Microsoft requires parental consent before collecting personal data from children under 13 (or the applicable age of digital consent in other countries), and provides parents with tools to review and delete their child's data.
Why it matters
If your child uses Microsoft services such as Xbox, Minecraft, or Microsoft 365 Education, their personal data is being collected and you have the right to review, correct, or delete it.
Microsoft's children's data provisions engage COPPA (US), GDPR Art. 8 (EEA), and the UK Children's Code; education sector deployments via Microsoft 365 Education also trigger FERPA obligations, and institutional buyers should verify age-gate and consent mechanisms in enterprise deployments.
🔒
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Consumer impact
Microsoft collects extensive personal data — including location, voice recordings, typed content, browsing history, and health-related data — across its entire product ecosystem, and uses this data for personalised advertising, product improvement, and AI model training. Data may be shared with third-party partners, advertisers, and other Microsoft-affiliated companies, and some data may be retained even after account deletion. You can review, download, or delete your personal data by visiting account.microsoft.com/privacy and adjusting settings via the Microsoft Privacy Dashboard.
What you can do
⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.
Delete Your Data
Sign in to your Microsoft account and navigate to Microsoft Family Safety at account.microsoft.com/family to review your child's account, manage permissions, and request deletion of their personal data.
Applicable agencies
Federal Trade Commission (ftc)
Oversees unfair or deceptive business practices and can investigate companies that mislead consumers about data collection, sharing, or use.
Who can file: Anyone affected by the company's practices (US or international)
What you need: Your account details, a timeline of relevant events, and a description of the specific issue
What to expect: Complaints inform FTC enforcement priorities and investigations but do not result in individual resolution or compensation
Enforces the Family Educational Rights and Privacy Act (FERPA), which protects student education records. Can investigate violations of student data privacy rights.
Who can file: Students (or parents of minor students) whose FERPA rights may have been violated by an educational institution that receives federal funding
What you need: Name of the institution, description of the FERPA violation, relevant dates, and documentation showing the violation if available
What to expect: The DOE Family Policy Compliance Office reviews complaints and may investigate. Resolution typically involves the institution correcting its practices. Filing must be within 180 days of the alleged violation.