First of all, no shit.

Second of all, this is obviously not theoretical…

Microsoft can associate the GDID with third-party services and the timing as well, giving Redmond a way to theoretically track a user’s online activity.

This shouldn’t come as a surprise, Microsoft can track everything you do on there platform.