Reading the registry behind the privacy toggles

The reason I trust this tool more than the average "one-click optimizer" is that it shows its work. Every privacy switch exposes the exact key, value name, type and options it writes. That turns the app from something you believe into something you can check.

Here is what I found when I followed the main privacy switches down to the registry, and how I verify afterwards without opening Regedit.

The map, in one table

These are the values I care about most, as shown in the app's own technical details panels:

Absence is a value

The single most useful thing the technical details panel taught me is that many of these values default to absent, and absence means enabled. SubscribedContentEnabled, Start_TrackProgs, PreInstalledAppsEverEnabled — if the value is not there, Windows behaves as though it were set to 1.

This matters when you audit. "The key is not present" is not a pass. You want the value explicitly written to 0. It also explains why some tools appear to work and then nothing changes: deleting a key is not the same as disabling a feature.

ContentDeliveryManager, the busiest key on the machine

If you only ever look at one registry location, make it this one. Under HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager you will find the switches behind suggested apps, lock screen overlays, Settings app promos, timeline suggestions, and the numbered SubscribedContent-######Enabled values that map to individual surfaces.

The numbered ones are the fun part. 338393, 353694 and 353696 are the Settings app suggestion slots; 353698 is Timeline suggestions on Windows 10. There is no documentation that makes those numbers meaningful — you learn them by watching which one changes when a suggestion disappears.

AllowTelemetry and what it really does

AllowTelemetry takes 0 (Security/Off), 1 (Basic/Required), or 3 (Full/Optional). On Home and Pro, 0 is not honoured the way it is on Enterprise and Education — the effective floor is Basic. Any tool claiming to give you zero telemetry on Home is overselling.

What you can honestly do is: set the policy to the minimum your edition respects, disable optional diagnostic data, turn off tailored experiences that use it, and stop feedback prompts. Winhance writes all four, across both hives. That is the real, boring, achievable outcome.

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\DataCollection" /v AllowTelemetry
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Privacy" /v TailoredExperiencesWithDiagnosticDataEnabled
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo" /v Enabled

App permissions live in ConsentStore

Camera, microphone, location, account info and app diagnostics are governed by string values — Allow or Deny — under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\. Note the type: these are strings, not DWORDs, which is a classic reason hand-written .reg files silently fail.

Location has a second layer, a policy value DisableLocation under LocationAndSensors in both hives. Set the ConsentStore value without the policy and a determined app can still get a fix through other paths.

My audit script

After a session I run a short PowerShell loop that reads back the values I expect and prints anything that does not match. It takes ten seconds and has caught two cases where a feature update quietly reset a policy:

$checks = @(
  @{P='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection'; N='AllowTelemetry';  E=1},
  @{P='HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo'; N='Enabled'; E=0},
  @{P='HKCU:\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager'; N='SilentInstalledAppsEnabled'; E=0}
)
foreach ($c in $checks) {
  $v = (Get-ItemProperty -Path $c.P -Name $c.N -ErrorAction SilentlyContinue).($c.N)
  if ($v -ne $c.E) { "DRIFT: $($c.N) = $v (expected $($c.E))" }
}

Adapt the expected values to your own choices. The point is not my list — it is having a list at all, so that "I set this up months ago" becomes a checkable claim.

What this does not do

None of this makes a Windows machine private in any meaningful adversarial sense. Your ISP, your browser, the apps you sign into and the operating system's own update channel all still know plenty. What these changes do is reduce the ambient, opt-out-by-default collection that most people never consented to in a way they would recognize.

Treat it as tidying, not as armour. Tidying is still worth doing.

Written by Joseph Savastano. Measurements come from my own machines and are not a promise about yours. Corrections are welcome and get published — send one.