Microsoft

Microsoft Privacy Statement (Site 586) — Practical Overview

*Based on the text provided, last updated July 2026. This is a privacy statement, not Microsoft’s full service terms or a contract governing every product.*

1. Data Collection & Usage

Microsoft collects data you provide, data generated through use, and information obtained from affiliates and third parties. Depending on the products used, this may include:

• Identity and account data: name, email, address, phone number, username, password information, age, gender, country, language, payment details, subscriptions, and licenses.
• Device and technical data: IP address, device identifiers, hardware/software configuration, operating system, connectivity, location, performance information, crash reports, and installed applications.
• Activity and interaction data: searches, commands, browsing history, purchases, product usage, support communications, bot interactions, clicks, contacts, social activity, and content consumption.
• User content: emails, chats, calls, meetings, documents, photos, files, recordings, voice clips, typed or handwritten input, and images.
• Sensitive or potentially sensitive data: precise location, biometric templates used by Windows Hello, voice data, health-related information submitted to Copilot Health, and data appearing in crash dumps or communications.

Microsoft uses this information to:

• Provide, authenticate, personalize, secure, update, troubleshoot, and support products;
• Improve products and develop new services;
• Advertise and send promotional communications;
• Detect fraud, malware, abuse, illegal activity, and child exploitation;
• Comply with law, enforce agreements, conduct research, and operate its business.

Retention varies considerably. For example, OneDrive files may remain until actively deleted, while other data may be retained for legal, security, business, or dispute-related reasons.

2. User Rights and Controls

Microsoft states that users generally may:

• Withdraw consent;
• Request information about processing;
• Access, correct, update, delete, or export data;
• Object to or restrict processing, including direct marketing;
• Manage search, browsing, location, Copilot, account, OneDrive, Outlook, Teams, and Xbox data through product settings or the Privacy Dashboard.

These rights may be limited by law, technical constraints, or organizational control. Work and school users generally must direct requests to their employer, school, or administrator.

Users can also control:

• Optional diagnostic data;
• Cookies and tracking;
• Personalized advertising;
• Windows advertising ID;
• Microphone, camera, location, and app permissions;
• Edge synchronization and browsing-activity sharing;
• Copilot history and personalization.

Deleting cookies may erase advertising choices and require users to opt out again.

3. Third-Party Sharing

Microsoft may share data with:

• Microsoft affiliates and subsidiaries;
• Vendors and service providers, including support providers;
• Payment processors, banks, fraud-prevention providers, and notification services;
• Advertising partners, including Xandr and other listed advertising companies;
• Game publishers, app developers, social networks, and third-party services you connect;
• Your employer or school when using an organizational account;
• Authorities, law enforcement, or other parties when legally required or necessary to protect safety, rights, systems, or property;
• Buyers or successors in a merger, sale, or similar corporate transaction.

Third-party apps, websites, extensions, notification providers, game publishers, and organizations may apply their own privacy policies. Microsoft is expressly not responsible for an organization’s or third party’s privacy practices.

International transfers may occur to the United States and other countries using stated legal safeguards, including contractual clauses and Data Privacy Framework mechanisms.

4. AI/ML Training

Yes. Microsoft expressly states that it may use personal data to develop, train, and fine-tune AI models, including large language models. It may also manually review some data or automated results to improve AI systems.

For consumer Copilot, prompts, conversation data, files or images submitted, location, and related data may be used to provide, improve, secure, and advertise services. In some markets, Copilot conversation data may help train models unless the user opts out.

Important exceptions include:

• Copilot Health data is stated not to be used for generative-AI training or advertising.
• Microsoft 365 consumer Copilot uses file content when the user specifically requests an action on that content.
• Windows Recall content is processed and stored locally unless the user explicitly shares it.

5. Key User Obligations and Restrictions

Users should:

• Protect account credentials and review whether an account is personal or organization-controlled;
• Avoid storing personal content in work or school accounts;
• Review sharing permissions, especially OneDrive “anyone with the link” sharing;
• Obtain required consent before recording communications or transmitting recordings;
• Follow Microsoft terms, community standards, and codes of conduct;
• Understand that content may be scanned, blocked, removed, or reported for safety, legal, or abuse-prevention reasons;
• Review third-party policies before linking accounts or using third-party apps and services.

6. Liability and Disputes

The supplied statement contains no general liability cap, warranty disclaimer, arbitration clause, or governing-law provision. Those terms likely appear in separate Microsoft service or product terms.

For privacy complaints, Microsoft directs users to its privacy support process and says it will respond within 30 days, unless law requires otherwise. Users may also complain to a data protection authority. For certain EU, UK, and Swiss data transferred under the Data Privacy Framework, unresolved complaints may proceed through relevant regulators and, in limited circumstances, binding arbitration.

7. Changes to the Statement

Microsoft may update the statement for legal, product, policy, or operational changes. It will:

• Change the “last updated” date;
• Describe revisions on a Change History page;
• Give prominent advance notice of material changes, particularly changes to processing purposes inconsistent with the original collection purpose.

Users are encouraged to review the statement periodically.