Organization may access diagnostic data and communications

The updated statement expands what device data Microsoft collects to explicitly include interactions with Microsoft websites and apps, moving beyond prior language that mentioned only device details, hardware, and settings. The terms now authorize Microsoft to personalize Copilot using conversation history (including saved memories) and optionally using data from other Microsoft products like Bing, Edge, and MSN. You can manage memories and control personalization features using settings within Microsoft Copilot at any time.

The updated privacy statement removes the previous detailed list of third-party sources from which Microsoft obtains personal data, including data brokers, public social media posts, location service providers, co-branded partners, and developers. Under the revised language, Microsoft describes obtaining data from 'Microsoft affiliates, subsidiaries, and third parties' without specifying the categories or types of third parties as explicitly as before. The company states it has reorganized the document for greater clarity and accessibility, but the operational effect is that users receive less specific disclosure about where their data originates from outside Microsoft.

The updated policy establishes additional grounds on which Microsoft may retain personal data. While the prior version tied retention to specific user expectations and available deletion controls, the revised language authorizes retention for 'operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes.' This expands the stated purposes beyond transaction fulfillment and legal compliance. The updated policy directs users to product-specific documentation for retention details rather than providing explicit deletion procedures and timelines in the privacy statement itself.