Microsoft Privacy Statement (Legacy)

This document explains what data Microsoft collects about you—including your location, browsing history, and the content of your emails, chats, and files—and how Microsoft uses that data, including to show you ads on Microsoft and other companies' sites and to train its AI systems. Your employer controls your work account and can access everything you create or store through it. A few categories of data have special protections: what you share with Copilot Health won't be used for ads or AI training, and personalized ads won't be shown to users whose accounts indicate they are under 18.

The Microsoft Privacy Statement establishes the terms under which Microsoft collects, uses, shares, and retains personal data across its products and services. It sets out broad data collection practices encompassing browsing history, precise and imprecise location data, and the full content of user communications and files including emails, chats, calls, photos, and documents. The statement permits Microsoft to use collected data for advertising on both Microsoft and third-party properties through automated profiling processes, and to use user data to develop, train, and fine-tune AI models including large language models. It carves out explicit restrictions for specific contexts: health data submitted to Copilot Health is excluded from AI training and advertising use; K-12 student personal data is excluded from advertising and commercial use; personalized advertising is withheld from users whose Microsoft accounts identify them as under 18; and Windows Recall data is stored locally on-device and not transmitted without affirmative user action. The statement also vests employing organizations with control over, and the right to access and process, data created by users operating under work accounts.

As an individual user, Microsoft collects your location, browsing history, and the actual content of your communications and files, and uses that data to serve targeted ads across Microsoft and third-party sites and to build AI systems. If you use a work account, your employer—not you—controls and can access that data. What you share through Copilot Health is protected from AI training and advertising use. Windows Recall stores its continuous record of on-screen activity only on your device and does not transmit it unless you take action to do so. If you play Xbox games or use network-connected apps, the publisher of that game or app can access your user identifier, gamertag, country, age range, and gameplay data.