What isn’t clear to me is how they’re able to say which GDID visited each site and when.

Did the hacker not disable telemetry? Was he using Microsoft Edge? Or is it just a GDID->IP mapping combined with network activity?

It is obvious that Microsoft has an identifier for my device. They enforce license activation.

The problem is that they’re tracking user activity and associating it with this ID, even for a user who, one would assume, rejected all telemetry.

Can they do this in devices owned by companies and governments that are configured with strict no telemetry and no cloud services policies?

This isn’t the pre-Win11 hardware license identifier that we already knew about. This is the “Microsoft Account identifier” that Win11 forces an association with for every install and activation of a Windows 11 hardware license. Presumably that identifier also exists in earlier versions of Windows when using Microsoft Store, or Office, or Sign In With Microsoft Account — but those were things one could opt out of. If the prior hardware license system could be so trivially linked to people, then Microsoft would be behaving like Oracle and issuing pay-or-else demands to millions of end users worldwide; they have not. The news here to me is that Windows 11 has now been proven publicly to correct that oversight, and can begin targeting specific individuals both for law enforcement and for corporate profits.

It's very naive to assume that they wouldn't collect and report the telemetry regardless. Filtering then bundling and compressing the data while staggering the calls back home. Any outbound traffic to Microsoft could be injected with that data, and redirected once it reaches.