"Microsoft exhibits critical risk across data collection, sharing, and tracking with particularly concerning practices around biometric data, government access, and fragmented user controls. Indefinite retention, broad third-party sharing, and pervasive cross-site advertising tracking are the primary drivers."
Take Action
8 Privacy Improvements Available
Microsoft Privacy Concerns & Scorecard
Microsoft collects an exceptionally broad range of sensitive personal data including biometric data (fingerprint, iris, facial recognition), precise location, health data, voice recordings, email content, chat messages, file contents, and behavioral data across all products and services.
Microsoft shares collected data with extensive third-party networks including advertising partners (Xandr, Facebook, Yahoo, Trade Desk, Media.net), analytics providers, data brokers, device manufacturers, app developers, and law enforcement with broad discretion and minimal transparency about specific recipients.
Microsoft employs pervasive tracking across its ecosystem and third-party sites using cookies, pixels, device IDs, and behavioral profiling to enable personalized advertising, with limited opt-out effectiveness and cookie-based preferences that expire after five years.
Microsoft retains most personal data indefinitely or for vague durations tied to business purposes, with no guaranteed deletion after account closure (60-day grace period before deletion begins) and selective retention of sensitive data like location histories and biometric templates.
Despite multiple privacy settings, user controls are fragmented across disconnected pages, opt-out mechanisms are incomplete (cookie-based preferences reset every 5 years), organizational administrators can override personal preferences, and the policy uses ambiguous language about data use for critical purposes like AI training.
Personal data export
- 1Sign in to the Microsoft privacy dashboard at account.microsoft.com/privacy using your Microsoft account.
- 2Select 'Download your data'.
- 3Select 'Create new archive' to begin packaging your personal data.
- 4Wait for Microsoft to prepare the archive (this may take some time), then download the file when it is ready.
Xbox optional data sharing off
- 1On your Xbox console, go to Profile and System, then select Settings.
- 2Navigate to Account, then select Privacy and Online Safety.
- 3Select Data Collection.
- 4Choose Block to opt out of optional data sharing.
Camera microphone app permissions
- 1Open the Start menu and go to Settings, then navigate to Privacy and Security.
- 2To control camera access, select Camera. Turn off 'Camera access' to block all apps from using the camera, or turn off 'Let apps access your camera' to block Microsoft Store apps while keeping desktop app access, or toggle individual apps on or off.
- 3To control microphone access, go back to Privacy and Security and select Microphone. Turn off 'Microphone access' to block all apps, or turn off 'Let apps access your microphone' to block Microsoft Store apps, or toggle individual apps on or off.
Automate your privacy
Connect your accounts to TrueTerms to automate these privacy actions and monitor policy changes.
Data Collection & Tracking
Personal Information Collected
Health feature personalization (Copilot Health), fitness tracking, health analytics, service improvement
Cloud storage, content backup, shared access, image processing for features like facial grouping, file synchronization across devices, Copilot context
Software stability and improvement, security threat detection, hardware issue diagnosis, service quality assurance
Service integration, contact synchronization, family management features, social feature enablement
AI model training and improvement, service delivery, personalized assistance, content moderation, policy enforcement
Parental monitoring and safety controls, age-appropriate service delivery, enforcement of usage limits, child safety protections
Gaming service delivery, social features, anti-cheat enforcement, personalized recommendations, engagement analytics
Account creation, authentication, profile management, service personalization, legal compliance
Authentication, accessibility features (voice typing, Narrator), device security, enforcement activities, AI model training
Personalized content and ads, emergency services (E911), navigation, Family Safety monitoring, local search results, weather and news personalization
Service delivery, security and fraud detection, spam/malware filtering, policy enforcement, AI model improvement (limited exclusions for email/chat/calls in ad targeting)
Search result personalization, ad targeting, product recommendations, Copilot context, service improvement, malware detection
Payment processing, transaction fulfillment, fraud detection, subscription management, spending analytics
Device management, software updates, compatibility determination, security enforcement, diagnostic data collection, product personalization
Service improvement, feature recommendations, engagement analytics, enforcement of terms of service, user experience optimization
Personalized recommendations, ad targeting, content discovery, service customization, aggregate analytics
Cross-Platform Tracking
Microsoft tracks users across its entire product ecosystem (Windows, Office, Edge, Teams, Outlook, Xbox, OneDrive, Copilot) and combines this data with tracking from third-party websites via cookies, pixels, and device identifiers. Data syncs across devices when users sign in with a Microsoft account, and Microsoft shares behavioral data with analytics providers and advertising networks that track users across unrelated sites and apps. Organizations managing work accounts have access to all user data regardless of context or sensitivity.
Tracking Methods:
First-party Cookies
Microsoft uses its own cookies to track user authentication, preferences, and browsing behavior within Microsoft properties and to enable account sign-in functionality across Microsoft services.
Third-party Cookies & Pixels
Third-party advertising networks (Xandr, Facebook, Yahoo, Trade Desk, Media.net) and analytics providers place cookies and web beacons on Microsoft sites to track user behavior across unrelated websites and apps for ad targeting and retargeting.
Device Fingerprinting & Advertising ID
Windows generates a unique Advertising ID per device used by Microsoft and third-party apps for personalized advertising; supplemented with device identifiers, IP address, and hardware configuration to create persistent cross-device profiles.
Login & Account Linking
Signing into a Microsoft account enables cross-device data syncing and associates all activity (browsing, app usage, location, communications) with a persistent user profile; organizational directory integration tracks work account activity across all services.
Analytics Tracking
Microsoft embeds analytics providers (Google Analytics, Mixpanel, AppsFlyer, Nielsen, Adjust, Clicktale, Flurry Analytics, Kissmetrics, Acuity Ads, WebTrends, Optimizely) that collect and combine user activity data across websites, apps, and offline services for behavioral profiling.
Web Beacons & Conversion Tracking
Invisible pixels embedded in emails and on partner websites track when users view ads, click ads, and complete purchases; data used to measure ad effectiveness and retarget users with similar content.
Unified Data Aggregation
Microsoft combines data from multiple contexts (search, browsing, app usage, location, purchases, communications) and syncs this profile across devices when users sign in; third parties can access and cross-reference these combined profiles through data sharing agreements.
Terms of Service Updates
New Effective Date for Terms
The Microsoft Services Agreement was published on July 30, 2025, with an effective date of September 30, 2025. This indicates a significant update to the terms that users must accept by that date.
Effective: September 30, 2025
Cookie Banner Added to Page Header
New version includes a prominent cookie consent banner at the top of the page allowing users to accept, reject, or manage optional cookies used for social media and personalized advertising. This change reflects updated privacy compliance practices and gives users explicit control over optional cookie usage.
Effective: September 30, 2025
Expanded data export capabilities and third-party service portability
The NEW version clarifies that exportable data can be accessed 'or the product user interface, when authenticated with your Microsoft account' and explicitly states 'This exportable data can be used to switch to third-party provider services.' The OLD version text cuts off mid-sentence. This change enhances user rights by explicitly acknowledging data portability for switching providers.
Effective: September 30, 2025
AI & Data Training
Microsoft uses your content to train AI
Below is what's used and how (if at all) you can object.
What Content Is Used
Copilot Prompts and Conversations
Text prompts submitted to Microsoft Copilot, conversation history, and context information used to generate responses. Data is used for AI model training and service improvement, with limited ability to control data use after submission.
Shared Files and Documents in Copilot
Files and documents uploaded or referenced within Copilot interactions, including content used for analysis, generation, and context. These files are processed and may be used for model improvement purposes.
Search Queries and Browsing Activity
Search queries submitted via Bing and browsing activity from Microsoft Edge used to train AI models for improved search relevance, recommendations, and personalization across Microsoft products.
User Communications and Text Input
Text input and communication data (excluding email, chat, and calls explicitly excluded from ad targeting) used for AI model training to improve natural language processing, recommendations, and content understanding.
How to Object
You can submit an objection using the steps below.
- 1
For Copilot: Users can manage prompt history by viewing and deleting conversation records on Microsoft Privacy Dashboard and in product settings. However, this does not prevent use of remaining data for model improvement. For broader opt-out, users must decline to use AI features or disable Copilot where possible. No comprehensive opt-out from AI training exists for other Microsoft services (Edge, Search, Office) that contribute data to model training.
Why We Analyzed Microsoft
TrueTerms automatically audits privacy policies and data practices using advanced machine learning to keep you informed and protected. This scorecard is based on the latest available public terms of service and privacy policies as of 2026.