Recent Policy Changes

Why it matters: The updated policy clarifies that deletion is not instantaneous; your data persists for up to 30 days after you take deletion action. This matters because it affects how quickly your data is truly removed from Microsoft's systems and may impact your understanding of data breach risk, data residency, and compliance with privacy regulations that require timely erasure.

Why it matters: This change updates the geographic country version associated with Google's Terms of Service but does not modify the substantive rights, obligations, or protections the terms establish. Users are governed by the identical terms and conditions; the change is administrative rather than operational.

Why it matters: The updated language establishes that Microsoft has modified its data retention practices in response to regulatory requirements effective March 2026 and has granted additional rights to EEA users. This signals that the underlying data handling framework has changed, but the disclosure itself does not specify what those changes entail, leaving organizations and users without clear operational guidance on how their data will now be retained, processed, or deleted.

Why it matters: The removal of language from a privacy policy can create gaps in transparency disclosures or eliminate commitments previously made to users. However, without knowing what was removed, the operational significance cannot be determined. If the deleted sentences addressed data practices, retention, or sharing, their absence may reduce transparency compliance under privacy law. If they were redundant language, the impact may be negligible. Compliance teams should retrieve and assess the deleted content.

Why it matters: The removal of explicit disclosure language about a specific marketing contact practice (AI-generated voice auto-dialer calls) creates an absence where the policy previously acknowledged the possibility. For users accustomed to seeing this disclosure in Microsoft's terms, the removal signals a change in how the company describes its marketing practices. For compliance teams, the removal may trigger review of whether TCPA and FTC Act transparency obligations are still adequately addressed under the updated language, and whether vendor documentation needs to be refreshed.

Why it matters: This is the first time the U.S. government has used a supply chain risk statute designed for foreign adversaries against an American company. If you use Claude for work — especially in defense, government contracting, or enterprise settings — this designation may affect whether your organization can maintain its Anthropic relationship. The dispute also reveals that the two specific provisions Anthropic refused to remove — prohibitions on mass surveillance and autonomous weapons — are governance commitments the company is willing to lose hundreds of millions of dollars to enforce.