Xbox Privacy Statement

This is Microsoft's privacy policy covering all Microsoft services including Xbox, explaining how your personal data — including your voice recordings, location, gameplay activity, browsing history, and payment information — is collected, used, and shared with third parties including advertisers and government agencies. The single most important thing to know is that Microsoft may use your voice recordings and gaming interactions to train AI models, and if you use preview or beta features, your data may be subject to fewer privacy protections than standard products. You can review and adjust your privacy settings, delete data, and opt out of certain data uses by visiting your Microsoft Privacy Dashboard at account.microsoft.com/privacy.

This document is Microsoft's global Privacy Statement (last updated March 2026) governing data collection, processing, and sharing across all Microsoft products and services — including Xbox — with legal bases including consent, contractual necessity, legitimate interests, and legal obligation under GDPR Art. 6. The most significant obligations include Microsoft's broad data collection across device identifiers, location, voice, browsing, and gaming activity, combined with sharing practices that extend to affiliates, vendors, advertisers, and government entities upon legal demand. Notably, the statement permits Microsoft to use personal data including voice recordings and gaming interactions to train AI and improve products, and discloses that 'preview' or free-of-charge releases may collect more data than standard releases with reduced privacy commitments — an unusual provision that materially expands data exposure for users of experimental features. The document engages GDPR (EU 2016/679), CCPA/CPRA (Cal. Civ. Code §1798.100 et seq.), COPPA (15 U.S.C. §6501), and multiple U.S. state data privacy laws including Virginia CDPA, Colorado CPA, and Texas TDPSA; compliance teams should note that the single privacy statement covers both consumer and enterprise services, creating complexity in demonstrating product-specific consent and data minimization obligations under GDPR Art. 5(1)(c) and CCPA opt-out rights for each service line. The Xbox-specific section collects gameplay data, voice communications, social interactions, and payment information, raising particular COPPA exposure given the platform's broad minor user base, and requires documented verifiable parental consent mechanisms.