How desktop apps watch you: A network analysis of popular Windows software

Most users assume that online tracking happens in the browser. We install extensions to block ads on websites, and we consider ourselves protected. But the browser is only a small part of your digital life.

Desktop applications — music players, messengers, game launchers, and PDF readers — also connect to the Internet constantly. And just like websites, many of them send data about your actions. The difference is that you cannot see this traffic without filtering your entire system.

This is why system-wide filtering is enabled by default in AdGuard for Windows v8.0. It provides the only reliable way to protect your privacy across all applications without breaking their functionality.

To see the actual scope of tracking happening on PC and how just browser protection is not enough, we conducted research.

A note on methodology
This was a single run on one machine with one user. The duration and usage scenarios varied slightly between apps, so we cannot directly compare one app to another. We also anonymized the names of the companies to keep the focus on the technical patterns rather than specific brands. The goal was to identify how tracking works in desktop environments, not to create a ranking.*

What we found

Across 18 applications, our testing revealed 1,965 unique server endpoints generating 4,945 individual web requests.

AdGuard intercepted and cleaned requests to 1,780 of these endpoints, removing invasive headers rather than blocking the connections completely. Additionally, AdGuard identified and blocked 404 distinct calls dedicated specifically to tracking and advertising.

While functional requests make up a substantial part of the total traffic volume, the fact that we had to clean almost 90% of the endpoints shows that tracking is ubiquitous. Small telemetry payloads fire rapidly in the background, building a detailed profile of your behavior over time.

What desktop tracking looks like in practice

Abstract statistics can feel distant. In practice, desktop applications translate your everyday actions into detailed network requests. An online game store tracks cursor movement and your account ID when you hover over a game card. A gaming console app sends your gamertag and device ID every 29 seconds, while a short-video platform uploads your screen time and a device fingerprint every minute.

Even a standard PDF reader logs button clicks, sending a separate request when you cancel a sign-in. A music streaming service uploads playback events every four seconds, including the exact track position, laptop model, and audio output details. A video platform sends your viewer profile in plaintext, including membership status and region.

You might think: “So what if an app logs a button click or my laptop model?”

Individually, these data points seem harmless. But together, they build a detailed profile of your behavior. Companies use this profile to track you across apps, adjust prices based on your device, and target you with ads. It also means your history is permanently tied to your identity and is at risk if the vendor’s servers are ever compromised.

The same receivers everywhere

We expected different companies to use different tracking tools. Instead, we found the same receivers appearing across unrelated applications.

A single Microsoft client ID appeared in four completely different apps: a messenger, a gaming console app, a music player, and a torrent client. This happens because many desktop apps are built using a web-view technology that includes browser telemetry by default.

We also found standard web analytics tools like Google Analytics and Google Tag Manager running inside desktop processes, not just in browsers.

Most importantly, the majority of tracking traffic did not go to third parties. It went directly to the servers of the app developer. This is not necessarily worse than third-party tracking, but it makes it harder to block. You cannot simply cut off the developer without losing access to the app itself.

Silent background chatter

One of the most surprising findings was the frequency of background activity. Desktop apps do not wait for you to click buttons to start sending data.

Over 40% of the apps we tested send telemetry on automated timers without any user interaction. You can open an application, step away from your desk, and return to find dozens of outbound pings logged while your PC sat completely idle.

These background pings range from high-frequency performance logs uploaded every single second to periodic system state reports sent on fixed background timers.

Why blocking domains is not enough

If tracking is this prevalent, the obvious question is: why not just block the domains that serve tracking purposes?

The problem is that desktop tracking rarely lives on separate “bad” domains. Instead, it usually resides on the same servers that power the app itself. In our tests, 46% of the applications sent tracking data from the exact same hosts used for core functionality.

Imagine a music streaming service. It might use a single server domain to handle your account login, the music stream, and the telemetry data. If you block that domain to stop the tracking, you also stop the music.

This is why simple domain blocking fails. To stop this tracking without breaking your apps, we need a more precise tool that can distinguish between a functional request and a tracking request on the same server.

Our solution: system-wide filtering with HTTPS inspection

AdGuard for Windows solves this using path-level filtering.
Standard network filters can only see the destination server, but modern apps encrypt the rest of the connection. By decrypting traffic locally on your device, we can inspect the full URL path and request headers. This visibility allows us to clean invasive data and block specific tracking paths while letting functional requests pass through.

Domain blocking disables entire servers. Path-level HTTPS filtering inspects individual URLs to remove telemetry while keeping core app features running

We balance protection and stability with a smart system. We enable full HTTPS filtering for trusted apps like browsers. We exclude sensitive apps, such as banking apps, to keep your data secure. For other apps, we filter basic traffic but leave HTTPS filtering off. You can turn it on manually in App management if you want deeper protection. This lets you stop hidden tracking without breaking your apps.

Why it’s safe
All processing happens on your computer. AdGuard does not see your passwords, messages, or browsing history. We do not send your traffic to our servers. We only compare the URL against the blocklist to decide whether to let it through. The process is fast, designed not to impact your CPU or internet speed.

Comparison of tracking protection methods

Conclusion

Desktop applications are no longer isolated from the web. They rely on complex networks of servers to function. These networks often carry hidden tracking data along with your work files. Traditional tools struggle to stop this tracking because they cannot see inside the encrypted connections of desktop apps.

AdGuard for Windows provides a better solution. By using path-level filtering, we can clean specific tracking requests while keeping your apps fully functional. This means your privacy stays in your hands without breaking the software you depend on.

Want to see it yourself?

Download AdGuard for Windows v8.0 and open the Filtering log. You can watch us block tracking requests from your desktop apps in real time.