Privacy Statement

Legal Rights & Agreement Rules · Context

Which Microsoft products and interactions this statement covers

This statement covers the interactions Microsoft has with you and the Microsoft products it lists, plus other Microsoft products that display the statement. "Products" is defined broadly to include services, websites, apps, software, servers and devices, across consumer, school, enterprise and developer uses. The page is marked as last updated in September 2026. The statement says the product-specific sections add relevant information, so a general rule here should be read together with the section for the product you use.

Supporting quotations

Last Updated: September 2026

References to Microsoft products in this statement include Microsoft services, websites, apps, software, servers, and devices.

This statement applies to the interactions Microsoft has with you and the Microsoft products listed below, as well as other Microsoft products that display this statement.

This privacy statement explains the personal data we process, how we process it, and for what purposes.

Qualifications & exceptions

• Applies to the products it lists and to other Microsoft products that display this statement.
• Product-specific sections give additional details; they are not replaced by this opening summary.

Not stated here

• The opening text does not say which product-specific sections would change a general rule for a given product.

Data Access & Collection · Company practice

Most Microsoft sites use cookies for settings, sign-in, ads and analytics

Microsoft says most of its sites place cookies, small text files that the site can read back later. It uses them to store your preferences and settings, help with sign-in, provide personalized ads and analyze how the sites operate. This opening paragraph only summarizes; the statement points to its Cookies and similar technologies section for the full explanation.

Supporting quotations

Most Microsoft sites use cookies

We use cookies to store your preferences and settings, help with sign-in, provide personalized ads, and analyze site operations.

Qualifications & exceptions

• The paragraph says "most" Microsoft sites, not all.
• Full detail is in the Cookies and similar technologies section.

Legal Rights & Agreement Rules · Company commitment

Microsoft says it complies with the EU-U.S., UK and Swiss-U.S. data privacy frameworks

Microsoft states that it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, and directs readers to the Storage and processing of personal data section and the U.S. Department of Commerce framework website to learn more. The opening paragraph does not say which data or which Microsoft entities the frameworks cover; that detail is in the later section.

Supporting quotations

Microsoft complies with the EU-U.S., UK Extension to the EU-U.S., and Swiss-U.S. Data Privacy Frameworks.

Qualifications & exceptions

• Details of the commitment are in the Storage and processing of personal data section.

Not stated here

• This paragraph does not say which Microsoft entities or which categories of data the frameworks cover.

Legal Rights & Agreement Rules · Procedure

How to reach the Microsoft privacy team or Data Protection Officer

To raise a privacy concern, complaint or question with the Microsoft privacy team or its Data Protection Officer, the statement tells you to use the privacy support and requests page and choose the option to contact the privacy team or Data Protection Officer. For more about contacting Microsoft, including Microsoft Ireland Operations Limited, it points to the How to contact us section.

Supporting quotations

If you have a privacy concern, complaint, or question for the Microsoft privacy team or Data Protection Officer

click on “Contact the Microsoft privacy team or the Microsoft Data Protection Officer” menu

Qualifications & exceptions

• The route given here is a web page and menu option, not an address or a deadline.

Not stated here

• The paragraph states no response time.

Legal Rights & Agreement Rules · Context

U.S. individuals are pointed to a state privacy notice and a consumer health data policy

For people in the United States, the statement refers you to two separate documents for additional information about your rights and how your personal data is processed: the U.S. State Data Privacy Notice (which includes notice-at-collection details) and the Consumer Health Data Privacy Policy. Those two documents are linked, not supplied in this saved statement, so their contents are not analyzed here.

Supporting quotations

For individuals in the United States, please refer to our

for additional information about your rights and the processing of your personal data

Qualifications & exceptions

• Applies to individuals in the United States.

Not stated here

• The U.S. State Data Privacy Notice and the Consumer Health Data Privacy Policy are linked but not part of the supplied text, so the rights and limits they set are unknown here.

Legal Rights & Agreement Rules · Context

Children and organization-provided products are handled in separate sections

The opening text tells readers that details about personal data collected from children are in the Collection of data from children section, with a separate page for young people. For businesses, schools and other organizations that use Microsoft products, it points to the Enterprise and developer products section. If your product or Microsoft account is provided by your organization, it points to the Products provided by your organization and Microsoft account sections. Those rules are not set out in this opening text.

Supporting quotations

You can find details about personal data collected from children in the

Please see the Enterprise and developer products section of this privacy statement for more information about how we process data from organizations that use our products and services, like businesses and schools.

If you use a Microsoft product or a Microsoft account provided by your organization

Qualifications & exceptions

• These are pointers; the operative rules are in the named sections.

Data Access & Collection · Company practice

Microsoft collects data you give, data from your use, and data from affiliates and third parties

Microsoft collects data from you through your interactions with it and your use of its products. Some of this you provide directly; other data it gathers from how you interact with and use the products. It also obtains data about users from Microsoft affiliates, subsidiaries and third parties. How much and what kinds of data it collects depends on the context of your interactions, the choices you make (including privacy settings), and the products and features you use, as well as applicable law. The stated purpose is to operate, improve and provide the products.

Supporting quotations

Microsoft collects data from users, through your interactions with us and your use of our products.

We also obtain data about users from Microsoft affiliates, subsidiaries, and third parties.

We collect data in order to operate, improve, and provide you with the best possible experiences.

The types and amount of data we collect depend on how you interact with Microsoft, your choices, privacy settings, and the features you use, as well as applicable law.

Qualifications & exceptions

• The amount and type of data depends on context, your choices, privacy settings, features used and applicable law.

Not stated here

• The overview does not list which third parties supply data; the following section lists source types.

Data Access & Collection · User right or choice

You can decline to provide data, but required data is needed to use a product or feature

When Microsoft asks for personal data you can decline, and you can use in-product controls, including those in your browser or operating system, to limit or prevent certain types of collection. The trade-off is stated plainly: many products need some personal data to provide a service, so if you do not provide or allow collection of required data you cannot use the related product or feature. If Microsoft needs data by law, or to enter into or carry out a contract with you, and you do not provide it, it will not be able to enter into or carry out the contract. If the data is optional and you do not share it, features such as personalization that rely on it will not work for you.

Supporting quotations

When we ask you to provide personal data, you can decline.

You can also use in-product controls, including those in your web browser or operating system to limit or prevent certain types of data collection.

If you choose not to provide or allow us to collect required data, you cannot use the related product or feature.

where we need to collect personal data by law or to enter into or carry out a contract with you, and you do not provide the data, we will not be able to enter into or carry out the contract

features like personalization that use such data will not work for you

Qualifications & exceptions

• The choice is limited to "certain types" of collection, not all collection.
• Declining required data means losing access to the related product or feature, or the contract.
• Optional data you withhold mainly affects features like personalization.

Data Access & Collection · Company practice

Contact, sign-in, demographic, payment and subscription data are collected

The statement lists several kinds of data about you and your account that Microsoft can collect: your name and contact details (name, email, mailing address, phone), account credentials (username, password and password hints), demographic data (age, gender, country, language preference), payment data (including credit card numbers and security codes) and subscription and licensing data. The list says these are things data collection "can include", so it is a list of possible categories rather than a promise that every product collects all of them.

Supporting quotations

The data we collect can include the following:

Your first and last name, email address, mailing address, phone number, and other similar contact details.

Information used to access your account, such as username, password, and password hints.

Details about you like your age, gender, country, and language preference.

Details needed to process payments, including credit card numbers and security codes.

Details about your product subscriptions, licenses, and other entitlements.

Qualifications & exceptions

• Introduced as "can include", so not every product collects every category.

Data Access & Collection · Company practice

Product use, device details, browsing history and error reports are collected

Microsoft lists data about how you use its products and about your device. This includes the features you use, your searches and commands, error reports and support requests; hardware and software details, product performance, interactions with its websites and apps, and your settings; payment and account history; and browsing history. Device data includes IP addresses, device identifiers, nearby networks and information about installed operating systems and software. Error reports ("crash dumps") usually include software, hardware and file content details related to the error, and other software on your device.

Supporting quotations

Information about your use of Microsoft products, including features you use, searches, commands given, error reports, and support requests.

Data about your device and product features you use, hardware and software details, product performance, your interactions with our websites and apps, and your settings.

Payment and account history.

Browsing history.

For example, IP addresses, device identifiers, nearby networks, and other information about the operating systems and other software installed on your device.

This usually includes software, hardware, and file content details related to an error, and other software on your device.

Qualifications & exceptions

• The statement presents these as examples within the device and usage data category.
• Crash dumps can include file content details related to the error.

Data Access & Collection · Company practice

Support calls and chats may be monitored and recorded; bot usage is collected

When you contact Microsoft for help, it collects the contact or authentication data you give, the content of your communications with Microsoft, the condition of your device, the products involved and other details that help it provide support. The statement says phone conversations or chat sessions with its representatives may be monitored and recorded. Separately, it collects your interactions with bots and skills available through Microsoft products, including bots and skills provided by third parties.

Supporting quotations

Data you provide when you contact Microsoft for help.

the content of your communications with Microsoft

Phone conversations or chat sessions with our representatives may be monitored and recorded.

Interactions with bots and skills available through Microsoft products, including bots and skills provided by third parties.

Qualifications & exceptions

• "May be monitored and recorded" is permissive; the text does not say when or in which cases it happens.

Not stated here

• The text does not say how long support recordings are kept or who can access them.

Inference & Profiling · Company practice

Interests, including inferred interests, and media you consume are collected

Microsoft collects preferences and interests that you share (such as favorite sports teams, programming languages or cities for weather) and interests it infers from your activity, with the example of activity on sites that use Microsoft technology for ads purposes. It also collects information about the media content you access through its products, such as TV, video, music or audio, apps and games.

Supporting quotations

Preferences and interests you share

or that we infer from your activity, such as your activity on sites that use our technology for ads purposes

Information about the media content you access through our products like TV, video, music/audio, apps, and games.

Qualifications & exceptions

• Inferred interests are drawn from activity, including on third-party sites that use Microsoft technology for ads purposes.

Data Access & Collection · Company practice

Search queries, voice clips, typed and inked input, and images are collected

Microsoft collects the search queries and commands you give in its products (including chat bot interactions); voice data, also called voice clips, covering spoken queries, commands or dictation and possibly background sounds; text, inking and typing data you provide by typing, inking or touch; and images with related data such as picture metadata, for example an image you provide to a Bing image-enabled service or upload to Microsoft Copilot. The voice data entry links to a separate page about how voice data is used and protected, which is not supplied here.

Supporting quotations

Search queries and commands you provide in Microsoft products, such as interactions with a chat bot.

this includes spoken queries commands, or dictation, and may include background sounds

Data and related information you provide by typing, inking, or using touch input in Microsoft products.

Images and related data, like picture metadata.

upload an image to Microsoft Copilot

Qualifications & exceptions

• Voice clips may include background sounds.

Not stated here

• A linked page on how voice data is used and protected is not part of the supplied text.

Data Access & Collection · Company practice

Contacts, who you communicate with and when, and social interactions are collected

If you use a product to manage contacts, share information, communicate with others or improve your productivity, Microsoft collects data about your contacts and relationships. It also collects traffic data about your use of its communication services, including whom you have contacted and when, and social data such as likes, events and other engagement with others.

Supporting quotations

Data about your contacts and relationships if you use a product to manage contacts, share information or communicate with others, or improve your productivity.

Data about your use of Microsoft’s communication services, including whom you’ve contacted and when.

Information about your interactions and relationships with others, such as likes, events, and other types of engagement.

Qualifications & exceptions

• Contacts data applies "if you use a product" for those purposes.

Data Access & Collection · Company practice

Precise and approximate device location data are collected

Microsoft collects data about your device's location. It may be precise, typically based on GPS, cell tower or Wi-Fi hotspot location, or imprecise, for example inferred from an IP address or from the city or postal code in your account profile. Location controls for apps are covered in a separate Location services section.

Supporting quotations

Data about your device’s location, which may be either precise (typically based on GPS, cell tower, or Wi-Fi hotspot location) or imprecise (for example, inferred from an IP address, or city or postal code in your account profile).

Qualifications & exceptions

• Includes imprecise location inferred from an IP address or profile details.

Data Access & Collection · Company practice

Biometric data may be collected, depending on the product and your consent

Microsoft lists biometric data, meaning unique data from technical processing of your physical, physiological or behavioral characteristics to verify your identity, such as a fingerprint or facial recognition used to sign in to a Windows device through Windows Hello. It says its collection and use of biometric data depends on the products and features you use and on your consent, and points to a later Windows Hello section for more.

Supporting quotations

Unique data about you from specific technical processing related to your physical, physiological, or behavioral characteristics to verify or confirm your identity.

Our collection and use of biometric data depends on the products and features you use and your consent.

Qualifications & exceptions

• Depends on the products and features used and on consent.

Data Access & Collection · Company practice

Event data, your files and messages, location recordings and feedback are collected

The list also covers other input (such as buttons pressed on an Xbox controller, other activity data, or information you give when registering for or attending an in-person event); content (information in files, messages, emails, chats, calls, meetings, photos, documents and other media you create or share using Microsoft products); video and audio recordings of events and activities at Microsoft buildings, retail spaces and other locations, which may include your image and voice; and feedback, survey answers and product reviews. The statement adds that product-specific sections describe the collection that applies to each product.

Supporting quotations

Data generated from using devices or participating in events, like buttons you press on an XBOX controller or other activity data, or information you provide when registering or attending an in-person event.

Information in files and messages, emails, chats, calls, meetings, photos, documents, and other media you create or share using Microsoft products.

Recordings of events and activities at Microsoft buildings, retail spaces, and other locations, which may include your image and voice data.

Information you provide in feedback, surveys, or product reviews.

Product-specific sections below describe data collection practices applicable to use of those products.

Qualifications & exceptions

• Recordings at Microsoft locations may include your image and voice data.
• Product-specific sections describe collection for particular products.

Data Access & Collection · Company practice

Microsoft also receives data from data brokers, partners and other third-party sources

Besides data from you, Microsoft receives data from its affiliates, subsidiaries and third parties. The listed sources include data brokers from which it buys demographic data and contact information to supplement what it collects; services that make user-generated content available, such as local business reviews or public social media posts; email providers and social networks when you give permission to access your data there; service providers that help determine your device location; joint marketing partners; developers and third parties that deliver experiences through Microsoft products; and publicly available sources such as open public sector, academic and commercial data sets. Microsoft says it protects data from third parties under the practices in this statement plus any added restrictions imposed by the source, and that the sources vary over time.

Supporting quotations

We protect data obtained from third parties according to the practices described in this statement, plus any additional restrictions imposed by the source of the data.

These third-party sources vary over time and include:

Data brokers from which we purchase demographic data and contact information to supplement the data we collect.

Services that make user-generated content from their service available to others, such as reviews of local businesses or public social media posts.

Communication services, including email providers and social networks, when you give us permission to access your data on such third-party services or networks.

Service providers that help us determine your device’s location.

Partners with whom we engage in joint marketing activities.

Developers who create experiences through or for Microsoft products.

Third parties that deliver experiences through Microsoft products.

Publicly available sources, such as open public sector, academic, and commercial data sets.

Qualifications & exceptions

• Data from communication services is obtained when you give permission to access your data on those services.
• Third-party sources vary over time.
• Data is protected under this statement plus any restrictions from the source.

Data Access & Collection · User right or choice

Closing reminder: you can decline or limit automatic data collection, with the same trade-offs

The Personal data we collect section ends by repeating the choice statement in slightly different words: you can decline when asked to provide personal data and can use browser, in-product or operating system controls to limit or prevent certain types of automatic data collection. Many products need some personal data to operate, so refusing required data means you cannot use that product or feature. Required-by-law and contract data are treated the same way, and withholding optional data stops features such as personalization from working.

Supporting quotations

When you are asked to provide personal data, you can decline.

to limit or prevent certain types of automatic data collection

If you choose not to provide or allow us to collect required data, you cannot use the related product or feature.

features like personalization that use the data will not work for you

Qualifications & exceptions

• Same limits as the earlier choice statement: limiting applies to certain types of automatic collection.

Use & Processing · Company practice

Microsoft uses collected data to provide, improve, advertise and run its business

Microsoft says it uses the data it collects to provide you with experiences, and lists the purposes: providing its products (including updating, securing, troubleshooting, support and recommendations); improving and developing products; advertising and marketing to you (promotional communications, personalized advertising and relevant offers); and operating its business (analyzing performance, meeting legal obligations, developing its workforce and doing research). The detailed list that follows expands each purpose.

Supporting quotations

Microsoft uses the data we collect to provide you with rich, interactive experiences.

Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations.

Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.

We also use the data to operate our business, which includes analyzing our performance, meeting our legal obligations, developing our workforce, and doing research.

Qualifications & exceptions

• This is a summary; later items give detail and some conditions.

Use & Processing · Permission or license

Microsoft may use your data to develop and train its AI models

As part of improving and developing its products, Microsoft says it may use your data to develop and train its AI models. The later product development item says this includes developing, training and fine-tuning AI models, including large language models, and that the data used is often de-identified. The wording is "may", and the statement links to a separate Copilot privacy FAQ for more, which is not supplied here.

Supporting quotations

we may use your data to develop and train our AI models

we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs)

we use data, often de-identified, to better understand our customers’ computing and productivity needs, and to train and fine-tune AI models

Qualifications & exceptions

• "May use" is permissive; it does not say which data or which products.
• The product development item says the data used is "often" de-identified, not always.

Not stated here

• The linked Copilot privacy FAQ is not part of the supplied text.
• The text does not say whether you can opt out of this use; control options may appear elsewhere in the statement.

Security & Safeguards · Company commitment

Microsoft says it protects personal data with security technologies, limited access and encryption

Microsoft states it is committed to protecting the security of your personal data and uses a variety of security technologies and procedures to help protect it from unauthorized access, use or disclosure. As examples, it stores personal data you provide on computer systems with limited access in controlled facilities, and it protects highly confidential data, such as a credit card number or password, with encryption when transmitting it over the internet. These are described as help to protect, not a guarantee.

Supporting quotations

Microsoft is committed to protecting the security of your personal data and uses a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure.

we store personal data you provide on computer systems that have limited access and are in controlled facilities

When we transmit highly confidential data (such as credit card number or password) over the internet, we protect it through the use of encryption.

Qualifications & exceptions

• The commitment is to "help protect"; it does not promise against all loss.
• Encryption is stated for highly confidential data sent over the internet.

Use & Processing · Company practice

Data is used to operate products, activate them, contact you and complete purchases

Microsoft uses data to operate and deliver its products, for example processing files you upload to OneDrive so you can access, edit and manage them. It may use your data to contact you about subscriptions, available product updates or your account. For product activation it uses device and application type, location and unique identifiers. For transactions it uses your payment and contact information to carry out your transactions and deliver your purchases.

Supporting quotations

We use data to operate and deliver our products, such as processing files you upload to OneDrive so you can access, edit, and manage them.

We may use your data to contact you for various reasons, such as to inform you about your subscriptions, tell you when product updates are available, or contact you about your account.

We use data like device and application type, location, and unique identifiers to activate products.

We use data like your payment and contact information to carry out your transactions with us and deliver your purchases.

Qualifications & exceptions

• Communications use is stated as "may".

Inference & Profiling · Company practice

Personalized features tailor your experience using your data and inferences about you

Many Microsoft products include personalized features that use automated processes to tailor your experience based on your data and on inferences drawn from your activities, interests and location. You can sync settings across devices through your Microsoft account, and many products let you turn personalized features off. The text says "many", not all, products allow turning personalization off.

Supporting quotations

Many products include personalized features and use automated processes to tailor your experience based on your data and inferences based on your activities, interests, and location.

many products allow you to turn off personalized features

Qualifications & exceptions

• Many, not all, products allow you to turn personalized features off.

Use & Processing · Company practice

Support data is used to fix issues, investigate incidents, and voice data from calls may be used for authentication

Microsoft uses data to help troubleshoot and resolve issues, repair devices, investigate security incidents, and provide, improve and secure its products, services and training. It says it may use voice data from support calls for authentication and security purposes. Separately, it uses data to troubleshoot performance issues, develop updates and security patches and notify users of product updates, which may involve automated systems that detect security and safety issues.

Supporting quotations

We use the data to help us troubleshoot and resolve issues, repair devices, investigate security incidents, and to provide, improve, and secure the quality of our products, services, and training.

We may use voice data from support calls for authentication and security purposes.

We use data to troubleshoot and resolve performance issues, develop updates and security patches, and notify users of product updates.

This may include using automated systems to detect security and safety issues.

Qualifications & exceptions

• Voice data from support calls: "may" be used, for authentication and security purposes.

Sharing & Disclosure · Company practice

Microsoft scans for harmful content, may block or remove content, and may report to NCMEC and law enforcement

Microsoft uses data to protect the security and safety of its products and customers, such as detecting malware and malicious activities. It reserves the right to block communications or remove content that violates its terms of use. It uses scanning technologies, such as hash matching, to help prevent harm to its systems, its users and others as described in its Code of Conduct, and to help prevent child exploitation. It may share information with the National Center for Missing and Exploited Children (NCMEC) and law enforcement authorities. It also uses tools to detect and disrupt misuse of video-calling capabilities by high-risk users to produce and share child sexual exploitation and abuse imagery.

Supporting quotations

We use data to protect the security and safety of our products and customers, such as by detecting malware and malicious activities.

We reserve the right to block communications or remove content that violates our terms of use.

We use scanning technologies (like hash matching) to help prevent harm to our systems, our users, and others as described in our Code of Conduct, and to help prevent child exploitation.

We may share information with the National Center for Missing and Exploited Children (NCMEC) and law enforcement authorities.

Qualifications & exceptions

• Sharing with NCMEC and law enforcement is stated as "may".
• The Code of Conduct is referenced but not supplied here.

Not stated here

• The scanning technologies are described only by example (hash matching); the text does not say which content types or products are scanned.
• The Code of Conduct is not part of the supplied text.

Inference & Profiling · Company practice

Account and partner signals are used to apply age-based protections across your Microsoft services

Microsoft uses information associated with your Microsoft account to provide more age-appropriate experiences. That information may include what you provide (such as date of birth or account settings), information from your use of services (such as how you interact with features and content), or information from partners or verification services, such as age range signals from app stores. It uses this to apply age-appropriate protections, settings and experiences, and generally applies age-based protections across the Microsoft services connected to your account. It may share age group information with Microsoft apps and services, and with third-party apps, so they can apply safeguards, tailor experiences and comply with laws.

Supporting quotations

We use information associated with your Microsoft account to provide more age-appropriate experiences across our services.

information from partners or verification services, such as age range signals received from app stores

we generally apply them across Microsoft services connected to your account

We may share age group information with Microsoft apps and services, as well as third-party apps, so that they can apply appropriate safeguards, tailor experiences, and comply with applicable laws and regulations.

Qualifications & exceptions

• Sharing of age group information (not necessarily exact age) is stated as "may".
• Age-based protections are "generally" applied across connected services.

Not stated here

• The text does not say which third-party apps receive age group information.

Use & Processing · Company practice

Error reports, Bing queries and voice data are used to improve products

Microsoft uses data to improve its products, including adding new features and capabilities. Its examples are using error reports to improve security features, queries and clicks in Bing to improve search results, and voice data to develop and improve speech recognition accuracy.

Supporting quotations

We use data to improve our products, including adding new features and capabilities.

we use error reports to improve security features, queries and clicks in Bing to improve search results, and voice data to develop and improve speech recognition accuracy

Qualifications & exceptions

• The three uses are given as examples.

Use & Processing · Company practice

Data, often de-identified, is used to develop new products and to train and fine-tune AI models

Microsoft uses data to develop new products, for example to better understand customers' computing and productivity needs and to train and fine-tune AI models that can shape new products. The text says the data is "often" de-identified, and that Microsoft may use your data to develop, train and fine-tune AI models, including large language models. A link points to a Copilot privacy FAQ that is not supplied here.

Supporting quotations

We use data to develop new products.

we use data, often de-identified, to better understand our customers’ computing and productivity needs, and to train and fine-tune AI models, which can shape the development of new products

Qualifications & exceptions

• "Often de-identified" does not mean always de-identified.

Not stated here

• The linked Copilot privacy FAQ is not part of the supplied text.

Use & Processing · Company practice

Data is used to send promotions, suggest offers and run prize contests

Microsoft uses data to send you promotional messages and to give you product information and offers likely to interest you, such as new games based on your activity. It uses your data to administer prize contests and events and to select and provide prizes to winners. For managing contact data, email subscriptions and promotional messages, the statement points to the How to access and control your personal data section.

Supporting quotations

We use data to send you promotional messages.

See the How to access and control your personal data section for information on managing your contact data, email subscriptions, and promotional messages.

Microsoft uses data to provide you with product information and offers likely to interest you, such as new games based on your activity.

We use your data to administer prize contests and events and to select winners.

Qualifications & exceptions

• Managing promotional messages is covered in the access and control section.

Use & Processing · Restriction or exception

Data is used for ads on Microsoft and third-party properties, but not message or file content

Microsoft uses data for advertising on Microsoft and third-party properties, sometimes using automated processes to make ads more relevant. It states that it does not use what you say in emails, human-to-human chat, video calls or voice mail, or your personal files, photos or documents, to target ads to you. The statement points to its Advertising section for more details.

Supporting quotations

We use data for advertising on Microsoft and third-party properties, sometimes using automated processes to make ads more relevant.

Microsoft does not use what you say in emails, human-to-human chat, video calls or voice mail, or your personal files, photos, or documents to target ads to you.

Qualifications & exceptions

• The exclusion covers email, human-to-human chat, video calls, voice mail and personal files, photos and documents.
• Other data may still be used for ads; the Advertising section gives details.

Use & Processing · Company practice

Data is used for business reporting, fraud and rights protection, legal compliance and research

Microsoft uses data to analyze and improve its business, make decisions and report on performance. It uses data to detect and prevent fraud, resolve disputes, enforce agreements and protect its property, for example confirming software licenses to reduce piracy, and it may use automated processes to detect activity that violates its rights or others' rights. It processes data to comply with applicable laws, for example using customers' ages to meet obligations to protect children's privacy. It uses data for research, including AI and machine learning, for public interest and scientific purposes, with appropriate safeguards for individuals' rights and freedoms.

Supporting quotations

We use data to analyze and improve our business, make informed decisions, and report on our business’ performance.

We use data to detect and prevent fraud, resolve disputes, enforce agreements, and protect our property.

We may use automated processes to detect and prevent activities that violate our rights and the rights of others, such as fraud.

We process data to comply with applicable laws.

With appropriate safeguards for individuals’ rights and freedoms, we use data for research, including AI and machine learning, for public interest and scientific purposes.

Qualifications & exceptions

• Research use is stated to be with appropriate safeguards for individuals' rights and freedoms.

Linking & Identification · Company practice

Microsoft combines data from different contexts and third parties, with some separation safeguards

Microsoft combines data collected from different contexts or obtained from third parties to give you a more seamless, consistent and personalized experience, to make informed business decisions and for other legitimate purposes. Its example is Microsoft Store using information about the apps and services you use to recommend apps. It says it uses technological and procedural safeguards to prevent certain data combinations, for example storing data from unauthenticated users separately from account information that directly identifies you, such as name, email address or phone number.

Supporting quotations

We combine data collected from different contexts or obtained from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes.

We use technological and procedural safeguards to prevent certain data combinations

we store data collected from unauthenticated users separately from account information that directly identifies you

Qualifications & exceptions

• Safeguards prevent "certain" combinations, not all.
• "Other legitimate purposes" is open-ended.

Not stated here

• The text does not list which combinations are prevented beyond the unauthenticated-user example.

Use & Processing · Company practice

Processing uses automated and manual methods, including human review of AI results

Microsoft says its processing of personal data uses both automated and manual (human) methods, which often work together. As an example, to build, train and improve the accuracy of automated systems such as AI, it manually reviews some of the results against the underlying data. The text does not say how many results are reviewed or who reviews them.

Supporting quotations

Our processing of personal data involves both automated and manual (human) methods, which often work together.

we manually review some of the results against the underlying data

Qualifications & exceptions

• Manual review is described for "some" results.

Not stated here

• The text does not say who the reviewers are or how much data they see.

Legal Rights & Agreement Rules · Company practice

Microsoft processes data on consent, necessity, legal duty, safety or legitimate interests

Microsoft says it processes your personal data with your consent and/or when it is necessary to provide the products you use, operate its business, meet contractual and legal obligations, protect the security and safety of its systems and customers, or pursue its legitimate interests or those of third parties. The legal basis may vary depending on how and across what products or services data is processed. When relying on legitimate interests, it says it balances them against your rights and freedoms and processes data only if those interests are not outweighed by yours.

Supporting quotations

We process your personal data with your consent and/or when it’s necessary to provide the products you use, operate our business, meet our contractual and legal obligations, protect the security and safety of our systems and our customers, or pursue our legitimate interests or those of third parties.

Our legal basis for processing may vary depending on how and across what products or services we process your data.

will only process your data if these interests are not outweighed by your own

Qualifications & exceptions

• The basis may vary by product and type of processing.
• Legitimate-interest processing is conditioned on the balancing test.

Retention & Deletion · Company practice

Microsoft keeps personal data as long as necessary, and retention periods can vary significantly

Microsoft retains personal data for as long as necessary to provide the products and services you use and to fulfill transactions you request. It also retains data for other legitimate purposes such as operating its business, meeting contractual and legal obligations, improving and developing products, protecting safety and security and resolving disputes. Actual retention periods can vary significantly by data type and context, and the statement points to product documentation. The criteria it lists are the purposes of use (for example, OneDrive documents are kept until you delete them), the nature and sensitivity of the data (for example, a shortened period for precise geolocation), and legal, contractual and similar obligations such as retention laws, government preservation orders and litigation, while it removes unlawful content where required by law.

Supporting quotations

Microsoft retains personal data for as long as necessary to provide the products and services you use and to fulfill the transactions you request.

actual retention periods can vary significantly

when you store a document in OneDrive, we maintain the data until you actively delete it

we maintain a shortened retention period for precise geolocation information

including data retention laws, government orders to preserve data relevant to an investigation, or data retained for the purposes of litigation

we’ll remove unlawful content where required by law

Qualifications & exceptions

• No fixed retention periods are given; periods vary significantly.
• Legal holds and preservation orders can extend retention.

Not stated here

• Specific retention periods for most data types are not stated in this section.

Sharing & Disclosure · Company practice

Microsoft discloses data with your consent, to complete what you request, or as required

Microsoft says it discloses your personal data with your consent, to complete any transaction or provide any product you have requested or authorized, or as needed for any other purpose described in the How we use personal data section. For example, it provides your content to third parties when you tell it to, such as when you send an email to a friend or link accounts with another service. It also discloses data when required by law or to respond to legal process, and to protect customers, safety, security, and Microsoft's and its customers' rights and property. It provides data to Microsoft-controlled affiliates and subsidiaries and to vendors working on its behalf.

Supporting quotations

Microsoft discloses your personal data with your consent, to complete any transaction or provide any product you have requested or authorized, or as needed to carry out any other purpose described in the How we use personal data section.

We also disclose personal data when required by law or to respond to legal process, and to protect customers, safety, security, and Microsoft and its customers’ rights and property.

We provide data to Microsoft-controlled affiliates and subsidiaries and to vendors working on our behalf.

we provide your content to third parties when you tell us to do so, such as when you send an email to a friend or link accounts with another service

Qualifications & exceptions

• The reasons include any other purpose described in the How we use personal data section, which is broad.

Sharing & Disclosure · Company practice

Work or school accounts: data such as interaction and diagnostic data is disclosed to your organization

If you use a work or school account, or a Microsoft product provided by an organization you are affiliated with, such as an employer or school, Microsoft discloses certain data, such as interaction data and diagnostic data, so your organization can manage the products. This applies to organization-provided accounts, not to personal Microsoft accounts.

Supporting quotations

If you use a work or school account or use a Microsoft product provided by an organization you are affiliated with, such as an employer or school, we disclose certain data such as interaction data and diagnostic data to enable your organization to manage the products.

Qualifications & exceptions

• Applies to work or school accounts and organization-provided products.
• "Certain data such as" means the examples are not an exhaustive list.

Charges & Financial Obligations · Company practice

Payment data goes to banks and processors, and saved shared payment methods can expose receipts

Microsoft says it will disclose payment data to banks and other payment transaction processors and financial services providers to fulfill your purchases, and for fraud prevention and credit risk reduction. If you save a payment method, such as a card, to an account used by you and other Microsoft account holders, your purchase receipts may be available to anyone else who uses and has access to the same payment method to make a purchase from Microsoft.

Supporting quotations

We will disclose payment data to banks and other payment transaction processors and financial services providers to fulfill your purchases with us, and for fraud prevention and credit risk reduction.

your purchase receipts may be available to anyone else who uses and has access to the same payment method to make a purchase from Microsoft

Qualifications & exceptions

• The receipt visibility applies when a payment method is saved on an account used by you and other account holders.

Sharing & Disclosure · Company practice

Data may be sent to an external provider to deliver push notifications on non-Windows devices

When you allow push notifications for Microsoft products or apps on a non-Windows device, Microsoft may send data to an external notification provider to deliver them. Your device's push notification services are governed by their own service-specific terms and privacy statements, which are not supplied here.

Supporting quotations

When you permit push notifications for Microsoft products or applications on a non-Windows device, we may send data to an external notification provider to deliver push notifications.

Your device’s push notification services are governed by their own service-specific terms and privacy statements.

Qualifications & exceptions

• Applies when you permit push notifications on a non-Windows device.

Not stated here

• The device push notification providers' terms and privacy statements are not part of the supplied text.

Sharing & Disclosure · Company practice

Personal data is also disclosed for digital advertising; details are in the Advertising section

Microsoft states that it also discloses personal data for digital advertising purposes and points to the Advertising section for how personal data is used for advertising. The detail of what is disclosed and to whom is not in this paragraph.

Supporting quotations

We also disclose personal data for digital advertising purposes.

Not stated here

• This paragraph does not say which advertising partners receive data or which data.

Sharing & Disclosure · Company practice

Data is shared with affiliates and vendors bound to Microsoft standards, and may transfer in mergers or sales

Microsoft enables access to personal data among Microsoft-controlled affiliates and subsidiaries, including for the purposes in the statement. It provides personal data to vendors or agents working on its behalf for those purposes, such as companies hired for customer service support. These companies must comply with Microsoft's data privacy and security standards and may not use your data for other purposes. Microsoft may also disclose personal data as part of corporate transactions such as mergers or asset sales.

Supporting quotations

we enable access to personal data among Microsoft-controlled affiliates and subsidiaries, including for the purposes described in this privacy statement

We also provide personal data to vendors or agents working on our behalf for the purposes described in this statement, such as companies we hire to provide customer service support.

These companies must comply with our data privacy and security standards and may not use your data for other purposes.

We may also disclose personal data as part of corporate transactions such as mergers or asset sales.

Qualifications & exceptions

• Vendors must comply with Microsoft's data privacy and security standards and may not use data for other purposes.
• Disclosure in corporate transactions is stated as "may".

Sharing & Disclosure · Permission or license

Microsoft may access and disclose your content, including emails and files, on a good-faith belief it is necessary

Microsoft says it retains, accesses, transfers, discloses and preserves personal data, including your content such as the content of emails in Outlook.com or files in OneDrive, when it has a good faith belief this is necessary to: comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; protect the safety of customers, organizations and the public, such as preventing spam, stopping fraud or detecting and combating harmful or illegal behavior and content; operate and maintain the security of its products, including stopping an attack; or protect Microsoft's rights or property, including enforcing the terms governing its services. If it receives information that its services are used to traffic in stolen property, it may refer the matter to law enforcement. A separate Law Enforcement Requests Report gives more information about government requests and is not supplied here.

Supporting quotations

we retain, access, transfer, disclose, and preserve personal data, including your content (like the content of your emails in Outlook.com or files in OneDrive), when we have a good faith belief that it is necessary to do any of the following:

Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies.

Protect the safety of our customers, organizations, and the public

Operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.

Protect the rights or property of Microsoft, including enforcing the terms governing the use of our services.

we may refer the matter to law enforcement

For more information about data we disclose in response to requests from law enforcement and other government agencies

Qualifications & exceptions

• The standard is Microsoft's "good faith belief" that an action is necessary.
• Referral to law enforcement for trafficking in stolen property is stated as "may".

Not stated here

• The linked Law Enforcement Requests Report is not part of the supplied text.
• The text does not say whether or when you are notified of such access or disclosure.

Sharing & Disclosure · Restriction or exception

Third-party products reached through Microsoft products follow their own privacy policies

Microsoft warns that some of its products link to, or let you access, products of third parties whose privacy practices differ from Microsoft's. For example, third-party applications or extensions that run on Windows or the Edge browser may collect personal data under their own practices. If you give personal data to any of those products, your data is governed by their privacy policies, not this statement.

Supporting quotations

some of our products include links to or otherwise enable you to access products of third parties whose privacy practices differ from those of Microsoft

If you provide personal data to any of those products, your data is governed by their privacy policies.

Qualifications & exceptions

• Applies to third-party products accessed through Microsoft products.

Account & Service Control · User right or choice

You can control your data through tools or by contacting Microsoft, but tools do not cover everything

Microsoft says you can make choices about the collection and use of your data, control the personal data it has obtained, and exercise your data protection rights by contacting Microsoft or using tools it provides, such as the Microsoft privacy dashboard. Not all personal data it processes can be reached through those tools; for data not available through the tools or the products themselves, you can contact Microsoft through the How to contact us section or the privacy support and requests page. Microsoft publishes aggregate metrics about user rights requests in a Privacy Report, which is not supplied here.

Supporting quotations

You can control your personal data that Microsoft has obtained and exercise your data protection rights by contacting Microsoft or using various tools we provide

Not all personal data processed by Microsoft can be accessed or controlled via the tools described in this section.

you can always contact Microsoft as described in the

We provide aggregate metrics about user requests to exercise their data protection rights

Not all personal data processed by Microsoft can be accessed or controlled via the tools above.

Qualifications & exceptions

• The tools do not cover all personal data; a contact route exists for the rest.

Not stated here

• The linked Privacy Report is not part of the supplied text.

Account & Service Control · User right or choice

Microsoft gives these data protection rights regardless of your location

Microsoft says it provides the following rights regardless of your location: you can withdraw consent at any time where Microsoft relied on your consent; you have the right to be informed about the collection and use of your personal data; you can request access to, erasure of and updates to your personal data; you can port your data using tools Microsoft provides or, if none exist, by contacting Microsoft for help; and you can object to or restrict Microsoft's use of your data, including objecting at any time to use for direct marketing or where Microsoft acts in the public interest or pursues legitimate interests of its own or a third party. For rights under U.S. state data privacy law, a separate paragraph gives a U.S. address, the privacy support and requests page and a U.S. toll-free number.

Supporting quotations

Microsoft provides you with the following data protection rights regardless of your location:

If Microsoft obtained your consent to use your personal data, you can withdraw that consent at any time.

You have the right to be informed about the collection and use of your personal data.

You can request access to, erasure of, and updates to your personal data.

you can use tools Microsoft provides to do so, or if none are available, you can contact Microsoft for assistance

you can object at any time to our use of your personal data for direct marketing purposes or where we are performing a task in the public interest or pursuing our legitimate interests or those of a third party

you may contact Microsoft at the U.S. address listed above, use our

or call our U.S. toll free number

Qualifications & exceptions

• Consent withdrawal applies where Microsoft obtained your consent.
• Porting depends on available tools; otherwise you contact Microsoft for assistance.

Not stated here

• The text does not state a deadline for Microsoft to respond to rights requests.

Account & Service Control · Restriction or exception

Your access and control may be limited by law or by an organization that administers your account

Microsoft says that in some cases your ability to access or control your personal data will be limited, as required or permitted by applicable law. If an organization such as your employer, school or service provider provides you with access to Microsoft products and administers your use of them, you should contact that organization to learn how to access and control your personal data.

Supporting quotations

In some cases, your ability to access or control your personal data will be limited, as required or permitted by applicable law.

If your organization, such as your employer, school, or service provider, provides you with access to and is administering your use of Microsoft products, contact your organization to learn more about how to access and control your personal data.

Qualifications & exceptions

• Limits are those "required or permitted" by law, which the text does not list.
• Applies to organization-administered use of Microsoft products.

Not stated here

• The text does not list which legal limits may apply.

Cross-references

• qualifies (model-proposed): Microsoft gives these data protection rights regardless of your location — qualifies: The rights listed as applying regardless of location are limited where law requires or permits, and organization-administered accounts route requests to the administrator.

Account & Service Control · Context

The listed tools are a general list and specific products may offer other controls

Microsoft says which tools are most useful depends on your interactions and the products you use, that the list is a general one, and that specific products may provide additional controls. It points to the product-specific sections for in-product ways to access your data.

Supporting quotations

The following is a general list of tools we provide to help you control your personal data; specific products may provide additional controls.

Qualifications & exceptions

• The list is general, not exhaustive.

Account & Service Control · User right or choice

Signed-in Bing and Copilot history can be viewed and cleared from your privacy dashboard

For Bing, if you are signed in with a Microsoft account you can view and clear stored search and chat history on the privacy dashboard; if you are not signed in you can view and clear search history associated with your device in Bing settings. For Microsoft Copilot, if you are signed in with a Microsoft account you can view, access, export and delete Copilot activity history from the privacy dashboard, and use in-product controls on the Copilot website or app.

Supporting quotations

If you are signed into Bing with your Microsoft account, you can view and clear your stored search and chat history on your

If you are not signed in, you can view and clear stored search history associated with your device in your

If you are signed into Microsoft Copilot with your Microsoft account, you can view, access, export and delete Copilot activity history from your

Qualifications & exceptions

• The Bing options differ depending on whether you are signed in.
• Copilot dashboard options require signing in with a Microsoft account.

Account & Service Control · User right or choice

Your Microsoft account, privacy dashboard and Store pages let you access, edit, clear or close

On the Microsoft account website you can access, edit or remove your profile and payment information, change your password, add security information or close your account. On the Microsoft privacy dashboard you can control some of the data Microsoft processes through your account, for example viewing and clearing browsing, search and location data associated with it. You can view your Microsoft Store profile and account information, and order history, in the Store.

Supporting quotations

You can visit the

if you want to access, edit, or remove your account’s profile and payment information, change your password, add security information or close your account

You can control some of the data Microsoft processes via your Microsoft account on the

you can view and clear the browsing, search, and location data associated with your Microsoft account

You can access your Microsoft Store profile and account information by visiting

Qualifications & exceptions

• The dashboard covers "some" of the data Microsoft processes, not all.

Account & Service Control · User right or choice

Teams, OneDrive, Outlook.com, Skype and Xbox each offer ways to view, export, download or delete your data

For personal Teams data you can follow a linked page to export or delete data tied to your personal Microsoft account. In OneDrive you can view, download and delete your files and photos by signing in. In Outlook.com you can download your emails from your Privacy and data settings. For Skype you can access, edit or remove some profile information, change your password, and request a copy of your chat history and shared files. For the Xbox network or Xbox.com you can view or edit personal data, including billing and account information, privacy settings and online safety and data sharing preferences, through My Xbox.

Supporting quotations

You can find out how to export or delete Teams data relating to your personal Microsoft account by visiting this

You can view, download, and delete your files and photos in OneDrive by signing into your

You can download your emails in

If you wish to access, edit, or remove some profile information for Skype or change your password

If you wish to export your Skype chat history and files shared on Skype

you can view or edit your personal data, including billing and account information, privacy settings, and online safety and data sharing preferences

Qualifications & exceptions

• Skype profile editing covers "some" profile information.
• Linked pages for Teams and Skype export are not supplied here.

Not stated here

• The linked Teams export or delete page is not part of the supplied text.

Account & Service Control · Procedure

For data the tools do not reach, contact Microsoft through its contact section or support page

Repeating the earlier point, the statement says not all personal data can be accessed or controlled through the listed tools. For data not available through the tools or through the product you use, you can contact Microsoft at the address in the How to contact us section or use the privacy support and requests page.

Supporting quotations

Not all personal data processed by Microsoft can be accessed or controlled via the tools above.

you can contact Microsoft at the address in the

Account & Service Control · User right or choice

You can opt out of promotional email, SMS, mail or phone, but not mandatory service messages

You can choose whether to receive promotional communications from Microsoft by email, SMS, mail or phone. To opt out of promotional emails or SMS, follow the directions in the message. For more options, including managing contact information, Microsoft-wide contact preferences, email subscriptions and sharing information with partners, sign in to your personal Microsoft account and visit the communication permissions page. If you do not have a Microsoft account, a web form lets you manage email contact preferences. These choices do not apply to mandatory service communications or other informational messages that have their own unsubscribe method.

Supporting quotations

You can choose whether to receive promotional communications from Microsoft by email, SMS, mail, or phone.

To opt out of promotional emails or SMS, follow the directions in the message.

If you don't have a Microsoft account, you can manage your Microsoft email contact preferences by using this

These choices do not apply to mandatory service communications or other informational messages with their own unsubscribe method.

Qualifications & exceptions

• Mandatory service communications and informational messages with their own unsubscribe method are excluded.

Account & Service Control · User right or choice

You can opt out of Microsoft personalized ads, and the opt-out is saved to your account or a five-year cookie

You can opt out of personalized advertising from Microsoft, including Xandr, through its Personalized ads and offers page, and can see third-party ad partners and opt out of data sharing for personalized ads on a Third-party ad settings page. If you are logged in, your opt-out is tied to your account and applied across devices whenever you are signed in. If you are not signed in, your preference is stored in a browser-specific cookie valid for five years, and you must opt out again if you delete cookies. For Microsoft-controlled ads in Windows apps, you can use the opt-out tied to your personal Microsoft account or turn off the advertising ID in Windows settings.

Supporting quotations

To opt out of receiving personalized advertising from Microsoft (including Xandr) visit our

opt out of data sharing for personalized ads at our

When you’re logged into your Microsoft account, your opt out choice will be associated with your account and applied across devices whenever you are signed in.

your preference is stored in a browser-specific cookie on your device, valid for five years; if you delete cookies, you must opt out again

turn off the advertising ID in Windows settings to opt out of personalized advertising

Qualifications & exceptions

• Signed-out opt-outs live in a browser-specific cookie and are lost if cookies are deleted.

Account & Service Control · Restriction or exception

Opting out does not stop ads or other uses of the data, and third-party partners require separate opt-outs

The statement says data used for personalized advertising is also used for other required purposes such as product delivery, analytics and fraud detection, so opting out of personalized ads does not stop that use. You will still see ads if you opt out, but they may be less relevant to you. To opt out of personalized advertising from third-party partners you must visit their sites, with more information in the Advertising section.

Supporting quotations

Data used for personalized advertising is also used for other required purposes, such as product delivery, analytics, and fraud detection.

You will still see ads even if you opt out of personalized ads, but they may be less relevant to you.

You can opt out of personalized advertising from third-party partners by visiting their sites.

Qualifications & exceptions

• Opt-out affects ad personalization, not the other required uses of the same data.

Account & Service Control · User right or choice

Browser controls include cookie settings, Edge tracking protection and honoring the Global Privacy Control signal

When you use a browser you can control your data through cookie controls, and you can withdraw consent to cookies using the browser-based controls described in the Cookies section. In Microsoft Edge, Tracking Protection can block third-party content, including cookies, from any site on a Tracking Protection List you add. Microsoft says it receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions; if it receives a GPC signal when you visit its sites it will turn off sharing your data with third parties for personalized ads and turn off the related toggle.

Supporting quotations

You can control the data stored by cookies and withdraw consent to cookies by using the browser-based cookie controls described in the Cookies section.

This feature will block third-party content, including cookies, from any site that is listed in a Tracking Protection List you add.

Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions.

Microsoft will turn off sharing your data with third parties for personalized ads

Qualifications & exceptions

• GPC is honored "in certain jurisdictions"; the text does not list them.

Not stated here

• The jurisdictions where Microsoft responds to the GPC signal are not named in this passage.

Data Access & Collection · Company practice

Cookies, web beacons and pixels store settings, sign you in, secure, remember and measure

Microsoft uses cookies and similar technologies such as web beacons and pixels for storing and honoring your preferences and settings, letting you sign in, providing personalized advertising, combating fraud, analyzing product performance and other legitimate purposes. It lists uses: saving choices like language or ad preferences; verifying identity and keeping you signed in; protecting products and detecting fraud and abuse; remembering information you provide, such as shopping cart items; social media cookies on some websites that may let you share content if you are signed in to those services; letting you give feedback; gathering usage and performance data such as visitor counts; and helping understand how products work, such as load balancing and uptime. Microsoft apps also use additional identifiers, such as the Advertising ID in Windows.

Supporting quotations

We use cookies and similar technologies, such as web beacons and pixels, for storing and honoring your preferences and settings, enabling you to sign in, providing personalized advertising, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes.

Microsoft apps use additional identifiers, such as the Advertising ID in Windows, for similar purposes

We use cookies to store and save your choices – like language settings or your ad preferences – so you don’t need to set them again.

We use cookies to protect our products and detect fraud and abuse.

We use cookies to remember information you provide, such as items in your shopping cart.

Some of our websites include social media cookies, which may let you share content with social media services if you’re signed in with them.

We use cookies so you can give feedback on our websites.

We use cookies to gather usage and performance data, such as visitor counts and other statistics about our websites and products.

We use cookies to help us understand and improve how our products and websites work, like gathering data to help with load balancing and uptime.

Qualifications & exceptions

• "Other legitimate purposes" is open-ended.
• Social media cookies are on "some" websites.

Account & Service Control · Company practice

Signing in with a Microsoft account stores an ID number and sign-in time in an encrypted cookie

Microsoft uses cookies to verify your identity and keep you signed in securely. When you sign in with a Microsoft account, it stores a unique ID number and the time you signed in in an encrypted cookie on your device, so you do not have to sign in repeatedly.

Supporting quotations

We use cookies to verify your identity and keep you signed in securely.

we store a unique ID number and the time you signed in in an encrypted cookie on your device

Use & Processing · Company practice

Cookies and web beacons personalize ads, track which ads you saw and measure ad-driven visits

Microsoft uses cookies to personalize ads based on your activity and says you can opt out as described in the access and control section. It also uses web beacons and similar technologies to understand which Microsoft ads shown on third-party websites and platforms drive visitors to its sites and apps, and these tools help deliver ads on external sites and platforms. It uses cookies to record ad views and clicks, such as which ads you have seen, to avoid showing the same ad repeatedly.

Supporting quotations

We use cookies to personalize ads based on your activity.

You can opt out as described in the How to access and control your personal data section of this privacy statement.

We also use web beacons and similar technologies to understand which Microsoft ads displayed on third-party websites and digital platforms drive visitors to our sites and apps.

We use cookies to record ad views and clicks, such as which ads you have seen.

Qualifications & exceptions

• Personalization can be opted out of as described in the access and control section.

Sharing & Disclosure · Company practice

Affiliates, partners and third parties may place cookies on Microsoft websites for several purposes

Microsoft websites may include web beacons, cookies or similar technologies from Microsoft affiliates and partners and from third parties such as service providers acting on its behalf. Third-party cookies may be used for required purposes to provide the website or service, to show you ads and content based on your social media profiles and activities on its websites, to help understand how people use the websites (including so the third parties can improve their own products and services), and to show you ads relevant to you.

Supporting quotations

Our websites may include web beacons, cookies, or similar technologies from Microsoft affiliates and partners as well as third parties, such as service providers acting on our behalf.

to show you ads and content based on your social media profiles and activities on our websites

so the third parties can improve their own products and services

Some cookies are placed by third parties acting on our behalf.

Qualifications & exceptions

• Third-party cookies "may" be used; the text does not name the third parties.
• Some uses benefit the third parties' own products and services.

Not stated here

• The third parties that place cookies are not named in this passage.

Account & Service Control · User right or choice

Where required, Microsoft asks for consent to optional cookies, and you can withdraw it

You can control data collected by cookies, web beacons and similar technologies, for example by using browser controls to limit, clear or block cookies. Where required, Microsoft obtains your consent before placing or using optional cookies that are not strictly necessary to provide the website or service or for facilitating a communication. Where consent is required, you may withdraw it by clicking "Manage cookies" in the website footer.

Supporting quotations

You can control the data collected by cookies, web beacons, and similar technologies.

Where required, we obtain your consent prior to placing or using optional cookies that are not (i) strictly necessary to provide the website or service; or (ii) for the purpose of facilitating a communication.

you may withdraw consent to optional cookies by clicking “Manage cookies” in the footer of the website

Where required, we obtain your consent prior to placing or using optional cookies.

Qualifications & exceptions

• Consent is requested only "where required"; the text does not say where.
• Necessary cookies and cookies for facilitating a communication are excluded from the consent step.

Not stated here

• The text does not say in which places consent is required.

Data Access & Collection · Company practice

Browser-identifying cookies serve operations and, with consent, advertising; one cookie stores profile details

Microsoft lists identifier cookies (MUID, MC1, MSFPC and ai_user) that identify unique web browsers visiting its sites; they are used for necessary operational purposes and, with consent, may also be used for advertising. A cookie called NAP contains an encrypted version of your country, postal code, age, gender, language and occupation, if known, based on your Microsoft account profile. A cookie called TOptOut records your decision not to receive personalized advertising delivered by Microsoft; where required, Microsoft places it by default and removes it when you consent to personalized advertising. The list is described as not exhaustive.

Supporting quotations

This list is not exhaustive, but it is intended to illustrate the primary purposes for which we typically set cookies.

Identifies unique web browsers visiting Microsoft sites.

With consent, these cookies may also be used for advertising.

Contains an encrypted version of your country, postal code, age, gender, language and occupation, if known, based on your Microsoft account profile.

Records your decision not to receive personalized advertising delivered by Microsoft.

Where required, we place this cookie by default and remove it when you consent to personalized advertising.

Qualifications & exceptions

• Advertising use of identifier cookies depends on consent.
• The list is illustrative, not exhaustive.

Security & Safeguards · Company practice

Other listed cookies store choices, authenticate sign-in, identify sessions and balance server load

The cookie list also includes MSCC, which holds user choices for most Microsoft properties; ESTSAUTH, ESTSAUTHLIGHT and ESTSAUTHPERSISTENT, which help authenticate you when you sign in with a Microsoft account; MS0, which identifies a specific session; MR, which resets or refreshes the MUID cookie; and several cookies for load balancing and routing a session to the same server. These are operational cookies and the statement does not tie them to advertising.

Supporting quotations

Contains user choices for most Microsoft properties.

Helps to authenticate you when you sign in with your Microsoft account.

Identifies a specific session.

Resets or refreshes the MUID cookie.

Identifies a gateway for load balancing.

Used for load balancing purposes and to ensure requests for a user session are handled by the same server.

Security & Safeguards · Company practice

Security cookies are listed; cookies of affiliates and partners such as LinkedIn and Xandr may be used

The cookie list includes security cookies (esctx, _RequestVerificationToken, .AspNetCore.Correlation and .AspNetCore.Nonce) that assist with the security of your website visit and stability of services by helping prevent fraud and malicious attacks. Microsoft says it may also use the cookies of other Microsoft affiliates, companies and partners, such as LinkedIn and Xandr.

Supporting quotations

Assist with the security of your website visit and stability of the services provided to you by helping prevent fraud and malicious attacks.

We may also use the cookies of other Microsoft affiliates, companies, and partners, such as LinkedIn and Xandr.

Qualifications & exceptions

• Use of affiliates' and partners' cookies is stated as "may".

Linking & Identification · Company practice

Third parties that set cookies on Microsoft sites follow their own privacy policies and may combine data across sites

Besides its own cookies, Microsoft uses cookies from third parties to enhance its sites. Some third parties can set cookies when you visit Microsoft sites, for example companies hired for site analytics and companies that deliver content like videos, news or ads. These companies use the data they process under their own privacy policies, which may enable them to collect and combine information about your activities across websites, apps or online services. Microsoft says which third-party cookie types may be used depends on the context, service or product, and on your settings and permissions.

Supporting quotations

we also use cookies from third parties to enhance the services on our sites. Some third parties can also set cookies when you visit Microsoft sites.

These companies use the data they process in accordance with their privacy policies, which may enable them to collect and combine information about your activities across websites, apps, or online services.

The following types of third-party cookies may be used, depending on the context, service or product, as well as your settings and permissions:

Qualifications & exceptions

• Third parties may collect and combine information about your activities across websites, apps or online services under their own policies.
• Which types are used depends on context, product and your settings and permissions.

Data Access & Collection · Company practice

Third-party cookie types: social media, analytics, advertising and required cookies

The statement lists four types of third-party cookies. Social media cookies help Microsoft and third parties show ads and content tailored to your interests, based on your social media profiles and activity on Microsoft websites. Analytics cookies collect information on how you use the websites to help Microsoft improve them and to let third parties develop and improve their own products, and may also be used for advertising. Advertising cookies record which ads you saw, which you clicked and purchases made after clicking, and show you ads relevant to you, such as ads based on social media interests and website browsing history. Required cookies enable core website functions such as login, preferences, shopping carts, performance and security.

Supporting quotations

These cookies help us and third parties show you ads and content tailored to your interests, based on your social media profiles and activity on our websites.

Analytics cookies from third parties collect information on how you use our websites to help us improve them and allow third parties to develop and improve their own products. They may also be used for advertising purposes.

Advertising cookies record which ads you’ve seen, which ads you’ve clicked, or the purchases you’ve made after clicking.

like ads based on your social media interests and website browsing history

Required cookies enable core website functions, such as login, preferences, shopping carts, performance, and security.

Qualifications & exceptions

• Analytics cookies from third parties may also be used for advertising.

Sharing & Disclosure · Procedure

A third-party cookie inventory lists who sets cookies, but some sites list them only on the site

Microsoft points to a third-party cookie inventory listing the third parties that set cookies on its websites. On some websites a list is available only directly on the site and may not be in the inventory. For those third parties' own practices you are told to consult their websites or privacy notices. The inventory is linked, not supplied here.

Supporting quotations

For a list of the third parties that set cookies on our websites, please visit our

On some of our websites, a list of third parties is available directly on the site and may not be included in our

Please consult the third party websites or privacy notices for more information on their privacy practices with respect to their cookies that may be set on our websites.

Qualifications & exceptions

• The central inventory may be incomplete for some sites.

Not stated here

• The inventory page is not part of the supplied text.

Account & Service Control · User right or choice

Blocking or deleting cookies can stop sign-in and erase preferences, and optional cookies are separated by purpose

Most browsers accept cookies automatically but let you block or delete them; the statement gives the Microsoft Edge steps as an example and refers other browsers to their own instructions. If you block cookies, you cannot sign in or use some features and cookie-dependent preferences are lost. If you delete cookies, settings and preferences held in them, including advertising preferences, are deleted and must be set again. Where required, Microsoft obtains your consent before optional cookies that are not strictly necessary or not for facilitating a communication, separates these optional cookies by purpose (advertising, analytics and social media) and lets you change choices through "Manage cookies" in the footer or website settings. It notes that certain features depend on cookies, and that other controls such as tracking protections are described in the access and control section.

Supporting quotations

Most web browsers automatically accept cookies but provide controls that allow you to block or delete them.

If you choose to block cookies, you cannot sign in or use some of those features, and preferences that are dependent on cookies will be lost.

If you delete your cookies, any settings and preferences controlled by those cookies, including advertising preferences, are deleted and will need to be recreated.

We separate these optional cookies by purpose, including advertising, analytics, and social media purposes.

Where consent is required, you can adjust your choices by clicking “Manage cookies” in the footer of the website or through the settings made available on the website.

Additional privacy controls that can impact cookies, including the tracking protections feature of Microsoft browsers, are described in the How to access and control your personal data section of this privacy statement.

Qualifications & exceptions

• Consent is requested only where required.
• Blocking cookies has costs: no sign-in and loss of some features and preferences.

Data Access & Collection · Company practice

Web beacons count visitors, track email opens and actions, and are placed on partner sites and ads

Some Microsoft webpages use electronic tags called web beacons to deliver cookies, count visitors and deliver products. Microsoft also uses web beacons or similar technologies in its communications to determine whether you open and act on them. It sometimes places web beacons on other companies' websites or ads to understand how interactions with Microsoft advertisements lead to actions such as purchases, or to learn about your activity on partner sites in connection with Microsoft products or services.

Supporting quotations

Some Microsoft webpages use electronic tags called web beacons to deliver cookies, count visitors, and deliver products.

We also use web beacons or similar technologies in our communications to determine whether you open and act on them.

We sometimes place our web beacons on other companies’ websites or ads to help us understand how interactions with Microsoft advertisements lead to actions, such as purchases, or to learn about your activity on partner sites in connection with Microsoft products or services.

Qualifications & exceptions

• Beacons on other companies' sites are placed "sometimes".

Sharing & Disclosure · Company practice

Third-party analytics providers may track you across sites; they are barred from identifying beacons on Microsoft sites

Microsoft products often include web beacons or similar technologies from third-party analytics providers who help compile statistics about Microsoft campaigns and operations. They may set or read their own cookies or identifiers on your device to collect information about your online activities across websites and apps. Microsoft says it prohibits these providers from using web beacons on its sites to collect or access information that directly identifies you, such as your name or email address. You can opt out of data collection or use by some of these providers by visiting their listed sites; one of them requires installing a browser add-on. The opt-out covers only some providers, not all.

Supporting quotations

Microsoft products often include web beacons or similar technologies from third-party analytics providers.

They may set or read their own cookies or identifiers on your device to collect information about your online activities across websites and apps.

we prohibit these providers from using web beacons on our sites to collect or access information that directly identifies you, such as your name or email address

You can opt out of data collection or use by some of these analytics providers by visiting any of the following sites:

Qualifications & exceptions

• The prohibition covers beacons on Microsoft sites and information that directly identifies you, not tracking across other sites.
• Opt-out is available for "some" of these providers via their own sites.

Not stated here

• The text does not name every analytics provider used, only those with opt-out pages.

Data Access & Collection · Company practice

Other local data files can store a unique identifier for your computer that can track behavior

Microsoft says its products can use other similar technologies to store and read data files on your computer, typically to maintain your preferences or to improve speed and performance by storing certain files locally. These technologies can also store a unique identifier for your computer, which can then track behavior. The text does not say how to control these technologies beyond the browser and product controls described elsewhere.

Supporting quotations

Our products can also use other similar technologies to store and read data files on your computer.

This is typically done to maintain your preferences or to improve speed and performance by storing certain files locally.

These technologies can also store a unique identifier for your computer, which can then track behavior.

Qualifications & exceptions

• The statement says "can" store a unique identifier that "can" track behavior; it does not say when.

Not stated here

• No specific control for these technologies is described in this passage.

Account & Service Control · Company practice

A Microsoft account ties together credentials, contact, payment, device and activity data

A Microsoft account is a personal account for signing in to Microsoft products and those of select partners. The personal data associated with it includes credentials, name and contact data, payment data, device and usage data, contacts, information about your activities, and interests and favorites. Signing in enables personalization, consistent experiences across products and devices, cloud storage, payments with stored payment methods and other features. The data associated with the account and how it is used depend on how you use the account.

Supporting quotations

Personal data associated with your Microsoft account includes credentials, contact and payment data, device and usage data and activity-related information.

This account includes personal data such as your credentials, name and contact data, payment data, device and usage data, contacts, information about your activities, and interests and favorites.

Signing into your Microsoft account helps personalize your experience, provides consistent experiences across products and devices, enables cloud storage, lets you make payments with stored payment methods, and enables other features.

The data associated with your Microsoft account, and how that data is used, depends on how you use the account.

Qualifications & exceptions

• What data is associated with the account depends on how you use it.

Sharing & Disclosure · Company practice

Signing in to third-party products or paying third-party merchants shares account data with them

If you sign in to a service offered by a third party with your Microsoft account, Microsoft shares account data with that third party according to the third party's privacy policy. When you sign in to a third-party product or pay third-party merchants with your Microsoft account, Microsoft shares data as needed, including your account version number and whether your account has been deactivated. Third parties may use or share your data under their own privacy policies, and you are told to review those policies.

Supporting quotations

If you sign into a service offered by a third party with your Microsoft account, Microsoft shares account data with that third party according to the third party’s privacy policy.

Microsoft shares data with the third party as needed, including your account version number and whether your account has been deactivated.

Third parties may use or share your data per their own privacy policies.

Qualifications & exceptions

• Sharing is "as needed", and the examples include account version number and whether the account is deactivated.
• The third party then handles the data under its own privacy policy.

Account & Service Control · Restriction or exception

A work or school account is controlled by your organization, which can access your data and content

A work or school account (also known as a Microsoft Entra ID account) is provided and managed by your organization. If you sign in to Microsoft products with one, your organization controls the account and can access and process your data, including communications, files and content in products you use with it. Your use is subject to the organization's policies, and the statement suggests reviewing them before using the account for personal use. If you lose access (for example by changing employers) you may lose access to products or content purchased or accessed with it. If you use a work or school email address to create a Microsoft account, your organization may access your data associated with that account. Microsoft says it is not responsible for your organization's privacy or security practices. Privacy questions and requests, such as access, correction or deletion, should go to your administrator.

Supporting quotations

A work or school account, also known as a Microsoft Entra ID account, is an account that is provided and managed by your organization, such as your employer or school.

Your organization controls your account and can access and process your data, including your communications, files, and content in products you use with your account.

Review your organization’s privacy and security policies before using your work or school account for personal use.

you may also lose access to products or content purchased or accessed with that account

If you use a work or school email address to create a Microsoft account, your organization may access your data associated with your Microsoft account.

Microsoft is not responsible for your organization’s privacy or security practices, which may differ from our own standards.

Direct any privacy questions or requests (such as to access, correct, or delete your data) to your administrator.

Qualifications & exceptions

• Applies when you sign in with a work or school account or create a Microsoft account with a work or school email address.
• Microsoft disclaims responsibility for the organization's practices.

Cross-references

• qualifies (model-proposed): A Microsoft account ties together credentials, contact, payment, device and activity data — qualifies: A personal account description is qualified for work or school accounts: the organization controls the account and can access its data.

Account & Service Control · Restriction or exception

A third-party account created through your service provider is controlled by that provider

A third-party account is a Microsoft account that you or a service provider, such as a cable or internet provider, create that is tied to an email address on the provider's domain. The service provider has control over the account, including the ability to access or delete it. The statement tells you to review the terms the provider gave you to understand what it can do with your account and data. Those provider terms are not supplied here.

Supporting quotations

A third-party account is a Microsoft account that you or your service provider (such as a cable or internet service provider) create that is tied to your email address with your service provider’s domain.

Your service provider has control over your account, including the ability to access or delete your account.

Qualifications & exceptions

• Applies to accounts tied to an email address on a service provider's domain.

Not stated here

• The service provider's terms are not part of the supplied text.

Account & Service Control · Company practice

Creating an account assigns a unique ID, may require a real name, and may make your details findable by others

When you create a Microsoft account you are asked for certain personal data and Microsoft assigns you a unique ID. For some products, such as those involving payments, a real name is required, but many products can be used without one. Your display name, email address and phone number can help others find you on Microsoft products, for example in Teams for personal use. In some cases you may need to switch to a personal email address to keep accessing consumer-oriented products like the Xbox network.

Supporting quotations

When you create a Microsoft account, you'll be asked to provide certain personal data and we'll assign you a unique ID.

For some products, like those involving payments, a real name is required, but many products can be used without it.

Data such as your display name, email address, and phone number can help others find you on Microsoft products

you may need to switch to a personal email address to continue accessing consumer-oriented products like the XBOX network

Qualifications & exceptions

• A real name is required only for some products such as those involving payments.

Data Access & Collection · Company practice

Microsoft logs the time, product, identifiers, IP address and device details when you sign in

When you sign in to your Microsoft account, Microsoft logs details including the date and time, the product accessed, your sign-in name, account and device identifiers, your IP address, and operating system and browser information.

Supporting quotations

When you sign in to your Microsoft account, we log details like the date and time, product accessed, sign-in name, account and device identifiers, IP address, and operating system and browser information.

Account & Service Control · Company practice

Signing in carries your account across products, can sign you in automatically, and may show your name and photo

Signing in to Microsoft products enables improved personalization, consistent experiences, cloud storage access and payments using information stored in your account, and information saved to your account may be available across Microsoft products. If you add your account to a Windows device (version 8 or higher), Windows automatically signs you in to Microsoft products on that device. When signed in, some products will show your name or username and profile photo, if you have one, in Microsoft products, communications and public posts.

Supporting quotations

Information saved to your account may be available across Microsoft products.

If you add your account to a Windows device (version 8 or higher), Windows will automatically sign you in to Microsoft products on that device.

some products will show your name or username and profile photo (if you have one) in Microsoft products, communications, and public posts

Qualifications & exceptions

• Windows automatic sign-in applies to Windows 8 or higher devices where the account is added.
• Name and photo display applies to "some" products.

Account & Service Control · Restriction or exception

Children under 13 (or a higher regional age) need a parent's consent to create a Microsoft account

Microsoft says children and teens can use many of its products, but may not have access to every feature adults do; some features are off by default or unavailable to younger users. When a child is under 13, or a higher age if required in their region, the child needs consent from a parent or guardian to create a Microsoft account, and parents can change or revoke consent at any time. For users under 13 or the age specified by law, certain products either block them or require parental or guardian consent or authorization before use. When consent is received the child's account is treated much like any other account, and the child can use services such as Outlook, Bing and Xbox and communicate or share data with other users. Microsoft says it will not knowingly ask children under the age of consent to provide more data than is necessary to provide the product.

Supporting quotations

child and teen users will not always have access to all the features and services that adult users do. Some of these features will be off by default or unavailable to younger users.

When a child is under 13-or a higher age if required in their region-the child will need consent from their parent or guardian to create a Microsoft account.

Parents can change or revoke consent at any time.

certain Microsoft products and services will either block users under that age or require parental or guardian consent or authorization before use, including when creating an account

the child's account is treated much like any other account, and the child will be able to use Microsoft services such as Outlook, Bing, and XBOX, and communicate or share data with other users

We will not knowingly ask children under the age of consent to provide more data than is necessary to provide the product.

Qualifications & exceptions

• The age threshold is 13 or a higher age where the region requires it.
• After consent, the account is treated "much like any other account", including communicating and sharing data with other users.

Account & Service Control · User right or choice

Child accounts join a family group where parents can manage settings and view or delete the child's data

Microsoft offers Family Safety tools that let parents connect their children's accounts to a family group. Accounts created with parental consent are automatically added to the parent's family group. As organizer, the parent or guardian can manage the child's information and settings on the Family Safety page and view or delete the child's data on their privacy dashboard. For child accounts that do not need parental consent to be created, parents can add the account to their family group after it is created. Parents of Xbox users have additional controls through the Xbox Family Settings app, and Xbox features are covered in the Xbox section.

Supporting quotations

Microsoft accounts created using parental consent are automatically added to the parent’s family group.

the parent or guardian can manage their child’s information and settings on their

view and delete a child’s data on their

Parents of XBOX users have additional controls through the XBOX Family Settings app.

For child accounts that don’t need parental consent to be created, parents can add the child account to their family group after account creation.

For more information on XBOX features, in-product controls, and the associated personal data collection, use, and disclosure, please see the XBOX section of this privacy statement.

Qualifications & exceptions

• Automatic addition applies to accounts created with parental consent; other child accounts must be added by the parent.

Use & Processing · Company commitment

Microsoft does not deliver personalized ads to accounts whose birthdate shows the user is under 18

Microsoft states that it does not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18 years of age. The commitment depends on the birthdate in the account; the statement points to the Advertising and Microsoft account sections for details.

Supporting quotations

we do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18 years of age

Qualifications & exceptions

• Depends on the birthdate recorded in the Microsoft account.

Not stated here

• The text does not say how ads are handled for under-18 users who have no birthdate recorded or who are signed out.

Cross-references

• narrows (model-proposed): Where permitted, personalized ads use data collected over time, including from advertisers and partners — exception_to: Personalized ads may use data collected over time where permitted, but not for accounts whose birthdate shows the user is under 18.

Account & Service Control · User right or choice

Parents can view and delete certain child data on the privacy dashboard, subject to local law

For products that require parental consent, parents can view and delete certain data about their child, such as browsing history, search history, location activity and app usage, by signing in to the parent's privacy dashboard. Some products, including Xbox, have their own in-product controls. A parent's ability to access or delete a child's personal information may vary depending on the laws where the parent is located.

Supporting quotations

For Microsoft products and services that require parental consent, parents can view and delete certain data about their child, such as browsing history, search history, location activity, and app usage by signing into the parent’s

Some Microsoft products, including XBOX, also have their own in-product controls.

a parent’s ability to access and/or delete their child’s personal information may vary depending on the laws where they’re located

Qualifications & exceptions

• Covers "certain" data, not necessarily all.
• Varies by the laws where the parent is located.

Account & Service Control · Procedure

Parents of children outside their family group can ask the privacy team, with verification and a 30-day deletion window

If a child's account is not part of your Microsoft family group and you cannot see their activity on your privacy dashboard, you can submit a request about the child's data through the privacy support form. The privacy team asks for account verification before fulfilling the request. Microsoft says it processes authenticated deletion requests within 30 days of receipt.

Supporting quotations

submit a request related to your child’s data through the

The privacy team will ask for account verification before fulfilling the request.

We process authenticated deletion requests within 30 days of receipt.

Qualifications & exceptions

• Deletion is processed within 30 days only for authenticated requests.

Retention & Deletion · Procedure

Closing a child's account deletes all their information, but only after a 60-day wait

To delete all of a child's personal information, you request deletion of the child's account using the close your account form while signed in to the child's account. After you request closure the account is marked for deletion, but Microsoft waits 60 days before permanently deleting it, in case you change your mind or need information. After 60 days the account is permanently deleted.

Supporting quotations

To delete all your child’s personal information, request deletion of the child’s account using the

the account is marked for deletion, but we will wait 60 days before permanently deleting the account in case you change your mind or need to access information. After 60 days, the account will be permanently deleted.

Qualifications & exceptions

• The account is marked for deletion and kept for 60 days before permanent deletion.

Use & Processing · Company practice

Data may be stored and processed in your region, the United States, and wherever Microsoft or its providers operate

Microsoft may store and process your personal data in your region, the United States, and any other jurisdiction where Microsoft or its affiliates, subsidiaries or service providers operate facilities. It lists major data centers in Australia, Austria, Brazil, Canada, Finland, France, Germany, Hong Kong, India, Ireland, Japan, Korea, Luxembourg, Malaysia, the Netherlands, Singapore, South Africa, the United Kingdom and the United States. Typically the primary storage location is in your region or in the United States, often with a backup in a data center in another region. Locations are chosen to operate services efficiently, improve performance and create redundancy in case of an outage or other problem.

Supporting quotations

Microsoft may store and process your personal data in your region, the United States, and any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities.

Microsoft maintains major data centers in Australia, Austria, Brazil, Canada, Finland, France, Germany, Hong Kong, India, Ireland, Japan, Korea, Luxembourg, Malaysia, the Netherlands, Singapore, South Africa, the United Kingdom, and the United States.

Typically, the primary storage location is in your region or in the United States, often with a backup to a data center in another region.

Storage location(s) are chosen in order to operate and provide our services efficiently, improve performance, and create redundancies in order to protect the data in the event of an outage or other problem.

Qualifications & exceptions

• "Typically" the primary location is in your region or the United States; this is not a guarantee.
• Backups are "often" in another region.

Sharing & Disclosure · Company practice

Data is transferred internationally, including to countries with weaker protection, under legal safeguards

Microsoft transfers personal data from the country of origin to other countries, including ones that may not offer the level of data protection the European Commission or your local data protection authority has determined to be adequate. In those cases it says it implements legal safeguards, such as standard contractual clauses approved by the European Commission, to help protect your rights and keep data protected. It notes the EU has found certain non-EU countries to have an "adequate" level of protection. For other reasons data may be transferred, it points to the sharing section.

Supporting quotations

When we transfer personal data internationally, we implement appropriate legal safeguards – to help protect your rights and ensure your data remains protected.

We transfer personal data from the country of origin to other countries, including those that may not offer the same level of data protection as determined by the European Commission or your local data protection authority.

we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected

Please refer to the Reasons we share personal data section for more information on Microsoft’s sharing of data, which include when we transfer data to another country.

Qualifications & exceptions

• Safeguards are stated as help to protect your rights; the exact safeguard for each transfer is not listed.
• Standard contractual clauses are one example, not the only safeguard.

Legal Rights & Agreement Rules · Company commitment

Microsoft Corporation certifies to the EU-U.S., UK Extension and Swiss-U.S. Data Privacy Frameworks

Microsoft Corporation says it complies with the EU-U.S. Data Privacy Framework, the UK Extension to it, and the Swiss-U.S. Data Privacy Framework, as set forth by the U.S. Department of Commerce. It says it has certified that it adheres to the EU-U.S. principles for personal data received from the European Union and from the United Kingdom (and Gibraltar), and to the Swiss-U.S. principles for personal data received from Switzerland. The controlled U.S. subsidiaries identified in its self-certification also adhere to the principles; the list of covered entities is linked, not supplied here.

Supporting quotations

Microsoft Corporation complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF

with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF

The controlled U.S. subsidiaries of Microsoft Corporation, as identified in our self-certification submission, also adhere to the DPF Principles

Qualifications & exceptions

• The commitment is by Microsoft Corporation and the U.S. subsidiaries named in its certification.

Not stated here

• The list of covered U.S. entities is linked but not part of the supplied text.

Legal Rights & Agreement Rules · Company commitment

Under the framework Microsoft stays liable for agents, and the framework principles prevail over this statement

For onward transfers, Microsoft Corporation says it is responsible for processing personal data it receives under the framework and then transfers to a third party acting as its agent. It remains liable under the framework if the agent processes such data inconsistently with it, unless Microsoft can prove it is not responsible for the event giving rise to the damage. If there is any conflict between this privacy statement and the EU-U.S. or Swiss-U.S. framework principles, the principles govern.

Supporting quotations

In the context of an onward transfer, Microsoft Corporation has responsibility for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on our behalf.

Microsoft Corporation remains liable under the DPF if our agent processes such personal data in a manner inconsistent with the DPF, unless Microsoft Corporation can prove that we are not responsible for the event giving rise to the damage.

If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.

Qualifications & exceptions

• Liability applies to agents acting on Microsoft's behalf, with an exception if Microsoft proves it is not responsible.
• The principles govern in a conflict with this statement.

Legal Rights & Agreement Rules · Procedure

Framework complaints go to Microsoft, then EU, UK or Swiss authorities, with binding arbitration as a last resort

For a question or complaint about Microsoft's participation in the Data Privacy Frameworks, Microsoft encourages contacting it through the privacy support and requests page. For complaints it cannot resolve directly, it has chosen to cooperate with the relevant EU Data Protection Authority or a panel of European data protection authorities for EU individuals, the UK Information Commissioner for UK individuals, and the Swiss Federal Data Protection and Information Commissioner for Swiss individuals, and will direct you to your authority's contacts if asked. Under the framework principles, binding arbitration is available for residual complaints not resolved by other means. Microsoft says it is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Supporting quotations

we encourage you to contact us via our

we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities, for resolving disputes with EU individuals, the UK Information Commissioner for resolving disputes with UK individuals, and the Swiss Federal Data Protection and Information Commissioner (FDPIC) for resolving disputes with Swiss individuals

binding arbitration is available to address residual complaints not resolved by other means

Microsoft is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Qualifications & exceptions

• Applies to EU, UK and Swiss individuals for framework-related complaints.
• Binding arbitration is for residual complaints not resolved by other means.

Legal Rights & Agreement Rules · Context

Individuals in Japan are pointed to Japanese-language references on data protection and telecommunications law

For individuals whose data is protected by Japan's Act on the Protection of Personal Information, the statement refers to an article on the Japanese Personal Information Protection Commission's website, published only in Japanese, about the commission's review of certain countries' data protection systems. For individuals in Japan it also links to a notice, in Japanese only, about the processing of information under the Telecommunications Business Act. Neither linked document is supplied here.

Supporting quotations

Individuals whose personal data is protected by Japan’s Act on the Protection of Personal Information should refer to the article on the

For individuals in Japan, please click

Qualifications & exceptions

• Applies to individuals in Japan.

Not stated here

• The linked Japanese-language article and notice are not part of the supplied text.

Use & Processing · Company practice

Ads may follow your current activity or a profile built over time, and you can opt out of personalization

Microsoft says advertising helps it provide, support and improve some of its products. Ads may be shown based on your current interactions and may also be personalized using information about you over time. You can opt out of personalized ads on the personalized ads and offers page and opt out of sharing data with third parties for personalized ads on the third-party ad settings page. Microsoft says it receives and responds to the Global Privacy Control browser signal. It uses data other than message and file content for advertising on Microsoft and third-party properties.

Supporting quotations

Ads may be shown based on your current interactions with us, as well as personalized using information about you over time.

You can opt out of receiving personalized ads through our

can opt out of sharing data with third parties for personalized ads by visiting our

Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal.

We use other data for advertising on Microsoft and third-party properties.

Qualifications & exceptions

• Opt-out covers personalization and third-party sharing for personalized ads, not all advertising.

Use & Processing · Restriction or exception

What you say in messages and calls and your personal files are not used to target ads

Microsoft states that it does not use what you say in email, human-to-human chat, video calls or voice mail, or your documents, photos or other personal files stored on your device or cloud storage, to target ads to you. It uses other data for advertising on Microsoft and third-party properties. The exclusion is about targeting ads; the text does not address other uses of that content.

Supporting quotations

Microsoft does not use what you say in email, human-to-human chat, video calls or voice mail, or your documents, photos, or other personal files stored on your device or cloud storage to target ads to you.

Qualifications & exceptions

• The commitment concerns ad targeting only.

Use & Processing · Company practice

Ads can relate to your current interaction, including Copilot conversations and files you share

Ads may relate to the current interaction you are having with Microsoft, such as your Copilot conversations (including files you share), your current location, transactions, product usage, search queries or the content you are viewing. For example, a Bing search for pizza places in Seattle may show ads for local restaurants.

Supporting quotations

Ads may be shown that relate to the current interaction you are having with us, such as your Copilot conversations (including files you share); your current location; transactions; product usage; search queries; or the content you’re viewing.

Qualifications & exceptions

• This covers ads tied to your current interaction, separate from profile-based personalization.

Inference & Profiling · Company practice

Where permitted, personalized ads use data collected over time, including from advertisers and partners

Where permitted, ads can also be personalized using information about you collected over time, such as demographic data, location, search queries, interests, purchase history, favorites, usage of Microsoft products and sites, and information from advertisers and partners. Microsoft calls these personalized advertising. Its example is viewing gaming content on Xbox.com and later seeing game ads on MSN.

Supporting quotations

Where permitted, ads can also be personalized using information about you collected over time, like demographic data, location, search queries, interests, purchase history, favorites, usage of our products and sites, and information from advertisers and partners.

viewing gaming content on

Qualifications & exceptions

• Applies "where permitted" by law or your settings.

Linking & Identification · Company practice

Personalized ads combine cookies with data like your IP address; opting out stops cookie data being used

Personalized ads use cookies combined with information collected when your browser interacts with Microsoft sites, such as your IP address. Microsoft states that data from cookies will not be used for personalized ads if you opt out of receiving them. It points to the personalized ads and offers settings page and its Opting Out section.

Supporting quotations

Personalized ads use cookies combined with information we collect when your browser interacts with our sites (like your IP address.)

Data from cookies will not be used for personalized ads if you opt-out of receiving such ads.

Qualifications & exceptions

• The opt-out promise is about cookie data and personalized ads.

Use & Processing · Company practice

Edge activity feeds personalized ads when signed in, and third parties can use the Windows advertising ID

Certain products have their own personalized ads settings. If you are signed in with your Microsoft account, subject to your privacy settings, Microsoft uses your online activity in Microsoft Edge to show you personalized ads, and you can adjust Edge settings under Privacy and Services. In Windows, if the advertising ID is enabled in your Windows privacy settings, third parties can access and use it to deliver ads in apps.

Supporting quotations

Certain products have their own personalized ads settings.

if you’re signed in with your Microsoft account, subject to your privacy settings, we use your online activity in Microsoft Edge to show you personalized ads

if the advertising ID is enabled in your Windows privacy settings, third parties can access and use it to deliver ads in apps

Qualifications & exceptions

• Edge personalization applies when signed in and subject to your privacy settings.
• Third-party use of the advertising ID applies when it is enabled.

Legal Rights & Agreement Rules · Company commitment

Microsoft says it adheres to the NAI framework and to DAA, EDAA and DAAC advertising programs

Microsoft states that it participates in industry self-regulatory programs and adheres to the NAI Self-Regulatory Framework. It also lists the Digital Advertising Alliance in the US, the European Interactive Digital Advertising Alliance in Europe, and the Digital Advertising Alliance of Canada. Those programs' rules are not supplied here.

Supporting quotations

Microsoft participates in industry self-regulatory programs and adheres to the

In the US:

In Europe:

In Canada:

Not stated here

• The self-regulatory frameworks' requirements are not part of the supplied text.

Use & Processing · Company commitment

No personalized ads to under-18 accounts, and no sensitive data for personalized advertising

Microsoft states that it does not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18. It also states that Microsoft Advertising does not collect, process or disclose personal data that qualifies as "sensitive data" under applicable U.S. state data privacy laws for the purposes of providing personalized advertising. The sensitive data commitment is tied to those state-law definitions and to Microsoft Advertising.

Supporting quotations

We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18 years of age.

Microsoft Advertising does not collect, process, or disclose personal data that qualifies as “sensitive data” under applicable U.S. state data privacy laws for the purposes of providing personalized advertising.

Qualifications & exceptions

• The children commitment depends on the birthdate in the account.
• The sensitive data commitment is limited to Microsoft Advertising and to sensitive data as defined under applicable U.S. state laws, for personalized advertising purposes.

Account & Service Control · User right or choice

Opting out is tied to your account when signed in, or to a five-year cookie when signed out

To opt out of personalized advertising from Microsoft you use the personalized ads and offers page, and to opt out of sharing data with third parties for personalized ads you use the third-party ad settings page. When logged in, your choice is tied to your account and applies across devices whenever you are signed in. When not signed in, the preference is stored in a browser-specific cookie valid for five years, and you must opt out again if you delete cookies. Microsoft receives and responds to the GPC signal in certain jurisdictions; on receiving one it turns off sharing data with third parties for personalized ads and the related toggle.

Supporting quotations

When you’re logged into your Microsoft account, your opt out choice will be associated with your account and applied across devices whenever you are signed in.

your preference is stored in a browser-specific cookie on your device, valid for five years; if you delete cookies, you must opt out again

Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions.

Microsoft will turn off sharing your data with third parties for personalized ads

Qualifications & exceptions

• Signed-out opt-outs live in a cookie and are lost if cookies are deleted.
• GPC is honored "in certain jurisdictions".

Not stated here

• The jurisdictions where GPC is honored are not named here.

Sharing & Disclosure · Company practice

Advertisers and ad companies can set cookies and track you across sites; Microsoft shares reports with advertisers

Advertisers sometimes include their own or other partners' web beacons within ads Microsoft displays, which lets them set and read their own cookies. In some cases Microsoft shares reports with advertisers about data it collected on their sites or ads. Microsoft partners with Xandr, a Microsoft company, and third-party ad companies to help provide advertising services, and also allows other third-party ad companies to display ads on its sites. These third parties may place cookies on your devices and collect data about your online activities across websites or online services. The companies currently include, but are not limited to, Facebook, Media.net, Outbrain, Taboola and Yahoo.

Supporting quotations

Advertisers sometimes include their own or other advertising partners’ web beacons within their ads that we display, enabling them to set and read their own cookies.

In some cases, we share reports with advertisers about the data we have collected on their sites or ads.

These third parties may place cookies on your devices and collect data about your online activities across websites or online services.

These companies currently include, but are not limited to:

Qualifications & exceptions

• The named companies are examples ("include, but are not limited to").
• Reports shared with advertisers are "in some cases".

Sharing & Disclosure · Company practice

Microsoft may give collected data to partners such as Xandr, Yahoo, Facebook and The Trade Desk for ad relevance

Microsoft says it may provide collected data to internal and external partners, including Xandr, other subsidiaries and affiliates, Yahoo, Facebook or The Trade Desk, to help make ads in Microsoft products, theirs or on other sites more relevant to you. Individuals in the United Kingdom are pointed to a Trade Desk page to learn about its advertising practices and opt out. Many of these companies take part in industry choice tools (DAA in the US, EDAA in Europe, DAAC in Canada) that let you opt out of ad targeting by participating companies.

Supporting quotations

We may provide collected data to internal and external partners, including Xandr, other subsidiaries and affiliates, Yahoo, Facebook, or Trade Desk to help make sure the ads you see in our products and theirs, or on other sites, are more relevant to you.

Many of these companies participate in the

which provide industry-wide choice tools to opt out of ad targeting from participating companies

Qualifications & exceptions

• Provision of data is stated as "may".
• Industry opt-out tools cover participating companies only.

Data Access & Collection · Company practice

Diagnostic data has required and optional levels; only the optional level can be turned off

Many Microsoft products collect diagnostic data to keep services secure and up to date, help ensure they work as expected, detect and fix problems and improve products; it can include information about crashes, performance and your product usage. There are two levels. Required diagnostic data is the minimum needed to keep products secure, up to date and performing as expected, and includes information about your device, the Microsoft software you use, settings, capabilities and performance. Products that collect diagnostic data always collect the required level, but you can control whether to send optional diagnostic data. Optional diagnostic data is additional data about your use of devices, applications, accessories and other products, and may include data about the websites you browse, device activity and enhanced error reporting. A Privacy Report is linked for more on how diagnostic data is used and is not supplied here.

Supporting quotations

Many Microsoft products collect diagnostic data to keep our services secure and up-to-date; help ensure they work as expected; detect, diagnose, and fix problems; and improve our products.

Products that collect diagnostic data will always collect required diagnostic data, but you can control whether to send us optional diagnostic data.

The minimum data necessary to help keep our products, apps and services secure, up to date, and performing as expected.

This may also include data about the websites you browse, device activity (also sometimes referred to as usage), and enhanced error reporting.

Qualifications & exceptions

• Required diagnostic data is always collected by products that collect diagnostic data.
• Only optional diagnostic data can be controlled.
• Optional diagnostic data "may" include browsing data.

Not stated here

• The linked Privacy Report is not part of the supplied text.

Data Access & Collection · Restriction or exception

Preview and free-of-charge releases can collect more data and offer fewer controls

Microsoft offers preview, insider, beta or other free-of-charge products and features so you can evaluate them while providing data about your use, including feedback and device and usage data. As a result, previews can automatically collect additional data, provide fewer controls and use different privacy and security measures than those typically present in its products.

Supporting quotations

previews can automatically collect additional data, provide fewer controls, and otherwise employ different privacy and security measures than those typically present in our products

Qualifications & exceptions

• Applies to previews, insider, beta and other free-of-charge releases.

Legal Rights & Agreement Rules · Company commitment

Microsoft updates the statement when needed, and gives prominent notice of material changes before they take effect

Microsoft updates the statement when necessary, for example in response to feedback, product changes, changes in its data processing or policies, or changes in law. When it posts changes it revises the last updated date and describes the changes on a Change history page. If there are material changes, such as a change to the purposes of processing that is not consistent with the original purpose for collection, it says it will give prominent notice before the change takes effect. It encourages you to review the statement periodically.

Supporting quotations

We update this privacy statement when necessary and to provide greater transparency

we will revise the "last updated" date at the top of the statement and describe the changes on the

If there are material changes to the statement, such as a change to the purposes of processing personal data that is not consistent with the original purpose for collection, we will provide prominent notice of the change before it takes effect.

We encourage you to periodically review this privacy statement for updates.

Qualifications & exceptions

• Prominent advance notice is promised for material changes; other changes are shown by the updated date and the Change history page.

Legal Rights & Agreement Rules · Company commitment

Microsoft promises a response within 30 days, and you can also complain to a data protection authority

To raise a privacy concern, complaint or question with the privacy team or the Data Protection Officer for your region, you use the privacy support and requests page and its contact menu. Microsoft says it will respond to questions or concerns within a period of no longer than 30 days or where otherwise required by law. You can also raise a concern or lodge a complaint with a data protection authority or other official with jurisdiction.

Supporting quotations

If you have a privacy concern, complaint, or question for the Microsoft privacy team or the Data Protection Officer for your region, please visit our

We will respond to questions or concerns within a period of no longer than 30 days or where otherwise required by law.

You can also raise a concern or lodge a complaint with a data protection authority or other official with jurisdiction.

Qualifications & exceptions

• The 30-day response is a maximum "or where otherwise required by law".

Legal Rights & Agreement Rules · Context

Microsoft Corporation, and Microsoft Ireland Operations Limited for EEA, UK and Swiss users, are the data controllers

When Microsoft is a controller, unless otherwise stated, Microsoft Corporation is the data controller for personal data collected through the products subject to this statement. For those in the European Economic Area, the United Kingdom and Switzerland, Microsoft Ireland Operations Limited is also named as a data controller. The statement gives a Redmond, Washington address and phone number for Microsoft Privacy, an address and phone number in Dublin for the Data Protection Officer of Microsoft Ireland Operations Limited, a link to find the subsidiary in your country, and Microsoft Schweiz GmbH as the representative of Microsoft Ireland Operations Limited under the Swiss Federal Act on Data Protection.

Supporting quotations

When Microsoft is a controller, unless otherwise stated, Microsoft Corporation and, for those in the European Economic Area, the United Kingdom, and Switzerland, Microsoft Ireland Operations Limited are the data controllers for personal data we collect through the products subject to this statement.

Microsoft Privacy, Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA.

Microsoft Ireland Operations Limited, Attn: Data Protection Officer, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

The representative of Microsoft Ireland Operations Limited within the meaning of Art. 14 of the Swiss Federal Act on Data Protection is Microsoft Schweiz GmbH

Qualifications & exceptions

• Applies "when Microsoft is a controller, unless otherwise stated".

Account & Service Control · Procedure

Extra contact routes: U.S. state-law requests, Brazil LGPD, deceased users' accounts and support

To exercise rights under applicable U.S. state data privacy law you may contact Microsoft at the U.S. address listed, use the privacy support and requests page or call a U.S. toll-free number. If you are in Brazil, a separate page lets you contact Microsoft under the LGPD. Next of kin can find information on managing a deceased loved one's Microsoft accounts on the privacy support and requests page. For technical or support questions, or personal Microsoft account password questions, the statement points to Microsoft Support and Microsoft account support.

Supporting quotations

If you would like to exercise your rights under applicable U.S. state data privacy law, you may contact Microsoft at the U.S. address listed above

or call our U.S. toll free number +1 (844) 931 2038

If you are located in Brazil, you may contact us under the LGPD

If you are a next of kin, more information about managing your deceased loved one’s Microsoft accounts is available on our

If you have a technical or support question, please visit

Qualifications & exceptions

• The U.S. state-law route applies to rights under applicable U.S. state privacy laws.

Account & Service Control · Procedure

You can exercise data rights by contacting Microsoft or using its tools

Closing the contact section, Microsoft says it offers various means to control the personal data it has obtained and to exercise data protection rights: contacting Microsoft through the privacy support and requests page or the contact information above, or using the tools it provides. It points to the How to access and control your personal data section for more detail.

Supporting quotations

We offer various means for you to control your personal data that Microsoft has obtained, and to exercise your data protection rights.

You can do so by contacting Microsoft at our

Use & Processing · Company commitment

Microsoft uses generative AI across products and says it follows its AI Principles and Responsible AI Standard

Microsoft says it uses artificial intelligence in many products and services, including generative AI features, and that "Copilot" is a family of services, products and solutions using generative AI to produce outputs. It says its use of AI is subject to its AI Principles and Responsible AI Standard, and that its collection and use of personal data in developing and deploying AI features is consistent with the commitments in the privacy statement. Those principles and standard are linked, not supplied here.

Supporting quotations

Microsoft leverages artificial intelligence (AI) in many of our products and services, including by incorporating generative AI features.

Our use of AI is subject to Microsoft’s

our collection and use of personal data in developing and deploying our AI features is consistent with our commitments outlined throughout our privacy statement

Microsoft’s collection and use of data may differ depending on the service and the intended functionality in a given scenario.

our collection and use of personal data in developing and deploying our AI features is consistent with our commitments outlined throughout our privacy statement

Qualifications & exceptions

• Data collection and use may differ depending on the Copilot service and the intended functionality.

Not stated here

• The AI Principles and Responsible AI Standard are linked but not part of the supplied text.

Use & Processing · Company practice

Microsoft Copilot uses your prompts, location, language and settings and can act on other apps for you

The Copilot website and apps are the core of the consumer Copilot experience: you can search the web, create content, use features like Copilot Vision, and let Copilot interact with other apps, services and websites to take actions on your behalf. When you use Copilot it uses your prompts, location, language and related settings to provide helpful responses and improve services.

Supporting quotations

as well as let Microsoft Copilot interact with other apps, services, and websites to take actions on your behalf

When you use Microsoft Copilot, it will use your prompts, location, language, and related settings to provide helpful responses and improve services.

Qualifications & exceptions

• Copilot can interact with other apps, services and websites to act on your behalf.

Inference & Profiling · Company practice

In some markets Copilot uses conversation history and saved memories, and may use data from Bing, Edge and MSN

For users in some markets, Copilot can use your conversation history, including any memories you save, to personalize your experience. Microsoft may also offer to personalize Copilot using your interactions with other products and services, like Bing, Edge and MSN. You can manage your memories and control personalization features through the settings in Copilot at any time.

Supporting quotations

For users in some markets, Microsoft Copilot can use your conversation history (including any memories you save) to personalize your experience.

using your interactions with our other products and services, like Bing, Edge, and MSN

You can manage your memories and control personalization features using the settings in Microsoft Copilot at any time.

Qualifications & exceptions

• Applies to users in some markets.
• Personalization from other products is something Microsoft "may" offer.

Not stated here

• The text does not list which markets are included.

Use & Processing · Company practice

Copilot prompts and conversation data are used to improve services, for advertising, and to prevent abuse

Microsoft says Copilot uses prompts and related data to provide and improve services, including relevant advertising. You can manage your prompt history in the product and on the Microsoft Privacy Dashboard, and adjust your location, language and other privacy settings in the product. Microsoft also uses your conversation data to monitor performance, troubleshoot and fix bugs, prevent abuse, and provide and improve Copilot. Its safety practices are described in a linked Transparency Note, which is not supplied here.

Supporting quotations

Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising.

You can manage your prompt history in product and on the Microsoft Privacy Dashboard

We also use your conversation data to monitor performance, troubleshoot and fix bugs and issues, prevent abuse, and to provide and improve Microsoft Copilot.

Qualifications & exceptions

• Advertising use is stated for prompts and related data.

Not stated here

• The linked Transparency Note and privacy controls page are not part of the supplied text.

Use & Processing · Context

Copilot in Edge, Xbox, third-party platforms and enterprise settings follows different rules

Where Copilot appears in other Microsoft products, such as Edge and Xbox, data is generally used according to each product's primary uses, as described in those sections. If you use Copilot in third-party products and services, such as messaging platforms, Microsoft processes your data as described in the statement, but the third party's privacy policies and data processing may also apply. For enterprise customers, Copilot offers enhanced data protection and customization, with data collected and used as described in the Enterprise and Developer Products section.

Supporting quotations

In these cases, data is generally used according to each product’s primary uses.

the third party’s privacy policies and data processing activities may also apply

For enterprise customers, Microsoft Copilot offers enhanced data protection and customization. Data is collected and used as described in the Enterprise and Developer Products section.

Qualifications & exceptions

• In other Microsoft products data is "generally" used according to each product's primary uses.
• A third party's policies may apply in addition.

Use & Processing · Company practice

Copilot in Microsoft 365 subscriptions processes content you choose, only when you ask it to act

Copilot features in Microsoft 365 apps that come with Microsoft 365 Personal, Family or Premium subscriptions apply large language model processing to content you choose to provide in apps such as Word, Excel, OneNote, Outlook and PowerPoint. Microsoft says Copilot uses the content in your files only when you ask it to perform a specific action on that specific content. It is not available in Office desktop licenses. Required service data about the operation of the service is collected during use, and Copilot handles data as described in the Productivity and Communications section. Linked Privacy Center and FAQ pages are not supplied here.

Supporting quotations

We do so by applying large language model (LLM) processing on the content you choose to provide in Microsoft 365 apps

Microsoft Copilot will use the content in your files only when you ask it to perform a specific action on that specific content

required service data is collected during your use of Microsoft Copilot

See the

Qualifications & exceptions

• File content is used only when you ask for a specific action on it.
• Applies to Microsoft 365 Personal, Family and Premium subscriptions.

Not stated here

• The Copilot Privacy Center and FAQ pages are not part of the supplied text.

Data Access & Collection · Company practice

Copilot Health lets you upload health records and wearable data to personalize health information

Copilot Health is a consumer Copilot offering for personalized assistance on health and wellness. It lets you upload health-related data, including personal health records and data from wearable devices, and can use that data together with your prompts and chat history to give you personalized information and recommendations.

Supporting quotations

Copilot Health allows you to upload health-related data including your personal health records and data from wearable devices.

Copilot Health can use that data, along with your prompts and chat history, to provide you with personalized information and recommendations.

Qualifications & exceptions

• You choose what health data to upload.

Use & Processing · Company commitment

Data you submit to Copilot Health is not used to train generative AI or for advertising or marketing

Microsoft states that the information you choose to submit to Copilot Health is used to provide and operate the Copilot Health service. It states that this information is not used to develop or train generative AI models and is not used for advertising or marketing purposes. This commitment is about the information you submit to Copilot Health; the Copilot Health FAQs are linked and not supplied here.

Supporting quotations

The information you choose to submit to Copilot Health is used to provide and operate the Copilot Health service.

It is not used to develop or train generative AI models, and it is not used for advertising or marketing purposes.

Qualifications & exceptions

• The commitment covers information you choose to submit to Copilot Health.

Not stated here

• The Copilot Health FAQs are not part of the supplied text.

Cross-references

• narrows (model-proposed): Microsoft may use your data to develop and train its AI models — exception_to: The general statement says Microsoft may use data to develop and train AI models; for information submitted to Copilot Health it states it is not used to train generative AI models or for advertising.

Legal Rights & Agreement Rules · Context

Enterprise and developer products are those designed mainly for organizations and developers

Enterprise and Developer Products are Microsoft products and related software offered to and designed primarily for use by organizations and developers. They include enterprise online services such as Microsoft 365, Azure, Dynamics 365 and Intune; other enterprise and developer cloud services; enterprise and developer software such as Windows Server, SQL Server and Visual Studio; appliances and hardware used for storage infrastructure; and professional services available with the enterprise online services.

Supporting quotations

Enterprise and Developer Products are Microsoft products and related software offered to and designed primarily for use by organizations and developers.

such as Microsoft 365, Microsoft Azure, Microsoft Dynamics 365, and Microsoft Intune

Other enterprise and developer cloud-based services

Other enterprise and developer software, such as Windows Server, SQL Server, Visual Studio, System Center, Azure Stack

Appliances and hardware used for storage infrastructure

Professional services referred to in the Product Terms that are available with Enterprise Online Services

Qualifications & exceptions

• The lists are given as examples.

Legal Rights & Agreement Rules · Restriction or exception

For enterprise and developer products, a customer's agreement with Microsoft controls over this statement

If this privacy statement conflicts with the terms of any agreement between a customer and Microsoft for Enterprise and Developer Products, the terms of the agreement control. Features and settings that affect privacy, for you or your end users, are described in the product documentation. This means the privacy statement is not the final word for enterprise customers or their end users; the customer's contract is, and it is not supplied here.

Supporting quotations

In the event of a conflict between our privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.

You can also learn more about our Enterprise and Developer Products’ features and settings, including choices that impact your privacy or your end users’ privacy, in product documentation.

the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control

in product documentation

Qualifications & exceptions

• Applies where a customer has an agreement with Microsoft for Enterprise and Developer Products.

Not stated here

• The customer agreements and product documentation are not part of the supplied text.

Cross-references

• qualifies (model-proposed): Which Microsoft products and interactions this statement covers — qualifies: The opening says the statement applies to listed products; for enterprise and developer products a customer agreement controls over it in a conflict.

Data Access & Collection · Company practice

Microsoft collects customer contact, support and device data and personalizes its messages to enterprise customers

When a customer such as an employer or school uses, buys or subscribes to Enterprise and Developer Products, or gets support for professional services, Microsoft collects and generates data to provide the service, run its business and communicate with the customer. Examples: when a customer deals with a sales representative, Microsoft collects the customer's name, contact data and organization information; when a customer contacts a support professional, it collects device and usage data or error reports to diagnose problems; and when it sends communications to the customer, it uses data to personalize the content.

Supporting quotations

Microsoft collects and generates data to provide the service, conduct our business operations, and communicate with the customer.

we collect the customer’s name and contact data, along with information about the customer’s organization, to support that engagement

we collect device and usage data or error reports to diagnose and resolve problems

we use data to personalize the content of the communication

Qualifications & exceptions

• The three situations are examples.

Sharing & Disclosure · Restriction or exception

Products enterprise customers buy from third parties are governed by their own privacy statements

Enterprise and Developer Products let customers buy, subscribe to or use other products and online services from Microsoft or third parties that have different privacy practices. Those products and services are governed by their own privacy statements and policies, not by this one.

Supporting quotations

Those products and online services are governed by their respective privacy statements and policies.

Qualifications & exceptions

• Applies to other products or services bought or used through the Enterprise and Developer Products.

Account & Service Control · Restriction or exception

If your work or school provides your product, the organization can administer it and access your data

If you use a Microsoft product with a work or school account, your organization can control and administer the product and account, including your access and privacy-related settings, and can access and process your data, including interaction data, diagnostic data and the contents of your communications and files. Your use is subject to your organization's policies. For privacy questions or to exercise data protection rights, you should contact your organization's administrator. Microsoft states it is not responsible for the privacy or security practices of its customers, including your work or school, which may differ from this statement.

Supporting quotations

If you use a Microsoft product with a work or school account, that organization can:

Control and administer your Microsoft product and product account, including controlling your access to, and the privacy-related settings of, the product or your account.

Access and process your data, including the interaction data, diagnostic data, and the contents of your communications and files associated with your Microsoft product and accounts.

For privacy questions or to exercise your data protection rights, please contact your organization’s administrator.

Microsoft is not responsible for the privacy or security practices of our customers, including your work or school, which may differ from this privacy statement.

Qualifications & exceptions

• Applies when you use a Microsoft product with a work or school account.
• Microsoft disclaims responsibility for the customer organization's practices.

Use & Processing · Company practice

For organization-provided products, Microsoft processes your data as the organization's contract describes

When you use a Microsoft product provided by your organization, Microsoft processes your personal data as described in its contract with the organization and as needed to provide the product and for Microsoft's related business operations. For questions about processing for your organization, you contact your organization. For questions about Microsoft's business operations in connection with providing products to your organization under the Product Terms, you contact Microsoft as described in the contact section.

Supporting quotations

Microsoft processes your personal data as described in the contract with your organization and as needed to provide the product and Microsoft’s related business operations.

For questions about Microsoft’s processing of your data for your organization, contact your organization.

Qualifications & exceptions

• The organization's contract is not supplied here.

Not stated here

• The contract with the organization and the Product Terms are not part of the supplied text.

Use & Processing · Company commitment

For K-12 school products, Microsoft commits not to sell, rent or use student data beyond educational purposes

For Microsoft products provided by your K-12 school, including Microsoft 365 Education, Microsoft states it will not collect or use student personal data beyond what is needed for authorized educational or school purposes, will not sell or rent student personal data, and will not use or share student personal data for advertising or similar commercial purposes. The list continues in the next section of the statement.

Supporting quotations

For Microsoft products provided by your K-12 school, including Microsoft 365 Education, Microsoft will:

not collect or use student personal data beyond that needed for authorized educational or school purposes;

not sell or rent student personal data;

not use or share student personal data for advertising or similar commercial purposes

Qualifications & exceptions

• Applies to products provided by a K-12 school.

Use & Processing · Company commitment

K-12: no advertising use, no student profiles beyond school purposes, and vendors held to the same commitments

Continuing the commitments for products provided by a K-12 school, Microsoft states it will not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students; will not build a personal profile of a student other than to support authorized educational or school purposes or as authorized by the parent, guardian or student of appropriate age; and will require vendors who receive student personal data to provide educational services to implement the same commitments.

Supporting quotations

not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;

not build a personal profile of a student, other than for supporting authorized educational or school purposes or as authorized by the parent, guardian, or student of appropriate age; and

require that our vendors who receive student personal data in order to provide our educational services to implement these same commitments for student personal data

Qualifications & exceptions

• Student profiles are allowed only for authorized school purposes or as authorized by the parent, guardian or student of appropriate age.

Legal Rights & Agreement Rules · Context

Enterprise online services process data under the Product Terms, the Data Protection Addendum and the Trust Center

To provide Enterprise Online Services, Microsoft says it processes, uses and stores data as described in the Product Terms, the Microsoft Products and Services Data Protection Addendum and the Microsoft Trust Center. Those documents are linked, not supplied here, so what they provide is unknown.

Supporting quotations

To provide our Enterprise Online Services, Microsoft processes, uses, and stores data as described in the

Not stated here

• The Product Terms, Data Protection Addendum and Trust Center are linked but not part of the supplied text.

Data Access & Collection · Company practice

Enterprise and developer software and appliances collect mainly device and usage data, with some optional reports

Enterprise and developer software and enterprise appliances collect data to operate effectively and provide the best experiences. The data depends on the features used and the organization's configuration and settings but is generally limited to device and usage data, and customers and, where applicable, end users may have choices about the data provided. Examples are device and usage data during installation or upgrade, device and usage data from product usage to improve security and functionality, and optional error reports sent to Microsoft. Microsoft uses this data to provide and improve products, deliver customer support, activate products, communicate with users and operate its business in compliance with applicable data protection laws.

Supporting quotations

The types of data collected depend on the features you use and your organization’s configuration and settings but is generally limited to device and usage data.

Customers and, where applicable, end users may have choices about the data provided.

Device and usage data collected during installation or upgrade to address technical issues.

Device and usage data from product usage to improve security and functionality.

Optional error reports sent to Microsoft to help diagnose problems and deliver support.

Microsoft uses this data to provide and improve our products, deliver customer support, activate products, communicate with users, and operate our business in compliance with applicable data protection laws.

Qualifications & exceptions

• "Generally limited to" device and usage data, not strictly limited.
• Error reports are described as optional.

Data Access & Collection · Company practice

HoloLens collects diagnostic data and sensor data, including camera, microphone and infrared inputs

HoloLens is a self-contained Windows computer headset. Microsoft collects diagnostic data to solve problems and keep Windows on HoloLens up to date, secure and working, and to improve HoloLens and related products depending on the diagnostic data settings you chose. HoloLens also processes and collects data related to the experience and device, which include cameras, microphones and infrared sensors that enable motion and voice navigation. The headset's microphones enable voice commands for navigation, controlling apps or entering search terms; a link goes to the voice data collection section.

Supporting quotations

Microsoft collects diagnostic data to solve problems and to keep Windows running on HoloLens up to date, secure, and operating properly.

depending on the diagnostic data settings you’ve chosen for your device

HoloLens also processes and collects data related to the HoloLens experience and device, which include cameras, microphones, and infrared sensors that enable motions and voice to navigate.

The headset's microphones enable voice commands for navigation, controlling apps, or to enter search terms.

Qualifications & exceptions

• Diagnostic data use for improvement depends on the diagnostic data settings you chose.

Data Access & Collection · User right or choice

HoloLens iris sign-in, hand gestures and environment tracking stay on the device

If you choose, HoloLens cameras can sign you in using your iris: it takes an image of your iris and measures distances between key points to create and store a numeric value that represents only you. Microsoft says this data stays on the HoloLens, is not shared with anyone, and you can delete it at any time. Hand gestures for system interactions are processed on the device and not stored. Environmental tracking points that let HoloLens understand surfaces have no associated images, are stored locally on the device, and you can delete them at any time.

Supporting quotations

If you choose, cameras can be used to sign you in automatically using your iris.

This data stays on the HoloLens and is not shared with anyone, and you can choose to delete this data from your HoloLens at any time.

This data is processed on your HoloLens device and is not stored.

There are no images associated with this environmental data and it is stored locally on the HoloLens device. You can choose to delete this data from your HoloLens at any time.

Qualifications & exceptions

• Iris sign-in is optional ("if you choose").
• These statements are about HoloLens on-device handling, not about all Microsoft products.

Data Access & Collection · Company practice

Productivity and communications products collect usage data and communication details, such as time and users in Teams

Productivity and communications products, such as Microsoft 365, Teams and OneDrive, are used to create, store and share documents and communicate with others. Microsoft says these services use your data depending on their features and how you use them. For example, when you use Teams it collects usage data and information about your communications, including the time and date and the users that are part of the communication. The statement points to the sections below for details by service.

Supporting quotations

These services will use your data depending on their features and how you use them

we will collect usage data as well as information about your communications when you use Microsoft Teams, including the time and date and users that are part of the communication

These services will use your data depending on their features and how you use them

Qualifications & exceptions

• Data use depends on the service features and how you use them.

Account & Service Control · User right or choice

Microsoft 365 and Office combine apps with connected online services, and have in-app privacy controls

Microsoft 365 is a collection of subscription productivity services and applications such as Word, Excel, PowerPoint, Outlook and OneNote. Office is the one-time purchase version available on PC or Mac. Both consist of client software and connected online services that span many platforms and have many interdependent experiences. You can manage your privacy through the privacy controls within the apps.

Supporting quotations

Both Microsoft 365 and Office are comprised of client software applications and connected online services

You can manage your privacy by accessing the privacy controls within your Microsoft 365 and Office apps.

Data Access & Collection · Company practice

The Office Roaming Service syncs your settings, including privacy settings, to Microsoft servers

The Office Roaming Service keeps your settings, including privacy settings, up to date across devices running Microsoft 365 or Office apps. When you sign in with a Microsoft account or an account from your organization, it syncs some customized settings to Microsoft servers, and when you sign in on another device it downloads and applies them. When you sign out, the service removes your settings from the device, and any changes you make to customized settings are sent to Microsoft servers.

Supporting quotations

When you sign in to your apps with either your Microsoft account or an account issued by your organization, the service syncs some of your customized settings to Microsoft servers.

When you sign out of your apps, the service removes your settings from your device.

Any changes you make to your customized settings are sent to Microsoft servers.

Qualifications & exceptions

• Syncs "some" of your customized settings.

Data Access & Collection · Restriction or exception

Microsoft 365 diagnostic data excludes your name, email address and file content

Diagnostic data in Microsoft 365 and Office is used to keep the apps secure and up to date, detect, diagnose and remediate problems, and make product improvements. Microsoft says this data does not include a user's name or email address, the content of the user's files, or information about apps unrelated to Microsoft 365 or Office. More detail is on linked pages and in the Diagnostic Data section.

Supporting quotations

Diagnostic data is used to (i) keep your Microsoft 365 or Office apps secure and up to date; (ii) detect, diagnose, and remediate problems; and (iii) make product improvements.

This data does not include a user’s name or email address, the content of the user’s files, or information about apps unrelated to Microsoft 365 or Office.

Qualifications & exceptions

• The exclusions are stated for this diagnostic data in Microsoft 365 and Office.

Use & Processing · User right or choice

Connected experiences analyze your content or download online content and can be turned off, with some exceptions

Microsoft 365 and Office provide experiences that are connected to and backed by cloud services. Examples are working with others on a document in OneDrive or translating a Word document. There are two types: experiences that analyze your content (using your file content to give design recommendations, editing suggestions or data insights, such as PowerPoint Designer) and experiences that download online content (such as templates or images). If you use connected experiences, Microsoft collects required service data to keep them reliable, up to date and secure. Privacy controls in the client apps let you configure connected experiences, but even if you turn them off certain functionality remains, such as syncing your mailbox in Outlook, plus the essential services. These controls are not available in Microsoft 365 for the web because it is already cloud-connected.

Supporting quotations

Experiences that use your file content to provide you with design recommendations, editing suggestions, data insights, and similar features.

Experiences that allow you to search and download online content including templates, images, 3D models, videos, and reference materials to enhance your documents.

If you choose to use connected experiences, we will collect required service data to help keep these connected experiences reliable, up to date, secure, and performing as expected.

But even if you turn off connected experiences, certain functionality will remain available, such as syncing your mailbox in Outlook, as well as essential services described below.

These controls are not available when using Microsoft 365 for the web since you will already be cloud-connected.

Qualifications & exceptions

• Turning off connected experiences does not stop essential services or functions like mailbox sync.
• Controls are not available in the web version.

Data Access & Collection · Restriction or exception

Essential services in Microsoft 365 cannot be disabled and always send required service data

Some services are essential to how Microsoft 365 and Office function and cannot be disabled; the licensing service that confirms you are properly licensed is one example. Required service data is collected and sent to Microsoft regardless of any other settings you have configured.

Supporting quotations

There are a set of services that are essential to how Microsoft 365 and Office function and cannot be disabled.

Required service data is collected and sent to Microsoft, regardless of any other settings that you have configured.

Qualifications & exceptions

• Applies regardless of other settings you have configured.

Use & Processing · Company practice

Connected experiences send required service data, and text you translate is processed but not stored

When you use a connected experience, required service data needed to deliver the cloud-based experience is sent to and processed by Microsoft. Required service data can include information about the operation of the experience that keeps the underlying service secure, up to date and performing as expected. If you use a connected experience that analyzes your content, such as Translate in Word, the text you typed and selected is also sent and processed to provide it. Microsoft says your text and the translation are not stored by its service.

Supporting quotations

required service data necessary to deliver our cloud-based connected experiences is sent to and processed by Microsoft

Required service data can include information related to the operation of the connected experience that is needed to keep the underlying service secure, up to date, and performing as expected.

the text you typed and selected to translate is also sent and processed to provide you with the connected experience

Your text and the translation are not stored by our service.

Qualifications & exceptions

• The "not stored" statement is given for the Translate in Word example.

Data Access & Collection · Company practice

Microsoft 365 apps use your microphone, camera, screen and contacts only when you start the related feature

Some Microsoft 365 apps use device capabilities through specific features: PowerPoint recording can use your microphone and camera, Record audio and Speaker Coach use the microphone, screenshot and screen clipping capture screen contents, Sticky Notes screenshots capture other apps' active windows, Dictate and Transcribe in Word, OneNote and PowerPoint use the microphone for speech-to-text, OneNote can insert photos or record video using the camera, and sharing in Microsoft 365 apps, To Do and Whiteboard accesses your contacts. Microsoft says applications will not access device capabilities until you begin using the feature, and you can manage microphone and camera access in Windows Privacy Settings.

Supporting quotations

the presentation recording feature can access your device microphone and camera to record presentations with audio and video

you can capture content from the active window of other apps on your device and insert it into your note

All Microsoft 365 apps along with To Do and Whiteboard have sharing functionality that accesses your contacts to allow you to share your documents with others in your contacts list.

Applications will not access your device capabilities until you begin using the feature.

You can manage your microphone and camera access settings in the Windows Privacy Settings menu.

Qualifications & exceptions

• Access begins only when you start using the feature.

Account & Service Control · Company practice

Family Safety tools need the child account to be in a family group and offer filters, limits and location sharing

The Microsoft Family Safety product lets a family group connect through the Family Safety app on Windows, Xbox or mobile devices, and the statement asks you to review the Family Safety information carefully before creating or joining a family group. Family Safety offers tools such as digital content filtering, screen time limits, spending controls for Microsoft and Xbox stores, age limits for apps and games, and location sharing. Family Safety controls on a child account require the child account to be in a family group: accounts that required parental consent are included automatically in the consenting individual's family group, and for other accounts the parent or guardian must add the account.

Supporting quotations

Please carefully review the information at

Microsoft Family Safety can help parents and guardians through tools such as digital content filtering, screen time limits, spending for Microsoft and XBOX stores, setting age limits for apps and games, and location sharing.

To enable Family Safety controls on a child account, the child account must be part of a family group.

the parent or guardian must add the account to their family group in order to use Family Safety controls

Qualifications & exceptions

• Automatic inclusion applies to accounts that required parental consent; others must be added by the parent or guardian.

Data Access & Collection · Company practice

Family activity reporting collects a child's device, search, web, app and game activity and reports it to parents

When family activity reporting is enabled for a child, Microsoft collects details about how the child uses their devices, such as search, web, app and game activity, and gives parents reports of the child's online activities. Microsoft says activity reports are routinely deleted from its servers, without giving a time period.

Supporting quotations

When you have enabled family activity reporting for a child, Microsoft will collect details about how the child uses their devices, such as search, web, app, and game activity, and provide parents with reports of that child's online activities.

Activity reports are routinely deleted from Microsoft servers.

Qualifications & exceptions

• Applies only when family activity reporting is enabled for the child.

Not stated here

• The text does not say how long activity reports are kept before routine deletion.

Data Access & Collection · Company practice

Family Safety location features upload your location, share it with the family group and record driving habits

Certain Family Safety features, such as Location Sharing, Drive Safety, Share Drives, Places and Location Alerts, use your location information when enabled. With Location Sharing, your device uploads location data to the cloud and shares it with others in your family group, and Microsoft retains only your last known location for that feature. Drive Safety uses location to record driving habits such as speed limits, phone use while driving and sudden acceleration or braking; those reports go to the cloud and you can choose to share them with your family group. You can turn these location features off at any time in Family Safety settings and manage location data on the Microsoft Privacy Dashboard.

Supporting quotations

Certain Family Safety features, such as Location Sharing, Drive Safety, Share Drives, Places, and Location Alerts, will use your location information when enabled.

your device will upload location data to the cloud and share it with others in your family group

Microsoft retains only your last known location as part of the Location Sharing feature.

your location will be used to record your driving habits, such as whether you are driving within the speed limits, if you’re using your phone while driving, and if you accelerate or brake suddenly

You can turn off these location features at any time in the Family Safety settings.

Qualifications & exceptions

• Applies when the features are enabled.
• For Location Sharing, only the last known location is retained.

Account & Service Control · Context

Microsoft Launcher can be used with or without an account, but some functions need device permissions

Microsoft Launcher is an Android launcher app. You can log in with a personal Microsoft account or work account or use it without any account, though some functions may be limited if you do not grant certain permissions. Using it requires installing it on your Android device, and permissions are required to enable the features described next.

Supporting quotations

Microsoft Launcher is an Android app that offers a highly customizable app launcher experience on Android devices.

Microsoft Launcher lets you log in with your personal Microsoft account or work account or use it without any account. However, some functions may be limited if you do not grant certain permissions.

permissions are required to enable the following features:

Qualifications & exceptions

• Some functions are limited if permissions are not granted.

Data Access & Collection · Company practice

Launcher's Copilot features may need camera, microphone and photos, and Glance syncs your daily data across devices

When signed in with a personal Microsoft account, Launcher lets you use Copilot features such as chat, web search, voice search and image search, and certain Copilot features require access to your device camera, microphone, photos and videos. Glance organizes daily activities such as your Outlook calendar, To Do list, Sticky Notes and recent documents in your Microsoft 365 apps; after signing in with a personal or work account, your data is synced across devices signed in to the same account to give you personalized experiences, and it can show recent photos and app usage if you give Glance permission to access that data.

Supporting quotations

Certain Copilot features require access to your device capabilities, such as your device camera, microphone, photos, and videos.

After signing-in with your personal Microsoft account or your work account, your data will be synced across devices signed into the same account to give you personalized experiences.

if you have given Glance permission to access that data

Qualifications & exceptions

• Camera, microphone, photos and videos access is needed only for certain Copilot features.
• Recent photos and app usage are shown only if you give Glance permission.

Use & Processing · Company practice

Launcher's news feed shows personalized ads when you sign in, and local news and weather use your location or zip code

When you sign in to Launcher with your Microsoft account you get a personalized news feed and advertisements in the News Feed, synchronized across your devices. You can receive local curated news when you give Launcher permission to access your location, and manage ad preferences through the Microsoft privacy dashboard. For weather, Launcher shows MSN Weather on your home screen and gives local weather when you allow location access or provide your zip code.

Supporting quotations

When you sign in with your Microsoft account, you can enjoy a personalized news feed and advertisements in Launcher’s News Feed, synchronized across all your devices.

You can also receive local curated news when you grant Microsoft Launcher permission to access your location information.

You can manage your ad preferences through the

You can receive up-to-date local weather information when you allow Launcher to access your location or provide your zip code.

Qualifications & exceptions

• Personalized news feed and ads apply when signed in.
• Local news needs location permission; local weather needs location or a zip code.

Data Access & Collection · Company practice

Launcher backups can be stored on your device or in OneDrive, and work profiles keep work and personal data apart

Launcher's backup and restore feature lets you transfer between phones or try different home screen setups, and backups can be stored locally or saved to the OneDrive account tied to your Microsoft account. Launcher supports Android work profile features, which keep personal and work data separate so you can access work resources without mixing them with personal apps and data.

Supporting quotations

Backups can be stored locally on your device or saved to your OneDrive account associated with your Microsoft account for easy access.

Microsoft Launcher supports Android work profile features, enabling you to maintain a clear boundary between personal and work data on your device.

Data Access & Collection · Company practice

Consumer Teams collects usage and communication details and can share your location with consent

This section applies to the consumer offering of Teams; if you use Teams with a school or work account, the Enterprise and developer products section applies. Teams is a collaboration and communication hub, and Microsoft collects usage data and information about your communications, including the time and date and the users that are part of the communication. With your consent you can share your location with friends and family.

Supporting quotations

This section applies to the consumer offering of Teams; if you are using Teams with a school or work account, see the

Microsoft collects usage data as well as information about your communications, including the time and date of the communication and users that are part of the communication.

With your consent, you can share your location with friends and family.

Qualifications & exceptions

• Consumer Teams only; work or school accounts follow the enterprise section.
• Location sharing needs your consent.

Sharing & Disclosure · Company practice

Your Teams profile can be visible to others and shared with schools and enterprises you interact with

Your Teams profile includes information from your Microsoft account: display name, email and/or phone number. It may become visible to other users through your interactions or your use of other apps or services, including Loop. Microsoft may also share it with enterprise customers when you interact through meetings and chats with end users on school or work accounts; for example, in a chat with a user on a school account, Microsoft may share your information with that school. To let others find you, your profile is included in the Teams public search directories and may be displayed on Teams; depending on your settings, people can find you by display name, email and/or phone number, and your profile may be visible to enterprise customers and their end users when you chat or meet with an end user of an organization.

Supporting quotations

Your Teams profile information may become visible to other users through your interactions with them or through your use of other apps or services, including Loop.

Microsoft may also share this information with enterprise customers when you interact through meetings and chats with end users who are using their school or work account.

your Teams profile is included in the Teams public search directories, and may be displayed on Teams

Depending on your settings, Teams users can find you by your display name, email, and/or phone number.

Your Teams profile may be visible to enterprise customers and their end users when you engage with an end user of an organization in chats and meetings.

Qualifications & exceptions

• Findability depends on your settings.
• Sharing with enterprise customers is stated as "may" and applies when you interact with end users on school or work accounts.

Data Access & Collection · Company practice

With your permission, Teams syncs device and Outlook contacts and may send invitations for you

With your permission, Teams periodically syncs your device and Outlook contacts and checks for other Teams users who match them. If you stop syncing, or if you are inactive on your device, contacts that have not been matched are deleted from Teams. If you want to invite contacts, you can invite users to a 1:1 directly, or Microsoft can send an invitation on your behalf via SMS or email for group conversations.

Supporting quotations

With your permission, Teams will sync your device and Outlook contacts periodically and check for other Teams users that match contacts in your device or Outlook address books.

any contacts that have not been matched during the synchronization process will be deleted from Teams

Microsoft can send an invitation on your behalf via SMS or email for invitations to group conversations

Qualifications & exceptions

• Requires your permission.
• Unmatched contacts are deleted from Teams if you stop syncing or are inactive.

Data Access & Collection · Company practice

Teams processes data of non-users found in other users' synced contacts and stores it while the sync continues

If your information is in the device or Outlook address book of a Teams user who syncs contacts with Teams, Microsoft may process your data to find out whether you are a current Teams user and to let that user invite you, including by SMS and email. As long as the Teams user stays active on Teams and keeps contact syncing enabled, your information is stored on Microsoft servers and periodically processed to check whether you have since joined Teams. If you join Teams, you appear as a suggested new contact for any Teams users who have your information in their address books.

Supporting quotations

Microsoft may process your data in order to determine whether you are a current Teams user and to allow Teams users to invite you to the service, including via SMS and email.

As long as the Teams user continues to be active on Teams on their device and continues to enable contact syncing with the applicable device or service, your information will be stored on our servers, and we will periodically process your information as a part of the Teams user’s contact syncing experience to check whether you have subsequently joined Teams.

If you do choose to join Teams, you will appear as a suggested new Teams contact for any Teams users with your information in their device or Outlook address books.

Qualifications & exceptions

• Applies to people who are not Teams users but appear in a Teams user's synced contacts.
• Storage continues as long as the Teams user remains active and keeps syncing.

Linking & Identification · User right or choice

You can sync third-party contacts and calendars to Teams, and removing them can affect other Microsoft apps

You can choose to sync contacts from third-party providers and unsync them from Teams or remove them from all Microsoft apps and services. You can choose to sync your Teams calendar with third-party calendars and stop at any time by removing the third-party account from Teams. Removing a third-party account from Teams may affect your experience on other Microsoft apps and services that use the same account, including where you consented to use third-party data in them.

Supporting quotations

You can also choose to sync contacts from third-party providers. You can choose to unsync your third-party contacts on Teams or remove third-party contacts from all Microsoft apps and services.

removing a third-party account from Teams may impact your experiences on other Microsoft apps and services that also use that account

You can stop syncing your Teams calendar anytime by removing a third-party account from Teams.

Qualifications & exceptions

• Removing a third-party account in Teams can affect other Microsoft apps that use it.

Sharing & Disclosure · Company practice

Teams tells your device's notification service who is calling and the start of chats; that company is not Microsoft

Teams uses the notification service on your device to alert you to incoming calls, chats and messages. On many devices that service is provided by another company. To show who is calling, or the first few words of a new chat, Teams has to tell the notification service, which uses the information under its own terms and privacy policy. Microsoft says it is not responsible for data collected by that company. If you do not want to use notification services for incoming Teams calls and messages, you can turn them off in your device settings.

Supporting quotations

To tell you who is calling, for example, or to give you the first few words of the new chat, Teams has to tell the notification service so that they can provide the notification to you.

The company providing the notification service on your device will use this information in accordance with their own terms and privacy policy. Microsoft is not responsible for the data collected by the company providing the notification service.

If you do not want to use the notification services for incoming Teams calls and messages, turn it off in the settings found on your device.

Qualifications & exceptions

• Applies on devices whose notification service is provided by another company.

Not stated here

• The device notification providers' terms are not part of the supplied text.

Sharing & Disclosure · Restriction or exception

Data you share with end users of organizations is subject to their organizations' policies

If you chat or meet in Teams with end users of organizations, such as schools and businesses, the data you share with them is subject to their organizations' policies, if any. You should direct privacy inquiries about data shared through those chats and meetings, including requests to exercise your data protection rights, to the organization's administrator. Microsoft states it is not responsible for the privacy or security practices of its customers, which may differ from this statement. If you use Teams with a work or school account, the Enterprise and developer products section applies.

Supporting quotations

If you engage in Teams meetings or chats with end users of organizations, the data you share with the end users is subject to their organization’s policies, if any.

You should direct your privacy inquiries related to your data shared through chats and meetings with an organization’s end users, including any requests to exercise your data protection rights, to the organization’s administrator.

Microsoft is not responsible for the privacy or security practices of our customers, which may differ from those set forth in this privacy statement.

Qualifications & exceptions

• Applies to chats and meetings with end users of organizations.
• Microsoft disclaims responsibility for customers' practices.

Use & Processing · Company practice

Translator processes your text, image, voice and usage data and de-identifies samples used for product improvement

Microsoft Translator is a machine translation service, available as a stand-alone app for Android, iOS and Windows and integrated into products such as Translator for Bing and Translator for Microsoft Edge. It processes the text, image and voice data you submit, plus device and usage data, to provide translations, personalize your experiences and improve its products and services. When randomly sampling text and audio for product improvement, Microsoft uses business and technical measures designed to help de-identify the data, such as deleting identifiers and certain text like email addresses and some number sequences that could contain personal data. The wording is "designed to help", so de-identification is not guaranteed.

Supporting quotations

Microsoft Translator processes the text, image, and voice data you submit, as well as device and usage data, to provide translations, personalize your experiences, and improve our products and services.

Microsoft uses business and technical measures designed to help de‑identify submitted data — such as deleting identifiers and certain text like email addresses and some number sequences that could contain personal data — when randomly sampling text and audio for product improvement.

Qualifications & exceptions

• De-identification measures are "designed to help", not guaranteed, and apply to random sampling for product improvement.

Not stated here

• The linked speech recognition page on voice data is not part of the supplied text.

Legal Rights & Agreement Rules · Restriction or exception

Other Microsoft translation services have different privacy practices than Microsoft Translator

Separate Microsoft translation services offered as features in other products and services have different privacy practices than Microsoft Translator. For the Azure Cognitive Services Translator Text API, Custom Translator and Translator Speech API, the statement points to the Enterprise and developer products section, and for the Translate feature in Microsoft 365 apps to the Productivity and communications products section.

Supporting quotations

Separate Microsoft translation services are available as features in other Microsoft products and services that have different privacy practices than Microsoft Translator.

Content & IP Rights · Context

OneDrive stores and shares your files, and some app versions cover both personal and work or school OneDrive

OneDrive lets you store and access your files on virtually any device and share and collaborate on them with others. Some versions of the OneDrive application let you access both your personal OneDrive, by signing in with your personal Microsoft account, and your OneDrive for Business, by signing in with a work or school account.

Supporting quotations

OneDrive lets you store and access your files on virtually any device as well as share and collaborate on your files with others.

Some versions of the OneDrive application enable you to access both your personal OneDrive (by signing in with your personal Microsoft account) and your OneDrive for Business (by signing in with your work or school Microsoft account).

Data Access & Collection · Company practice

OneDrive collects usage data and the content you store, and indexes document contents for search

When you use OneDrive, Microsoft collects data about your usage of the service and the content you store, to provide, improve and protect the services. For example, it indexes the contents of your OneDrive documents so you can search for them later. It also collects device information to deliver personalized experiences such as syncing content across devices. Files in OneDrive for Business are stored separately from personal OneDrive files, and OneDrive for Business collects and transmits personal data for authentication, such as your email address and password, to Microsoft and/or to the provider of your Microsoft 365 service.

Supporting quotations

we collect data about your usage of the service, as well as the content you store, to provide, improve, and protect the services

we index the contents of your OneDrive documents so that you can search for them later

We also collect device information so we can deliver personalized experiences, like enabling you to sync content across devices.

Files managed with OneDrive for Business are stored separately from files stored with your personal OneDrive.

OneDrive for Business collects and transmits personal data for authentication, such as your email address and password, which will be transmitted to Microsoft and/or to the provider of your Microsoft 365 service.

Qualifications & exceptions

• OneDrive for Business authentication data goes to Microsoft and/or the Microsoft 365 service provider.

Content & IP Rights · Restriction or exception

OneDrive content inherits folder sharing, links can be forwarded, and social shares must be deleted in both places

Content you store in OneDrive inherits the sharing permissions of its folder, so content in a public folder is public and available to anyone who can find the folder. If you share content to a social network like Facebook, either the content is uploaded there or a link is posted, making it accessible to anyone on that network, and to delete it you must remove it from both the social network (if uploaded) and OneDrive. If you share via a link, an email with the link is sent and anyone with the link can access your content; if a recipient forwards the link, those people can also access your content even if you did not choose to share with them. You can revoke access by signing in and managing permissions for the specific content; after revocation the link is deactivated unless you reshare it.

Supporting quotations

When you store content in OneDrive, your content will inherit the sharing permissions of the folder it’s stored in.

if you store content in a public folder, the content will be public and available to anyone who can find the folder

Doing this makes the content accessible to anyone on that social network. To delete the content, delete it from both the social network (if it was uploaded there) and from OneDrive.

allows anyone with the link to access your content

If one of the people who received the link sends it to other people, they will also be able to access your content, even if you did not choose to share the content with them.

You can revoke access to your content on OneDrive by signing in to your account and then selecting the specific content to manage the permission levels.

Qualifications & exceptions

• Content in a public folder is public.
• Forwarded links give access to anyone who gets the link until you revoke it.

Retention & Deletion · Company practice

Deleted Outlook.com items stay about 7 days in Deleted Items and up to 30 days more before final deletion

Outlook.com is Microsoft's primary consumer email service, covering addresses that end in outlook.com, live.com, hotmail.com and msn.com. It offers features to connect with friends on social networks, and you need a Microsoft account to use it. When you delete an email or item, it generally goes to the Deleted Items folder where it stays for approximately 7 days unless you move it back, empty the folder or the service empties it automatically, whichever comes first. After the folder is emptied, items remain in Microsoft's system for up to 30 days before final deletion, unless Microsoft is legally required to retain the data longer.

Supporting quotations

Outlook.com is the primary consumer email service from Microsoft and includes email accounts with addresses that end in outlook.com, live.com, hotmail.com, and msn.com.

the item generally goes into your Deleted Items folder where it remains for approximately 7 days

those items remain in our system for up to 30 days before final deletion, unless we are legally required to retain the data for longer

Qualifications & exceptions

• The 7-day period is "approximately" and "generally".
• Longer retention applies if legally required.

Data Access & Collection · Company practice

Adding an Outlook account syncs your mail, calendar, files and contacts; mobile Outlook also syncs to Microsoft servers

Outlook client applications let you manage email, calendar items, files and contacts from services like Exchange Online and Outlook.com, even across accounts from third-party providers. To add an account you must give Outlook permission to access data from the email or file storage service. When you add an account, your emails, calendar, files, contacts, settings and other data automatically sync to your device. On the mobile app this data also syncs to Microsoft servers to enable features like improved search and personalized mail filtering; on desktop you can choose whether to sync data to Microsoft servers. You can remove accounts or change sync settings at any time. If you add a work or school account, your organization can set rules and controls, such as requiring multi-factor authentication or remotely erasing data on your device, that affect how you use Outlook.

Supporting quotations

To add an account to your Outlook applications, you must provide permission for Outlook to access data from the email or file storage services.

your emails, calendar, files, contacts, settings, and other data automatically sync to your device

On the mobile Outlook app, this data also syncs to Microsoft servers to enable enhanced features like improved search and personalized mail filtering.

On desktop, you can choose whether to sync your data to Microsoft servers. You can remove accounts or change sync settings at any time.

your organization can set rules and controls — like requiring multi-factor authentication or remotely erasing data on your device — that can affect how you use Outlook

Qualifications & exceptions

• Mobile Outlook syncs to Microsoft servers; on desktop this is your choice.
• Work or school accounts are subject to the organization's rules, including remote erase.

Data Access & Collection · Company practice

Outlook can use your microphone for Dictate and your location for weather and nearby search

In Outlook clients that support it, the Dictate feature uses your device microphone, or another connected microphone, to dictate and send an email. Outlook may also use your device location to provide weather for your current location and to let you search for nearby locations. The statement points to the Microsoft 365 section for more on the data Outlook applications collect.

Supporting quotations

you can use the Dictate feature to dictate the contents of and send an email. You can Dictate with your device’s microphone or any other microphone you connect to your device.

Outlook may also use your device location information to provide you with weather information for your current location as well as provide the ability to search for nearby locations.

Qualifications & exceptions

• Location use is stated as "may".

Data Access & Collection · Company practice

Skype Dial Pad calls collect usage data including time, date, and numbers or user names on the call

The Skype Dial Pad lets you make and receive calls to landlines or mobile numbers. This section applies to consumer Skype; for Skype for Business, the Enterprise and developer products section applies. As part of providing the features, Microsoft collects usage data about your calls, including the time and date and the numbers or user names that are part of the calls. A Skype user can also log in to Teams using Skype credentials and chat and call other Teams users.

Supporting quotations

This section applies to the consumer version of Skype; if you are using Skype for Business, see the

Microsoft collects usage data about your calls, including the time and date and the numbers or user names that are part of the calls.

If you log into Teams via your Skype credentials, you can use Teams to chat with and call other Teams users.

Qualifications & exceptions

• Consumer Skype only; Skype for Business follows the enterprise section.

Sharing & Disclosure · User right or choice

Skype Dial Pad emergency calling in the U.S. collects your location only if you enable it and shares it on a 911 call

If you enable location sharing for emergency calling from the Skype Dial Pad in the United States, your location is periodically collected so Microsoft can share it with emergency calling service providers if you dial 911. Microsoft states your location information is shared only if you enabled location sharing for emergency calling and you start a 911 call.

Supporting quotations

If you enable location sharing for emergency calling, your location will be periodically collected to enable Microsoft to share your location with emergency calling service providers if you dial 911.

Your location information is only shared if you enable location sharing for emergency calling and you initiate a 911 call.

Qualifications & exceptions

• Applies to the Skype Dial Pad in the United States.
• Sharing requires both enabling the setting and starting a 911 call.

Data Access & Collection · Company practice

Microsoft collects diagnostic data from Surface devices, accessories and apps

Microsoft offers Surface devices and accessories for everyday computing. It collects diagnostic data as you use Surface devices, accessories and applications, and refers to the Diagnostic data section and linked pages for detail, including a list of required Surface diagnostic data. Those linked pages are not supplied here.

Supporting quotations

Microsoft collects diagnostic data as you use your Surface devices, Surface accessories, and Surface applications.

Not stated here

• The linked Surface diagnostic data pages and the list of required diagnostic data are not part of the supplied text.

Data Access & Collection · Company practice

Surface Duo runs on Google Android, may rely on Google information, and sends diagnostic data without name or email

Microsoft provides a core Surface Duo experience that runs on the Google Android operating system, including apps such as Microsoft Launcher. You can sign in with a Google ID to enable Google services and also sign in with a Microsoft account to enable Microsoft services. Microsoft apps and services may rely on information provided by Google. Surface Duo collects diagnostic data to solve problems, keep the core experience up to date and secure, and improve Surface Duo and related products and services; Microsoft states the data does not include your user name, email address or the content of your files.

Supporting quotations

Microsoft provides a core Surface Duo experience that runs on the Google Android operating system.

Microsoft apps and services may rely on information provided by Google.

Surface Duo collects diagnostic data to solve problems and to keep the core Surface Duo experience up to date, secure, and operating properly.

The data does not include your user name, email address, or the content of your files.

Qualifications & exceptions

• Microsoft apps and services "may" rely on information provided by Google.

Data Access & Collection · Restriction or exception

On Surface Duo, Microsoft apps need location enabled for both Google and Microsoft

Surface Duo uses Google location services to determine your device's precise location to give you experiences such as local weather. To let Microsoft apps use location-based features, you must enable location services for both Google and Microsoft, and some apps may require enabling these separately in Surface Duo settings. The Google Privacy Policy covers Google's location service and related practices and is not supplied here.

Supporting quotations

Surface Duo uses Google location services for determining your device’s precise geographic location to provide you with enhanced experiences such as to show you your local weather.

To allow Microsoft apps to access location-based features, you must enable location services for both Google and Microsoft .

Qualifications & exceptions

• Both Google and Microsoft location settings must be enabled for Microsoft location-based features.

Not stated here

• Google's privacy policy is not part of the supplied text.

Inference & Profiling · Company practice

SwiftKey learns your writing style from the words you use and how you type, but avoids passwords and payment fields

The Microsoft SwiftKey keyboard and related cloud services process data about words you use and how you type, and Microsoft uses it to learn your writing style and provide personalized autocorrection and predictive text, plus features such as emoji predictions. Prediction technology builds a personalized language model by analyzing the words and phrases you use most often across apps and websites. Microsoft says the keyboard avoids collecting sensitive information by excluding data from certain fields like passwords or payment details.

Supporting quotations

process data about words you use and how you type. Microsoft uses this data to learn your writing style, and to provide personalized autocorrection and predictive text that adapts to you.

SwiftKey prediction technology learns and reflects your writing style by analyzing the words and phrases you use most often across various apps and websites creating a personalized language model to optimize text predictions.

The keyboard avoids collecting sensitive information by excluding data from certain fields like passwords or payment details.

Qualifications & exceptions

• Exclusion covers "certain fields like passwords or payment details", not necessarily all sensitive fields.

Data Access & Collection · User right or choice

If you opt in, SwiftKey sends de-identified typing snippets to Microsoft and does not link them to your account

When you opt in to share, SwiftKey collects device and usage data and uses de-identified device, usage and model data to analyze performance and improve products. You can also choose to share SwiftKey language and typing data; if you opt in, SwiftKey may send short, de-identified snippets of what and how you type, with related correction data, to Microsoft servers. These snippets are used in automated processes to validate prediction services and enhance features, and Microsoft says they are never linked to your SwiftKey account. You can manage choices at any time in SwiftKey Settings.

Supporting quotations

When you opt in to share with us, SwiftKey collects device and usage data and uses de-identified device data, usage data, and model data to analyze service performance and improve products.

If you opt in, SwiftKey may send short, de-identified snippets of what and how you type, along with related correction data to our servers for processing.

To protect your privacy, these snippets are never linked to your SwiftKey account.

You can manage your choices at any time in SwiftKey Settings.

Qualifications & exceptions

• Applies only if you opt in.
• Snippets are described as short and de-identified; the de-identification method is not described.

Content & IP Rights · User right or choice

SwiftKey backup and sync to OneDrive is optional and requires a Microsoft account

SwiftKey includes an optional OneDrive backup. If you turn on backup and sync, it saves your language model and related data to OneDrive so you can use personalized predictions, other services and settings across devices. You must sign in with a Microsoft account. Data in OneDrive is protected by OneDrive's security controls, including encryption in transit and at rest. You can turn backup off at any time in SwiftKey Settings and manage or delete SwiftKey data in OneDrive.

Supporting quotations

SwiftKey includes an optional OneDrive backup component. If you turn on backup and sync, SwiftKey saves your language model and related data to OneDrive

You must sign in with a Microsoft account to enable OneDrive backup and sync.

You can turn backup off at any time in SwiftKey Settings and manage or delete SwiftKey data in your OneDrive.

Qualifications & exceptions

• Optional; you must turn on backup and sync and sign in with a Microsoft account.

Data Access & Collection · Company practice

SwiftKey AR effects process your face and hand data only on your device and delete it immediately

If you use the SwiftKey camera and choose to apply Augmented Reality effects to selfies through third-party lens services, the lens feature processes your video and images to extract information about the location of your face and hands, solely to transform your appearance. Microsoft states this session-based data is processed only on your device, is not used to personally identify you, is deleted immediately after use, and is never sent to SwiftKey or any third party.

Supporting quotations

you can choose to apply Augmented Reality (AR) effects to your selfies through third-party lens services

This session-based data is processed only on your device, is not used to personally identify you, is deleted immediately after use, and is never sent to SwiftKey or any third party.

Qualifications & exceptions

• Applies only if you choose to apply AR effects.

Legal Rights & Agreement Rules · Context

LinkedIn's data practices are covered by LinkedIn's own privacy policy

For the data LinkedIn collects and how it is used and shared, the statement refers you to LinkedIn's Privacy Policy rather than describing those practices itself. That policy is linked, not supplied here.

Supporting quotations

To learn about the data LinkedIn collects and how it is used and shared, please see LinkedIn’s

Not stated here

• LinkedIn's Privacy Policy is not part of the supplied text.

Use & Processing · Context

Search and browse products sense, process and act on information, learning and adapting over time

The statement describes search and browse products as connecting you with information and intelligently sensing, processing and acting on it, learning and adapting over time. For AI and Copilot capabilities in these products it refers to the Artificial Intelligence and Copilot section.

Supporting quotations

Search and browse products connect you with information and intelligently sense, process, and act on information—learning and adapting over time.

Search and browse products connect you with information and intelligently sense, process, and act on information—learning and adapting over time.

Data Access & Collection · Company practice

Bing uses your search or command, IP address, location, cookie IDs, time and browser setup to complete the task

Bing services include search and mapping and collect and process data in many forms, including inked or typed text, voice data and images; they also power experiences inside other Microsoft services such as Microsoft 365 and some Windows features. When you search or enter a command in a Bing-powered experience, Microsoft uses that data (text, voice or image) along with your IP address, location, the unique identifiers in cookies or similar technologies, the date and time of your search and your browser configuration to complete the task. If you use Bing voice-enabled services, your voice input and speech performance data are sent to Microsoft.

Supporting quotations

Bing services collect and process data in many forms, including text that has been inked or typed, voice data, and images.

we will use that data (which could take the form of text, voice data, or an image), along with your IP address, location, the unique identifiers contained in our cookies or similar technologies, the time and date of your search, and your browser configuration to complete the task you’ve requested

If you use Bing voice-enabled services, your voice input and the performance data associated with the speech functionality will be sent to Microsoft.

Use & Processing · Company practice

Copilot Search in Bing uses and collects personal data consistent with Bing's core web search

Bing includes Copilot Search, an AI-enhanced web search that reviews and summarizes search results from across the web and helps users create content. Microsoft states that Copilot Search's use and collection of personal data is consistent with Bing's core web search offering as described in this section.

Supporting quotations

Copilot Search’s use and collection of personal data is consistent with Bing’s core web search offering as described in this section.

Data Access & Collection · User right or choice

Search suggestions collect what you type and click, and cannot be turned off in the Windows search box

To give search suggestions as you type, Microsoft collects the characters you type and what you click. You can turn the feature on or off in Bing Settings, and in Microsoft Edge in Edge Settings. In the search box in Windows 10 and Windows 11, search suggestions cannot be turned off.

Supporting quotations

Microsoft collects the characters that you type and what you click on.

To turn this feature on or off in Bing, go to

Search suggestions cannot be turned off in the search box in Windows 10 and Windows 11.

Qualifications & exceptions

• Cannot be turned off in the Windows 10 and 11 search box.

Data Access & Collection · User right or choice

The Bing Experience Improvement Program collects visited website addresses, deletes them after 18 months and is optional

If you use Bing Desktop or Bing Toolbar and choose to take part in the Bing Experience Improvement Program, Microsoft collects additional data about how you use those apps, including the addresses of the websites you visit, to improve search ranking and relevance. It states that it does not use this data to identify or contact you or to personalize advertising. You can turn the program off at any time in the app settings, and Microsoft deletes the information collected through it after 18 months.

Supporting quotations

If you are using Bing Desktop or Bing Toolbar and choose to participate in the Bing Experience Improvement Program, we also collect additional data about how you use these specific Bing apps, including the addresses of the websites you visit, to help improve search ranking and relevance.

We do not use the data collected through the Bing Experience Improvement Program to identify or contact you or to personalize advertising.

We delete the information collected through the Bing Experience Improvement Program after 18 months.

Qualifications & exceptions

• Applies only if you choose to participate in the program.

Retention & Deletion · Company practice

Signed-in Bing personalizes and syncs history; clearing history does not delete the search logs

When you sign in to Bing with your personal Microsoft account, Bing gives you an enhanced experience including syncing your search history across devices, customizing interests, favorites and settings, and connecting your account with third-party services; you manage personalization in Bing Settings. When signed in you can review and clear your search terms and clicked results on the privacy dashboard or in Bing Settings. Clearing history removes it from your search history but does not delete information from Microsoft's search logs, which are retained and de-identified as described earlier or based on your privacy dashboard instructions.

Supporting quotations

Bing provides you with an enhanced experience when you sign in with your personal Microsoft account, including syncing your search history across devices, customizing your interests, favorites, and settings, and connecting your account with third-party services.

These tools allow you to review and clear your search terms and clicked results from Bing.

Clearing your history in Bing removes it from your search history, but does not delete information from our search logs, which are retained and de-identified as described above or based on your privacy dashboard instructions.

Qualifications & exceptions

• Clearing history does not delete data from search logs.

Not stated here

• The "described above" retention and de-identification terms for search logs are not shown in this passage.

Cross-references

• qualifies (model-proposed): Signed-in Bing and Copilot history can be viewed and cleared from your privacy dashboard — qualifies: Clearing Bing history on the dashboard or settings does not delete information from search logs, which is retained and de-identified.

Sharing & Disclosure · Company practice

Partners that use Bing send Microsoft search data, and destination sites receive standard browser data

You may reach Bing-powered experiences through third-party services. To provide these, Bing receives data from partners, including your search query and related data such as date, time, IP address and a unique identifier, and Microsoft uses it as described in the statement or as further limited by its contracts with partners. For how the third parties handle your data you are told to check their privacy policies. When you select a search result or ad on a Bing results page, the destination website receives the standard data your browser sends to every site, such as your IP address, browser type and language and the host name of the site you came from.

Supporting quotations

Bing receives data from these and other partners, including your search query and related data (such as date, time, IP address, and a unique identifier).

We will use this data as described in this statement or as further limited by our contractual obligations with our partners.

the destination website will receive the standard data your browser sends to every web site you visit—such as your IP address, browser type and language, and the host name of the site you came from

Qualifications & exceptions

• Use of partner data may be further limited by contracts with partners.

Not stated here

• The contracts with partners and the third-party services' privacy policies are not part of the supplied text.

Sharing & Disclosure · Company practice

Microsoft shares de-identified Bing data with selected third parties after a filter for sensitive terms

Microsoft shares some de-identified data from Bing and Bing-powered experiences with selected third parties. Before doing so it runs the data through a process designed to remove certain sensitive data that users may have typed into search terms, such as social security numbers or credit card numbers. It requires these third parties to keep the data secure and not use it for purposes other than those for which it was provided. The filter is described as "designed to" remove certain sensitive data, not all of it.

Supporting quotations

We share some de-identified data from Bing and Bing-powered experiences with selected third parties.

we run the data through a process designed to remove certain sensitive data that users may have included in the search terms themselves (such as social security numbers or credit card numbers)

We require these third parties to keep the data secure and to not use the data for purposes other than for which it is provided.

Qualifications & exceptions

• The filtering process is "designed to remove certain sensitive data", not guaranteed to remove all.

Not stated here

• The third parties receiving the data are not named.

Data Access & Collection · Company practice

Edge stores browsing data and passwords on your device, and sites you visit receive standard browser data

Microsoft Edge is the default web browser for Windows and is available on Linux, macOS, iOS and Android. Microsoft collects data necessary to provide features you request. Data about how you use the browser, such as browsing history, web form data, temporary internet files and cookies, is stored on your device, as are passwords saved in Password Manager, and you can delete this data in Edge settings. Whenever you use a browser, standard data about your device, such as IP address, browser type and language, access times and referring site addresses, is sent to the sites you visit, which may log it under their own practices.

Supporting quotations

Microsoft collects data that is necessary to provide features you request in Microsoft Edge.

Data about how you use your browser, such as your browsing history, web form data, temporary internet files, and cookies, are stored on your device.

Edge can also store your passwords on your device in Password Manager. You can delete this data from your device in Edge settings.

standard data about your device—like your IP address, browser type and language, access times, and referring website addresses—is sent to the websites you visit and online services you use

Qualifications & exceptions

• Local storage of browsing data is on your device; Microsoft collects data "necessary to provide features you request".

Data Access & Collection · Company practice

Edge sends required diagnostic data and optional data such as browsing history, tied to a browser installation ID

Microsoft Edge collects diagnostic data to keep the service up to date, secure and working. You can choose to send optional diagnostic data, including usage information, browsing history, information about websites you visit and search terms, to help enhance Edge and other Microsoft products and services. The diagnostic data collected by Edge is stored with one or more unique identifiers that help Microsoft recognize an individual browser installation on a device and understand service issues and use patterns.

Supporting quotations

Microsoft Edge collects diagnostic data to keep the service up to date, secure, and operating properly.

You can also choose to send optional diagnostic data—including usage information, browsing history, information about websites you visit, and search terms—to help enhance Microsoft Edge and other Microsoft products and services.

The diagnostic data collected by Microsoft Edge is stored with one or more unique identifiers that help us recognize an individual browser installation on a device and understand the browser’s service issues and use patterns.

Qualifications & exceptions

• Optional diagnostic data (including browsing history) is your choice.
• Identifiers recognize an individual browser installation.

Data Access & Collection · User right or choice

When allowed, Edge uses your search activity on any website to improve services, de-identified and kept for one year

When you allow it, Microsoft Edge collects and uses data from your search activity across the web, including on websites Microsoft does not own or operate, to improve Microsoft services. This may include search queries, the results and your interactions with them (such as links you click), and demographic information that is part of the search results. Edge de-identifies this data and retains it for one year, and Microsoft states it does not use it to personalize or provide ads to you. You can turn off this collection in Edge settings.

Supporting quotations

When you allow it, Microsoft Edge collects and uses data from your search activity across the web, including websites Microsoft does not own or operate, to improve Microsoft services.

Microsoft Edge de-identifies this data and retains it for one year.

Microsoft does not use this collected data to personalize or provide ads to you.

You can turn off this data collection in your Edge settings.

Qualifications & exceptions

• Applies only when you allow it.

Account & Service Control · User right or choice

Signed-in Edge syncs privacy settings and, if chosen, browsing data, passwords and payment information

When you sign in to Edge with a Microsoft account, Edge stores your privacy preferences and applies them across your signed-in devices, including during Windows setup or on a new device. Edge can sync browser data, including favorites, history, extensions, settings, open tabs, autofill entries such as name, address and phone number, passwords and payment information, across signed-in devices. You control which data to sync in Edge settings. If you delete browser data while synced, you delete it across all signed-in devices. If you sync extensions acquired from third-party web stores, a copy of the extension is downloaded directly to your synced devices.

Supporting quotations

Microsoft Edge will store your privacy preferences and apply these settings across your signed-in devices

Microsoft Edge can sync your browser data—including your favorites, browsing history, extensions and associated data, settings, open tabs, autofill form entries (like your name, address, and phone number), passwords, and payment information—across your signed in devices.

You can control which data to sync in Edge settings. If you delete browser data while synced, you will delete the data across all signed-in devices.

Qualifications & exceptions

• Which browser data syncs is your choice in Edge settings.
• Deleting synced data deletes it on all signed-in devices.

Inference & Profiling · User right or choice

You may choose to share Edge browsing activity to personalize Microsoft services including ads, and can stop it

You may choose to share your Edge browsing activity with Microsoft to personalize Edge and other Microsoft services such as ads, Bing, Shopping, MSN and Copilot. Browsing activity includes browse history, favorites, usage data and web content. You can stop sharing in Edge settings, and the "See ads that interest you" setting on the Microsoft privacy dashboard lets you control use of browsing activity for personalized ads.

Supporting quotations

You may also choose to share your Microsoft Edge browsing activity with us to allow us to personalize Microsoft Edge and other Microsoft services like ads, Bing, Shopping, MSN, and Copilot.

Browsing activity includes your browse history, favorites, usage data, and web content.

You can stop sharing your Microsoft Edge browsing activity within Edge settings.

The See ads that interest you setting on the Microsoft

Qualifications & exceptions

• Sharing browsing activity is your choice.

Security & Safeguards · Company practice

Password Monitor sends hashed, encrypted credentials to check for breaches and does not keep them after the check

If you turn on Microsoft's Password Monitor, your saved credentials are hashed, encrypted and sent to the Password Monitor service so Microsoft can warn you if they were detected in a malicious attack or breach. Microsoft states it does not retain this data after the check is complete.

Supporting quotations

If you have turned on Microsoft’s Password Monitor, your saved credentials are hashed, encrypted, and sent to the Password Monitor service so that we can warn you if your credentials were detected in a malicious attack or a breach.

We do not retain this data after the check is complete.

Qualifications & exceptions

• Applies only if you turn on Password Monitor.

Sharing & Disclosure · User right or choice

Edge sends what you type in the address bar and standard device data to your default search provider

Edge's Search and site suggestions feature uses your search queries and browsing history to give faster and more relevant recommendations. As you type in the address bar, Edge sends your search queries, standard device data and location (if enabled) to your default search provider for real-time suggestions and results. You can disable these features in Edge settings. If Bing is your default search provider, Microsoft uses the data as described in the Bing section.

Supporting quotations

As you type in the address bar, Microsoft Edge sends your search queries, standard device data, and location (if enabled) to your default search provider for real-time suggestions and search results.

You can disable these features in Edge settings.

If Bing is your default search provider, we use this data as described in the

Qualifications & exceptions

• Location is sent only if enabled.
• Another default search provider uses the data under its own practices.

Not stated here

• The text does not describe other search providers' handling of this data.

Data Access & Collection · User right or choice

Copilot in Edge can access your browsing activity and screenshots if you allow, and captures page snapshots for tasks

Copilot in Edge collects and processes data to provide requested services, including typed text, voice data and uploaded files. You can choose to let Copilot in Edge access your browsing activity, including screenshots of webpages you visit, open tabs and browsing history, to give better answers and enable advanced features, and you can manage these choices in Edge settings. If you choose features that perform tasks on your behalf, Copilot captures visual snapshots of the pages it visits to interact with them and complete the action. Microsoft says Edge's use of data connected with Copilot is consistent with the Copilot data use described in the AI section.

Supporting quotations

Copilot in Edge collects and processes data in order to provide the services requested, including text that has been typed, voice data, and uploaded files.

you can choose to allow Microsoft Copilot in Edge to access your browsing activity, including screenshots of webpages you visit, open tabs, and browsing history to provide better answers and enable advanced Copilot features

You can manage Copilot in Edge choices in Edge settings.

If you choose to use features that perform tasks on your behalf, Copilot will capture visual snapshots of the pages it visits to interact with and complete the action.

Qualifications & exceptions

• Access to browsing activity requires your choice.
• Snapshots apply when you use features that perform tasks on your behalf.

Use & Processing · Context

Edge features that show MSN content, such as a new tab, follow the MSN section

Certain Edge features, such as opening a new tab, connect you to MSN content. Data use in MSN is covered by the MSN section of the statement rather than the Edge section.

Supporting quotations

Certain features in Microsoft Edge connect you to MSN content, such as when you open a new tab in the browser. Data use in MSN is covered by the MSN section of this privacy statement.

Data Access & Collection · Company practice

Windows collects data about you, your device and your use, and a managing organization can access and control it

Windows is a personalized computing environment with cloud-based components. To provide and secure it, Microsoft collects data about you, your device and the way you use Windows, and offers optional features such as personalized tips, ads and recommendations; Windows gives you choices about the data collected and how it is used. If your device is managed by an organization such as an employer or school, the organization may use centralized management tools to access and process your data, including interaction data, diagnostic data and the contents of your communications and files, and to control device settings including privacy settings, policies, software updates and data collection. This statement covers Windows 10 and Windows 11; earlier versions have their own statements.

Supporting quotations

we collect data about you, your device, and the way you use Windows

We also provide you with optional features like personalized tips, ads, and recommendations.

If your Windows device is managed by your organization, your organization may use centralized management tools provided by Microsoft or others to access and process your data (including your interaction data, diagnostic data, and the contents of your communications and files), and to control device settings (including privacy settings), device policies, software updates, data collection by us or the organization, or other aspects of your device.

This statement discusses Windows 10 and Windows 11; earlier versions of Windows are subject to their own privacy statements.

Earlier versions of Windows are subject to their own privacy statements.

Qualifications & exceptions

• Applies to Windows 10 and Windows 11 only.
• Organization access applies when your device is managed by an organization.

Account & Service Control · User right or choice

Windows Settings lets you control which apps can use your camera, microphone, location, contacts and other capabilities

Windows Settings is where you manage user accounts, network settings and personalization. It also lets you manage which apps can access device capabilities such as the camera, microphone, location, calendar, contacts, call history and messages. Each capability has its own privacy settings page, so you can control which apps can use each capability. Settings also covers privacy preferences such as location and collection of diagnostic data, and lets you turn individual apps and services on or off for device capabilities.

Supporting quotations

Windows Settings also allows you to manage which apps can access various device capabilities such as the device’s camera, microphone, location, calendar, contacts, call history, messages and more, while controlling access to your personal data.

Each capability has its own privacy settings page in Windows Settings, so you can control which apps can use each capability.

Set privacy preferences such as location and collection of diagnostic data. Fine-tune which individual apps and services can access device capabilities by turning them on or off.

Account & Service Control · Context

Windows Settings also manages appearance, devices, networks, accounts and system options

Beyond privacy, Windows Settings is described as handling personalization of appearance, language and privacy settings (including use of the microphone, camera and location); installing and managing devices such as printers and external drives; network configuration using relevant device identifiers; adding or removing user accounts and sign-in options; and system options such as display, notifications, power and installed apps. A separate Data collection summary for Windows is linked and not supplied here.

Supporting quotations

Personalize Windows appearance, language, and privacy settings, including using device features like the microphone, camera, and location.

Adjust Wi-Fi, Ethernet, cellular and VPN settings, using relevant device identifiers.

Add or remove user accounts and manage sign-in options.

Configure display, notifications, power, and manage installed apps and more.

For more information about data collection in Windows, see

Not stated here

• The linked Data collection summary for Windows is not part of the supplied text.

Data Access & Collection · Company practice

Activating Windows sends your product key and device data to Microsoft, and on phones device location at first power-up

When you activate Windows, a product key is associated with your device, and the key plus data about the software and your device are sent to Microsoft to validate your license. This data may be sent again if you need to re-activate or validate. On phones running Windows, device and network identifiers and the device location at first power-up are also sent to Microsoft for warranty registration, stock replenishment and fraud prevention.

Supporting quotations

The product key and data about the software and your device are sent to Microsoft to help validate your license to the software.

On phones running Windows, device and network identifiers, as well as device location at the time of the first power-up of the device, are also sent to Microsoft for the purpose of warranty registration, stock replenishment, and fraud prevention.

Qualifications & exceptions

• Phone location at first power-up applies to phones running Windows.

Linking & Identification · User right or choice

Windows creates an advertising ID that Microsoft, third-party apps and ad networks can use, and you can turn it off

Windows generates an advertising ID for each user on a device, which Microsoft, third-party apps and advertising networks can use to provide relevant ads and personalized experiences in apps and across the web, similar to how websites use cookies. App developers and ad networks can also use it for their own purposes, subject to their own privacy policies and the controls described. The setting applies to Windows apps using the advertising identifier, and you can turn off use of the ID in the Windows Settings app.

Supporting quotations

Windows generates an advertising ID for each user on a device, which Microsoft, third-party apps, and advertising networks can use to provide relevant ads and personalized experiences on apps and across the web, similar to how websites use cookies.

App developers and advertising networks can also use it for their own purposes, subject to their own privacy policies and the controls described below.

You can turn off use of the advertising ID in the Windows Settings app.

Qualifications & exceptions

• Developers and ad networks may use the ID for their own purposes under their own policies.
• The setting applies to Windows apps that use the advertising identifier, not other personalized advertising.

Use & Processing · Restriction or exception

The advertising ID setting does not control cookie-based or third-party personalized advertising

Microsoft says the Windows advertising ID setting does not apply to other methods of personalized advertising delivered by Microsoft or third parties, such as cookies used for personalized display ads on websites. Third-party products accessed through or installed on Windows may also deliver other forms of personalized advertising under their own privacy policies. Turning off the advertising ID therefore does not stop all personalized ads.

Supporting quotations

The advertising ID setting does not apply to other methods of personalized advertising delivered by Microsoft or third parties, such as cookies used to provide personalized display ads on websites.

Third-party products accessed through or installed on Windows may also deliver other forms of personalized advertising subject to their own privacy policies.

Cross-references

• qualifies (model-proposed): Windows creates an advertising ID that Microsoft, third-party apps and ad networks can use, and you can turn it off — qualifies: The advertising ID setting covers Windows apps using the identifier; cookie-based and third-party personalized advertising are not controlled by it.

Sharing & Disclosure · Company practice

With your consent, Settings may share device and SIM identifiers with a mobile operator's website

When you activate a cellular data plan from a third-party mobile operator through Windows Settings, the operator's website may ask for access to your device and SIM card identifiers. With your consent, the Settings app may share those specific identifiers with the operator's website.

Supporting quotations

the mobile operator's website may request access to your device and SIM card identifiers. With your consent, the Settings app may share the specific identifiers with the operator’s website.

Qualifications & exceptions

• Requires your consent.

Data Access & Collection · Company practice

Windows diagnostic data is stored with identifiers that recognize individual users on a device

Microsoft collects Windows diagnostic data to solve problems, keep Windows up to date, secure and working, and improve Windows and related products. The data is collected periodically from your device and stored with unique identifiers that help Microsoft recognize individual users on a device and identify issues and usage patterns. Product materials sometimes call required diagnostic data "Basic" and optional diagnostic data "Full"; current lists of the events and fields are on linked pages that are not supplied here.

Supporting quotations

Microsoft collects diagnostic data to solve problems and to keep its products like Windows up to date, secure, and operating properly, and to improve Windows and related Microsoft products and services.

This data is periodically collected from your device and stored with unique identifiers to help Microsoft recognize individual users on a device and identify issues and usage patterns.

Certain product documentation and other materials refer to required diagnostic data as “Basic diagnostic data” and to optional diagnostic data as “Full diagnostic data.”

Not stated here

• The linked lists of required and optional Windows diagnostic events are not part of the supplied text.

Sharing & Disclosure · Company practice

If your organization enrolls your device, Microsoft processes Windows diagnostic data under its contract with it

If you use a work or school account, your organization may enroll your device in the Windows diagnostic data processor configuration, in which case Microsoft processes Windows diagnostic data based on a contract with the organization. If an organization uses Microsoft management tools or engages Microsoft to manage your device, Microsoft and the organization can process and use diagnostic and error data from your device for device management, monitoring, troubleshooting and other organizational purposes.

Supporting quotations

your organization may enroll your device in the Windows diagnostic data processor configuration. Microsoft processes Windows diagnostic data based on a contract with the organization.

Microsoft and your organization can process and use diagnostic and error data from your device for device management, monitoring, troubleshooting, and other organizational purposes.

Qualifications & exceptions

• Applies to devices used with a work or school account and enrolled by the organization.

Not stated here

• The contract with the organization is not part of the supplied text.

Data Access & Collection · Company practice

Required Windows diagnostic data covers device, network, OS, peripherals, installed apps and update status

Required diagnostic data includes information about your device, its settings and capabilities, and whether it is performing properly. Listed items: device data such as processor type, manufacturer, battery, cameras, firmware and memory; network capabilities and connection data such as the IP address, mobile network and whether the connection is free or paid; operating system and configuration data such as version, region and language settings, diagnostics settings and Windows Insider membership; connected peripherals; applications installed, with name, version and publisher; whether the device is ready for and receives updates and whether they succeed; the reliability of the diagnostics system itself; and basic error reporting on the health of the operating system and applications.

Supporting quotations

Required diagnostic data includes information about your device, its settings and capabilities, and whether it is performing properly.

Data about the device such as the processor type, OEM manufacturer, type of battery and capacity, number and type of cameras, firmware, and memory attributes.

Network capabilities and connection data such as the device’s IP address, mobile network, and whether the device is connected to a free or paid network.

Data about the operating system and its configuration such as the OS version and build number, region and language settings, diagnostics data settings, and whether the device is part of the Windows Insider program.

Data about connected peripherals such as model, manufacturer, drivers, and compatibility data.

Data about the applications installed on the device such as application name, version, and publisher.

Whether a device is ready for and can receive an update based on factors like low battery, limited disk space, or connectivity through a paid network.

Whether updates complete successfully or fail.

Data about the reliability of the diagnostics collection system itself.

Basic error reporting, which is health data about the operating system and applications running on your device.

Data Access & Collection · User right or choice

Optional Windows diagnostic data adds app activity, Edge browsing history and search terms, and crash memory

If you choose to send optional diagnostic data, required diagnostic data is always included, and Microsoft also collects additional device, connectivity and configuration data; status and logging information about the health of the operating system and other components; app activity, such as which programs are launched, how long they run and how quickly they respond; browser activity in Microsoft Edge, including browsing history and search terms; and enhanced error reporting that includes the memory state of the device when a crash occurs, which may unintentionally contain user content such as parts of a file you were using.

Supporting quotations

When you choose to send optional diagnostic data, required diagnostic data will always be included

Additional data about the device, connectivity, and configuration, beyond that collected as part of required diagnostic data.

Status and logging information about the health of operating system and other system components beyond that collected about the update and diagnostics systems under required diagnostic data.

App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input.

Browser activity, including browsing history and search terms, in Microsoft Edge.

Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred).

Qualifications & exceptions

• Optional diagnostic data is sent only if you choose; required diagnostic data is always included.
• Crash memory "may unintentionally contain user content".

Data Access & Collection · Company practice

Optional Windows diagnostic data is collected from only a sample of devices, and a viewer shows what your device sends

Even if you choose to send optional diagnostic data, some of the data may not be collected from your device: Microsoft minimizes collection by gathering some data from only a subset (sample) of devices. The Diagnostic Data Viewer tool shows whether your device is part of a sample and what data is collected from it. Download instructions are in the Windows Settings app under Diagnostics & feedback.

Supporting quotations

Microsoft minimizes the amount of data it collects by collecting some of the data from only a subset of devices (sample).

The Diagnostic Data Viewer tool shows if your device is part of a sample and what specific data is collected from your device.

Qualifications & exceptions

• Some optional data comes from a sample of devices only.

Sharing & Disclosure · Company practice

Windows diagnostic collection can change; error report portions and aggregated data may be shared with others

The specific Windows diagnostic data collected may change to address new issues or support new devices, for example collecting new types of data to troubleshoot performance or update devices. Microsoft provides limited portions of error report information to partners, like device manufacturers, solely to help them repair or improve products and services that work with Windows and other Microsoft products. It may also share aggregated, de-identified diagnostic data, such as general usage trends for Windows apps and features, with select third parties.

Supporting quotations

The specific data collected through Windows diagnostics may change as needed to address new issues or support recently released devices.

We provide limited portions of error report information to partners, like device manufacturers, solely to help them repair or improve their products and services, which work with Windows and other Microsoft products and services.

We may also share aggregated, de-identified diagnostic data, such as general usage trends for Windows apps and features, with select third parties.

Qualifications & exceptions

• Error report sharing is limited portions and solely for repair or improvement by partners.
• Shared usage data is aggregated and de-identified.

Not stated here

• The select third parties that receive aggregated data are not named.

Data Access & Collection · User right or choice

If you enable it, Windows collects samples of what you type or write, processed to remove identifying details

You can choose to help improve inking and typing recognition by sending inking and typing diagnostic data. If enabled, Microsoft collects samples of what you type or write to improve features like handwriting recognition, autocompletion, next word prediction and spelling correction across languages. The samples are divided into small pieces and processed to remove information that could identify you or rebuild the original content, such as unique identifiers, sequencing details, email addresses and numeric values. Performance data, including text changes you make manually and words you add to the dictionary, is also included.

Supporting quotations

You can choose to help Microsoft improve inking and typing recognition by sending inking and typing diagnostic data.

If enabled, Microsoft collects samples of what you type or write to enhance features like handwriting recognition, autocompletion, next word prediction, and spelling correction across languages.

processed to remove information that could identify you or reconstruct the original content, such as unique identifiers, sequencing details, email addresses, and numeric values

Performance data, including text changes you make manually and words you add to the dictionary, is also included.

Qualifications & exceptions

• Applies only if you enable it.
• Processing is described as removing information that "could identify you or reconstruct the original content".

Inference & Profiling · User right or choice

If Personalized offers is on, Windows uses diagnostic and account data to show tips, ads and recommendations

If you turn on Personalized offers, Microsoft uses information about your device and how you use it, including Windows diagnostic data, in combination with your account information and data from other Microsoft products to offer personalized tips, ads and recommendations, including ads and recommendations for Microsoft and third-party products, apps and hardware. When it is on, Windows may use your required diagnostic data, and if you share optional diagnostic data, also information about how you use apps and features and additional device health information. Microsoft may also personalize offers locally on your device even when the data does not leave it. It states it does not use the content of crash dumps, speech, typing or inking input data for personalizing offers.

Supporting quotations

If you choose to turn on Personalized offers, we will use information about your device and how you use it, including Windows diagnostic data, in combination with your account info and data collected by other Microsoft products and services to offer you personalized tips, ads, and recommendations to enhance your Windows experiences.

ads and recommendations for Microsoft and third-party products and services, features, apps, and hardware

When Personalized offers is on, Windows may use your required diagnostic data to personalize offers.

If you have decided to share optional diagnostic data, the data used to personalize offers may also include information about how you use apps and features, plus additional information about the health of your device.

We do not use the content of crash dumps, speech, typing, or inking input data for personalizing offers.

Qualifications & exceptions

• Applies only if you turn on Personalized offers.
• Optional diagnostic data adds app and feature usage and device health information.

Linking & Identification · Company practice

Personalized offers may also combine web activity, other Microsoft product use, purchases and third-party site data

In addition to device information and diagnostic data, Microsoft may use or combine data from other Microsoft products and your account to personalize offers: web activity, if you give Edge permission to collect it for personalized search, ads and news; information about your use of other Microsoft products and services, including Bing, Microsoft 365, Xbox and Microsoft websites such as MSN.com; subscription and purchase history; and data from third-party websites that may be shared with Microsoft. It may also use your interactions with tips, recommendations and promotions to provide and improve personalized offers and similar messages in other Microsoft products.

Supporting quotations

we may use or combine the following data from other Microsoft products and your account with Windows diagnostic data to personalize offers:

Web activity, if you give Microsoft Edge permission to collect your web activity for personalized search, ads, and news.

Info about your use of other Microsoft products and services, including Microsoft Bing, Microsoft 365, XBOX, and Microsoft websites, such as MSN.com.

Subscription and purchase history.

Data from third-party websites which may be shared with Microsoft.

We may also use information about your interactions with tips, recommendations, and promotions to provide and improve the personalized offers and similar messages in other Microsoft products.

Qualifications & exceptions

• Edge web activity is used only if you give Edge permission.
• Uses are stated as "may".

Account & Service Control · User right or choice

Managing personalized offers varies by region, and some contextual messaging continues even when it is off

To manage how data from other Microsoft products is used to personalize offers, you can visit the Personalized ads and offers page. In some regions, such as the European Economic Area, turning off Personalized offers in Windows also stops the use of data from other Microsoft products to personalize tips, ads and recommendations in Windows; in other regions, you manage that use on the Personalized ads and offers page. Contextual data from your device and some basic account data are still used to show appropriate messaging in Windows, regardless of whether Personalized offers or the other-products settings are off, for example to make sure content is in the right language and suitable for your age group.

Supporting quotations

In some regions such as the European Economic Area, turning off Personalized offers on Windows also stops the use of data from other Microsoft products to personalize tips, ads, and recommendations in Windows.

In other regions, you can manage how data collected by other Microsoft products is used to personalize offers by visiting your

Contextual data from your device and some basic account data are used to show you appropriate messaging in Windows regardless of whether the Personalized offers setting in Windows or the settings to use data from other Microsoft products to personalize offers are turned off.

Qualifications & exceptions

• The effect of turning off Personalized offers depends on region.
• Contextual messaging continues when personalization settings are off.

Account & Service Control · User right or choice

The Personalized offers setting covers only Windows and can be changed any time

Personalized offers applies to tips, offers, ads and recommendations you see in Windows. Changing the setting does not affect the kinds of offers you may see in other Microsoft products. You can change it at any time by searching for Personalized offers in Windows Settings.

Supporting quotations

Personalized offers applies to tips, offers, ads, and recommendations you see in Windows. Changing this setting will not impact the kinds of offers you may see in other Microsoft products.

You can change this setting at any time by searching for Personalized offers in the Windows Settings app.

Qualifications & exceptions

• Does not change offers in other Microsoft products.

Inference & Profiling · User right or choice

Tailored experiences, being replaced by Personalized offers, uses Windows diagnostic data stored with identifiers

Tailored experiences is being replaced by Personalized offers in more recent versions of Windows, but may still appear if you have not installed the latest update. If you turn it on, Microsoft uses your Windows diagnostic data (required or optional, as you selected) to offer personalized tips, ads and recommendations. With required data, personalization is based on device information, settings, capabilities and performance; with optional data, also on how you use apps and features and device health. Microsoft states it does not use information about the websites you browse, crash dump content, speech, typing or inking input data for personalization from customers who selected optional data. The data is transmitted to Microsoft and stored with unique identifiers that can help recognize an individual user on an individual device.

Supporting quotations

Tailored experiences is being replaced by Personalized offers in more recent versions of Windows.

If you choose to turn on Tailored experiences, we will use your Windows diagnostic data (Required or Optional as you have selected) to offer you personalized tips, ads, and recommendations to enhance Microsoft experiences.

we do not use information about the websites you browse, the content of crash dumps, speech, typing, or inking input data for personalization when we receive such data from customers who have selected Optional

Tailored experiences data is transmitted to Microsoft and stored with one or more unique identifiers that can help us recognize an individual user on an individual device and understand the device’s service issues and use patterns.

Tailored experiences include suggestions on how to customize and optimize Windows, as well as ads and recommendations for Microsoft and third-party products and services, features, apps, and hardware for your Windows experiences.

Qualifications & exceptions

• Applies only if you turn on Tailored experiences.
• Data is stored with identifiers that can recognize an individual user on a device.

Data Access & Collection · Company practice

Feedback Hub reads installed apps, may use camera and microphone on HoloLens, and sends diagnostic data with feedback

Feedback Hub lets you give feedback on Microsoft products and installed first-party apps and, in some cases, third-party apps, and it determines the apps installed on your device through public APIs. For HoloLens users it can access the camera and microphone when you choose to share surroundings or audio and uses picture and document libraries to attach screenshots and recordings. When you submit feedback about a problem, diagnostic data is sent, either automatically or by your choice depending on your Windows diagnostic data settings. Additional personal data may be collected depending on the type of feedback, for example location data for feedback about location services.

Supporting quotations

It determines the apps installed on your device through public APIs.

For HoloLens users, Feedback Hub can access your camera and microphone when you choose to share surroundings or audio input

When you submit feedback about a problem to Microsoft, diagnostic data is sent to help improve Microsoft products and services.

Additional personal data may be collected based on the type of feedback you provide to better troubleshoot specific issues – for example, location data when providing feedback about location services.

Qualifications & exceptions

• HoloLens camera and microphone access happens when you choose to share surroundings or audio.
• Whether diagnostic data is sent automatically depends on your diagnostic data settings.

Sharing & Disclosure · Company practice

Feedback may be visible to your organization or the public and shared with device and firmware partners

You can sign in to Feedback Hub with a personal Microsoft account or a work or school account. With a work or school account, your feedback may be associated with your organization and viewable by its administrators. Whichever account you use, your feedback may be publicly accessible depending on your organization's settings. Microsoft may also share your feedback and related data with partners, like device manufacturers or firmware developers, to help resolve issues with products and services that work with Windows.

Supporting quotations

When you use a work or school account your feedback may be associated with your organization and viewable by its administrators through Feedback Hub or the admin center.

Regardless of which account you use, your feedback may be publicly accessible depending on your organization’s settings.

Microsoft may also share your feedback and related data with partners, like device manufacturers or firmware developers to assist in resolving issues with products and services that work with Windows.

Qualifications & exceptions

• Public accessibility depends on the organization's settings.
• Sharing with partners is stated as "may".

Data Access & Collection · Company practice

Get Help can run diagnostics and use the microphone if enabled, but does not use your location

Get Help gives Windows users technical support, including self-service help, diagnostics recommendations and a connection to a live Microsoft agent. If you choose to run a diagnostic, the data collected is handled under the Windows Diagnostics section. You can sign in with a Microsoft account to create a support case. If enabled by system settings, you can use the system microphone in Get Help to speak your question, with controls in the Microphone Privacy Settings. Microsoft states Get Help does not use your location for its services.

Supporting quotations

If you choose to run a Diagnostic, any diagnostic data collected is handled according to the Windows Diagnostics section above.

helps connect you to a live Microsoft agent if needed

If enabled by system settings, you can use the system microphone in Get Help to voice your support question instead of typing

Get Help does not use your location for its services.

Qualifications & exceptions

• Voice questions need the microphone enabled by system settings.

Use & Processing · Company practice

Live captions transcribe speech from online, downloaded or microphone audio; microphone transcription is off by default

Live captions transcribe audio to help you follow spoken content. They can caption any audio containing speech, whether online, downloaded to your device or received from your microphone. By default, transcribing microphone audio is disabled. Microsoft states that voice data that is captioned is processed only on your device and not shared to the cloud or with Microsoft.

Supporting quotations

Live captions can generate captions from any audio containing speech, whether the audio is online, downloaded to your device, or received from your microphone. By default, transcribing microphone audio is disabled.

Voice data that is captioned is only processed on your device and is not shared to the cloud or with Microsoft

Qualifications & exceptions

• Microphone transcription is disabled by default.

Use & Processing · Company commitment

Voice data captioned by Live captions is processed only on your device

Microsoft states that voice data captioned through Live captions is processed only on your device and is not shared to the cloud or with Microsoft. This repeats and supports the Live captions description earlier in the Windows section.

Supporting quotations

Voice data that is captioned is only processed on your device and is not shared to the cloud or with Microsoft.

Data Access & Collection · Company practice

Windows location service combines GPS, Wi-Fi, cell, IP and default location, and you control app access in Settings

Microsoft's location service helps find the precise location of your Windows device using a combination of GPS, nearby wireless access points and routers, cell towers, IP address or a default location. Location services let you control which apps can access your precise location. When turned off, Windows and apps do not have access to device location, and some apps may not be able to access information about Wi-Fi networks. When turned on, apps can access approximate location and can request permission to use precise location, which you manage in Windows Settings. When location is enabled, data about cell towers and Wi-Fi access points and their locations is collected, de-identified and used to improve location services.

Supporting quotations

Microsoft’s location service helps determine the precise geographic location of your Windows device using a combination of GPS, nearby wireless access points and routers, cell towers, IP address, or default location.

When location services are turned off, Windows and apps will not have access to device location

With location services turned on, apps can access approximate location and can request permission to use precise location. You can manage these permissions in Windows Settings.

When location is enabled, data about cell towers and Wi-Fi access points and their locations are collected, de-identified, and used to improve location services.

Qualifications & exceptions

• When location services are off, Windows and apps do not have access to device location, subject to the exceptions in later paragraphs.

Retention & Deletion · Company practice

Your last known location is saved to the cloud when you are signed in and an app uses location

If an app or feature accesses your device location and you are signed in with a Microsoft account, your last known location is also saved to the cloud. It is available across your devices to other apps or services that use your Microsoft account and that you have given permission. You can view or delete this location information from your Microsoft account privacy dashboard.

Supporting quotations

If an app or feature accesses your device’s location and you are signed in with your Microsoft account, your last known location information is also saved to the cloud.

This location information can be viewed or deleted from your Microsoft account privacy dashboard.

Qualifications & exceptions

• Applies when an app or feature accesses your location and you are signed in with a Microsoft account.

Data Access & Collection · Restriction or exception

Some apps and services can still find your location when Windows location services are off

Some ways of determining location are not directly controlled by the location settings. For example, desktop apps, which are usually downloaded from the internet or installed from media, do not support per-app control over precise location access. Even when you have turned off location services, some third-party apps and services could use other technologies, such as Bluetooth, IP address or a cellular modem, or cloud-based location services, to work out your device's location with varying accuracy. A limited set of Windows features use your IP address to provide contextual information for your area, such as weather on the taskbar, when location services are off.

Supporting quotations

desktop apps are a type of app that do not support per-app control over precise location access

Even when you’ve turned off location services in Windows, some third-party apps and services could use other technologies (such as Bluetooth, IP address, cellular modem, etc.) or cloud-based location services to determine your device’s location with varying degrees of accuracy.

A limited set of features in Windows will use your IP address to provide you with contextual information for your area if location services are turned off, such as weather on the taskbar.

Qualifications & exceptions

• Turning off location services does not stop every way an app or feature could find your location.

Cross-references

• contrast (model-proposed): Windows location service combines GPS, Wi-Fi, cell, IP and default location, and you control app access in Settings — contrast: The location controls say Windows and apps lose access to location when services are off, while the exceptions say desktop apps, third-party technologies and IP-based features can still work out location. Reviewed tension.

Sharing & Disclosure · Restriction or exception

Emergency calls share your precise location regardless of settings, and apps may still get your general location

Whenever you make an emergency call, Windows attempts to determine and share your precise location regardless of your location settings, and your mobile operator will have access to your device location if your device uses a cellular service. If you turn on Location services, apps that cannot use your precise location may still have access to your general or coarse location, such as your city, postal code or region.

Supporting quotations

whenever you make an emergency call, Windows will attempt to determine and share your precise location, regardless of your location settings

your mobile operator will have access to your device’s location if your device is using a cellular service

apps that cannot use your precise location may still have access to your general or coarse location, such as your city, postal code, or region

Qualifications & exceptions

• Emergency location sharing applies regardless of location settings.

Data Access & Collection · Company practice

Find my device lets a device administrator locate the device even if other users denied location access

Find my device lets an administrator of a Windows device find the device's location from the Microsoft devices page. To enable it, an administrator must be signed in with a Microsoft account and have the location setting enabled. The feature works even if other users have denied location access for all their apps. When the administrator tries to locate the device, users see a notification in the notification area.

Supporting quotations

The Find my device feature allows an administrator of a Windows device to find the location of that device

This feature will work even if other users have denied access to location for all their apps.

When the administrator attempts to locate the device, users will see a notification in the notification area.

Qualifications & exceptions

• Requires an administrator signed in with a Microsoft account and the location setting enabled.

Data Access & Collection · Company practice

Narrator sends the image or page URL to Microsoft for descriptions; images are not kept, and you can disable it

When you use Narrator features such as image descriptions, page title descriptions or popular links lists, the image or URL of the web page you are visiting is sent to Microsoft. This data is used only to generate the requested descriptions or summaries and to improve Microsoft services such as Bing, and images are not retained after analysis. You can disable these features in Windows Settings. If you enable "Help Make Narrator Better" and submit verbal feedback through Feedback Hub, recent device and usage data, including event trace log data, is submitted with it to improve Microsoft products.

Supporting quotations

the image or URL of the web page you’re visiting is sent to Microsoft. This data is used only to generate the requested descriptions or summaries and to improve Microsoft services, such as Bing. Images are not retained by Microsoft after analysis.

You can disable these features at any time by going to

If you enable the setting “Help Make Narrator Better” in the Windows settings app and submit verbal feedback through Feedback Hub, recent device and usage data, including event trace log (ETL) data, will be submitted along with your verbal feedback

Qualifications & exceptions

• Verbal feedback with device and usage data is sent only if you enable the setting and submit feedback.

Account & Service Control · Context

Phone Link links your phone to your Windows PC; features and synced data differ for Android and iPhone

Phone Link lets you link your mobile phone to your Windows PC to enable cross-device experiences. Some features, and the data synced between phone and Windows devices, differ for Android devices and iPhones and are described separately.

Supporting quotations

The Phone Link feature lets you link your mobile phone to your Windows PC, enabling a variety of cross-device experiences across all your Windows devices.

Some Phone Link features, and the resulting data that is synced between your phone and Windows devices, differs for Android devices and iPhones and is described separately below.

Data Access & Collection · Company practice

Phone Link collects usage and device data; Android use needs an app, permissions and a Microsoft account

As part of providing Phone Link, Microsoft collects performance, usage and device data, for example the hardware capabilities of your phone and Windows device, the number and duration of Phone Link sessions and the time spent during setup. For Android phones, Phone Link can show recent photos, text messages and live calls, let you act on phone notifications, use Android apps from your PC and mirror your phone screen. To use it you must install the Link to Windows app on the phone, grant permissions, and log in to your Microsoft account on both devices, which must be online; some features need Bluetooth pairing. You can unlink the phone at any time from either device.

Supporting quotations

Microsoft collects performance, usage, and device data that includes, for example, the hardware capabilities of your mobile phone and Windows device, the number and duration of your sessions on Phone Link, and the amount of time you spent during setup.

You can use Phone Link to see recent photos, view and send text messages, and make and receive live calls from your Android phone on your Windows device.

To use Phone Link, you must install the Link to Windows app on your Android device and grant the requested app permissions.

You must log into your Microsoft account on the Phone Link feature on your Windows device and on Link to Windows on your Android phone.

You can unlink your Android phone from your Windows device at any time

Qualifications & exceptions

• Android features require the Link to Windows app, permissions and a Microsoft account sign-in on both devices.

Retention & Deletion · Company commitment

Microsoft says it never stores Android texts, call history, photos or app information on its servers

Microsoft states that it never stores your texts, call history, photos, what apps you have, or information displayed by the apps on its servers, and never changes them on your phone. This statement is made for Android Phone Link and is separate from the contacts sync feature, which does store contacts online, and from the app list collected for app mirroring.

Supporting quotations

We never store your texts, call history, photos, or what apps you have or information displayed by the apps on our servers or change them on your phone.

Qualifications & exceptions

• The commitment is stated for Phone Link on Android; contacts sync and the installed-app list for mirroring are treated separately.

Data Access & Collection · Company practice

On Android, texts and calls are stored temporarily on your PC, visible for 30 days, plus a limited number of photos

Phone Link accesses the content of your Android text messages and the sender's or recipient's contact information. Messages are stored temporarily on your device and only those received or sent in the last 30 days are visible on the Windows device. For calls, you must enable certain permissions on both devices, such as call log access and permission to make calls from your PC; call details are stored temporarily on the Windows device and only calls from the last 30 days are visible. For photos, you can copy, share, edit, save or delete a limited number of recent photos, which are stored temporarily on the Windows device.

Supporting quotations

Phone Link accesses the content of your text messages and the sender’s or recipient’s contact information.

only those messages received and sent within the last 30 days are visible on your Windows device

you must enable certain permissions on both the Phone Link Settings page on your Windows device and Android phone’s settings, such as call logs access and permission to make phone calls from your PC

only calls received and dialed within the last 30 days are visible under call logs on your Windows device

Phone Link allows you to copy, share, edit, save, or delete a limited number of your most recent photos from your Android phone on your Windows device. These photos are temporarily stored on your Windows device.

Qualifications & exceptions

• Stored temporarily on the Windows device; visibility is limited to the last 30 days for texts and calls.

Data Access & Collection · Company practice

On Android, Microsoft collects your installed app list for mirroring, and Contacts sync stores contacts online

Notifications sync requires enabling certain permissions on both devices. For app mirroring on supported devices, Microsoft collects a list of your installed Android apps and recent activity to provide the service and show recently used apps, and says it does not retain further information. Instant Hotspot shares hotspot information with the paired PC over secure Bluetooth, and mobile data charges may apply. If you enable "Contacts sync" in Link to Windows, your Android contacts are synced to the Microsoft cloud, stored online and associated with your Microsoft account, and are accessible in other Microsoft products and services.

Supporting quotations

To activate this Phone Link feature, you must enable certain permissions, such as sync notifications, on both your Windows device and Android phone.

Microsoft collects a list of your installed Android apps and recent activity to provide the service and show you your most recently used apps but does not retain further information.

Please note mobile data charges may apply depending on your mobile data plan.

Link to Windows allows you to sync your Android contacts into the Microsoft cloud.

Your contacts information is stored online and associated with your Microsoft account.

Qualifications & exceptions

• Contacts sync is optional and stores contacts online.
• App mirroring collects the installed app list and recent activity.

Data Access & Collection · Company practice

On iPhone, Phone Link works over Bluetooth, and Microsoft says it never stores texts or call history on its servers

With an iPhone, Phone Link lets you make and receive calls, view and send text messages and act on notifications from your Windows device. You must have Bluetooth enabled on the iPhone and may optionally install the Link to Windows app. You can unlink the iPhone from Phone Link settings or by choosing Forget This Device in the iPhone Bluetooth settings. Microsoft states it never stores your texts or call history on its servers or changes them on your iPhone.

Supporting quotations

You can use Phone Link to make and receive calls from your iPhone, view and send text messages, and view, dismiss, or perform other actions on your iPhone notification from your Windows device.

To use Phone Link, you must have Bluetooth enabled on your iPhone. You may also optionally install the Link to Windows app on your iPhone.

You can unlink your iPhone from your Windows device at any time

We never store your texts or call history on our servers or change them on your iPhone.

Data Access & Collection · Company practice

On iPhone, Phone Link reads text content and contacts, and stores texts and call details temporarily on your PC

Phone Link lets you view SMS messages delivered to your iPhone on your Windows devices and send messages from them. It accesses the content of your text messages and the sender's or recipient's contact information. The messages are stored temporarily on your Windows device, and only messages received and sent within your Bluetooth session or iMessage are visible. For calls, you must enable Sync Contacts in your iPhone's Bluetooth settings; call details are stored temporarily on your Windows device.

Supporting quotations

Phone Link accesses the content of your text messages and the sender’s or recipient’s contact information. These text messages are temporarily stored on your Windows device

To activate this feature, you must enable the Sync Contacts feature under Bluetooth settings on your iPhone. These call details are temporarily stored on your Windows device.

Qualifications & exceptions

• Stored temporarily on the Windows device.

Data Access & Collection · Company practice

On iPhone, notifications and contacts sync only after you enable the matching permissions

Phone Link lets you view, read and act on your iPhone notifications on your Windows device; to activate this you must enable certain permissions, such as sync notifications, on both devices. You can sync your iPhone contacts for messaging and calling by turning on Sync Contacts under your PC name in the iPhone Bluetooth settings after connecting the iPhone to Phone Link.

Supporting quotations

To activate this Phone Link feature, you must enable certain permissions such as sync notifications, on both your Windows device and iPhone.

Phone Link allows you to sync your contacts from your iPhone to access them for messaging and calling by going into Bluetooth settings on your iPhone and toggle on Sync Contacts under your PC name after connecting your iPhone to Phone Link.

Qualifications & exceptions

• Both features need permissions or settings you enable on the iPhone.

Data Access & Collection · User right or choice

Cross-device experiences link your mobile device through your Microsoft account and collect usage and device data

Cross-device experiences let your PC access a linked mobile device through your Microsoft account. By linking a device and enabling these experiences, Windows may make certain mobile device content available across Windows to provide integrated cross-device features. They can be managed under Mobile Devices in Windows Settings, and you can turn the feature on or off at any time. Microsoft collects performance, usage and device data, including the hardware capabilities of your mobile and Windows devices.

Supporting quotations

By linking your mobile device and enabling these experiences, Windows may make certain mobile device content available across Windows to deliver features and services that support integrated cross‑device functionality.

As part of providing these features, Microsoft collects performance usage and device data, including information about the hardware capabilities of your mobile and Windows devices.

You can turn this feature on or off at any time in your Windows PC Settings.

Qualifications & exceptions

• Content is made available "certain" content and only when you link a device and enable the experiences.

Retention & Deletion · Company commitment

Connected camera, new-photo notifications and file access are not stored on Microsoft servers

Using your mobile device as a connected camera in Windows apps is enabled under Mobile Devices in Settings, and Microsoft states it does not record or store your camera sessions or what the camera displays. New photo notifications from the linked device store photos temporarily on your PC while you edit or open them; you must start saving to keep them, and Microsoft says it never stores your photos on its servers or changes or deletes photos on your mobile device. Showing your mobile device in File Explorer gives access to its files, and Microsoft says it will not store file contents in its services. You can also enable access through Windows Share to share files and folders between the PC and the mobile device.

Supporting quotations

Microsoft does not record or store your camera sessions or any of the information displayed by your camera in any of the applications or products.

These photos are temporarily stored on your Windows PC while you are editing or opening those photos.

We never store your photos on our servers or change or delete any photos on your mobile device.

Microsoft will not store your file contents in its services.

Once enabled, your linked devices are visible in Windows, allowing you to share files and folders between your PC and your mobile device.

Qualifications & exceptions

• These features require you to enable them in Settings.

Content & IP Rights · Restriction or exception

Windows recording saves locally, may be sent to a public broadcast service, and you carry the legal responsibility

Some Windows devices have a recording feature that captures audio and video clips of your activity, including communications with others. If you choose to record, the recording is saved locally on your device, and in some cases you may be able to send it to a Microsoft product or service that broadcasts it publicly. The statement tells you to understand your legal responsibilities before recording or transmitting any communication, which may include getting everyone's prior consent, and says Microsoft is not responsible for how you use recording features or your recordings.

Supporting quotations

If you choose to record a session, the recording will be saved locally on your device. In some cases, you may have the option to transmit the recording to a Microsoft product or service that broadcasts the recording publicly.

You should understand your legal responsibilities before recording and/or transmitting any communication. This may include obtaining the prior consent of everyone participating in the conversation or any other authorizations as required.

Microsoft is not responsible for how you use recording features or your recordings.

Qualifications & exceptions

• Local saving applies when you choose to record; public broadcast is an option "in some cases".

Security & Safeguards · Company practice

Device encryption backs up your BitLocker recovery key to your Microsoft account, and Microsoft says it does not use it

Device encryption uses BitLocker to encrypt the drive Windows is installed on and generates a recovery key. The BitLocker recovery key for a personal device is automatically backed up online and associated with your personal Microsoft account. Microsoft states it does not use your individual recovery keys for any purpose.

Supporting quotations

When device encryption is on, Windows encrypts the drive Windows is installed on and generates a recovery key.

The BitLocker recovery key for your personal device is automatically backed up online and associated with your personal Microsoft account.

Microsoft doesn't use your individual recovery keys for any purpose.

Qualifications & exceptions

• Backup is automatic for personal devices signed in with a personal Microsoft account.

Security & Safeguards · User right or choice

The malware removal tool runs monthly and reports malware and device data to Microsoft unless you turn it off

The Malicious Software Removal Tool runs on your device at least once a month as part of Windows Update, checks for specific prevalent malware and helps remove it. During a malware check, a report with data about detected malware, errors and other data about your device is sent to Microsoft. You can turn off the reporting feature if you do not want to send this data.

Supporting quotations

MSRT runs on your device at least once per month as part of Windows Update

During a malware check, a report will be sent to Microsoft with specific data about malware detected, errors, and other data about your device.

You can turn off MSRT's reporting feature if you do not want to send this data to Microsoft.

Qualifications & exceptions

• Reporting can be turned off.

Account & Service Control · Company practice

Windows Family tools can require parental consent for children and report a child's device activity to parents

Parents can use Microsoft Family Safety to understand and set boundaries on how their child uses their device. For users under 13, or the age set by law where they live, certain products either block them or require consent from a parent or guardian before use, including when creating an account; during registration under-age users are prompted to request consent by entering an adult's email. When Family activity reporting is turned on for a child, Microsoft collects details about how the child uses their device and gives parents reports of the child's activities. Activity reports are routinely deleted from Microsoft servers.

Supporting quotations

certain Microsoft products and services will either block users under that age or will ask them to obtain consent or authorization from a parent or guardian before they can use it, including when creating an account to access Microsoft services

during the registration process you'll be prompted to request consent from a parent or guardian by entering an adult’s email

When Family activity reporting is turned on for a child, Microsoft will collect details about how the child uses their device and provide parents with reports of that child's activities.

Activity reports are routinely deleted from Microsoft servers.

Qualifications & exceptions

• Reporting applies when Family activity reporting is turned on for the child.

Not stated here

• The text does not say how long activity reports are kept before routine deletion.

Security & Safeguards · Company practice

SmartScreen and Smart App Control send web addresses and file names, hashes, locations and certificates to Microsoft

Microsoft Defender SmartScreen identifies threats from unsafe websites, apps and files, and when checking content it sends relevant data, including web addresses and, if needed, details about suspicious sites or apps, to Microsoft for security analysis. Microsoft says this data is used only for security purposes such as detecting and responding to security incidents, identity theft, fraud or other malicious activity. Smart App Control, where supported, starts in evaluation mode using data collected by SmartScreen (file names, hashes, download locations and digital certificates) to decide whether it suits your device, and is enabled automatically if the device qualifies. When either checks a file, data about the file, including its name, a hash of its contents, download location and digital certificates, is sent to Microsoft. You can turn SmartScreen and Smart App Control on or off in the Windows Security app.

Supporting quotations

When checking content, it sends relevant data—including web addresses and, if needed, details about suspicious sites or apps—to Microsoft for security analysis.

This data will only be used for security purposes in detecting, protecting against, and responding to security incidents, identity theft, fraud, or other malicious, deceptive, or illegal activities.

If your device qualifies, Smart App Control is automatically enabled for added protection; otherwise, it remains permanently off.

data about that file is sent to Microsoft, including the file name, a hash of the file’s contents, the download location, and the file’s digital certificates

You can turn Smart App Control on or off in the Windows Security app.

Qualifications & exceptions

• Smart App Control is enabled automatically if your device qualifies; otherwise it stays off.
• Data use is stated as for security purposes only.

Security & Safeguards · User right or choice

Microsoft Defender Antivirus sends malware reports and possibly suspicious files, asking before sending personal data

Microsoft Defender Antivirus automatically activates when no other antimalware software is running and scans for malware, unwanted software and harmful apps. When it is on or running, it automatically sends reports to Microsoft with data about suspected malware, unwanted software, potentially unwanted apps and other malicious content, and may also send files that could contain malicious content for further inspection. If a report may contain personal data, you are asked for permission before it is sent. You can choose to disable reporting and file sharing with Microsoft.

Supporting quotations

When Microsoft Defender Antivirus is turned on or otherwise running, it automatically sends reports to Microsoft with data about suspected malware and other unwanted software, potentially unwanted apps, and other malicious content.

It may also send files that could contain malicious content, such as malware or unknown files for further inspection.

If a report may contain personal data, you'll be asked for permission before it’s sent.

You can choose to disable reporting and file sharing with Microsoft.

Qualifications & exceptions

• Reporting is automatic while Defender Antivirus is running, unless you disable it.
• Permission is asked only for reports that may contain personal data.

Data Access & Collection · Company practice

Online speech recognition sends voice recordings to Microsoft, which says it will not store them without permission

Microsoft provides both device-based and cloud-based speech recognition. Turning on the Online speech recognition setting lets apps use cloud-based recognition and, in Windows 10, enables dictation. When you use cloud-based recognition, Microsoft collects and uses your voice recordings and creates a text transcription, and states it will not store, sample or listen to your voice recordings without your permission. You can turn off online speech recognition at any time to stop apps from sending voice data to Microsoft, and still use device-based features like captions, Narrator or voice access, though cloud recognition is more accurate. On HoloLens and Windows Mixed Reality, turning on speech at setup enables both settings, and while the headset is on it is always listening and sends voice input to Microsoft's cloud.

Supporting quotations

Microsoft provides both a device-based speech recognition feature and cloud-based (online) speech recognition technologies.

Turning on the Online speech recognition setting lets apps use Microsoft cloud-based speech recognition.

With both settings enabled, while your headset is turned on the device will always be listening to your voice input and will send your voice data to Microsoft’s cloud-based speech recognition technologies.

we collect and use your voice recordings and create a text transcription of the spoken words in the voice data. Microsoft will not store, sample, or listen to your voice recordings without your permission.

You can turn off online speech recognition at any time and stop any apps that rely on the online speech recognition setting from sending your voice data to Microsoft.

Qualifications & exceptions

• The promise not to store, sample or listen to recordings is conditioned on not having your permission.
• Headsets with speech turned on at setup are always listening while on.

Data Access & Collection · User right or choice

On HoloLens or Mixed Reality headsets you can turn off device-based speech recognition to stop listening

If you use a HoloLens or Windows Mixed Reality headset, you can turn off device-based speech recognition at any time, which stops the device from listening for your voice input.

Supporting quotations

you can also turn off device-based speech recognition at any time. This will stop the device from listening for your voice input.

Data Access & Collection · Company practice

Voice activation lets permitted apps listen for keywords, even when locked, and may send recordings to their clouds

Windows lets supported apps respond to voice keywords. If you give an app permission to listen for keywords, Windows actively monitors the microphone for them, and each app must ask for your permission first. When a keyword is detected, the app accesses and processes your voice recording and responds, and may send the recording to its own cloud services to process commands and collect recordings for other purposes, such as improving its services. Voice activation can work when the device is locked and the screen is off; once activated, an app may continue listening, and anyone who speaks near the device can activate it with the same capabilities and information as when unlocked. You can turn voice activation off at any time, but some third-party desktop apps and services could still listen to the microphone and collect voice input even when it is off.

Supporting quotations

If you’ve given permission for an app to listen for voice keywords, Windows will actively monitor the microphone for those keywords.

The app may send your voice recording to its own cloud services to process commands and collect the recordings for other purposes, such as improving its services.

Voice activation functionality can be enabled when the device is locked and the screen is off.

The app may be activated by anyone who speaks near the device and have access to the same set of capabilities and information as when the device is unlocked.

You can turn off voice activation at any time.

some third-party desktop apps and services could still be listening to the microphone and collect your voice input

Qualifications & exceptions

• Requires your permission for each app.
• Turning it off in Windows does not stop every third-party desktop app from listening.

Data Access & Collection · User right or choice

Voice typing may use online recognition and optional voice clips; voice access recognizes speech on the device

In Windows 11, voice typing may use both device-based and online speech recognition. You can choose to contribute voice clips to help improve voice typing, and can still use voice typing if you do not; you can change the choice at any time. Microsoft states it will not store, sample or listen to your voice recordings without your permission. Voice access lets people control their PC and write text by voice using modern on-device speech recognition that works without an internet connection, and uses the device microphone when invoked.

Supporting quotations

Voice typing may use both device-based and online speech recognition technologies to power its speech-to-text transcription service.

You can also choose to contribute voice clips to help improve voice typing. If you choose not to contribute voice clips, you can still use voice typing.

Microsoft will not store, sample, or listen to your voice recordings without your permission.

Voice access leverages modern, on-device speech recognition to accurately recognize speech and is supported without an internet connection.

Qualifications & exceptions

• Contributing voice clips is optional.

Data Access & Collection · User right or choice

Inking and typing personalization collects your typed and handwritten words for a custom word list and can be turned off

Your typed and handwritten words are collected to provide a custom word list, better character recognition and text suggestions as you type or write. You can turn inking and typing personalization off at any time, which deletes the custom word list stored on your device; if you turn it back on you will need to recreate the list.

Supporting quotations

Your typed and handwritten words are collected to provide you with a custom word list, better character recognition to help you type and write on your device and text suggestions that appear as you type or write.

You can turn off inking & typing personalization at any time. This will delete your custom word list stored on your device.

Retention & Deletion · User right or choice

When signed in, Windows can store your settings, files and device configuration on Microsoft servers

When you sign in to Windows with a Microsoft account, Windows can store your settings, files and device configuration data on Microsoft servers, and says it uses the stored data only to make it easier to move your experience to a different device. You can turn this off in Windows settings and can delete previously backed-up data from your Microsoft Account Devices page.

Supporting quotations

Windows can store your settings, files, and device configuration data in Microsoft’s servers.

Windows will only use the stored settings, files, and device configuration data to make it easier for you to migrate your experience on a different device.

You can turn off this feature and stop Windows from storing your settings, files, and configuration data from the Windows settings.

You can delete the data that has been backed up previously to your Microsoft account

Qualifications & exceptions

• Microsoft states the stored data is used only for migrating your experience.

Use & Processing · User right or choice

Windows Update and Microsoft Update download updates, and you choose automatic installs or restart notifications

Windows Update provides software updates for Windows and supporting software such as manufacturer drivers and firmware, and Microsoft Update provides updates for other Microsoft software such as Microsoft 365. Windows Update automatically downloads Windows updates. You can configure it to install them automatically (recommended) or to notify you when a restart is needed. Microsoft Store apps are updated through the Microsoft Store.

Supporting quotations

Windows Update is a service that provides you with software updates for Windows software and other supporting software, such as drivers and firmware supplied by device manufacturers.

Windows Update automatically downloads Windows software updates to your device. You can configure Windows Update to automatically install these updates as they become available (recommended) or have Windows notify you when a restart is required to finish installing updates.

Use & Processing · Company practice

Click to Do analyzes screenshots on your device, and activity leaves it only when you choose

Click to Do can work on its own or with Windows Recall. It lets you capture and analyze screenshots, detect text and images and offer actions such as editing a screenshot or revising text. Microsoft says all activity stays on your device unless you explicitly choose otherwise, for example sending an image for a Bing search or asking for a summary of selected text, which is processed by Microsoft's Azure AI cloud service. If you use the microphone to search for text in a captured screenshot, the audio captured is not transmitted off your device.

Supporting quotations

All activity remains on your local device unless you explicitly choose, like sending an image for a Bing search, requesting a summary of selected text (which is processed by Microsoft’s Azure AI cloud service), or using another tool to modify a screenshot.

The audio captured by the microphone is not transmitted off your device.

Qualifications & exceptions

• Data leaves the device only through actions you choose, such as a Bing image search or a cloud summary.

Data Access & Collection · User right or choice

Recall saves screen snapshots only if you opt in, stores them locally and requires Windows Hello to open them

Recall is available only on Copilot+ PCs and helps find previously viewed content. You must opt in to save snapshots, which are screen images with metadata like app name and time stamp, stored securely on the device and protected with Windows Hello Enhanced Sign-in Security. Each time Recall is opened you must authenticate with Windows Hello biometrics or a PIN to decrypt the content. Analysis and processing of snapshots occurs only on the device, and Click to Do runs on top of Recall snapshots to take actions on text or images on the screen.

Supporting quotations

Recall is a Windows feature available exclusively on Copilot+ PCs that helps users find previously viewed content using remembered text or visual clues.

To use Recall, users must opt-in to save snapshots — screen images with metadata like app name and time stamp — which are securely stored locally and protected with Windows Hello Enhanced Sign-in Security (ESS).

Each time Recall is opened, users must authenticate using Windows Hello biometric sign-in or PIN to decrypt snapshot contents. Analysis and processing of snapshots occur only on the device.

Qualifications & exceptions

• Available only on Copilot+ PCs; requires opt-in.

Retention & Deletion · Company commitment

Recall data is never sent off your device unless you take action, such as sharing a snapshot or submitting feedback

Recall stores all captured data, including snapshots, metadata, processing results and queries, locally on your Copilot+ PC and within your signed-in account. Microsoft says the information is never transmitted off the device unless you take action, such as copying a snapshot to another app or submitting feedback through Feedback Hub with a snapshot attached, and that Recall content can be shared only by explicit user action on the device. Searching Recall by microphone keeps the audio on the device.

Supporting quotations

all audio captured stays on your device

Recall securely stores all captured data—including personal data like snapshots, metadata, processing results, and user queries—locally on your Copilot+ PC and within your signed-in account.

This information is never transmitted off your device unless you take action, such as copying a snapshot to another app or submitting feedback through the Windows Feedback Hub with a snapshot attached.

The only way Recall content can be shared is by explicit user action on the device.

Qualifications & exceptions

• Sharing happens only through your explicit action.

Account & Service Control · User right or choice

You can pause or delete Recall snapshots, and a Sensitive Content filter is on by default but can be turned off

You can control Recall content by pausing or deleting snapshots, filtering content, or using a supported browser in privacy mode. A timeline organizes snapshots chronologically, and you can delete snapshots individually, by website domain or by app. A Sensitive Content filter is on by default to help prevent retention of more delicate information such as credit card numbers and state-issued ID numbers, and you can turn it off in Windows Settings. The filter is described as helping prevent retention, not as a guarantee.

Supporting quotations

You can control your content (such as snapshots, metadata, search queries, and history) by pausing or deleting snapshots, filtering content, or using a supported browser in privacy mode.

Within the timeline view, you can delete snapshots individually, by website domain, or by app.

Recall also has a Sensitive Content filter that is on by default to help prevent the retention of information that might be more delicate in nature (e.g., credit card numbers, state issued ID numbers, etc.). Users can turn this filter off if they wish in Windows Settings.

Qualifications & exceptions

• The Sensitive Content filter is described as "help prevent" retention of sensitive information.

Data Access & Collection · Company practice

The Camera app embeds location and device details in photos and videos if you allow location

If you allow the Camera app to use your location, location data is embedded in the photos and videos you take, along with other descriptive data such as camera model and date. If you share a photo or video, the embedded data is accessible to the people and services you share with. You can disable Camera location access by turning off location services in Settings or the app's access to them. When the Camera app is open it shows rectangles detected by the camera for image enhancement and does not retain image enhancing data. The app uses device capabilities including location, camera, microphone, video and picture library.

Supporting quotations

If you allow the Camera app to use your location, location data is embedded in the photos and videos you take with your device.

If you choose to share a photo or video, any embedded data will be accessible to the people and services you share with.

The Camera app does not retain any image enhancing data.

Qualifications & exceptions

• Location is embedded only if you allow the Camera app to use it.

Content & IP Rights · Context

The updated Photos app organizes local and cloud photos from services such as OneDrive and iCloud

The statement says there are two versions of the Photos app, an updated one with iCloud integration and local and cloud folder views, and a legacy one with features like Video Editor, People and Albums. The updated app lets you organize, view and share photos and videos stored locally or synced from cloud services like OneDrive and iCloud, and lets you move, copy or upload files to your computer or OneDrive.

Supporting quotations

The updated Photos app includes features like iCloud integration and local and cloud folder views.

The updated Photos app lets you organize, view, and share photos and videos by grouping them through options such as name, date taken or modified, and storage location, whether locally or synced from cloud services like OneDrive and iCloud.

Inference & Profiling · User right or choice

The legacy Photos app can group faces on your device, with a three-year prompt, and turning it off removes the groupings

The Photos legacy app has a People setting that, when enabled, uses face grouping technology to organize local photos and videos by detecting faces and grouping similar ones; you can link groupings to contacts in the People app. Groupings are stored on your device for as long as you keep groupings or the related photos or videos. If you have not used the legacy app for three years, you are prompted to allow continued facial grouping. You can turn the setting off at any time, which removes facial grouping data from the app but does not delete your photos or videos. The legacy app also offers Collections, Albums and a Video Editor.

Supporting quotations

when enabled, uses face grouping technology to organize your local photos and videos by detecting faces and grouping visually similar ones

You can associate these facial groupings with contacts from your People app.

your groupings will be stored on your device for as long as you keep groupings, or the related photos or videos themselves

If you haven’t interacted with the Photos legacy app for three years, you’ll be prompted to allow continued facial grouping.

turning it off removes facial grouping data from the app but does not delete your photos or videos

The Photos legacy app lets you organize, view, and share your photos and videos, offering features not available in the updated Photos app

Qualifications & exceptions

• Face grouping is off unless you enable it.
• Groupings are stored on your device.

Sharing & Disclosure · Restriction or exception

Photos or videos you share can carry embedded location, camera model and date

If you share a photo or video using the Photos app or the Photos legacy app, any embedded data, such as location, camera model and date, is accessible to the people and services you share it with.

Supporting quotations

any embedded data (such as location, camera model, and date) will be accessible to the people and services you share the photo or video with

Data Access & Collection · Company practice

People and Mail and Calendar apps import contacts; Mail and Calendar also syncs your data to Microsoft servers

The People app centralizes contacts, importing them automatically when you add email and social network accounts, after telling you what data it can import or sync and letting you choose; other installed apps may also sync data into it, and you can remove accounts at any time. The Mail and Calendar app connects email, calendars and files from Microsoft and third-party providers. When you add an account, your email, calendar items, files, contacts and settings automatically sync to your device and to Microsoft servers, and the credentials you enter are sent to the third-party provider's server. If an organization provides the account, it can set policies such as multi-factor authentication or remote wipe. The app provides location-based services such as weather in your calendar, and you can remove accounts, change synced data or disable device capabilities like location and camera at any time.

Supporting quotations

The People app centralizes your contacts in one place by automatically importing them when you add accounts, including email and social network accounts.

Other apps you install may also sync data to the People app, including providing additional details to existing contacts.

your email, calendar items, files, contacts, and other settings from your account will automatically sync to your device and to Microsoft servers

To configure an account, you must provide the app with your account credentials (such as username and password), which will be sent to the third-party provider’s server.

If your account is provided by an organization (like a work account), the account owner can implement certain policies and controls that may affect your use of the app — for example, multi-factor authentication or the ability to remotely wipe data from your device.

You can remove an account, make changes to the data that’s synced from your account, or disable access to your device’s capabilities like your location and camera at any time.

Qualifications & exceptions

• Mail and Calendar syncs to Microsoft servers, not only to the device.
• Organization-provided accounts can carry remote wipe and other controls.

Data Access & Collection · Company practice

Operator Messages, Clock, Journal and PC Manager apps describe local storage, device access and cleanup scans

The Windows Operator Messages app shows account-related SMS from your mobile operator about your data plan, stores them locally on the device, lets you view and delete them, and uses device capabilities such as Contacts. The Clock app lets signed-in users enable Microsoft To Do, a cloud-connected experience; Focus Session data is stored locally and can be cleared in Clock settings, and Focus Sessions can connect to Spotify. Microsoft Journal is a note-taking app for touch and pen devices that uses AI and machine learning for handwriting recognition that processes data locally; users with Microsoft 365 can access their calendar and contacts, and Journal can use the photo library, camera and microphone. PC Manager, available in select regions, scans your device on request so you can delete unneeded files, optimize cache and stop or recover from unauthorized changes.

Supporting quotations

These messages are stored locally on your device. From your device, you can also access, view, and delete these messages.

When the user turns on Focus Session in Microsoft To Do, session data is stored locally, which you can clear by going to the Clock settings page.

Focus Sessions supports connecting to Spotify accounts to listen to ambient audio.

The app leverages AI and machine learning to better recognize your handwriting that processes data locally on your device.

Journal lets you access photos library and the device camera and microphone so that you can add them to a workbook.

Based on your request, PC Manager will scan your device, and allow you to delete unneeded or temporary documents, optimize cache, stop or recover from unauthorized changes, or use other features to improve your PC’s performance.

Qualifications & exceptions

• PC Manager scans on your request; availability is by region.

Data Access & Collection · Company practice

PC Manager can send pop-up screenshots if you join a plan; Circle to Act screenshots are processed in Azure

PC Manager blocks pop-ups using ad-block rules and the pop-ups you select. If you agree to join the Microsoft PC Manager Pop-up Plan, you can send screenshots of the pop-ups you block, and Microsoft says it collects only the screenshots, window title and window class. Screenshots are retained only for a short period and regularly deleted, and you manage the plan in PC Manager settings. Feedback may include personal data you write, and is regularly deleted after processing. Circle to Act, offered in selected markets, includes Screenshot Tool, Text Extraction, Translation and Smart Copy. For Smart Copy, uploaded screenshots may be processed in data centers outside your location. For Text Extraction and Translation, screenshots are sent to Microsoft Azure operated by Microsoft or local partners in your region and results are returned to you. Microsoft says it does not keep the images, text or results except where legally required.

Supporting quotations

If you agree to join the “Microsoft PC Manager Pop-up Plan,” when you block pop-up windows through custom block, you can help us optimize Microsoft PC Manager's pop-up management feature by taking screenshots of the pop-up and sending them to Microsoft.

Microsoft does not collect information other than screenshots, Windows title, and the class of Windows. Screenshots are only retained for a short period of time and regularly deleted.

To enable the Smart Copy feature, screenshots you upload during use may be processed by Microsoft in data centers located outside of your location.

Microsoft does not retain any image or text data you submit or the results provided, except where required to comply with legal obligations.

Qualifications & exceptions

• Pop-up screenshots are sent only if you agree to join the plan.
• Circle to Act is offered in selected markets.
• Retention for pop-up screenshots is "a short period", with no number given.

Not stated here

• The retention period for pop-up screenshots is not stated.

Data Access & Collection · Company practice

Snipping Tool and Sound Recorder capture screenshots, screen recordings and audio and store them on your device

The Snipping Tool uses your microphone and picture library to capture and store screenshots and screen recordings, and its Text Action feature uses built-in OCR so you can select and copy text from images. Copied items also go to your clipboard, and if you enable clipboard history across devices, the copied content can be used on other devices. You manage clipboard and snipping preferences in Windows settings. The Sound Recorder app captures audio through your microphone, lets you mark moments, trim and adjust, and autosaves recordings to your Documents folder where you can share them.

Supporting quotations

The Snipping Tool uses your microphone and pictures library to capture and store screenshots and screen recordings.

If you enable clipboard history across devices, the copied content can be used seamlessly across different devices.

Your recordings are autosaved and stored in your Documents folder for easy access, and you can share your recorded audio with friends and family.

Qualifications & exceptions

• Cross-device clipboard use applies only if you enable clipboard history across devices.

Data Access & Collection · Company practice

Clipchamp collects imprecise location, and Media Player and Movies & TV send identifiers or collect viewing data

Clipchamp is a video editor that saves finished videos to your device or personal OneDrive; you can allow it to access your camera and microphone, and it collects your imprecise location to provide a better experience, such as choosing which language to show. Media Player reads multimedia files you open and your Music and Video library folders to build its library pages. To show artist and album art it sends Microsoft an information request containing standard device data (IP address, software version, regional and language settings) and a content identifier, and you can disable this on the app's Settings page. Movies & TV collects data about the movies and TV shows you watch, including the length of play and ratings you give, to help you discover content, and needs access to your video library to play local video files.

Supporting quotations

Clipchamp will collect your imprecise location to provide a better experience, such as choosing which language to display to you.

When you open Media Player, it will read the contents of your Music library and Video library folders

Media Player sends an information request to Microsoft containing standard device data, such as your device IP address, device software version, your regional and language settings, and an identifier for the content. You can disable this feature on the app’s Settings page.

Movies & TV will collect data about what movies and TV shows you watch, including the length of play and any ratings you give.

it needs access to the video library on your device

Qualifications & exceptions

• Media Player art lookup can be disabled in its settings.

Sharing & Disclosure · Company practice

Windows Media Player Legacy sends media identifiers to Microsoft and a per-session Player ID to streaming servers

Windows Media Player Legacy plays CDs and digital media and shows related media information. To provide more details, it may send Microsoft a request containing standard computer information, a media content identifier and your library's existing media information, including your edits and entries, so Microsoft can recognize the track. When playing content streamed over a network, it may send the streaming media or web server a log with details such as connection time, IP address, operating system version, player version, Player ID, date and protocol. To help protect privacy, the Player ID sent is unique to each session.

Supporting quotations

Windows Media Player Legacy may send a request to Microsoft that includes standard computer information, a media content identifier, and your library’s existing media information (including any edits or entries you’ve made) so Microsoft can recognize the track and return other available information.

the player may send a log to the streaming media or web server containing details such as connection time, IP address, operating system version, Windows Media Player Legacy version, Player ID number, date, and protocol

the Player ID sent by Windows Media Player Legacy is unique to each session

Qualifications & exceptions

• Requests to Microsoft and logs to streaming servers are stated as "may".

Data Access & Collection · Company practice

Windows Hello stores a template of your face, fingerprint or iris on your device and not the image

If you turn on Windows Hello, it uses unique points or features extracted from your face, fingerprint or iris, stored on your device as a template to identify you, and it does not store the actual image. Microsoft says biometric verification data used at sign-in does not leave your device and stays there until you remove it. After a significant period of Windows Hello inactivity, you are prompted to confirm you want to keep storing the data. You can delete your biometric verification data in Settings.

Supporting quotations

If you turn it on, Windows Hello uses unique points or features that are extracted from your face, fingerprint, or iris and stored on your device as a template to identify you—but it does not store the actual image of your face, fingerprint, or iris.

Biometric verification data that's used when you sign in doesn't leave your device and remains on your device until you remove it.

After a significant period of Windows Hello inactivity, you will be prompted to confirm that you want to continue to store your biometric verification data. You can delete your biometric verification data from within Settings.

Qualifications & exceptions

• Applies only if you turn on Windows Hello.

Use & Processing · Company practice

Windows Search can search your files and cloud storage, and web searches are powered by Bing under the Bing rules

Windows Search lets you search "your stuff" and the web from one place. If you choose to search your stuff, it returns items from your personal OneDrive, your OneDrive for Business if enabled, other supported third-party cloud storage providers and your device. If you choose to search the web or get search suggestions with Windows Search, results are powered by Bing and Microsoft uses your search query as described in the Bing section.

Supporting quotations

If you choose to use Windows Search to search "your stuff," it will provide results for items on your personal OneDrive, your OneDrive for Business if so enabled, other supported third-party cloud storage providers and on your device.

If you choose to use Windows Search to search the web, or get search suggestions with Windows Search, your search results will be powered by Bing and we will use your search query as described in the Bing section of this privacy statement.

Qualifications & exceptions

• Web searching and suggestions are your choice and follow the Bing section.

Data Access & Collection · Company practice

Entertainment services collect identifiers, interactions, chat partners, uploaded content and purchases

Entertainment and related services such as Xbox, Microsoft Store and MSN give access to content, apps and games. Microsoft says it collects and uses your information depending on how you use them, for example your unique identifiers, how you interact with the services, who you chat with, content you upload and products you search for and buy.

Supporting quotations

We collect and use your information depending on how you use these services to fuel your experience – for example, we collect your unique identifiers, information about how you interact with in these services, who you chat with, what content you upload, and products you search for and buy.

we collect your unique identifiers, information about how you interact with in these services, who you chat with, what content you upload, and products you search for and buy

Account & Service Control · Company practice

An Xbox profile gets a public gamertag and ID, and age or identity checks can change your settings or access

The Xbox network is Microsoft's online gaming and entertainment service. When you sign up for an Xbox profile, Microsoft assigns a gamertag (a public nickname) and a unique identifier, and data it collects about your use is stored using your identifiers. Depending on your jurisdiction you may need to verify your age or identity for some services; an accompanying notice explains what data is collected and the third-party verification provider. In some cases Microsoft also uses the length of your account and age signals from operating systems or app stores to understand your age. If it cannot verify your age or identity, it may change your settings or access to certain features.

Supporting quotations

The XBOX network is the online gaming and entertainment service from Microsoft

When you sign up for an XBOX profile, we assign you a gamertag (a public nickname) and a unique identifier.

Depending on your jurisdiction, you may need to verify your age or identity to access some services or features.

In some cases, we reference the length of your account as well as age signals we receive from operating systems or app stores to better understand your age.

If we are unable to verify your age or identity it may cause us to change your settings or access to certain features.

Qualifications & exceptions

• Age or identity verification depends on your jurisdiction.

Not stated here

• The accompanying age and identity verification notice and its third-party provider are not part of the supplied text.

Account & Service Control · Restriction or exception

Children under 13 need parental consent for Xbox; limited data is collected and settings start most restrictive

Children under 13, or the age set in their jurisdiction, need parental or guardian consent to create an Xbox profile and use the network; the parent signs in with their own Microsoft account as the adult family group organizer. Microsoft collects limited information about children: name, birthdate, email address and region. When you create your child's profile you consent to Microsoft collecting, using and sharing their information, including personal data, based on their Xbox privacy and communication settings, and the child's privacy settings start at the most restrictive level by default.

Supporting quotations

Children under 13 years old or as otherwise specified in your jurisdiction need parental or guardian consent to create an XBOX profile and use the XBOX network.

We collect limited information about children, including their name, birthdate, email address, and region.

When you create your child’s XBOX profile, you consent to Microsoft collecting, using, and sharing their information, including their personal data, based on their XBOX network privacy and communication settings.

Your child’s privacy settings start at the most restrictive level by default.

Qualifications & exceptions

• The parent's consent covers collection, use and sharing based on the child's privacy and communication settings.

Data Access & Collection · Company practice

Xbox consoles get a device ID; Microsoft collects sign-ins, purchases, play, performance, content and social data

When you sign in to Xbox experiences, Microsoft assigns a unique identifier to your device, and when a console is online and you sign in it identifies which console and operating system version you use. Data collected about your use of Xbox services, games, apps and consoles includes sign-in and sign-out times, purchases and content obtained; games and apps used, progress, achievements and play statistics; performance data about consoles, Game Pass, apps, the network, accessories and your connection, including errors; content you add, upload or share, including text, pictures and video; and social activity such as chat data, interactions with other gamers and friends and followers. If you use Xbox on another device with storage, usage data is stored there and sent to Microsoft the next time you sign in, even if you played offline.

Supporting quotations

When you sign in to XBOX experiences—in apps or on a console—we also assign a unique identifier to your device.

When you sign in and sign out of XBOX, any purchases you make, and content you obtain.

Which games you play and apps you use, your game progress, achievements, play time per game, and other play statistics.

Performance data about XBOX consoles, XBOX Game Pass and other XBOX apps, the XBOX network, connected accessories, and your network connection, including any software or hardware errors.

Content you add, upload, or share through the XBOX network, including text, pictures, and video you capture in games and apps.

Social activity, including chat data and interactions with other gamers, and connections you make (friends you add and people who follow you) on the XBOX network.

usage data will be stored on the storage device and sent to Microsoft the next time you sign in to XBOX, even if you’ve been playing offline

Qualifications & exceptions

• Usage data from offline play is sent the next time you sign in.

Use & Processing · Company practice

Xbox data powers recommendations and offers, and games can use the microphone, camera and screen recording

Data collected about Xbox use lets Microsoft provide its services and curated experiences, including connecting you to games, content and services and presenting offers, discounts and recommendations; you can change recommendation settings on the Xbox online safety and privacy settings page. While using Xbox, you can use device capabilities such as the microphone, camera and screen recording to improve your gaming experience.

Supporting quotations

Data we collect enables us to provide you with our services and with curated experiences. This includes connecting you to games, content, and services, as well as presenting you with offers, discounts, and recommendations.

While using XBOX, you can use the device’s capabilities such as the microphone, camera, and screen recording to improve your gaming experience.

Data Access & Collection · Company practice

Xbox diagnostic data has required and optional levels, and child accounts send only the minimum required data

Xbox diagnostic data has two categories, required and optional. Required diagnostic data for Xbox includes information about your device, service performance, how you use products, apps and services, game activity and your settings and capabilities. If your child uses an Xbox console, only the minimum required diagnostic data is sent to Microsoft to keep Xbox safe, secure and performing as expected, and optional diagnostic data collection is turned off for child accounts.

Supporting quotations

Required diagnostic data for XBOX includes information about your device, service performance, how you use our products, apps and services, game activity, and your settings and capabilities.

only the minimum required diagnostic data is sent to Microsoft to help keep XBOX safe, secure, and performing as expected. Optional diagnostic data collection is turned off for child accounts.

Qualifications & exceptions

• Optional diagnostic data collection is off for child accounts.

Data Access & Collection · Company practice

Other players can capture your character, gamertag and audio chat, and party chat captions are stored as text

Any player in a multiplayer game session can record video clips and take screenshots of their view, and other players' clips and screenshots can capture your in-game character and gamertag during that session; if a player captures clips they might also capture audio chat, depending on their settings. During Xbox party chat, a player can turn on a voice-to-text feature that captions all voice communication in the party for that player. Microsoft uses the resulting text to provide captioning for players who need it, and may also use it to provide a safe gaming environment, enforce the Community Standards for Xbox and for the other purposes described in the statement.

Supporting quotations

Other players’ game clips and screenshots can capture your in-game character and gamertag during that session. If a player captures game clips, they might also capture audio chat, depending on their settings.

If a player activates this feature, all voice communication in the party is captioned for the player.

This data may also be used to provide a safe gaming environment and enforce the Community Standards for XBOX as well as the other purposes described in this statement.

Qualifications & exceptions

• Captioning is activated by a player and covers all voice communication in the party.
• Audio capture depends on the capturing player's settings.

Sharing & Disclosure · Company practice

Your Xbox gamertag, scores and activity are visible to players, linked services and partners; leaderboards are public

Your gamertag, game and play statistics, achievements, presence (whether you are signed in), shared content and other activity data can be seen by other players signed in to Xbox, customers of third-party services you linked your profile to, and other services associated with Xbox, including partner companies. Your gamertag and leaderboard scores are public and cannot be hidden. For other data, you can adjust privacy settings on consoles and on Xbox.com to limit or block what is shared with the public or friends. For children, online presence (default "friends"), gamertag, statistics and achievements are visible to other players, and sharing while playing or communicating depends on safety settings.

Supporting quotations

Your gamertag, game and play statistics, achievements, presence (whether you are currently signed in to XBOX), content you share, and other data about your activity on XBOX can be seen by:

Other players signed in to XBOX.

Customers of third-party services you’ve linked your profile to.

Other services associated with XBOX (including those of partner companies).

Your gamertag and scores that show on game leaderboards are considered public and cannot be hidden.

For other data, you can adjust your privacy settings on consoles and at

your child’s online presence (defaulted to “friends”), gamertag, gameplay statistics, and achievements are visible to other players

Qualifications & exceptions

• Gamertag and leaderboard scores are public and cannot be hidden.
• Other data can be limited with privacy settings.

Sharing & Disclosure · Company practice

Game and app publishers get your Xbox ID, gamertag, play data, friends list and content, under their own policies

When you use an Xbox online game or any network-connected app on Xbox, PC or mobile, the publisher gets data to help deliver, support and improve its product. That includes your Xbox user identifier and gamertag; limited account info such as country and age range; in-game communications data; any Xbox enforcement activity; game-play sessions; your presence; time spent; rankings, statistics, profiles, avatars or gamerpics; friends lists; activity feeds and memberships for official clubs; and content you create or submit in the game or app. To stop sharing game or app data with a publisher, remove its games or app from all your devices, and some access can be revoked on the Microsoft consent page. Third-party publishers have their own relationship with users and their own privacy policies, linked from detail pages in the Microsoft Store.

Supporting quotations

the publisher of that game or app has access to data to help the publisher deliver, support, and improve its product

your XBOX user identifier; gamertag; limited account info such as country and age range; data about your in-game communications; any XBOX enforcement activity; game-play sessions (for example, moves made in-game, types of vehicles used in-game); your presence on the XBOX network; the time you spend playing the game or app; rankings, statistics, gamer profiles, avatars, or gamerpics; friends lists; activity feeds for official clubs you belong to; official club memberships; and any content you create or submit in the game or app

To stop sharing game or app data with a publisher, remove its games or app from all devices where you have installed them.

Third-party publishers and developers of games and apps have their own distinct and independent relationship with users and their collection and usage of personal data is subject to their specific privacy policies.

Qualifications & exceptions

• Stopping sharing generally means removing the game or app from all devices.
• Publishers' own policies govern their use of your data.

Not stated here

• The third-party publishers' privacy policies are not part of the supplied text.

Use & Processing · User right or choice

Optional Xbox AI features use your prompts, and Xbox Family Settings apply on Xbox platforms

Xbox offers optional AI-enhanced features, including Support Virtual Agents and Game assist. To respond, they use your voice or text prompt, public support articles and other relevant data described in the statement or the feature; additional privacy settings exist in some of them, and you can view, export or delete Game assist chats in the Copilot section of the privacy dashboard. The Xbox Family Settings app lets you manage a child's Xbox experience, such as spending in the Microsoft and Xbox stores, viewing activity and setting age ratings and screen time limits. Xbox-specific Family Safety settings apply on Xbox console or via Xbox on PC or mobile but may not apply on other platforms.

Supporting quotations

XBOX offers optional AI-enhanced features, including our Support Virtual Agents and Game assist.

these AI-enhanced features use your voice or text-based prompt, publicly-available support articles, and other relevant data

You can view, export, or delete your chats with Game assist in the Copilot section on the

You can use the

XBOX-specific Family Safety settings will apply on XBOX console or via XBOX on PC or mobile device but may not be applied on other platforms.

Qualifications & exceptions

• AI-enhanced features are optional.
• Xbox Family Settings may not apply on other platforms.

Use & Processing · Company practice

To keep Xbox safe, Microsoft may collect and review voice, text, images, videos and in-game content

To help make the Xbox network a safe gaming environment and enforce the Community Standards for Xbox, Microsoft says it may collect and review voice, text, images, videos and in-game content, such as game clips you upload, conversations you have and things you post in clubs and games.

Supporting quotations

we may collect and review voice, text, images, videos and in-game content (such as game clips you upload, conversations you have, and things you post in clubs and games)

Qualifications & exceptions

• Stated as "may".

Data Access & Collection · Company practice

Xbox anti-cheat tools may create hashes from browser, device, activity, game and OS information

Microsoft prohibits cheating, hacking, account stealing and other unauthorized or fraudulent activity when you use an Xbox online game or any network-connected app on Xbox, PC or mobile. To detect and prevent fraud and cheating, it may use anti-cheat and fraud prevention tools and technologies that may create digital signatures, known as hashes, using certain information collected from your device and how you use it. That can include information about the browser, device, activities, game identifiers and operating system.

Supporting quotations

In order to detect and prevent fraud and cheating, we may use anti-cheat and fraud prevention tools, applications, and other technologies.

Such technologies may create digital signatures (known as “hashes”) using certain information collected from your XBOX console, PC, or mobile device, and how you use that device. This can include information about the browser, device, activities, game identifiers, and operating system.

Qualifications & exceptions

• Stated as "may"; the information "can include" the listed items.

Data Access & Collection · Company practice

Legacy Xbox 360 collects limited required diagnostic data, and Kinect uses a camera, microphone and infrared sensor

The Xbox 360 console collects limited required diagnostic data to keep the console working while connected to the Xbox network. The Kinect sensor combines a camera, microphone and infrared sensor so that motion and voice can control gameplay in supported titles, and a separate Xbox Kinect and Privacy page is linked and not supplied here.

Supporting quotations

This XBOX console collects limited required diagnostic data to keep your console functioning as expected while using a console connected to the XBOX network.

The Kinect sensor is a combination of camera, microphone, and infrared sensor that can enable motions and voice to be used to control gameplay for titles that support it.

Not stated here

• The Xbox Kinect and Privacy page is not part of the supplied text.

Data Access & Collection · Company practice

Microsoft Store collects browsing, purchase and install activity, links reviews to your account and may check your age

Microsoft Store is an online storefront for apps, games, subscriptions and digital content. Microsoft collects information about your interactions with it: products you browse, search, view, add to wish lists or carts, acquire, subscribe to, purchase, install, update, use, delete or ask for support about, your viewing settings and preferences, and ratings, reviews and problem reports you submit. Your Microsoft account is linked to your ratings and reviews, and the name or picture on your account may be shown with a review you post. It uses your device region settings to present content and your device identifier to manage product rights tied to your device. Depending on your jurisdiction you may need to verify your age to view or acquire age-restricted content; a notice explains the data collected and the third-party verification provider.

Supporting quotations

We collect information about your interactions with Microsoft Store, including: the products you browse, search for, view, add to wish lists or shopping carts, acquire, subscribe to, purchase, install, update, use, delete, uninstall, or for which you request customer support

Your Microsoft account is linked to your ratings and reviews, and the name and/or picture associated with your Microsoft account may be shown with any review you post.

Microsoft Store also uses your device’s region settings to present relevant content and merchandising, and your device identifier to manage product rights tied to your device.

Depending on your jurisdiction, you may need to verify your age to allow you to view or acquire certain age-restricted content on Microsoft Store.

Microsoft Store is an online service

Qualifications & exceptions

• Age verification depends on your jurisdiction.

Not stated here

• The age verification notice and its third-party provider are not part of the supplied text.

Sharing & Disclosure · Restriction or exception

Store apps may access device features and follow their developers' policies; other sources are outside this statement

Many apps from Microsoft Store use device hardware and software features that can require access to your data, such as a photo app using the camera or a restaurant guide using location; the app's product description page lists the features used. On Windows you can choose in many cases which apps can use a feature in Settings. For security, Microsoft Store automatically checks for, downloads and installs updates for apps installed from it, which you can pause in Store settings, and you are prompted for consent if an update seeks new access to features such as location. Personal data an app collects is subject to the developer's privacy policy, linked from the app page. Microsoft says the privacy information described here does not apply to your use of or acquisitions from third-party sources such as other app stores or websites.

Supporting quotations

Many apps you install from Microsoft Store use specific hardware and software features of your device, which can require access to your data.

On Windows, in many cases, you can choose which apps can use a particular feature.

Microsoft Store will automatically check for, download, and install app updates to ensure you have the latest versions. You can pause this feature in your Microsoft Store settings.

If an updated app seeks new access to certain features—such as your location—you will be prompted for consent.

Any personal data that an app collects and uses is subject to the app developer's privacy policy

The privacy information described here does not apply to your use of or acquisitions from those third-party sources.

Qualifications & exceptions

• Store apps' own data collection is governed by each developer's privacy policy.
• Automatic app updates can be paused.

Not stated here

• App developers' privacy policies are not part of the supplied text.

Data Access & Collection · Company practice

MSN apps collect installation and device data, and the weather app uses your location

MSN (formerly Microsoft Start or Microsoft News) is a content service for news, weather, sports and finance, available on several platforms and included in Edge and Windows widgets. When you install the MSN app, MSN Weather or Microsoft News apps, Microsoft collects data on whether the app installed properly, the installation date, app version and device details such as operating system and browser, on a regular basis to count users and find performance problems. When you use the weather app, it uses your location to provide relevant weather content.

Supporting quotations

MSN (formerly known as Microsoft Start or Microsoft News) is a content service that includes news, weather, sports, and finance.

we collect data that tells us if the app was installed properly, the installation date, the app version, and other data about your device such as the operating system and browser

When you use the weather app, we use your location to provide you with relevant weather content.

Use & Processing · Company practice

MSN collects how you interact with content, uses location, and uses data for ads you can opt out of

Microsoft also collects data about how you interact with MSN content, such as how often you use it and which articles you view, to provide relevant content. MSN gives an enhanced experience when you sign in with a Microsoft account, including customizing interests and favorites, and uses your location for local weather and news. You can manage personalization in MSN and Bing settings and in other Microsoft services that include MSN. Microsoft also uses the data to show you advertisements of possible interest, and you can opt out of interest-based advertising through the links within MSN or the opt-out page.

Supporting quotations

We also collect data about how you interact with MSN content, such as usage frequency and articles viewed, to provide you with relevant content.

We use your location to provide you with relevant content such as local weather and news.

We also use the data we collect to provide you with advertisements that may be of interest to you.

You can opt out of interest-based advertising through the advertising links within MSN services, or by visiting the Microsoft

Qualifications & exceptions

• Interest-based advertising can be opted out of through MSN links or the opt-out page.

Charges & Financial Obligations · Company commitment

MSN Money only displays third-party finance data and does not send your sign-in credentials to Microsoft

Previous versions of MSN Money let you access personal finance information from third-party financial institutions. Microsoft states MSN Money only displays this information and does not store it on its servers, and that the sign-in credentials you use to reach it are encrypted on your device and not sent to Microsoft. The financial institutions and other third-party services you access through MSN are subject to their own terms and privacy policies.

Supporting quotations

MSN Money only displays this information and does not store it on our servers.

Your sign-in credentials used to access your financial information from third parties are encrypted on your device and are not sent to Microsoft.

These financial institutions, as well as any other third-party services you access through MSN services, are subject to their own terms and privacy policies.

Qualifications & exceptions

• Stated for previous versions of MSN Money.

Not stated here

• The financial institutions' terms and privacy policies are not part of the supplied text.

Data Access & Collection · Company practice

Mixed Reality uses headset sensors, collects diagnostic data and body-joint measurements, and processes gestures locally

Windows Mixed Reality uses a compatible headset's camera, microphone and infrared sensors so motion and voice can control games and apps. Microsoft collects diagnostic data to solve problems and keep Mixed Reality up to date, secure and working, and to improve products depending on your diagnostic data settings. It maps distances between your body's joints to make a stick figure representation of you and, if you are online, collects those numeric values to enable and improve the experience. Hand gestures for simple system interactions are processed on your PC and not stored. The headset's microphones enable voice commands for games, apps and searches, and Mixed Reality can also be used for audio and video communications.

Supporting quotations

Mixed Reality uses a compatible headset’s camera, microphone, and infrared sensors to enable motions and voice to be used to control gameplay and to navigate apps and games.

Microsoft collects diagnostic data to solve problems and to keep Mixed Reality running on Windows up to date, secure, and operating properly.

Mixed Reality maps distances between your body's joints to create a stick figure representation of you. If you are connected to the Internet, we collect those numeric values to enable and improve your experience.

This data is processed on your PC and is not stored.

The headset's microphones enable voice commands to control games, apps, or to enter search terms.

Windows Mixed Reality can also be used for audio and video communications.

Qualifications & exceptions

• Body-joint values are collected only when you are connected to the Internet.
• Diagnostic data use for improvement depends on your diagnostic data settings.