Windows Privacy Configuration

Open Settings (Win + I) and go to Privacy & security

Click "General" under Windows permissions

Turn off "Let apps show me personalized ads by using my advertising ID"

Write down what the settings screens actually store

Go: a terminal — Linux, macOS, or PowerShell on Windows. mkdir wprivlab then cd wprivlab.

Do: save this as user_export.reg. It is the format Windows itself produces, and it holds four of the settings this page walked you through — all switched off, the state you would be in after following it:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo]
"Enabled"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Privacy]
"TailoredExperiencesWithDiagnosticDataEnabled"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location]
"Value"="Deny"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\webcam]
"Value"="Deny"

You should see: one file. Each bracketed line is a registry key; each quoted line under it is a setting and its value.

Every toggle you clicked in Settings wrote one of these lines. The screens are a friendly front end to exactly this — which means “did that setting stick?” is answered by reading a value, not by remembering a click.

If not: if a later step reports nothing found, the backslashes were lost in copying — each key line needs single backslashes exactly as shown.

Build something that reads all of them at once

Go: the same folder.

Do: save this as audit.py. It turns raw registry values into plain English, and flags one specific situation you will meet in step 3:

import re, sys, pathlib

# Settings this lab knows how to explain: (key fragment, value name) -> (label, what "on" means)
KNOWN = {
    ("AdvertisingInfo", "Enabled"):
        ("Advertising ID", {"0": "off — apps get no shared ad identifier",
                            "1": "ON — apps share one identifier for you"}),
    ("Privacy", "TailoredExperiencesWithDiagnosticDataEnabled"):
        ("Tailored experiences", {"0": "off", "1": "ON — diagnostic data used to personalise"}),
    ("ConsentStore\\location", "Value"):
        ("Location access", {"Deny": "denied", "Allow": "ALLOWED for apps"}),
    ("ConsentStore\\webcam", "Value"):
        ("Camera access", {"Deny": "denied", "Allow": "ALLOWED for apps"}),
}

if len(sys.argv) < 2:
    sys.exit("usage: audit.py <export.reg> [more.reg ...]")

# read every file given, so an exported policy branch can be audited
# alongside your own settings
text = "\n".join(pathlib.Path(f).read_text(encoding="utf-8", errors="replace")
                 for f in sys.argv[1:])
current, found = None, {}
policy = {}
for line in text.splitlines():
    line = line.strip()
    if line.startswith("["):
        current = line.strip("[]")
        continue
    m = re.match(r'"([^"]+)"=(?:dword:0*([0-9a-fA-F]+)|"([^"]*)")', line)
    if not m or current is None:
        continue
    name = m.group(1)
    val = m.group(2) if m.group(2) is not None else m.group(3)
    if m.group(2) is not None:
        val = str(int(val, 16))
    for (frag, vname), (label, meanings) in KNOWN.items():
        if frag in current and name == vname:
            target = policy if "\\Policies\\" in current else found
            target[label] = (val, meanings.get(val, f"unrecognised value {val!r}"))

for label in sorted(set(found) | set(policy)):
    if label in policy:
        pv, pm = policy[label]
        if label in found and found[label][0] != pv:
            uv, um = found[label]
            print(f"  {label:<22} POLICY OVERRIDES YOU")
            print(f"  {'':22} you chose : {um}")
            print(f"  {'':22} enforced  : {pm}")
        else:
            print(f"  {label:<22} {pm}  (set by policy)")
    else:
        print(f"  {label:<22} {found[label][1]}")

Run it against your export:

python3 audit.py user_export.reg

You should see: every setting in one place:

  Advertising ID         off — apps get no shared ad identifier
  Camera access          denied
  Location access        denied
  Tailored experiences   off

Four settings that live on four different Settings screens, answered by one command. That is the practical value on its own — nobody re-clicks through thirty privacy screens to check, which is exactly why drift goes unnoticed for years.

If not: if the output is empty, the filename is wrong or the export lost its structure — run head -4 user_export.reg and confirm the first line reads Windows Registry Editor Version 5.00.

Add a policy, the way a workplace or a bundled installer would

Go: the same folder.

Do: save this as policy.reg, in its own file. It is a Group Policy value — the kind an employer, a school, or some installed software can set:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\AdvertisingInfo]
"Enabled"=dword:00000001

Now run the audit over both files. audit.py takes as many as you give it:

python3 audit.py user_export.reg policy.reg

You should see: your setting and the enforced one, side by side:

  Advertising ID         POLICY OVERRIDES YOU
                         you chose : off — apps get no shared ad identifier
                         enforced  : ON — apps share one identifier for you
  Camera access          denied
  Location access        denied
  Tailored experiences   off

🔴 Your choice is still recorded, and it is not the one in force. A value under HKEY_LOCAL_MACHINE\Software\Policies outranks the per-user setting, and the Settings app will keep showing your toggle as off. Nothing lies to you — the screen shows what you chose. It just never shows what wins.

This is not exotic. Managed work machines set policies by design, and some consumer software writes them during install.

If not: if the second run looks identical to the first, only one filename reached the command — both must be on the same line, separated by a space.

Export your own settings and audit them

Go: a Windows Command Prompt or PowerShell — no administrator rights needed.

Do: export the two branches holding the settings from this page, then audit them:

reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" mine.reg
reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore" consent.reg
python3 audit.py mine.reg consent.reg

You should see: your real settings, reported the same way. Anything the auditor does not recognise is simply absent from its table — it reports only the four it knows.

Not re-run for this page — reg is Windows-only and this page was written on Linux. Steps 1–3 were run, and they carry the reasoning. The registry paths are Microsoft's documented locations for these settings.

Exporting is read-only. It copies values out to a text file and writes nothing back, so this is safe to run before you have decided anything.

If not: ERROR: The system was unable to find the specified registry key means that branch does not exist on your Windows version — export the ones that do and audit those. If python3 is not found on Windows, it is usually installed as py.

Find out whether a policy is deciding for you

Go: the same Windows terminal.

Do: the branch that outranks your choices lives elsewhere. Export it too — on a personal machine it is often absent, and that absence is itself the answer:

reg export "HKLM\Software\Policies\Microsoft\Windows\CurrentVersion" policies.reg

You should see: either a file listing enforced settings, or ERROR: The system was unable to find the specified registry key — which means nothing is overriding you there.

Also not re-run here, for the same reason.

If the file does appear, add it to the audit — python3 audit.py mine.reg consent.reg policies.reg — and you will see any override exactly as step 3 showed it. A managed machine is not a broken one: if your employer enforces a setting, that is their decision to make on their hardware. What matters is knowing which of your choices are actually yours, and no Settings screen will tell you that.

If not: if the export succeeds on a personal machine and contains keys you never set, something installed them. That is worth investigating — note the key names before changing anything.