NVIDIA Telemetry Spooks Privacy-sensitive Users, How to Disable it

[btarunr]

Over the past few versions of NVIDIA GeForce drivers, the company has been bundling a telemetry tool that is enabled by default, auto-runs on Windows startup by default, and doesn't appear in the list of things you can choose not to install, when doing a custom-installation with NVIDIA GeForce driver installers. Very little is known about this new Telemetry component. For all we know, it could be a means for NVIDIA to collect crash-reports that help it improve its drivers down the line. Not everyone is convinced with this explanation.

Spanning across three separate startup tasks (a bit much for a crash reporter?), Telemetry is allegedly a means for NVIDIA to send data "back and forth." Users that are the privacy equivalent of germ-freaks might see this as a means for NVIDIA to spy on its users, for a plethora of data, such as usage patterns, etc. MajorGeeks posted a brief tutorial on how to disable Telemetry (and other bloatware included in NVIDIA drivers), using Sysinternals, but you can use Task Manager, msconfig, or Registry Editor to disable these as well.



View at TechPowerUp Main Site

 

[SimpleTECH]

This only applies if you installed GeForce Experience. If you're like me, select custom → uncheck everything but PhysX (if you use games that have that), select 'Perform a clean installation' → restart if needed.

 

[R-T-B]

This only applies if you installed GeForce Experience. If you're like me, select custom → uncheck everything but PhysX (if you use games that have that), select 'Perform a clean installation' → restart if needed.

Not true. I was the one who originally posted this and have since confirmed it false with a fresh install of 375.70.

I want to see a wireshark of this shit (and not just false reddit claims of one)... though it's likely encrypted.

 

[RejZoR]

It has to be encrypted, otherwise someone needs to slap NVIDIA on their face.

 

[R-T-B]

It has to be encrypted, otherwise someone needs to slap NVIDIA on their face.

I agree but I've seen dumber things happen in telemetry.

Like OnePlus sending your IMEI/MEID with ever update request clearwire...

 

[MaMoo]

This only applies if you installed GeForce Experience. If you're like me, select custom → uncheck everything but PhysX (if you use games that have that), select 'Perform a clean installation' → restart if needed.

Nope, it is by default integrated into driver bundles now, without GFE.

There was this log from reddit (summary and link below, click on "here"), although it originated from a magazine (about 4+ months ago, telemetry may have changed since then):



Disclaimer: CanardPC Hardware is a printed magazine thus I do not have any link to an online article for now. They have already published online some popular articles in the past but it is still very uncommon and, if it happens for this one, it will be in French. I will add a scan of the article if they authorize me to do so (usually they don't mind if it is on a non-French website).


Anyway here is the best summary I could make in English:


When installing the latest driver (368.25), the process immediately send the current driver version and the PCI ID of your graphic card at gfswl.geforce.com using HTTP without encryption.


After transmitting some miscellaneous information like ID and size of your monitor to Adobe and a Google Analytics' tracker Nvidia will send information regarding your hardware such as CPU and SSD model reference to telemetry.nvidia.com.


Now if you agree to install GeForce Experience, which is the default option, a detailed description of your hardware is sent a few minutes later to gfe.nvidia.com/getsugar. This description includes: brand and model of your motherboard, serial number, BIOS version, information regarding USB drives currently plugged, RAM capacity, GPU frequency, etc.


But wait, there is more! GeForce Experience will communicate the software you use (not only games), when you use it, for how long and, if it is a game, a framerate history, current settings and various statistical data.


It will also record where you click on the various utilities provided and how long you stay on each page. Almost 100Ko of information, along with Google trackers, are sent to Nvidia.


A decrypted log intercepted from our test setup is available here.


This is clearly a breach of your privacy. Nvidia's privacy policy does not mention these activities in the French version, only in the English one.


Regarding AMD (Crimson 16.5.3), some basic information are sent during driver installation, just like Nvidia, but we detected nothing more afterwards even when launching various applications or games.


This short article is part of a 15-pages dossier regarding privacy. There is one page on Steam, Origin, Battle.Net and GoG if anyone is interested (spoiler: besides GoG they use a lot of third-party cookies/trackers).


Now regarding the magazine's reputation, they are not anti-Nvidia or pro-AMD. In the same issue of the magazine they blame various websites and AMD for what happened at Computex 2016 and their lack of ethics (here is one of their many tweets regarding this event). They have also advised their readers to chose Nvidia's graphic cards over AMD's in the mid/high-end segment for a while now.

 

[Forza.Milan]

This only applies if you installed GeForce Experience. If you're like me, select custom → uncheck everything but PhysX (if you use games that have that), select 'Perform a clean installation' → restart if needed.

When i do clean install with version 375.70, i uncheck everything including HD Sound, i only selecting Graphics drivers and physx , but still i found it.

then i followed instruction in wccftech to get rid all...

 

[jihadjoe]

This only applies if you installed GeForce Experience. If you're like me, select custom → uncheck everything but PhysX (if you use games that have that), select 'Perform a clean installation' → restart if needed.

Can confirm this. Updated to 375.70 today then went to Sysinternals Autoruns to look for the telemetry stuff. Most of those keys mentioned in the article aren't even present on my system and the only thing I unchecked on the installer was GFE.

 

[Countryside]

Before this spins off to a privacy and die hard fanboy battle it will be smart to keep in mind that if this Telemetry will be used for improvement of driver quality meaning quicker problem solving thats good
but that does not mean you can't collect a little bit of metadata on the side and lets be honest show me a company who does not to that today.

 

[xkm1948]

So now nVidia will also see my porn site collection, as well as visiting frequency? Just like the NSA?

Oh wait, I don't have a geforce card! whew~

 

[RejZoR]

It's all about transparency. Telling users exactly what you collect and how data is transmitted and shared should be #1 priority.

If I know what exactly they collect and how they send and who they share it with, I'm ok with that. There is just one BUT here. It has to have an option to turn it off EASILY. Meaning you can opt out of this. It shouldn't be like "Accept our EULA or stop using our graphic card/latest drivers". They can't enforce such terms on you AFTER you already have a 800€ graphic card for example which was bought under the old terms. Same goes for drivers. They can't force you in such submission after such expensive purchase and be on outdated drivers just because you disagree with their methods.

They have to add the switch for this in NV Contro Panel. Every serious program that shares data/telemetry has this.

avast! Antivirus for example goes even further in this regard. They have two options (checkboxes), one is to share info with AVAST Software and second checkbox to opt out of 3rd party sharing. So you can still share data with parent company, but you don't allow them to share it further. That's the level of transparency every company should have. Yes, including NVIDIA.

If all they send is driver version and device ID, that's not really that problematic. That's actual telemtry.

 

[evernessince]

Before this spins off to a privacy and die hard fanboy battle it will be smart to keep in mind that if this Telemetry will be used for improvement of driver quality meaning quicker problem solving thats good
but that does not mean you can't collect a little bit of metadata on the side and lets be honest show me a company who does not to that today.

Because that's worked so well for windows 10.... oh wait, windows 10 updates have more issues than windows 7.

 

[RejZoR]

Because that's worked so well for windows 10.... oh wait, windows 10 updates have more issues than windows 7.

That's not true. It's amusing how quickly people forget about all the retarded updating issues when it comes to Windows 7. Wanna check several pages long thread in General Software about just one issue with Win7 updater? Or how shit just kept breaking non stop for really dumb reasons or no reasons at all? I do remember them...

 

[Countryside]

Because that's worked so well for windows 10.... oh wait, windows 10 updates have more issues than windows 7.

Yeah Windows 10 is a happy collector but that last part is a big No no

 

[Naito]

Now they can link this telemetry data to your brand spanking new Geforce Experience account... DoB and all...

 

[cyneater]

Sounds like it would be perfect if yout a windows 10 user

 

[R-T-B]

Can confirm this. Updated to 375.70 today then went to Sysinternals Autoruns to look for the telemetry stuff. Most of those keys mentioned in the article aren't even present on my system and the only thing I unchecked on the installer was GFE.

Windows 7 I'm guessing?

I think it's only the 10-installer that does it.

EDIT: Yep, a quick test confirms that.

 

[RejZoR]

There is no point in gathering data on obsolete OS... Only reason I can think of is to see how many users even still use it, to know if it's worth bothering with Win7 drivers. If number of users is so tiny, they can basically drop updates for it...

 

[Chaitanya]

As expected Nvidia upto no good.

 

[bug]

Because that's worked so well for windows 10.... oh wait, windows 10 updates have more issues than windows 7.

It did, actually. The feature was released together with Vista and Windows has become a much better OS because of this. If nothing else, it showed that most of Windows crashes were because of device drivers and allowed Microsoft to better guard against those.

 

[P4-630]

I think it's only the 10-installer that does it.

I also had GFE installed and disabled this shit saturday, I'm on windows 8.1.

 

[TheDeeGee]

So many paranoid people.

You're being followed your entire life.

 

[bug]

So many paranoid people.

You're being followed your entire life.

Fwiw, I'm not paranoid and I think telemetry data is good for the consumer in the end (I always let browsers, IDEs and such send telemetry data). But there's no excuse for not making it opt-in and informing users properly about what's going on.

 

[MaMoo]

Fwiw, I'm not paranoid and I think telemetry data is good for the consumer in the end (I always let browsers, IDEs and such send telemetry data). But there's no excuse for not making it opt-in and informing users properly about what's going on.

I fully agree. It should be an optional, not the default option in a DRIVER install. Additionally, the privacy agreement is very vague and allows Nvidia to "share" all your data that it gathered with "business partners, resellers, affiliates, service providers, consulting partners and others." This data can include very sensitive information: "such as name, address, e-mail address, telephone number and non-traditional identifiers such as unique device identifiers and Internet Protocol (IP) addresses...."

 

[qubit]

This is likely benign, but whenever a company starts monitoring without telling you about it up front and without giving you an option to disable it, it's right to be a little suspicious about their motives.

Ultimately, I don't see this as sinister, but is a bit intrusive. After all every product maker wants to know as much as possible about how their products are being used and about the customers using it, their habits etc so this is a good way to go about getting that info. It puts that registration requirement for GFE into context now, doesn't it? It's all about identifying YOU.

While I'd prefer it if they didn't do this, I won't be stripping it out and engaging in an endless game of cat and mouse whenever I install the latest driver. I have more important things to worry about.

Also, if anyone is thinking of going AMD over this, don't worry they'll start doing this soon as well.