Old version
March 13, 2026 06:00 UTC
b00f93e97712c94234c217fb26263315378680077cada036ee4ced9e4b67b11c
CA-V-001648
New version
April 1, 2026 06:04 UTC
9747780db9713278eb767f30b62e22d28d9779dfd8af583372a209ed3f6f92c8
CA-V-001728
Share 𝕏 Share in Share
Change Summary
Microsoft revised how it explains data retention. Previously, the policy listed specific criteria for deciding how long to keep data, including examples like documents in OneDrive. Now the policy provides a higher-level framework mentioning purposes for retention, data sensitivity, and legal obligations, but directs users to product documentation for specifics. The practical effect is less transparency about retention timelines in the main privacy policy itself.
medium severity
1 Sentences added
11 Sentences removed
9 Sentences modified
2306 Sentences before
2296 Sentences after
Added
Removed
Modified
BeforeAfter
733Back to top Our retention of personal data Microsoft retains personal data for as long as necessary to provide the products and fulfill the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements.733Back to top Our retention of personal data Microsoft retains personal data for as long as necessary to provide the products and services you use and to fulfill the transactions you request.
734We also retain personal data for other legitimate purposes such as operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.
735Other criteria used to determine the retention periods include: Do customers provide, create, or maintain the data with the expectation we will retain it until they affirmatively remove it?736See relevant product documentation for more information.
736Examples include a document you store in OneDrive, or an email message you keep in your Outlook.com inbox.737Criteria used to determine the retention periods include: The purposes for which we use the information.
737In such cases, we would aim to maintain the data until you actively delete it, such as by moving an email from your Outlook.com inbox to the Deleted Items folder, and then emptying that folder (when your Deleted Items folder is emptied, those emptied items remain in our system for up to 30 days before final deletion).738For example, when you store a document in OneDrive, we maintain the data until you actively delete it.
738(Note that there may be other reasons why the data has to be deleted sooner, for example if you exceed limits on how much data can be stored in your account.) Is there an automated control, such as in the Microsoft privacy dashboard, that enables the customer to access and delete the personal data at any time?739The nature and sensitivity of the information.
739If there is not, a shortened data retention time will generally be adopted.740For example, we maintain a shortened retention period for precise geolocation information.
740Is the personal data of a sensitive type?741Legal, contractual and other similar obligations we are subject to, including data retention laws, government orders to preserve data relevant to an investigation, or data retained for the purposes of litigation.
741If so, a shortened retention time would generally be adopted.742Conversely, we’ll remove unlawful content where required by law.
742Has Microsoft adopted and announced a specific retention period for a certain data type?Removed
743For example, for Bing search queries, we de-identify stored queries by removing the entirety of the IP address after 6 months, and cookie IDs and other cross-session identifiers that are used to identify a particular account or device after 18 months.Removed
744Has the user provided consent for a longer retention period?Removed
745If so, we will retain data in accordance with your consent.Removed
746Is Microsoft subject to a legal, contractual, or similar obligation to retain or delete the data?Removed
747Examples can include mandatory data retention laws in the applicable jurisdiction, government orders to preserve data relevant to an investigation, or data retained for the purposes of litigation.Removed
748Conversely, if we are required by law to remove unlawful content, we will do so.Removed
839Data retention .Removed
840For personalized advertising, we retain data for no more than 13 months, unless we obtain your consent to retain the data longer.Removed
854To opt out of receiving personalized advertising from Microsoft, visit our opt-out page.846To learn more about Microsoft’s use of data to deliver personalized advertising and to opt out of receiving personalized advertising from Microsoft, visit our opt-out page.
1333Retention and de-identification .Removed
1334We de-identify stored search queries by removing the entirety of the IP address after 6 months, and cookie IDs and other cross-session identifiers that are used to identify a particular account or device after 18 months.Removed
Stay ahead of the changes

Watch this before it changes again

Follow unlimited companies, monitor the clauses that matter across every platform, and get the full institutional analysis on what each change obligates you to do.