Microsoft Privacy Statement (Legacy)

This document explains what data Microsoft collects about you—including your location, browsing history, and the actual content of your emails and files—and how it uses that data, including to show you ads and to train AI systems. Your employer controls your work account data and can access your messages and files. A few categories of users receive extra protections: children under 18 do not receive personalized ads, student data cannot be used for commercial purposes, and health data shared with Copilot Health will not be used to train AI or target ads.

The Microsoft Privacy Statement establishes the scope of personal data Microsoft collects, uses, shares, and retains across its products and services. Microsoft collects highly granular data categories including browsing history, precise and imprecise location, and the full content of users' emails, chats, calls, photos, and documents. User data is used for advertising on both Microsoft and third-party properties through automated profiling processes, and may be used to develop, train, and fine-tune AI models including large language models. The statement carves out specific protections: health data submitted to Copilot Health is excluded from AI training and advertising use; K-12 student personal data is prohibited from advertising and commercial use; personalized advertising is withheld from users whose Microsoft accounts identify them as under 18; and Windows Recall data is stored locally and not transmitted off-device absent user action. Employing organizations hold control and access rights over data created under work accounts, and Microsoft discloses personal data to law enforcement based on a good-faith belief standard.

Microsoft collects broad categories of personal data—including location, browsing history, and the content of private communications and files—and uses that data to serve targeted ads on Microsoft and third-party sites and to train AI models. Users with work accounts have no personal privacy expectation in the data they create through those accounts, as their employer holds access and processing rights. Windows Recall data stays on-device unless a user takes action to share it. Users whose Microsoft account identifies them as under 18 are excluded from personalized advertising. If you use Copilot Health, your submitted health data will not be used for AI training or advertising.