Microsoft admits WGA update phones home
Click cancel to continue
Microsoft has admitted that the latest update to its Windows Genuine Advantage program will phone back to Redmond even if the user clicks cancel.
WGA is meant to help Redmond fight piracy, but has been criticised on privacy grounds and because previous versions have incorrectly labelled people with genuine software as pirates.
But if you cancel the installation of WGA, maybe because you dislike the privacy implications, the software will still phone home. Microsoft stresses that WGA does not take any information which could identify you as an individual, but is only used to collate statistics on WGA use.
Microsoft UK anti-piracy manager Michala Alexander said in a statement:
The data collection and transfer in question are part of some of our update download services, such as the Windows Update service. As with other programs downloaded via these services, the success or failure of WGA Notifications' installation is sent to Microsoft.
If the user interrupts installation of WGA Notifications, we send the number of the screen on which installation stopped (first, second, etc.). In order to establish an accurate count, we also generate several globally unique identifiers (GUIDs) that do not contain any personal information. We use the GUIDs to tally the number of individual machines without identifying the user. Other data sent includes user and machine language settings and whether or not the machine was joined to a domain.
We use the information collected to generate aggregate statistics that help us improve the WGA user experience and quality of service.
Protecting the privacy of our customer's information is very important to Microsoft. That is why we have detailed what information is collected in the Windows Update privacy statement. In addition, the Microsoft Genuine Advantage privacy statement and the Windows Genuine Advantage Notifications End User License Agreement describe this data collection. As documented in these disclosures, the information collected is not used to identify or contact the user.
Sponsored: DevOps and continuous delivery