Microsoft
Microsoft Corporation
Analysed ·Policy updated
https://www.microsoft.com/en-us/privacy/privacystatement2 Concern2 Mixed0 Positive
C-44 / 100
In Plain English
Microsoft's privacy statement covers an enormous product surface — Windows, Office, Azure, Bing, Xbox, and Copilot — and the data practices vary dramatically across them. The umbrella policy is deliberately vague, deferring almost all specifics to product-level documentation. Cross-product data combination, AI model training on your content, and employer/school access to your files and communications are the key risks most consumers don't realise they're accepting.
Category Breakdown
Known data breaches
No known public data breaches
Microsoft does not appear in the Have I Been Pwned database of publicly disclosed data breaches.
How Microsoft could earn a higher grade
Recommended changes
- Summarise Windows diagnostic levels (Required vs Optional), what each collects, and how to minimise telemetry in the main privacy statement instead of only linking to the separate Data collection summary for Windows.
- Make Copilot and other generative-AI training uses opt-in by default in consumer accounts, or clearly separate enterprise, education, and personal accounts so work/school administrators cannot access personal Microsoft content without an explicit boundary.
- Publish a cross-product data map showing which categories flow between Windows, Bing, Outlook, Xbox, LinkedIn, and Copilot — and which combinations users can disable without losing core product functionality.
- Consolidate advertising and Xandr opt-out, third-party cookies on Microsoft properties, and personalised marketing into one dashboard path described in the primary policy, not scattered opt-out pages.
- Add top-level retention ranges for major data classes (search and browsing history, Copilot prompts, diagnostic telemetry, support tickets) in the main statement instead of deferring all timelines to product-specific notices.
- Disclose named security standards (e.g. ISO 27001, SOC 2 where applicable) and encryption practices at the umbrella-policy level for consumer services, not only in Azure or enterprise trust documentation.
Frequently asked questions
Alternatives to Microsoft
B+
Apple
78/100
Apple collects significantly less data than other big tech companies and explicitly commits — using both Nevada and Cali…