A used CPU becomes a paper trail, a punishment, and a preview of computing\u2019s next privacy fight.<\/h5>\n\n\n\n![\"Pixel](\"https:\/\/media.reclaimthenet.org\/images\/2026\/10\/IJd1mBSf3adc.jpg\")
<\/figure>\n\n\n\nBy Ken Macon<\/p>\n\n\n\n
Let\u2019s start with the German buyer who, on September 21, picked up a used AMD Ryzen 7 5800X3D processor<\/u><\/a> and tried to play Valorant on it. The game wouldn\u2019t start. It had run just fine on the old chip.<\/p>\n\n\n\nThe buyer said that the game\u2019s developer, Riot Games, told them through its support that the processor had been blacklisted by its anti-cheat system, Vanguard, as of August 12 \u2013 more than a month before the purchase.<\/p>\n\n\n\n
Riot\u2019s support allegedly said the ban was the result of the previous owner cheating, and that the ban would not be lifted. The motherboard and the drive were now flagged as well, the player was told.<\/p>\n\n\n\n
Riot has not responded to a request for comment sent by PCWorld.<\/p>\n\n\n\n
Riot\u2019s head of anti-cheat, Phillip Koskinas, responded on X<\/u><\/a> to the story, which was first posted on the German-language PCBaumeister subreddit on September 26 and then picked up by a user called CR1337.<\/p>\n\n\n\nKoskinas called the account \u201cpretty unlikely\u201d and said he could not find a support ticket matching the one described by the German player.<\/p>\n\n\n\n
Koskinas said that a hardware ban lasts a maximum of four months, applies only to the game where the cheating happened, and that the support should have told the player how long the ban had left.<\/p>\n\n\n\n
Koskinas also denied<\/u><\/a> that Vanguard blacklists other parts of a PC if it finds one that is banned.<\/p>\n\n\n\nEven if we take Koskinas\u2019 explanation as true, the fact remains that even according to him, an innocent buyer of a used processor is left unable to play the game until the ban on that chip expires \u2013 and there is no way for the buyer to know this before making the purchase.<\/p>\n\n\n\n
When a company like Riot bans a game account, the punishment is directed at a person found to have violated the rules, and they are unable to play the game using that account.<\/p>\n\n\n\n
When the company bans hardware, the punishment is directed at an object, and whoever holds the object at a given time is the one who is punished.<\/p>\n\n\n\n
While it may seem like a good idea to buy second-hand in order to save money and reduce electronic waste, some gamers are learning the hard way that it can also mean buying a used component that is banned from playing a game, with no way to find out before making the purchase.<\/p>\n\n\n\n
Riot Games’ own support page<\/u><\/a>, “Understanding Hardware ID (HWID) Bans,” calls a hardware ban “a drastic step.”<\/p>\n\n\n\n“When a computer has a hardware ID ban, it means that we’ve banned the physical components of that computer rather than just banning an account,” the page explains.<\/p>\n\n\n\n
It continues that a ban is “effectively a statement that we don’t want that particular person to create, access, or use any account on a Riot platform or game for the duration of the ban.”<\/p>\n\n\n\n
It’s not that particular person who is punished if they are not the one currently using the hardware. The page spells it out: if a friend or family member logs in on a banned computer, that account is restricted there and banned for a set period, “as the system assumes that the account is attempting to circumvent the original ban.”<\/p>\n\n\n\n
Riot advises, “If you suspect a computer has an HWID ban, it’s best not to try to log in with any account.”<\/p>\n\n\n\n
“Reinstalling a game or deleting the responsible account won’t remove an HWID ban.”<\/p>\n\n\n\n
Activision, another game maker, puts it like this<\/u><\/a>: be careful buying a secondhand device, because you could end up with a banned product, and there is no appeal.<\/p>\n\n\n\nThese are not new issues – back in 2007, a person who bought a refurbished Xbox 360 found it had arrived banned for life from Xbox Live. In 2009, banned consoles were resold on eBay. In 2025, some Switch 2 owners reported being banned<\/u><\/a> by Nintendo after using secondhand Switch 1 game cards that they had bought online.<\/p>\n\n\n\nSo how exactly does a game know one processor from another of the same model? The chips themselves only report their model to the operating system, so the identity has to be dug out from somewhere the owner never looks, such as the Trusted Platform Module (TPM) inside the processor, or the way it handles clock and voltage (since each processor “behaves slightly differently and can thus be identified”) – or even the firmware serial number.<\/p>\n\n\n\n
The only thing that is clear is that it is not the operating system that can identify a processor uniquely. “A Ryzen 7 5800X3D, for example, is not distinguishable from another Ryzen 7 5800X3D without further ado,” German tech site Heise said<\/u><\/a>. The site suggested that the TPM is a good candidate to carry a unique identifier, a “hardware ID,” that can be used by software.<\/p>\n\n\n\nRiot Games has not revealed exactly how its Vanguard anti-cheat software identifies a processor, but Heise said it would be “much easier to write identification hashes into the Trusted Platform Module. Because this TPM sits as a coprocessor directly in the CPU in most PCs, the hash remains when switching to a new PC.” In 2024 Riot said it was using Vanguard<\/u><\/a> to enforce TPM and Secure Boot, even on Windows 10, “to eliminate bootkits as a vector and to give ourselves a better form of hardware ID.”<\/p>\n\n\n\nOn AMD machines, the TPM usually runs as firmware inside the processor itself, the fTPM. A 2023 paper by TU Berlin researchers<\/u><\/a>, who reverse-engineered the fTPM, found that its storage and integrity keys “are derived from a 128 bit secret unique to each CPU.” AMD itself warns on its support page<\/u><\/a> that when its fTPM fails attestation, “Gamers may be unable to compete in online cash tournaments.”<\/p>\n\n\n\nMicrosoft says that the TPM’s Endorsement Key<\/u><\/a> (EK) is unique to every TPM and cannot be changed or removed. This key can identify the module.<\/p>\n\n\n\nIn Windows 11, Microsoft says<\/u><\/a>, the TPM’s unique RSA key, which is “burned into the chip,” can be used for device authentication.<\/p>\n\n\n\nSome AMD and Intel processors also have a Protected Processor Identification Number (PPIN).<\/p>\n\n\n\n
We have had this fight before. In 1999, Intel announced the Pentium III would carry a processor serial number, a unique ID readable by software. Privacy groups immediately launched a boycott, and the campaign against what they called Big Brother Inside<\/u><\/a> was on. In January 1999, Intel\u2019s Pat Gelsinger explained the purpose of the number at the RSA conference<\/u><\/a>, using an example that today seems almost quaint, given the way the same idea has evolved.<\/p>\n\n\n\nGelsinger said the number would be needed to enter a chat room. \u201cYou think about this maybe as a chat room, where unless you\u2019re able to deliver the processor serial number, you\u2019re not able to enter that protected chat room,\u201d he said.<\/p>\n\n\n\n
Junkbusters, EPIC, and Privacy International quickly realized that the number would be like a permanent cookie, but one that cannot be deleted or changed. The groups warned that it would enable a massive profile to be collected and sold, and called for a boycott of Intel products.<\/p>\n\n\n\n
At the time, Congressman Edward Markey wrote to Intel CEO Craig Barrett, \u201cI hope that Intel will seek to design its products to improve the security of electronic commerce transactions without putting consumer privacy at risk.\u201d<\/p>\n\n\n\n
In April 2000, Wired reported<\/u><\/a> that Intel was dropping the serial number from future chips, and quoted an Intel source as saying that the company had decided that the benefits were not worth \u201cthe bad rep it would give us.\u201d<\/p>\n\n\n\nThat was not the end of it. In 2026, the example of a chat room that you could not enter without your chip’s number, given by Intel’s Pat Gelsinger in 1999, has turned into a game you cannot play because of the same issue.<\/p>\n\n\n\n
What came after that was Trusted Computing \u2013 and we have to give it this: the Trusted Platform Module (TPM) does do real security work.<\/p>\n\n\n\n
The idea of a unique chip ID has not gone away since then. In 2003, the Cambridge security researcher Ross Anderson explained<\/u><\/a> the purpose of the Trusted Platform Module (TPM) that was being introduced at the time: \u201cThe TCG specification will transfer the ultimate control of your PC from you to whoever wrote the software it happens to be running.\u201d<\/p>\n\n\n\nAnderson also noted that the idea was not new, and compared it to the way the Soviet Union used to control its citizens by registering and tracking their typewriters and fax machines. “TC similarly attempts to register and control all computers,” he wrote.<\/p>\n\n\n\n
The same year, the EFF\u2019s Seth Schoen noted<\/u><\/a> at the time that remote attestation, a key feature of TPMs, treats the computer owner as an adversary, and proposed an \u201cOwner Override\u201d that would allow people to control what their machine reports to remote parties. Schoen conceded that this would prevent \u201ctrusted computing\u201d from being used for the purpose of stopping cheating in online games.<\/p>\n\n\n\nThe industry came up with Direct Anonymous Attestation (DAA) in 2004, a way to prevent the linking of different transactions by the same TPM.<\/p>\n\n\n\n
The authors of the DAA paper<\/u><\/a> – Brickell, Camenisch, and Chen – said that the goal was to ensure that a verifier “only learns that she uses a TPM but not which particular one,” and that without this, “all her transactions would become linkable to each other.”<\/p>\n\n\n\nOne of the authors, Camenisch, would later say that DAA was introduced “to make privacy groups happy.”<\/p>\n\n\n\n
In 2022, Richard Stallman updated his essay<\/u><\/a> “Can You Trust Your Computer?” to say that “the threat I warned about in 2002 has become terrifyingly real.”<\/p>\n\n\n\nThe identity chip has now become mandatory hardware, included in almost every new PC, with Windows 11 requiring TPM 2.0 to even install.<\/p>\n\n\n\n
If you think of your PC as your property (and you should, since you paid for it) then the price of entry of many popular online games these days is the kernel, the deepest level of your operating system.<\/p>\n\n\n\n
You hand that over to a game company, and the code stays there even when you are not playing the game.<\/p>\n\n\n\n
The kernel is where an operating system\u2019s most sensitive components live, and where a malicious actor can do the most damage.<\/p>\n\n\n\n
In exchange, you get to play the game.<\/p>\n\n\n\n
Companies whose games install kernel-level software say they do this to detect and prevent cheating.<\/p>\n\n\n\n
EA, for one, has said it doesn\u2019t want deeper access to users\u2019 PCs than necessary, but that anti-cheat software requires it.<\/p>\n\n\n\n
The problem is not so much the intent of the game company, it\u2019s the fact that once you give a third party the keys to the kingdom, you can never be sure what will happen next.<\/p>\n\n\n\n
What about when this software is abused for other purposes? In 2022, Trend Micro found<\/u><\/a> that the Genshin Impact anti-cheat driver was used by ransomware to kill antivirus products installed on a system.<\/p>\n\n\n\nThe driver, mhyprot2.sys, was found to be used by ransomware to uninstall and disable security software. Trend Micro said that the game did not have to be installed on a victim\u2019s PC in order for the attack to work.<\/p>\n\n\n\n
Trend Micro noted that even when a fix is issued, \u201cthe module cannot be erased once distributed.\u201d<\/p>\n\n\n\n
In 2013, the New Jersey Attorney General settled for $1 million with E-Sports Entertainment<\/u><\/a>, whose anti-cheat client was found to be mining Bitcoin on users\u2019 computers.<\/p>\n\n\n\nThe state\u2019s Division of Law Director Christopher Porrino said at the time that subscribers to the service \u201cpaid for protection from cheaters \u2013 not to be cheated by the very services they\u2019d purchased.\u201d<\/p>\n\n\n\n
In July 2024, a CrowdStrike update crashed an estimated 8.5 million Windows devices<\/u><\/a>.<\/p>\n\n\n\nThat same year, Microsoft announced that it was moving security tools out of the kernel, and into user space, where the rest of the applications run.<\/p>\n\n\n\n
The reason given was to improve overall system security. In 2025, Microsoft explained<\/u><\/a> that this means that \u201csecurity products like anti-virus and endpoint protection solutions can run in user mode just as apps do.\u201d<\/p>\n\n\n\nRiot itself has written that Microsoft is trying to move all third-party applications out of the kernel.<\/p>\n\n\n\n
Yet gamers continue to allow this type of software to run on their PCs.<\/p>\n\n\n\n
The fact remains that the kernel is no place for third-party software, and that includes anti-cheat tools.<\/p>\n\n\n\n
In the world of PC gaming, the anti-cheat arms race is reaching for lower and lower levels of the software stack, all the way to the hardware. And each round of this race is making gaming more expensive and more difficult for honest users.<\/p>\n\n\n\n
Riot Games, makers of League of Legends, and of Vanguard, the anti-cheat software that has been under some fire lately, are particularly proud of the latest iteration of their product. In May, they announced that they had managed to block DMA (direct memory access) cheat devices, that work by having one computer read the memory of another. The cost of these devices can be as high as $6,000.<\/p>\n\n\n\n
Riot\u2019s statement at the time<\/u><\/a> was that owners of these devices had now been left with a \u201cbrand new $6k paperweight.\u201d<\/p>\n\n\n\nThe update that blocked these cheats relies on a Windows 11 25H2 feature that monitors driver activity. And it only works with a number of other security features turned on: Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU. Riot calls this checklist Pre-Check, and says that 34.33% of machines are fully compliant.<\/p>\n\n\n\n
Other major game publishers have similar, if less stringent requirements: Activision\u2019s Ricochet anti-cheat uses Remote Attestation to check PC security settings directly with Microsoft. EA said that over 4.8 million players<\/u><\/a> enabled Secure Boot after the company made it a requirement, and the game Battlefield 6 requires TPM 2.0. FACEIT, a platform<\/u><\/a> for competitive multiplayer games, also requires TPM 2.0 and Secure Boot, and says that the former \u201crecords a unique fingerprint of every component in the boot chain.\u201d<\/p>\n\n\n\nThen there are the games that have decided to block Linux players, and Linux users who happen to own a Steam Deck. In 2024, Apex Legends blocked both, explaining that there was \u201cno reliable way\u201d to differentiate between a legitimate Steam Deck and a \u201cmalicious cheat\u201d claiming to be one.<\/p>\n\n\n\n
While this may look like a cat-and-mouse game between cheaters and anti-cheat developers, the reality is that each round of this fight moves the verification and control of the system deeper: from the game itself to the kernel, from the kernel to the boot chain, and from software to hardware. <\/p>\n\n\n\n
And at each step of the way, it is the honest user who pays the price.<\/p>\n\n\n\n
The case of Peter Stokes<\/u><\/a>, who was identified and caught by the FBI thanks to the unique identifier of his Windows installation, is not an isolated example of how this technology is used.<\/p>\n\n\n\nMicrosoft\u2019s Global Device Identifier is defined as \u201ca persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine.\u201d<\/p>\n\n\n\n
Stokes used a VPN, but the VPN only hid his IP address, it could not change the identity of the machine. Microsoft\u2019s records then tied the device to Stokes\u2019 accounts and his travels. Microsoft proactively went to the authorities with this information in October 2024, more than a year before Stokes was charged.<\/p>\n\n\n\n
That\u2019s a pretty strong case, and Stokes has a lot to answer for, if the accusations against him are true.<\/p>\n\n\n\n
Our reporting at the time noted that nothing about this is aimed only at criminals. The identifier is there on every Windows machine, and there is no settings toggle to switch it off. Reinstalling Windows will give you a new number, but if you log in to your Microsoft account, the company will know it is the same machine and will join the two identifiers.<\/p>\n\n\n\n
Apple machines have a hardware UUID<\/u><\/a> that survives a software reinstall because it describes the logic board.<\/p>\n\n\n\nIn 2025 we reported<\/u><\/a> that a senior US official, Michael Kratsios, confirmed talk of giving AI chips \u201cbetter location-tracking.\u201d<\/p>\n\n\n\nNvidia said it does not and will not put “backdoors” in its chips.<\/p>\n\n\n\n
However, features introduced for “specialized” hardware have a way of eventually trickling down to regular users.<\/p>\n\n\n\n
What the Stokes case shows is that the game ban is merely the most visible part of a much broader trend of machines identifying themselves, whether their owners wish it or not.<\/p>\n\n\n\n
Google has been trying for a long time to turn the web into a place where hardware ID can be used to decide who can access what content, and how \u2013 and this effort has been persistent, despite the giant abandoning one such initiative, Web Environment Integrity, in 2023<\/u><\/a>.<\/p>\n\n\n\nThat plan was to let websites check if a browser was running on approved hardware and software. This was met with criticism from the likes of Mozilla, Brave, and Vivaldi, while the EFF said at the time<\/u><\/a> that \u201cremote attestations have no place on open platforms.\u201d<\/p>\n\n\n\nThe plan didn\u2019t go away, it only changed its name to Fraud Defense<\/u><\/a> and instead of a standards process, Google simply went ahead and started rolling it out in May 2026. This reCAPTCHA successor uses the Play Integrity API and Google-certified hardware, and is already resulting in de-Googled phones being blocked from using parts of the web.<\/p>\n\n\n\nThose phones, running GrapheneOS, LineageOS, and CalyxOS, fail the Play Integrity check<\/u><\/a>, and that means their users are unable to access some apps, including those provided by governments, such as Australia\u2019s myGov and Brazil\u2019s gov.br. GrapheneOS reacted by saying that these apps are in reality enforcing Google\u2019s business interests, rather than improving security.<\/p>\n\n\n\nIn 2022, free software pioneer Richard Stallman warned about remote attestation already being used in Google’s Play Integrity API.<\/p>\n\n\n\n
What this means is that once hardware ID becomes the deciding factor in who can access what on the web \u2013 the question is no longer what you do or who you are \u2013 but rather, whether your machine is approved.<\/p>\n\n\n\n
A very strong argument can be made that the whole thing is illegal in the EU, specifically in Germany where the player lives.<\/p>\n\n\n\n
Device identifiers are personal data, as is clear from Recital 30 of the GDPR<\/u><\/a>, which states that “natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols” and that these identifiers “may be used to create profiles of the natural persons and identify them.”<\/p>\n\n\n\nThe CJEU has ruled in Breyer (2016)<\/u><\/a> that information can be personal data even if “it is not necessary that that information alone allows the data subject to be identified.”<\/p>\n\n\n\nThe ePrivacy Directive, meanwhile, in Recital 24<\/u><\/a>, states that “terminal equipment of users of electronic communications networks and any information stored on such equipment are part of the private sphere of the users.”<\/p>\n\n\n\nSo, the EU has defined a device as part of the private sphere, and its identifiers as personal data.<\/p>\n\n\n\n
According to the ePrivacy Directive, accessing and storing information on a device is only allowed if the user has given consent, unless this is \u201cstrictly necessary\u201d for a service the user has asked for.<\/p>\n\n\n\n
The European Data Protection Board (EDPB) guidelines from 2024<\/u><\/a> cover information stored by a hardware manufacturer, such as the MAC addresses of network interface controllers.<\/p>\n\n\n\n
<\/figure>\n\n\n\nBy Ken Macon<\/p>\n\n\n\n
Let\u2019s start with the German buyer who, on September 21, picked up a used AMD Ryzen 7 5800X3D processor<\/u><\/a> and tried to play Valorant on it. The game wouldn\u2019t start. It had run just fine on the old chip.<\/p>\n\n\n\n The buyer said that the game\u2019s developer, Riot Games, told them through its support that the processor had been blacklisted by its anti-cheat system, Vanguard, as of August 12 \u2013 more than a month before the purchase.<\/p>\n\n\n\n Riot\u2019s support allegedly said the ban was the result of the previous owner cheating, and that the ban would not be lifted. The motherboard and the drive were now flagged as well, the player was told.<\/p>\n\n\n\n Riot has not responded to a request for comment sent by PCWorld.<\/p>\n\n\n\n Riot\u2019s head of anti-cheat, Phillip Koskinas, responded on X<\/u><\/a> to the story, which was first posted on the German-language PCBaumeister subreddit on September 26 and then picked up by a user called CR1337.<\/p>\n\n\n\n Koskinas called the account \u201cpretty unlikely\u201d and said he could not find a support ticket matching the one described by the German player.<\/p>\n\n\n\n Koskinas said that a hardware ban lasts a maximum of four months, applies only to the game where the cheating happened, and that the support should have told the player how long the ban had left.<\/p>\n\n\n\n Koskinas also denied<\/u><\/a> that Vanguard blacklists other parts of a PC if it finds one that is banned.<\/p>\n\n\n\n Even if we take Koskinas\u2019 explanation as true, the fact remains that even according to him, an innocent buyer of a used processor is left unable to play the game until the ban on that chip expires \u2013 and there is no way for the buyer to know this before making the purchase.<\/p>\n\n\n\n When a company like Riot bans a game account, the punishment is directed at a person found to have violated the rules, and they are unable to play the game using that account.<\/p>\n\n\n\n When the company bans hardware, the punishment is directed at an object, and whoever holds the object at a given time is the one who is punished.<\/p>\n\n\n\n While it may seem like a good idea to buy second-hand in order to save money and reduce electronic waste, some gamers are learning the hard way that it can also mean buying a used component that is banned from playing a game, with no way to find out before making the purchase.<\/p>\n\n\n\n Riot Games’ own support page<\/u><\/a>, “Understanding Hardware ID (HWID) Bans,” calls a hardware ban “a drastic step.”<\/p>\n\n\n\n “When a computer has a hardware ID ban, it means that we’ve banned the physical components of that computer rather than just banning an account,” the page explains.<\/p>\n\n\n\n It continues that a ban is “effectively a statement that we don’t want that particular person to create, access, or use any account on a Riot platform or game for the duration of the ban.”<\/p>\n\n\n\n It’s not that particular person who is punished if they are not the one currently using the hardware. The page spells it out: if a friend or family member logs in on a banned computer, that account is restricted there and banned for a set period, “as the system assumes that the account is attempting to circumvent the original ban.”<\/p>\n\n\n\n Riot advises, “If you suspect a computer has an HWID ban, it’s best not to try to log in with any account.”<\/p>\n\n\n\n “Reinstalling a game or deleting the responsible account won’t remove an HWID ban.”<\/p>\n\n\n\n Activision, another game maker, puts it like this<\/u><\/a>: be careful buying a secondhand device, because you could end up with a banned product, and there is no appeal.<\/p>\n\n\n\n These are not new issues – back in 2007, a person who bought a refurbished Xbox 360 found it had arrived banned for life from Xbox Live. In 2009, banned consoles were resold on eBay. In 2025, some Switch 2 owners reported being banned<\/u><\/a> by Nintendo after using secondhand Switch 1 game cards that they had bought online.<\/p>\n\n\n\n So how exactly does a game know one processor from another of the same model? The chips themselves only report their model to the operating system, so the identity has to be dug out from somewhere the owner never looks, such as the Trusted Platform Module (TPM) inside the processor, or the way it handles clock and voltage (since each processor “behaves slightly differently and can thus be identified”) – or even the firmware serial number.<\/p>\n\n\n\n The only thing that is clear is that it is not the operating system that can identify a processor uniquely. “A Ryzen 7 5800X3D, for example, is not distinguishable from another Ryzen 7 5800X3D without further ado,” German tech site Heise said<\/u><\/a>. The site suggested that the TPM is a good candidate to carry a unique identifier, a “hardware ID,” that can be used by software.<\/p>\n\n\n\n Riot Games has not revealed exactly how its Vanguard anti-cheat software identifies a processor, but Heise said it would be “much easier to write identification hashes into the Trusted Platform Module. Because this TPM sits as a coprocessor directly in the CPU in most PCs, the hash remains when switching to a new PC.” In 2024 Riot said it was using Vanguard<\/u><\/a> to enforce TPM and Secure Boot, even on Windows 10, “to eliminate bootkits as a vector and to give ourselves a better form of hardware ID.”<\/p>\n\n\n\n On AMD machines, the TPM usually runs as firmware inside the processor itself, the fTPM. A 2023 paper by TU Berlin researchers<\/u><\/a>, who reverse-engineered the fTPM, found that its storage and integrity keys “are derived from a 128 bit secret unique to each CPU.” AMD itself warns on its support page<\/u><\/a> that when its fTPM fails attestation, “Gamers may be unable to compete in online cash tournaments.”<\/p>\n\n\n\n Microsoft says that the TPM’s Endorsement Key<\/u><\/a> (EK) is unique to every TPM and cannot be changed or removed. This key can identify the module.<\/p>\n\n\n\n In Windows 11, Microsoft says<\/u><\/a>, the TPM’s unique RSA key, which is “burned into the chip,” can be used for device authentication.<\/p>\n\n\n\n Some AMD and Intel processors also have a Protected Processor Identification Number (PPIN).<\/p>\n\n\n\n We have had this fight before. In 1999, Intel announced the Pentium III would carry a processor serial number, a unique ID readable by software. Privacy groups immediately launched a boycott, and the campaign against what they called Big Brother Inside<\/u><\/a> was on. In January 1999, Intel\u2019s Pat Gelsinger explained the purpose of the number at the RSA conference<\/u><\/a>, using an example that today seems almost quaint, given the way the same idea has evolved.<\/p>\n\n\n\n Gelsinger said the number would be needed to enter a chat room. \u201cYou think about this maybe as a chat room, where unless you\u2019re able to deliver the processor serial number, you\u2019re not able to enter that protected chat room,\u201d he said.<\/p>\n\n\n\n Junkbusters, EPIC, and Privacy International quickly realized that the number would be like a permanent cookie, but one that cannot be deleted or changed. The groups warned that it would enable a massive profile to be collected and sold, and called for a boycott of Intel products.<\/p>\n\n\n\n At the time, Congressman Edward Markey wrote to Intel CEO Craig Barrett, \u201cI hope that Intel will seek to design its products to improve the security of electronic commerce transactions without putting consumer privacy at risk.\u201d<\/p>\n\n\n\n In April 2000, Wired reported<\/u><\/a> that Intel was dropping the serial number from future chips, and quoted an Intel source as saying that the company had decided that the benefits were not worth \u201cthe bad rep it would give us.\u201d<\/p>\n\n\n\n That was not the end of it. In 2026, the example of a chat room that you could not enter without your chip’s number, given by Intel’s Pat Gelsinger in 1999, has turned into a game you cannot play because of the same issue.<\/p>\n\n\n\n What came after that was Trusted Computing \u2013 and we have to give it this: the Trusted Platform Module (TPM) does do real security work.<\/p>\n\n\n\n The idea of a unique chip ID has not gone away since then. In 2003, the Cambridge security researcher Ross Anderson explained<\/u><\/a> the purpose of the Trusted Platform Module (TPM) that was being introduced at the time: \u201cThe TCG specification will transfer the ultimate control of your PC from you to whoever wrote the software it happens to be running.\u201d<\/p>\n\n\n\n Anderson also noted that the idea was not new, and compared it to the way the Soviet Union used to control its citizens by registering and tracking their typewriters and fax machines. “TC similarly attempts to register and control all computers,” he wrote.<\/p>\n\n\n\n The same year, the EFF\u2019s Seth Schoen noted<\/u><\/a> at the time that remote attestation, a key feature of TPMs, treats the computer owner as an adversary, and proposed an \u201cOwner Override\u201d that would allow people to control what their machine reports to remote parties. Schoen conceded that this would prevent \u201ctrusted computing\u201d from being used for the purpose of stopping cheating in online games.<\/p>\n\n\n\n The industry came up with Direct Anonymous Attestation (DAA) in 2004, a way to prevent the linking of different transactions by the same TPM.<\/p>\n\n\n\n The authors of the DAA paper<\/u><\/a> – Brickell, Camenisch, and Chen – said that the goal was to ensure that a verifier “only learns that she uses a TPM but not which particular one,” and that without this, “all her transactions would become linkable to each other.”<\/p>\n\n\n\n One of the authors, Camenisch, would later say that DAA was introduced “to make privacy groups happy.”<\/p>\n\n\n\n In 2022, Richard Stallman updated his essay<\/u><\/a> “Can You Trust Your Computer?” to say that “the threat I warned about in 2002 has become terrifyingly real.”<\/p>\n\n\n\n The identity chip has now become mandatory hardware, included in almost every new PC, with Windows 11 requiring TPM 2.0 to even install.<\/p>\n\n\n\n If you think of your PC as your property (and you should, since you paid for it) then the price of entry of many popular online games these days is the kernel, the deepest level of your operating system.<\/p>\n\n\n\n You hand that over to a game company, and the code stays there even when you are not playing the game.<\/p>\n\n\n\n The kernel is where an operating system\u2019s most sensitive components live, and where a malicious actor can do the most damage.<\/p>\n\n\n\n In exchange, you get to play the game.<\/p>\n\n\n\n Companies whose games install kernel-level software say they do this to detect and prevent cheating.<\/p>\n\n\n\n EA, for one, has said it doesn\u2019t want deeper access to users\u2019 PCs than necessary, but that anti-cheat software requires it.<\/p>\n\n\n\n The problem is not so much the intent of the game company, it\u2019s the fact that once you give a third party the keys to the kingdom, you can never be sure what will happen next.<\/p>\n\n\n\n What about when this software is abused for other purposes? In 2022, Trend Micro found<\/u><\/a> that the Genshin Impact anti-cheat driver was used by ransomware to kill antivirus products installed on a system.<\/p>\n\n\n\n The driver, mhyprot2.sys, was found to be used by ransomware to uninstall and disable security software. Trend Micro said that the game did not have to be installed on a victim\u2019s PC in order for the attack to work.<\/p>\n\n\n\n Trend Micro noted that even when a fix is issued, \u201cthe module cannot be erased once distributed.\u201d<\/p>\n\n\n\n In 2013, the New Jersey Attorney General settled for $1 million with E-Sports Entertainment<\/u><\/a>, whose anti-cheat client was found to be mining Bitcoin on users\u2019 computers.<\/p>\n\n\n\n The state\u2019s Division of Law Director Christopher Porrino said at the time that subscribers to the service \u201cpaid for protection from cheaters \u2013 not to be cheated by the very services they\u2019d purchased.\u201d<\/p>\n\n\n\n In July 2024, a CrowdStrike update crashed an estimated 8.5 million Windows devices<\/u><\/a>.<\/p>\n\n\n\n That same year, Microsoft announced that it was moving security tools out of the kernel, and into user space, where the rest of the applications run.<\/p>\n\n\n\n The reason given was to improve overall system security. In 2025, Microsoft explained<\/u><\/a> that this means that \u201csecurity products like anti-virus and endpoint protection solutions can run in user mode just as apps do.\u201d<\/p>\n\n\n\n Riot itself has written that Microsoft is trying to move all third-party applications out of the kernel.<\/p>\n\n\n\n Yet gamers continue to allow this type of software to run on their PCs.<\/p>\n\n\n\n The fact remains that the kernel is no place for third-party software, and that includes anti-cheat tools.<\/p>\n\n\n\n In the world of PC gaming, the anti-cheat arms race is reaching for lower and lower levels of the software stack, all the way to the hardware. And each round of this race is making gaming more expensive and more difficult for honest users.<\/p>\n\n\n\n Riot Games, makers of League of Legends, and of Vanguard, the anti-cheat software that has been under some fire lately, are particularly proud of the latest iteration of their product. In May, they announced that they had managed to block DMA (direct memory access) cheat devices, that work by having one computer read the memory of another. The cost of these devices can be as high as $6,000.<\/p>\n\n\n\n Riot\u2019s statement at the time<\/u><\/a> was that owners of these devices had now been left with a \u201cbrand new $6k paperweight.\u201d<\/p>\n\n\n\n The update that blocked these cheats relies on a Windows 11 25H2 feature that monitors driver activity. And it only works with a number of other security features turned on: Secure Boot, TPM 2.0, VBS, HVCI, and IOMMU. Riot calls this checklist Pre-Check, and says that 34.33% of machines are fully compliant.<\/p>\n\n\n\n Other major game publishers have similar, if less stringent requirements: Activision\u2019s Ricochet anti-cheat uses Remote Attestation to check PC security settings directly with Microsoft. EA said that over 4.8 million players<\/u><\/a> enabled Secure Boot after the company made it a requirement, and the game Battlefield 6 requires TPM 2.0. FACEIT, a platform<\/u><\/a> for competitive multiplayer games, also requires TPM 2.0 and Secure Boot, and says that the former \u201crecords a unique fingerprint of every component in the boot chain.\u201d<\/p>\n\n\n\n Then there are the games that have decided to block Linux players, and Linux users who happen to own a Steam Deck. In 2024, Apex Legends blocked both, explaining that there was \u201cno reliable way\u201d to differentiate between a legitimate Steam Deck and a \u201cmalicious cheat\u201d claiming to be one.<\/p>\n\n\n\n While this may look like a cat-and-mouse game between cheaters and anti-cheat developers, the reality is that each round of this fight moves the verification and control of the system deeper: from the game itself to the kernel, from the kernel to the boot chain, and from software to hardware. <\/p>\n\n\n\n And at each step of the way, it is the honest user who pays the price.<\/p>\n\n\n\n The case of Peter Stokes<\/u><\/a>, who was identified and caught by the FBI thanks to the unique identifier of his Windows installation, is not an isolated example of how this technology is used.<\/p>\n\n\n\n Microsoft\u2019s Global Device Identifier is defined as \u201ca persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device, either a physical device (e.g., a mobile phone or laptop) or virtual machine.\u201d<\/p>\n\n\n\n Stokes used a VPN, but the VPN only hid his IP address, it could not change the identity of the machine. Microsoft\u2019s records then tied the device to Stokes\u2019 accounts and his travels. Microsoft proactively went to the authorities with this information in October 2024, more than a year before Stokes was charged.<\/p>\n\n\n\n That\u2019s a pretty strong case, and Stokes has a lot to answer for, if the accusations against him are true.<\/p>\n\n\n\n Our reporting at the time noted that nothing about this is aimed only at criminals. The identifier is there on every Windows machine, and there is no settings toggle to switch it off. Reinstalling Windows will give you a new number, but if you log in to your Microsoft account, the company will know it is the same machine and will join the two identifiers.<\/p>\n\n\n\n Apple machines have a hardware UUID<\/u><\/a> that survives a software reinstall because it describes the logic board.<\/p>\n\n\n\n In 2025 we reported<\/u><\/a> that a senior US official, Michael Kratsios, confirmed talk of giving AI chips \u201cbetter location-tracking.\u201d<\/p>\n\n\n\n Nvidia said it does not and will not put “backdoors” in its chips.<\/p>\n\n\n\n However, features introduced for “specialized” hardware have a way of eventually trickling down to regular users.<\/p>\n\n\n\n What the Stokes case shows is that the game ban is merely the most visible part of a much broader trend of machines identifying themselves, whether their owners wish it or not.<\/p>\n\n\n\n Google has been trying for a long time to turn the web into a place where hardware ID can be used to decide who can access what content, and how \u2013 and this effort has been persistent, despite the giant abandoning one such initiative, Web Environment Integrity, in 2023<\/u><\/a>.<\/p>\n\n\n\n That plan was to let websites check if a browser was running on approved hardware and software. This was met with criticism from the likes of Mozilla, Brave, and Vivaldi, while the EFF said at the time<\/u><\/a> that \u201cremote attestations have no place on open platforms.\u201d<\/p>\n\n\n\n The plan didn\u2019t go away, it only changed its name to Fraud Defense<\/u><\/a> and instead of a standards process, Google simply went ahead and started rolling it out in May 2026. This reCAPTCHA successor uses the Play Integrity API and Google-certified hardware, and is already resulting in de-Googled phones being blocked from using parts of the web.<\/p>\n\n\n\n Those phones, running GrapheneOS, LineageOS, and CalyxOS, fail the Play Integrity check<\/u><\/a>, and that means their users are unable to access some apps, including those provided by governments, such as Australia\u2019s myGov and Brazil\u2019s gov.br. GrapheneOS reacted by saying that these apps are in reality enforcing Google\u2019s business interests, rather than improving security.<\/p>\n\n\n\n In 2022, free software pioneer Richard Stallman warned about remote attestation already being used in Google’s Play Integrity API.<\/p>\n\n\n\n What this means is that once hardware ID becomes the deciding factor in who can access what on the web \u2013 the question is no longer what you do or who you are \u2013 but rather, whether your machine is approved.<\/p>\n\n\n\n A very strong argument can be made that the whole thing is illegal in the EU, specifically in Germany where the player lives.<\/p>\n\n\n\n Device identifiers are personal data, as is clear from Recital 30 of the GDPR<\/u><\/a>, which states that “natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols” and that these identifiers “may be used to create profiles of the natural persons and identify them.”<\/p>\n\n\n\n The CJEU has ruled in Breyer (2016)<\/u><\/a> that information can be personal data even if “it is not necessary that that information alone allows the data subject to be identified.”<\/p>\n\n\n\n The ePrivacy Directive, meanwhile, in Recital 24<\/u><\/a>, states that “terminal equipment of users of electronic communications networks and any information stored on such equipment are part of the private sphere of the users.”<\/p>\n\n\n\n So, the EU has defined a device as part of the private sphere, and its identifiers as personal data.<\/p>\n\n\n\n According to the ePrivacy Directive, accessing and storing information on a device is only allowed if the user has given consent, unless this is \u201cstrictly necessary\u201d for a service the user has asked for.<\/p>\n\n\n\n The European Data Protection Board (EDPB) guidelines from 2024<\/u><\/a> cover information stored by a hardware manufacturer, such as the MAC addresses of network interface controllers.<\/p>\n\n\n\n