Microsoft Privacy

This is Microsoft's global Privacy Statement covering the full range of Microsoft consumer and enterprise products, including Windows, Microsoft 365, Azure, Bing, Copilot, Xbox, Teams, and OneDrive. The statement discloses that Microsoft may use personal data, including prompts, voice data, browsing history, and file content, to develop and train AI models including large language models, with opt-out available only in certain markets and for specific services. The statement also discloses that organizational account holders, such as employers or schools, may access and process employees' or students' communications, files, and interaction data associated with Microsoft products used under those accounts.

This document is Microsoft's global Privacy Statement (last updated June 2026), governing the collection, use, disclosure, and retention of personal data across Microsoft's consumer and enterprise product portfolio, including Azure, Microsoft 365, Windows, Bing, Copilot, Xbox, Teams, OneDrive, and associated services. The statement asserts that Microsoft collects a broad range of personal data categories including identifiers, biometric data, voice data, location data, browsing history, content of files and communications, and inferred interests, and states that this data is used to provide products, develop and train AI models including large language models, deliver personalized advertising, and operate business functions. Notably, the statement authorizes the use of personal data to develop and fine-tune AI models, including LLMs, with an opt-out mechanism available only in certain markets and for specific Copilot services, and discloses data sharing with named third-party advertising partners including Facebook, Yahoo, Taboola, Outbrain, and Xandr; the statement also asserts broad content-access rights for organizational accounts, where employers or schools may access communications, files, and interaction data associated with work or school accounts. The document engages GDPR, CCPA and applicable U.S. state privacy laws, COPPA, Brazil's LGPD, Japan's Act on the Protection of Personal Information, the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, and industry self-regulatory frameworks including the NAI, DAA, EDAA, and DAAC; compliance obligations vary significantly by jurisdiction, and the document's assertion of legitimate interests as a legal basis for processing, as well as its AI training data use provisions, may require evaluation under GDPR Article 6 and applicable EU AI Act requirements. The statement designates Microsoft Ireland Operations Limited as the data controller for EEA, UK, and Switzerland users, commits to DPF binding arbitration for residual complaints, and acknowledges FTC investigatory authority over Microsoft's DPF compliance.

The agreement establishes that Microsoft collects a broad range of personal data categories, including biometric data, voice data, precise and imprecise location data, browsing history, file and communication content, and inferred interests, across its full product portfolio. Under these terms, Microsoft may use personal data to develop and fine-tune AI models including large language models, with opt-out available only in certain markets and for specific Copilot services; users in markets where this applies can opt out via the Microsoft Privacy Dashboard or in-product controls. You can opt out of personalized advertising through Microsoft's Personalized Ads and Offers page, manage data access and deletion requests through the Microsoft Privacy Dashboard, and submit data rights requests via Microsoft's privacy support and requests page.