Microsoft Paint Is Quietly Tagging Everything You Make

A meticulous reverse-engineering post by a researcher known as xusheng has revealed that Microsoft Paint and the Windows Photos app silently embed invisible watermarks in image output — including files created entirely offline — tagged with a Globally Unique Identifier, or GUID, that functions as a machine fingerprint. The disclosure, which accumulated 738 points and 345 comments on Hacker News, has alarmed privacy advocates and security researchers because the watermark persists regardless of network state: even images generated without any cloud connection carry the persistent identifier.

Independent commenters in the Hacker News thread rapidly confirmed the behavior. The GUID appears tied to either a device identifier or a Microsoft account depending on system configuration, and Microsoft has not issued a public statement explaining the practice. The closest historical analogue is printer steganography — the yellow microdots laser printers embed to encode serial numbers and timestamps — a technique that gained public notoriety when it helped trace the source of a leaked NSA document in 2017. The Paint discovery is the software equivalent, applied to the output of a consumer application most users consider innocuous.

The leading theory among technical commenters is that the watermarking reflects Microsoft's implementation of the Coalition for Content Provenance and Authenticity standard, known as C2PA, an industry framework backed by Adobe, Google, and Microsoft that is designed to help identify AI-generated content and combat deepfakes. The intent is ostensibly transparency — but commenters noted a sharp irony: a tool meant to build trust in digital content is itself built on an undisclosed data collection practice. 'The question isn't whether watermarking is good or bad in the abstract,' one commenter wrote, 'it's whether users have the right to know they're being watermarked and to opt out.' No documented opt-out mechanism currently exists.

Apple's separate announcement that iCloud Plus Hide My Email addresses will persist and remain functional through the icloud.com web interface drew a markedly different community reaction — largely positive — and the contrast was not lost on observers. Apple explicitly communicated the preservation of a privacy feature; Microsoft appears to have implemented a surveillance-adjacent feature without telling anyone. If Microsoft maintains a lookup table linking GUIDs to accounts or devices — which it almost certainly does for support and licensing — any image created in Paint becomes attributable to a specific user, potentially indefinitely.