Microsoft updated its Privacy Statement on March 13, 2026, adding new language that allows the company to contact users at phone numbers they provide for marketing purposes using auto-dialers and AI-generated or prerecorded voice messages. At the same time, they removed a sentence that had granted additional rights to users in the European Economic Area under the updated policy. The update also reflects a date change from February 2026 to March 2026, and removes a reference to a data retention policy update tied to new regulatory requirements.
The new AI auto-dialer marketing language means Microsoft can call users with AI-generated voices if they provide a phone number and consent, which expands corporate contact rights significantly. The simultaneous removal of EEA rights language reduces previously stated protections for European users without explanation.
Microsoft has added language permitting it to use auto-dialers and AI-generated or prerecorded voice calls to reach users who consent to marketing communications at a phone number they provide. Simultaneously, the policy removed a sentence that had promised additional rights to users in the European Economic Area, which may reduce protections for those users. You can avoid these marketing calls by not providing Microsoft with your phone number or by declining to consent to marketing communications when prompted.
Microsoft's March 13, 2026 privacy statement update introduces explicit consent-based auto-dialer and AI voice marketing language, implicating the US Telephone Consumer Protection Act (TCPA, 47 U.S.C. § 227) and FTC telemarketing rules. Critically, the removal of EEA-specific rights language may affect GDPR compliance posture — specifically around Art. 13 and Art. 14 transparency obligations. Organizations with Microsoft in their vendor stack should assess whether this removal impacts their own privacy notices and DPAs. Action is required for compliance officers managing EU-facing deployments.
1. TCPA (47 U.S.C. § 227): The new auto-dialer and AI/prerecorded voice marketing language directly triggers TCPA consent requirements. The FCC's 2023 and 2024 rulings on AI-generated voice calls (including the February 2024 declaratory ruling classifying AI-generated voices as 'artificial' under TCPA) are directly relevant. Consent must be express written consent under 47 C.F.R. § 64.1200(a)(2).
Compliance intelligence locked
Obligation analysis, escalation trigger, board language, and recommended action.
Watcher: regulatory citations + obligations. Professional: full compliance memo.
ConductAtlas provides verified policy intelligence sourced directly from platform documents. All analysis is intended to support, not replace, legal and compliance review. Record CA-C-000015.
ConductAtlas Policy Archive Entity: Microsoft | Document: Microsoft Privacy Statement (Legacy) | Record: CA-C-000015 Captured: 2026-03-13 06:00:18 UTC URL: https://conductatlas.com/change/2026-03-13-microsoft-microsoft-privacy-statement-legacy-15/ Accessed: April 4, 2026
Microsoft updated how it explains data retention in its privacy statement on April 1, 2026. Previously, the policy listed specific …
Microsoft updated their Responsible AI Principles page on March 13, 2026, making three small changes to how they describe their …
Microsoft updated its Privacy Statement on March 13, 2026 to disclose that if you provide a phone number and consent …
Create a free account and add Microsoft to your watchlist. We'll email you the moment something changes.