Microsoft generates inferences about your interests, preferences, and behaviour based on how you use their products, even if you never directly provided that information.
Microsoft can build a detailed profile about you from passive usage patterns — meaning data you never consciously shared can be used to make assumptions about your interests, lifestyle, or personal circumstances.
The generation of inferred or derived personal data raises significant obligations under GDPR Article 22 (automated decision-making), Article 9 (special category inferences), and CCPA/CPRA provisions covering inferences drawn from personal information; DPIAs may be required for high-risk processing of this nature.
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.
Microsoft collects an extensive range of personal data — including location, voice, typed content, browsing history, and device diagnostics — across all its products and may combine this data for advertising, product improvement, and AI model training. Consumers' personal data may be shared with third-party advertisers, affiliates, and service providers, and inferred data about interests and behaviour is generated even from passive use. You can review and manage your privacy settings, including ad personalisation and data collection preferences, at https://account.microsoft.com/privacy.