you downloand the appropriate patch you want. When you extract the content of MSU file (instructions here) and retrieve the CAB files, you will find a folder which name looks something like this: amd64_microsoft-windows-u..ed-telemetry-client followed by several numbers. Check the content of that folder and open the Telemetry file in JSON format to have a technical insight about its details, mainly description of the data echanged between your machine and Microsoft server(s).
Telemetry is also seen as a part of Microsoft Customer Experience Improvement Program as
it is impossible for us to contact most of our customers in person to get their feedback. The Customer Experience Improvement Program (CEIP) was created to give all Microsoft customers the ability to contribute to the design and development of Microsoft products.
If you check Privacy Statement for the Microsoft Customer Experience Improvement Program you can read:
When you participate, we collect basic information about how you use your programs, your computer or device, and connected devices. We also collect information about how each is set up and performing. These reports are sent to Microsoft to help improve the features our customers use most often and to create solutions to common problems.
Which statement is in contradiction with the first text we quoted as the user has no ability to turn off totally Telemetry.
As for the exact data being exchanged through Telemetry, apart from the quoted text and the efforts you may make to read that JSON file (and may be survey your machine's communication?), I can not say more. But it is really very interesting to know that precisely (if it is possible).
UPDATE 2:
Additional information I found ( I still refer to official documentation only to stay objective):
From Instrumentation and Telemetry Guidance, we can read that the information generally include:
- Details of operational events that occur as part of the normal operation of the application, together with useful information about that event. For example, in an ecommerce site it would be useful to record the order number and value of each order that is placed. These are typically informational events that are used to collect data about the way the application is used.
- Details of runtime events that occur, and useful information about that event such as the location or data store used and the response time for access to the data store. These are also informational events that can provide additional insight into the normal operation of the application. The event should not include any sensitive information such as credentials, or any other data that might enable an attacker obtaining the logs to compromise the system.
- Specific data about errors that occur at runtime, such as the customer ID and other values associated with an order update operation that failed. Typically these are warning or error events and will contain one or more system-generated error messages.
- Data from performance counters that measure specific values related to the operation of the application. These might be built-in system counters, such as those that measure processor load and network usage, or they might be custom performance counters that measure the number of orders placed or the average response time of a specific component.
(Further reading: Telemetry – Application Instrumentation, Windows Azure: Telemetry Basics and Troubleshooting)
From Share telemetry data with Mozilla to help improve Firefox, we can read that it collects for example:
- memory consumption
- responsiveness timing
- feature usage
- memory configuration
- hardware configuration
Note that whatever a user does, it seems it is impossible to know what Windows collects and sends permanently. Windows does not stop sending undefined information on his/her behalf as this study shows: Even when told not to, Windows 10 just can’t stop talking to Microsoft. But still what the official documentation describes is not very good for the user such as when Windows takes system files or memory snapshots, which may unintentionally include parts of a document you were working on when a problem occurred.
Answer from user45139 on Stack ExchangeVideos
Do I have the right to delete or request my Windows telemetry data? How is this happening?
What operating systems can I consider as alternatives to Windows due to my privacy concerns?
How can I be sure that my telemetry data is in the gu00fcvenu011fun? How does Microsoft protect this data?
Apologies if this is repetitive but i remember coming across repurposed windows 10/11 had completely removed telemetry, un-necessary processes. Kindly help
So to my knowledge Linux does not track your movements and you can define permissions accordingly. With Windows however, even say I disable telemetry and tracking options, does this actually stop tracking and data being sent back to Microsoft or an external party?