This review explains the Microsoft Privacy Statement in plain language, for Windows, Microsoft 365, Bing, and Xbox households, including parents and older adults. It was checked on September 23, 2026. Product sections are long, and not every product chapter was read line by line. Claims below are limited to sentences opened on that date. This is not legal advice.
Primary source: Microsoft Privacy Statement.
Snapshot
- Covers Microsoft products and services described in the statement, with extra chapters for Windows, Microsoft 365, Xbox, Bing, and others.
- Collects account data, content you create, location, voice clips, and, if you use Windows Hello, biometric data such as a fingerprint or face to sign in.
- Microsoft says it does not use what you say in email, human-to-human chat, video calls, or voice mail, or your personal files, photos, or documents, to target ads to you.
- Some Windows AI features stay on the device unless you choose to send content to a cloud service.
- Family Safety lets a parent connect a child’s account and, if activity reporting is on, see how the child uses the device.
What they collect
The statement lists interests you share or that Microsoft infers, voice data including spoken queries and background sounds, contacts if you use a product to manage them, and location that may be precise, from GPS, cell towers, or Wi-Fi, or imprecise, from an IP address or the city in your profile. Content includes files, emails, chats, photos, and documents you create or share with Microsoft products.
Biometric data is described for identity checks, with Windows Hello fingerprint or face sign-in as the example. The Windows Hello chapter was not read in full for this review.
Who gets the data
If you sign in to a third-party service with a Microsoft account, Microsoft shares account data with that third party according to the third party’s privacy policy. Service providers help determine device location and compile statistics, and some of those providers may set their own cookies.
Advertising uses data on Microsoft and third-party properties. The limit quoted above is specific: email content, human-to-human chat, calls, voice mail, and personal files are not used to target ads. Other data, such as an advertising ID, can still be used. You can opt out of personalized advertising from Microsoft, including Xandr, on the personalized ads page the statement links. Opting out does not stop ads. It makes them less personalized. Global Privacy Control is honored in certain jurisdictions and, the statement says, turns off sharing with third parties for personalized ads.
Easy to miss
- The ad limit covers the contents of mail and files. It does not say Microsoft ignores search queries, location, or an advertising ID.
- Signing in to another company’s site with a Microsoft account shares account data under that other company’s policy, not only Microsoft’s.
- Family activity reporting, when turned on, means Microsoft collects details about how the child uses the device and gives parents reports. Those reports are routinely deleted from Microsoft servers. “Routinely” is not a number of days in the sentence checked here.
- A GPC signal is described for certain jurisdictions, not as a worldwide switch.
New technology
Windows Click to Do can capture and analyze screenshots, identify text and images, and offer actions. The statement says Click to Do cannot identify the content within screenshots by itself, and that all activity remains on your local device unless you explicitly choose otherwise. Examples of leaving the device include sending an image for a Bing search, or requesting a summary of selected text, which is processed by Microsoft’s Azure AI cloud service. Microphone search inside a captured screenshot stays on the device: “The audio captured by the microphone is not transmitted off your device.”
The statement also says you may upload an image to Microsoft Copilot. That upload is a choice to send an image to Microsoft. The full Copilot chapter was not read line by line for this review.
Kids and families
Microsoft offers Family Safety tools so parents can connect children’s accounts to a family group. Accounts created with parental consent are added to the parent’s family group. The parent can manage settings on the Family Safety page and view or delete a child’s data on the privacy dashboard. Xbox has additional family settings. For users under 13, or the age set by local law, certain products block the user or require parental consent. If the user is under the statutory age, registration asks for a parent or guardian email.
Older adults
The privacy dashboard is where browsing, search, and location data tied to the Microsoft account can be viewed and cleared. Support calls may use voice data for authentication. That is a reason to be careful: a real Microsoft support flow should not start with an unexpected pop-up that asks you to call a number and install remote-access software. Use the privacy dashboard while you are signed in, or the contact path printed on the privacy statement.
What you can turn off
- Open the Microsoft privacy dashboard, linked from the statement, and clear browsing, search, and location history you do not want kept.
- Opt out of personalized ads on the personalized ads page, and review third-party ad settings. On Windows, the statement also points to turning off the advertising ID.
- Leave Click to Do content on the device. Do not send a screenshot to Bing or ask for a cloud summary if you do not want that image processed by Azure AI.
- For a child, use Family Safety, and decide whether activity reporting should be on. It is a parent report, and it is also a collection of how the child uses the device.
What this means for you
Microsoft draws a real line around the contents of your mail and documents for ad targeting. The newer line to watch is Windows AI that stays local until you choose a cloud action, and Family Safety reporting, which is helpful for a parent and is still a record of a child’s device use.
Does Microsoft read my email to show ads?
The statement says Microsoft does not use what you say in emails, human-to-human chat, video calls, or voice mail, or your personal files, photos, or documents, to target ads to you. Other data can still be used for personalized ads unless you opt out.
Does Windows AI send my screen to the cloud?
For Click to Do, the statement says activity remains on the local device unless you choose to send it, such as a Bing image search or an Azure AI summary. Recall is a separate Copilot+ PC feature. Its chapter was not quoted in this review.
This is not legal advice. Checked September 23, 2026. Menus and product chapters change. Recheck the statement before you rely on a switch.