Microsoft Privacy

This document is Microsoft's global Privacy Statement, last updated March 2026, governing the collection, use, and sharing of personal data across Microsoft's consumer and enterprise products and services, with its legal basis rooted in consent, contractual necessity, legitimate interests, and legal obligation depending on jurisdiction. The statement asserts that Microsoft collects a broad range of personal data including name, contact information, device and usage data, location, biometric data (voiceprints and facial recognition in applicable products), browsing history, search queries, and content of communications, and the terms authorize use of this data for product improvement, personalization, advertising, and security purposes. Notably, the statement includes specific provisions for AI and Copilot capabilities, enterprise online services, children's data, and U.S. state-level privacy rights, and it distinguishes between Microsoft acting as a data controller for consumer products and as a data processor when enterprise customers deploy its services, a distinction that materially affects which rights consumers can exercise directly against Microsoft. The statement engages GDPR for EU/EEA users, CCPA and a range of U.S. state privacy laws for U.S. residents, COPPA for children under 13, and relevant frameworks in other jurisdictions; the statement acknowledges that data may be transferred internationally and that Microsoft relies on Standard Contractual Clauses and other transfer mechanisms. Material compliance considerations include the breadth of data collected for AI and Copilot features, the layered controller-processor structure in enterprise contexts, and Microsoft's stated reliance on legitimate interests as a processing basis in some contexts, which may require evaluation under GDPR's balancing test.