The Settings → Privacy & security pane is a policy editor; here's the direct translation you'd check from a script:
General → Advertising ID
HKCU\…\AdvertisingInfo:Enabled
General → Tailored offers
HKCU\…\Privacy:TailoredExperiencesWithDiagnosticDataEnabled
General → show suggested content
HKCU\…\ContentDeliveryManager:ContentExplore(other variants available per build)
Diagnostics & feedback → optional data
GPO-relayed; not per-user tunable in supportable ways
Activity history
Timeline and upload settings under account sync; per user
What users get wrong
- “Opt-offs reset at updates”: per-user values persist across feature updates (known-breaking exceptions get doc'd). What's perceived as resets is often new toggles appearing with defaults after upgrades.
- “Local StopAll” style scripts catch what the dashboard toggles — no: dashboard toggles land into own restorable values; broad script nets disable infra they don't inventory. Evaluate with the scope model.
Documented per-value, per-user path with proper restore semantics is the same discipline ProofTune applies — your own verification script becomes the audit instrument of the tool's iterate-audit loop.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.