What can I do about this clause?

{'method': 'WEB_FORM', 'recipient': 'https://www.microsoft.com/en-us/privacy', 'difficulty': 'MODERATE', 'action_type': 'DELETE_DATA', 'instructions': 'Visit microsoft.com/en-us/privacy and navigate to the Privacy Response Center. Sign in with your Microsoft account and submit a data access, deletion, or opt-out request. Microsoft is required to respond within 45 days under most U.S. state privacy laws.', 'deadline_days': 45, 'deadline_hours': None}

Which regulatory agencies enforce this type of clause?

{'agency': 'State_AG', 'reason': "U.S. state Attorneys General in Virginia, Colorado, Texas, Connecticut, and other states have enforcement authority over their respective state data privacy laws applicable to Microsoft's data practices.", 'complaint_url': 'https://www.naag.org/find-my-ag/'}

What is the severity of this clause?

ConductAtlas classifies this U.S. State Data Privacy Rights clause as medium severity. Severity reflects the magnitude of rights affected, the breadth of users impacted, and the degree of discretion the platform retains.

Do other platforms have similar clauses?

Yes. ConductAtlas has identified similar U.S. State Data Privacy Rights clauses across approximately 1 other tracked platforms. You can compare how platforms differ on this clause type in the cross-platform comparison view.

U.S. State Data Privacy Rights — Xbox

Share 𝕏 Share in Share 🔒 PDF

What it is

If you live in California, Virginia, Colorado, Texas, or other states with privacy laws, you have specific rights to access, delete, and opt out of the sale or sharing of your personal data, and you can exercise these rights through Microsoft's Privacy Response Center.

Consumer impact (what this means for users)

Xbox users in California, Virginia, Colorado, Texas, and other covered states can request access to, deletion of, or opt-out of the sale or sharing of their personal data, including gaming activity and behavioral data, by submitting a request through Microsoft's Privacy Response Center at microsoft.com/en-us/privacy.

What you can do

⚠️ These actions may provide transparency or partial mitigation but may not fully address the underlying issue. Effectiveness varies by jurisdiction and individual circumstances.

Delete Your Data
Within 45 days
Visit microsoft.com/en-us/privacy and navigate to the Privacy Response Center. Sign in with your Microsoft account and submit a data access, deletion, or opt-out request. Microsoft is required to respond within 45 days under most U.S. state privacy laws.

Cross-platform context

See how other platforms handle U.S. State Data Privacy Rights and similar clauses.

Compare across platforms →

Need full compliance memos? See Professional →

Why it matters (compliance & risk perspective)

U.S. state privacy laws give millions of Xbox users concrete rights to see, delete, and stop the sharing of their personal data — but these rights are only activated if you actively request them through Microsoft's privacy portal.

View original clause language

Depending on where you live and subject to certain exceptions, you may have the right to request access to personal data we hold about you, to receive a copy of that data in a portable format, to correct inaccurate data, to delete your data, to opt out of the sale or sharing of personal data, to opt out of targeted advertising, and to not be discriminated against for exercising these rights. To submit a privacy rights request, visit our Privacy Response Center.

Institutional analysis (Compliance & legal intelligence)

REGULATORY FRAMEWORK: This provision engages CCPA/CPRA (Cal. Civ. Code §1798.100–1798.199) enforced by the CPPA; Virginia CDPA (Va. Code §59.1-571 et seq.); Colorado CPA (C.R.S. §6-1-1301); Texas TDPSA (Tex. Bus. & Com. Code Ch. 541); Connecticut CTDPA; and emerging state privacy laws in Montana, Oregon, and others. The enforcement authority varies by state — CPPA in California, State AGs in most other jurisdictions.

🔒

Compliance intelligence locked

Regulatory citations, enforcement risk, and due diligence action items.

Watcher $9.99/mo Professional $149/mo

Watcher: regulatory citations. Professional: full compliance memo.

Applicable agencies

State AG

U.S. state Attorneys General in Virginia, Colorado, Texas, Connecticut, and other states have enforcement authority over their respective state data privacy laws applicable to Microsoft's data practices.
File a complaint →

Provision details

Document information

Document

Xbox Privacy Statement

Entity

Xbox

Document last updated

April 29, 2026

Tracking information

First tracked

April 27, 2026

Last verified

April 27, 2026

Record ID

CA-P-003194

Document ID

CA-D-00018

Evidence Provenance

Source URL

https://privacy.microsoft.com/en-us/privacystatement

Wayback Machine

View archived versions →

SHA-256

a67035af599dcfcefd7a22ae7c70147370fe6651cb96942500cd2ead91f2a017

Verified

✓ Snapshot stored ✓ Change verified

How to Cite

ConductAtlas Policy Archive
Entity: Xbox | Document: Xbox Privacy Statement | Record: CA-P-003194
Captured: 2026-04-27 09:55:26 UTC | SHA-256: a67035af599dcfce…
URL: https://conductatlas.com/platform/xbox/xbox-privacy-statement/us-state-data-privacy-rights/
Accessed: May 2, 2026

Classification

Severity

Medium

U.S. State Data Privacy Rights