"Microsoft's privacy practices present high risk due to extensive collection of sensitive data including biometrics and health information, aggressive third-party sharing with advertisers and data brokers, and persistent tracking across platforms. Complex fragmented controls and mandatory data collection for core services severely limit user agency."
Take Action
3 Privacy Improvements Available
microsoft Privacy Concerns & Scorecard
Microsoft employs persistent cross-platform tracking through cookies, web beacons, advertising IDs, and behavioral profiling to deliver personalized advertisements across Microsoft and third-party properties. Tracking persists for 5 years even after opt-out if user is not signed in.
Microsoft provides complex, fragmented opt-out mechanisms scattered across multiple platforms and settings pages. Opt-outs are often incomplete, require multiple steps, and do not prevent all data collection or sharing. Many privacy-sensitive features cannot be disabled without losing core service functionality.
Microsoft collects an exceptionally broad range of personal data including biometric data (fingerprint, facial recognition, iris templates), health records, financial data, location tracking, device activity, communications content, and file contents across multiple services.
Microsoft shares game publishers and app developers with comprehensive user data including gameplay sessions, in-game communications, social activity, presence status, rankings, and user-created content without explicit per-instance consent.
Microsoft retains personal data indefinitely for multiple purposes with vague retention timelines. Many data types have unspecified retention periods. Account deletion requires 60-day waiting period before permanent deletion, extending data exposure.
Account deletion
- 1Sign in to your Microsoft account at account.microsoft.com.
- 2Go to the account closure page (account.microsoft.com/account/close).
- 3Review the list of services and data that will be affected by closing your account.
- 4Check the boxes to confirm you understand the impact of closing your account.
- 5Select a reason for closing your account, then select 'Mark account for closure'.
Xbox optional data sharing off
- 1On your Xbox console, go to Profile and System, then select Settings.
- 2Navigate to Account, then select Privacy and Online Safety.
- 3Select Data Collection.
- 4Choose Block to opt out of optional data sharing.
Location tracking off
- 1Open the Start menu and go to Settings.
- 2Navigate to Privacy and Security, then select Location.
- 3To disable location services for the entire device, turn off the Location services toggle.
- 4To prevent all apps from accessing your location while keeping location services on, turn off the 'Let apps access your location' toggle.
- 5To control location access for individual apps, scroll down the Location settings page and toggle off specific apps you do not want to have location access.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Account authentication, service delivery, and user identification across Microsoft ecosystem
Weather localization, emergency calling, local search results, personalized advertisements, family monitoring, and location-based services
Device authentication (Windows Hello), accessibility features, motion control, identity verification, and photo organization
Health tracking, wellness recommendations, Copilot Health features, and product personalization
Service delivery, customer support, abuse detection, and Microsoft support call monitoring for training
Cloud storage, file sharing, accessibility features, connected experiences providing content suggestions, and file analysis for malware/abuse detection
Service improvement, personalization, targeted advertising, analytics, anti-abuse monitoring, and product development
Service compatibility, device management, crash reporting, software updates, and security analysis
Keyboard and writing improvement, accessibility features, personalization, and AI model training for text prediction
Address book functionality, contact synchronization, social features, communication enablement, and Xbox social features
Payment processing, subscription management, purchase history tracking, and personalized shopping recommendations
Content personalization, age-appropriate content delivery, enforcement of terms of service, and personalized advertising (except for under 18)
Content recommendation, personalization, and targeted advertising based on inferred user interests
Service reliability, security monitoring, malware detection, and technical troubleshooting
Personalized advertising delivery, ad performance tracking, and cross-site behavioral profiling
Voice command execution, speech recognition, accessibility features, voice authentication, and game communication
Parental controls, Family Safety monitoring, age-appropriate content delivery, and child account management
AI model training, fine-tuning, and improvement of Microsoft AI services
Cross-Platform Tracking
Microsoft tracks users across its ecosystem of services (Windows, Office 365, Teams, OneDrive, Outlook, Bing, Edge, Xbox) and integrates behavioral data across these platforms. Through web beacons, cookies, and the Windows advertising ID, Microsoft extends tracking to third-party websites and apps. Data collected on one service is combined with activity from other services to create comprehensive user profiles used for advertising, AI training, and product recommendations.
Tracking Methods:
Tracking Cookies
First-party and third-party cookies placed on user devices to track browsing behavior, preferences, and ad performance. Cookies persist for extended periods (5 years) even after opt-out if user is not signed in. Used across Microsoft properties and third-party sites.
Web Beacons and Pixels
Web beacons embedded on Microsoft and third-party websites to track user interactions, measure ad performance, and track conversions. Pixels placed by third-party advertisers to measure exposure and clicks across websites.
Device Advertising ID
Unique advertising identifier (AAID on Android, IDFA equivalent on other platforms) assigned to Windows devices. Collected by Microsoft and shared with third-party apps and advertising networks for personalized ad delivery and behavioral tracking.
Cross-Device Sign-In Tracking
Signing into Microsoft Account across devices enables tracking of same user across Windows PCs, phones, tablets, and browsers. Activities synced across all signed-in devices for personalization and ad targeting.
Behavioral Fingerprinting
Device characteristics, browser attributes, operating system, installed software, and usage patterns combined to create unique device fingerprint even without cookies. Anti-cheat tools create digital signatures from device information.
IP Address Tracking
Collection and logging of user IP addresses across Microsoft services and third-party sites using Microsoft technology (Bing, Analytics, ad pixels). IP addresses combined with behavioral data for location inference and ad targeting.
Analytics Integrations
Third-party analytics services (Google Analytics, Mixpanel, Adjust, AppsFlyer, etc.) embedded in Microsoft and partner properties to track user behavior across websites and apps. These services combine data from multiple properties to profile user behavior.
Social Media Tracking Pixels
Facebook and other social media cookies enable interest-based targeting based on social profile data and website activity. Microsoft services communicate with social networks to enable retargeting on those platforms.
Terms of Service Updates
Cookie Banner Added to Page Header
New version includes a prominent cookie consent banner at the top of the page allowing users to accept, reject, or manage optional cookies used for social media and personalized advertising. This change reflects updated privacy compliance practices and gives users explicit control over optional cookie usage.
Effective: September 30, 2025
Expanded data export capabilities and third-party service portability
The NEW version clarifies that exportable data can be accessed 'or the product user interface, when authenticated with your Microsoft account' and explicitly states 'This exportable data can be used to switch to third-party provider services.' The OLD version text cuts off mid-sentence. This change enhances user rights by explicitly acknowledging data portability for switching providers.
Effective: September 30, 2025
AI & Data Training
microsoft uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Copilot Conversation Prompts
Text prompts entered into Microsoft Copilot are used for AI model training and fine-tuning by default. Users must opt out to prevent this use.
Uploaded Content in Copilot
Documents, images, and other content uploaded to Copilot for analysis are used for AI model training unless user opts out.
Conversation History
Complete conversation history in Copilot and other AI services is retained and used for model training by default.
Typing and Inking Data
SwiftKey typing data and input patterns are collected and processed by Microsoft cloud services for AI model training to improve text prediction and personalization.
User Feedback and Ratings
User feedback on AI responses, product ratings, and usage patterns are used for AI model training and service improvement.
How to Object
You can submit an objection using the steps below.
- 1
Visit https://account.microsoft.com/privacy/activity-history.
- 2
For Copilot: toggle off 'Improve Copilot by learning from your activity' in Copilot settings.
- 3
Manage and delete prompt history through Microsoft Privacy Dashboard.
- 4
For Teams and other services: disable diagnostic data sharing for AI improvement in Settings > Privacy.
- 5
For Microsoft 365: delete activity history to prevent model training.
Why We Analyzed microsoft
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.