Track 1 platform and get the weekly governance digest. No credit card required.
This page describes what the document states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability may vary by jurisdiction. Methodology
This document establishes Microsoft's privacy practices across its consumer and enterprise products, including Windows, Microsoft 365, Bing, Xbox, Cortana, Teams, and Copilot. The policy authorizes Microsoft to collect personal data including names, location, device identifiers, browsing and search history, voice recordings, and file and communication content, and to use this data for product operation, advertising, product improvement, and AI model development. The policy specifies that users may review, adjust, and delete personal data through the Microsoft privacy dashboard at account.microsoft.com/privacy.
This document is Microsoft's global Privacy Statement, last updated March 2026, governing the collection, use, and sharing of personal data across Microsoft's consumer and enterprise products and services, with its legal basis rooted in consent, contractual necessity, legitimate interests, and legal obligation depending on jurisdiction. The statement asserts that Microsoft collects a broad range of personal data including name, contact information, device and usage data, location, biometric data (voiceprints and facial recognition in applicable products), browsing history, search queries, and content of communications, and the terms authorize use of this data for product improvement, personalization, advertising, and security purposes. Notably, the statement includes specific provisions for AI and Copilot capabilities, enterprise online services, children's data, and U.S. state-level privacy rights, and it distinguishes between Microsoft acting as a data controller for consumer products and as a data processor when enterprise customers deploy its services, a distinction that materially affects which rights consumers can exercise directly against Microsoft. The statement engages GDPR for EU/EEA users, CCPA and a range of U.S. state privacy laws for U.S. residents, COPPA for children under 13, and relevant frameworks in other jurisdictions; the statement acknowledges that data may be transferred internationally and that Microsoft relies on Standard Contractual Clauses and other transfer mechanisms. Material compliance considerations include the breadth of data collected for AI and Copilot features, the layered controller-processor structure in enterprise contexts, and Microsoft's stated reliance on legitimate interests as a processing basis in some contexts, which may require evaluation under GDPR's balancing test.
Institutional analysis available with Compliance
Regulatory exposure by statute, material risk assessment, vendor due diligence action items, and enforcement precedent. Available on Compliance.
Start Compliance free trial5 important changes detected
6 versions captured · Last updated: June 2026
Microsoft revised how it explains data retention. Previously, the policy listed specific criteria for deciding how long to keep data, including examples like documents in OneDrive. Now the policy provides …
View change record →Microsoft Azure's privacy policy now discloses that if you consent to receive marketing communications via phone, the company may contact you using automated dialing systems and artificial or prerecorded voices, …
View change record →Microsoft updated its data retention policy on March 6, 2026, to provide more specific guidance on how long it keeps your data and under what circumstances. The new language clarifies …
View change record →New foundational provision establishing the scope and sources of data collection including direct provision, behavioral tracking, contextual collection, and third-party sources.
New clarification distinguishing Microsoft's role as processor versus controller in enterprise contexts, establishing that client organizations retain data control authority.
New provision addressing state-level privacy rights under emerging U.S. state privacy laws including access, correction, deletion, portability, and opt-out rights for sales and targeted advertising.
New provision detailing use of data for personalization, recommendations, and interest-based advertising with acknowledgment of promotional communications.
New provision establishing notification procedures for material privacy statement changes, including prominent notice posting and direct notification requirements.
High-severity provision on behavioral profiling removed, likely consolidated into the new 'Advertising and Interest-Based Targeting' provision with lower medium severity.
High-severity provision on third-party data sharing removed entirely, with only implicit reference remaining in the new 'Personal Data Collection Scope' provision about obtaining data from third parties.
General consumer rights provision removed and replaced with jurisdiction-specific 'U.S. State Data Privacy Rights' provision reflecting regulatory evolution toward state-level privacy laws.
High-severity provision on biometric and voice data collection removed without explicit replacement, potentially subsumed under broader 'Personal Data Collection Scope' provision.
High-severity provision on location data collection removed without explicit replacement, representing potential downgrade in transparency regarding sensitive location tracking practices.
Provision changed from empty excerpt to detailed specification of AI data collection including prompts, content, responses, and usage patterns with explicit purposes.
Severity downgraded from high to medium and provision now includes specific contact procedure and deletion commitment with explicit age threshold of 13.
Provision changed from empty excerpt to detailed explanation of cookie functionality including preference storage, sign-in, interest-based advertising, fraud prevention, and performance analysis.
Provision changed from empty excerpt to comprehensive disclosure of global data transfers with explicit mention of U.S. transfers and acknowledgment of different data protection standards.
Severity downgraded from medium to low and provision expanded from empty excerpt to specify retention purposes including legal compliance, dispute resolution, and agreement enforcement with acknowledgment of variation by product.
Monitoring
Microsoft Azure has updated this document before.
Monitor includes same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
Compliance Governance Intelligence
Need provision-level monitoring and regulatory mapping?
Compliance includes governance timelines, compliance memos, audit-ready analysis, and full provision tracking.
Start Compliance free trialCross-platform context
See how other platforms handle AI and Copilot Data Use and similar clauses.
Compare across platforms →Governance Monitoring
Structured alerts for policy changes, governance events, and provision updates across 318+ platforms.