Microsoft may collect biometric data (such as facial recognition or voice prints) and health-related information in certain products and services. This sensitive data is subject to additional protections but is still collected and processed.
Biometric and health data are among the most sensitive categories of personal information, and their collection by a major technology company carries significant privacy risks if misused or breached.
Collection of biometric and special category health data triggers heightened obligations under GDPR Article 9, CCPA sensitive data provisions, and the Washington My Health MY Data Act, requiring explicit consent, Data Protection Impact Assessments, and restricted processing purposes.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Microsoft collects extensive personal data across its products including search history, voice recordings, location data, browsing behaviour, and inferred interests, and uses this data for targeted advertising and product improvement. Users' data may be shared with affiliates, advertising partners, and other third parties, and sensitive data such as health and biometric information may also be collected in certain contexts. You can review, download, or delete your personal data by visiting Microsoft's Privacy Dashboard at account.microsoft.com/privacy.