10 Total
5 High severity
5 Medium severity
0 Low severity
Summary

This is Microsoft's master terms-of-service agreement covering nearly all consumer-facing Microsoft products — including Xbox, Outlook, OneDrive, Bing, and Microsoft 365. The most important thing to know is that Microsoft claims a broad, royalty-free license to use, copy, distribute, and create derivative works from content you post or store across its services, and US users give up their right to sue Microsoft in a class action by agreeing to binding arbitration. If you are a US user and want to opt out of arbitration, you must send written notice to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 within 30 days of first accepting the agreement.

Technical Summary

The Microsoft Services Agreement (MSA) is a binding contract governing consumer access to Microsoft's portfolio of consumer products and services — including Outlook, OneDrive, Xbox, Skype, Bing, Microsoft 365, and Cortana — with Washington State law as the governing jurisdiction. The agreement imposes significant obligations on users including compliance with a detailed Code of Conduct, prohibition on reverse engineering, restrictions on content that violates third-party rights, and mandatory use of Microsoft's designated payment methods; Microsoft in turn commits to providing services 'as-is' with broad warranty disclaimers and caps liability at the amount paid in the prior 12 months. Notable deviations from industry standard include a binding arbitration clause with a class action waiver applicable to US users, a unilateral right for Microsoft to modify, suspend, or terminate services or accounts with or without notice, and a broad license grant over user-generated content that includes sublicensing rights. The agreement engages GDPR (for EU/EEA users), CCPA (for California residents), COPPA (for users under 13), and the FTC Act Section 5 through its consumer-facing data and privacy practices; material compliance considerations include the adequacy of consent mechanisms for the content license grant, the enforceability of the arbitration clause post-Viking River Cruises, and the scope of data retention practices following account closure.

Institutional Analysis

(1) REGULATORY EXPOSURE: The MSA engages GDPR Arts. 6, 7, 13, and 17 (lawful basis for processing, consent requirements, transparency, and right to erasure) enforced by EU data protection authorities…

(1) REGULATORY EXPOSURE: The MSA engages GDPR Arts. 6, 7, 13, and 17 (lawful basis for processing, consent requirements, transparency, and right to erasure) enforced by EU data protection authorities; CCPA §§1798.100–1798.199 (consumer rights to access, deletion, and opt-out of sale) enforced by th…

🔒

Compliance intelligence locked

Regulatory exposure, material risk, and due diligence action items.

Evidence Provenance
Captured March 5, 2026 06:14 UTC
Document ID CA-D-000002
Version ID CA-V-000002
Wayback Machine View archived versions →
SHA-256 07d4cff7f4460eea523dbe528820200836a150daa59e5ed401527c766149e647
✓ Snapshot stored ✓ Text extracted ✓ Change verified ✓ Cryptographically signed
Change Timeline
High Severity — 5 provisions
Medium Severity — 5 provisions