What is Telemetry?
Windows OS monitors and debugs information about the user's running applications. This is called instrumentation. Gathering remote information that is collected by instrumentation is what is called Telemetry.
As the product is not opensource, one can legitimately think of the worse. But to keep the answer as objective as possible, I prefer to quote from Windows 10 feedback, diagnostics, and privacy: FAQ:
As you use Windows, we collect performance and usage information that
helps us identify and troubleshoot problems as well as improve our
products and services. We recommend that you select Full for this
Basic information is data that is vital to the operation of Windows. This data helps keep Windows and apps running properly by
letting Microsoft know the capabilities of your device, what is
installed, and whether Windows is operating correctly. This option
also turns on basic error reporting back to Microsoft. If you select
this option, we’ll be able to provide updates to Windows (through
Windows Update, including malicious software protection by the
Malicious Software Removal Tool), but some apps and features may not
work correctly or at all.
Enhanced data includes all Basic data plus data about how you use Windows, such as how frequently or how long you use certain features
or apps and which apps you use most often. This option also lets us
collect enhanced diagnostic information, such as the memory state of
your device when a system or app crash occurs, as well as measure
reliability of devices, the operating system, and apps. If you select
this option, we’ll be able to provide you with an enhanced and
personalized Windows experience.
Full data includes all Basic and Enhanced data, and also turns on advanced diagnostic features that collect additional data from your
device, such as system files or memory snapshots, which may
unintentionally include parts of a document you were working on when a
problem occurred. This information helps us further troubleshoot and
fix problems. If an error report contains personal data, we won’t use
that information to identify, contact, or target advertising to you.
This is the recommended option for the best Windows experience and the
most effective troubleshooting.
Note that only on Enterprise Edition one can turn that feature off totally. On Windows 10 Home and Professional, for instance, it can be set only it to Basic.
Is this information specific to the telemetry service or just general
information that Windows collects? I've had problems in tying up
what's telemetry (which was back-ported to win8/7) and what's general
data passed back to MS.
Telemetry is a main part of Diagnostics Tracking Service available in Windows 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1, Windows Server 2012 R2 Datacenter,
Windows Server 2012 R2 Essentials,
Windows Server 2012 R2 Foundation,
Windows Server 2012 R2 Standard and Windows 10. The quoted paragraphs concern the Diagnostics Tracking Service mechanism in which other modules, apart from Telemetry, are included.
Diagnostics Tracking Service consists mainly in these files:
As you can see Telemetry is a JSON file that is used to describe the data sent back and forth between Windows machine (client) and server.
If you are curious about the details, you can see its content when you downloand the appropriate patch you want. When you extract the content of MSU file (instructions here) and retrieve the CAB files, you will find a folder which name looks something like this:
amd64_microsoft-windows-u..ed-telemetry-client followed by several numbers. Check the content of that folder and open the Telemetry file in JSON format to have a technical insight about its details, mainly description of the data echanged between your machine and Microsoft server(s).
Telemetry is also seen as a part of Microsoft Customer Experience Improvement Program as
it is impossible for us to contact most of our customers in person to
get their feedback. The Customer Experience Improvement Program (CEIP)
was created to give all Microsoft customers the ability to contribute
to the design and development of Microsoft products.
If you check Privacy Statement for the Microsoft® Customer Experience Improvement Program you can read:
When you participate, we collect basic information about how you use
your programs, your computer or device, and connected devices. We also
collect information about how each is set up and performing. These
reports are sent to Microsoft to help improve the features our
customers use most often and to create solutions to common problems.
Which statement is in contradiction with the first text we quoted as the user has no ability to turn off totally Telemetry.
As for the exact data being exchanged through Telemetry, apart from the quoted text and the efforts you may make to read that JSON file (and may be survey your machine's communication?), I can not say more. But it is really very interesting to know that precisely (if it is possible).
Additional information I found ( I still refer to official documentation only to stay objective):
From Instrumentation and Telemetry Guidance, we can read that the information generally include:
- Details of operational events that occur as part of the normal operation of the application, together with useful information about that event. For example, in an ecommerce site it would be useful to record the order number and value of each order that is placed. These are typically informational events that are used to collect data about the way the application is used.
- Details of runtime events that occur, and useful information about that event such as the location or data store used and the response time for access to the data store. These are also informational events that can provide additional insight into the normal operation of the application. The event should not include any sensitive information such as credentials, or any other data that might enable an attacker obtaining the logs to compromise the system.
- Specific data about errors that occur at runtime, such as the customer ID and other values associated with an order update operation that failed. Typically these are warning or error events and will contain one or more system-generated error messages.
- Data from performance counters that measure specific values related to the operation of the application. These might be built-in system counters, such as those that measure processor load and network usage, or they might be custom performance counters that measure the number of orders placed or the average response time of a specific component.
(Further reading: Telemetry – Application Instrumentation, Windows Azure: Telemetry Basics and Troubleshooting)
From Share telemetry data with Mozilla to help improve Firefox, we can read that it collects for example:
- memory consumption
- responsiveness timing
- feature usage
- memory configuration
- hardware configuration
Note that whatever a user does, it seems it is impossible to know what Windows collects and sends permanently. Windows does not stop sending undefined information on his/her behalf as this study shows: Even when told not to, Windows 10 just can’t stop talking to Microsoft. But still what the official documentation describes is not very good for the user such as when Windows takes system files or memory snapshots, which may unintentionally include parts of a document you were working on when a problem occurred.