Microsoft Privacy Statement

Microsoft collects data from users, through your interactions with us and through your use of our products. We collect data in order to operate, improve, and provide you with the best possible experiences. Some data is provided directly by you, while we collect other data based on how you use our products and communicate with us. The types and amount of data we collect depend on how you interact with Microsoft, your choices, privacy settings, and the features you use, as well as applicable law.

The data we collect can include the following:

Name and contact details. Your first and last name, email address, mailing address, phone number, and other similar contact details.

Account credentials. Information used to access your account, such as username, password, and password hints.

Demographic data. Details about you like your age, gender, country, and language preference.

Payment data. Details needed to process payments, including credit card numbers and security codes.

Subscription and licensing data. Details about your product subscriptions, licenses, and other entitlements.

Interactions. Information about your use of Microsoft products, including features you use, searches, commands given, error reports, and support requests.

• Device and usage data. Data about your device and product features you use, hardware and software details, product performance, your interactions with our websites and apps, and your settings. For example:
  • Payment and account history.
  • Browsing history.
  • Device, connectivity, and configuration data. For example, IP addresses, device identifiers, nearby networks, and other information about the operating systems and other software installed on your device.
  • Error reports (“crash dumps”) and performance data. This usually includes software, hardware, and file content details related to an error, and other software on your device.
  • Troubleshooting and help data. Data you provide when you contact Microsoft for help. For example, contact or authentication data, the content of your communications with Microsoft, the condition of your device, the products at issue, and other details that help us provide support. Phone conversations or chat sessions with our representatives may be monitored and recorded.
  • Bot usage data. Interactions with bots and skills available through Microsoft products, including bots and skills provided by third parties.
• Interests and favorites. Preferences and interests you share (like favorite sports teams, preferred programming languages, or cities for weather or traffic) or that we infer from your activity, such as your activity on sites that use our technology for ads purposes.
• Content consumption. Information about the media content you access through our products like TV, video, music/audio, apps, and games.
• Searches and commands. Search queries and commands you provide in Microsoft products, such as interactions with a chat bot.
• Voice data. Also referred to as “voice clips,” this includes spoken queries commands, or dictation, and may include background sounds. Learn more about how Microsoft uses and protects voice data in its speech recognition technologies.
• Text, inking, and typing data. Data and related information you provide by typing, inking, or using touch input in Microsoft products.
• Images. Images and related data, like picture metadata. For example, we collect the image you provide when you use a Bing image-enabled service or upload an image to Microsoft Copilot.
• Contacts and relationships. Data about your contacts and relationships if you use a product to manage contacts, share information or communicate with others, or improve your productivity.
• Traffic data. Data about your use of Microsoft’s communication services, including whom you’ve contacted and when.
• Social data. Information about your interactions and relationships with others, such as likes, events, and other types of engagement.
• Location data. Data about your device’s location, which may be either precise (typically based on GPS, cell tower, or Wi-Fi hotspot location) or imprecise (for example, inferred from an IP address, or city or postal code in your account profile).
• Biometric data. Unique data about you from specific technical processing related to your physical, physiological, or behavioral characteristics to verify or confirm your identity. For instance, you can use your fingerprint or facial recognition to sign in to your Windows device via Windows Hello (please see the Windows Hello section below for more information). Our collection and use of biometric data depends on the products and features you use and your consent.
• Other input. Data generated from using devices or participating in events, like buttons you press on an XBOX controller or other activity data, or information you provide when registering or attending an in-person event.

Content. Information in files and messages, emails, chats, calls, meetings, photos, documents, and other media you create or share using Microsoft products.

Video and audio recordings at Microsoft locations. Recordings of events and activities at Microsoft buildings, retail spaces, and other locations, which may include your image and voice data.

Feedback and ratings. Information you provide in feedback, surveys, or product reviews.

Product-specific sections below describe data collection practices applicable to use of those products.

We also receive data from Microsoft affiliates, subsidiaries, and third parties. We protect data obtained from third parties according to the practices described in this statement, plus any additional restrictions imposed by the source of the data. These third-party sources vary over time and include:

• Data brokers from which we purchase demographic data and contact information to supplement the data we collect.
• Services that make user-generated content from their service available to others, such as reviews of local businesses or public social media posts.
• Communication services, including email providers and social networks, when you give us permission to access your data on such third-party services or networks.
• Service providers that help us determine your device’s location.
• Partners with whom we engage in joint marketing activities.
• Developers who create experiences through or for Microsoft products.
• Third parties that deliver experiences through Microsoft products.
• Publicly available sources, such as open public sector, academic, and commercial data sets.

You have choices when it comes to the data you share. When you are asked to provide personal data, you can decline. You can also use web browser, in-product, or operating system controls to limit or prevent certain types of automatic data collection. Many of our products require some personal data to operate and provide you with a service. If you choose not to provide or allow us to collect required data, you cannot use the related product or feature. Likewise, where we need to collect personal data by law or to enter into or carry out a contract with you and you do not provide the data, we will not be able to enter into or carry out the contract. Where providing the data is optional, and you choose not to share personal data, features like personalization that use the data will not work for you.

Microsoft uses the data we collect to provide you with rich, interactive experiences. We also use the data to operate our business, which includes analyzing our performance, meeting our legal obligations, developing our workforce, and doing research. Microsoft is committed to protecting the security of your personal data and uses a variety of security technologies and procedures to help protect your personal data from unauthorized access, use, or disclosure. For example, we store personal data you provide on computer systems that have limited access and are in controlled facilities. When we transmit highly confidential data (such as credit card number or password) over the internet, we protect it through the use of encryption.

Specifically, we use data to:

• Provide our products. We use data to operate and deliver our products, such as processing files you upload to OneDrive so you can access, edit, and manage them. This also includes:
  • Communications. We may use your data to contact you for various reasons, such as to inform you about your subscriptions, tell you when product updates are available, or contact you about your account.
  • Personalization. Many products include personalized features and use automated processes to tailor your experience based on your data and inferences based on your activities, interests, and location. You can sync settings across devices via your Microsoft account, and many products allow you to turn off personalized features.
  • Product activation. We use data like device and application type, location, and unique identifiers to activate products.
  • Transactions. We use data like your payment and contact information to carry out your transactions with us and deliver your purchases.
  • Customer support. We use the data to help us troubleshoot and resolve issues, repair devices, investigate security incidents, and to provide, improve, and secure the quality of our products, services, and training. We may use voice data from support calls for authentication and security purposes.
  • Security and Safety. We use data to protect the security and safety of our products and customers, such as by detecting malware and malicious activities. We reserve the right to block communications or remove content that violates our terms of use. We use scanning technologies (like hash matching) to help prevent harm to our systems, our users, and others as described in our Code of Conduct, and to help prevent child exploitation. We may share information with the National Center for Missing and Exploited Children (NCMEC) and law enforcement authorities. We also use tools to detect and disrupt the misuse of video-calling capabilities to produce and share child sexual exploitation and abuse imagery by high-risk users. Learn more about our efforts to prevent and detect child exploitation here.
  • Providing Age Appropriate Experiences. We use information associated with your Microsoft account to provide more age-appropriate experiences across our services. This may include information you provide, such as your date of birth or settings you choose in your account, information from your use of Microsoft services, such as how you interact with features, content, and products, or information from partners or verification services, such as age range signals received from app stores. We use this information to help us apply age-appropriate protections, settings, and experiences. When we apply age-based protections, we generally apply them across Microsoft services connected to your account so that your experience is consistent. We may share age group information with Microsoft apps and services, as well as third-party apps, so that they can apply appropriate safeguards, tailor experiences, and comply with applicable laws and regulations.
  • Troubleshooting and Updates. We use data to troubleshoot and resolve performance issues, develop updates and security patches, and notify users of product updates. This may include using automated systems to detect security and safety issues.
• Product Improvement and Development
  • Product improvement. We use data to improve our products, including adding new features and capabilities. For example, we use error reports to improve security features, queries and clicks in Bing to improve search results, and voice data to develop and improve speech recognition accuracy.
  • Product development. We use data to develop new products. For example, we use data, often de-identified, to better understand our customers’ computing and productivity needs, and to train and fine-tune AI models, which can shape the development of new products. As part of our efforts to improve and develop our products, we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs). Learn more here.
• Marketing, Advertising, and Promotions
  • Promotional communications. We use data to send you promotional messages. See the How to access and control your personal data section for information on managing your contact data, email subscriptions, and promotional messages.
  • Relevant offers. Microsoft uses data to provide you with product information and offers likely to interest you, such as new games based on your activity.
  • Advertising. We use data for advertising on Microsoft and third-party properties, sometimes using automated processes to make ads more relevant. Microsoft does not use what you say in emails, human-to-human chat, video calls or voice mail, or your personal files, photos, or documents to target ads to you. See the Advertising section for more details.
  • Prize promotions and events. We use your data to administer prize contests and events and to select winners. For example, if you enter into a prize promotion, we may use your data to select a winner and provide the prize to you if you win.
• Business Operations
  • Reporting and business operations. We use data to analyze and improve our business, make informed decisions, and report on our business’ performance.
  • Protecting rights and property. We use data to detect and prevent fraud, resolve disputes, enforce agreements, and protect our property. For example, we use data to confirm software licenses to reduce piracy and combat fraud. We may use automated processes to detect and prevent activities that violate our rights and the rights of others, such as fraud.
  • Legal compliance. We process data to comply with applicable laws. For example, we use the age of our customers to assist us in meeting our obligations to protect children’s privacy.
• Research. With appropriate safeguards for individuals’ rights and freedoms, we use data for research, including AI and machine learning, for public interest and scientific purposes.

We combine data collected from different contexts or obtained from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes. For example, Microsoft Store uses information about the apps and services you use to make personalized app recommendations. We use technological and procedural safeguards to prevent certain data combinations; for example, we store data collected from unauthenticated users separately from account information that directly identifies you, such as your name, email address, or phone number.

Our processing of personal data involves both automated and manual (human) methods, which often work together. For example, to build, train, and improve the accuracy of our automated systems – such as AI - we manually review some of the results against the underlying data.

Legal bases for processing

We process your personal data with your consent and/or when it’s necessary to provide the products you use, operate our business, meet our contractual and legal obligations, protect the security and safety of our systems and our customers, or pursue our legitimate interests or those of third parties. Our reasons for using your data are described here and in the Reasons we disclose personal data section. Our legal basis for processing may vary depending on how and across what products or services we process your data. When we rely on legitimate interests, we consider and balance those interests against your rights and freedoms and will only process your data if these interests are not outweighed by your own.

Our retention of personal data

Microsoft retains personal data for as long as necessary to provide the products and services you use and to fulfill the transactions you request. We also retain personal data for other legitimate purposes such as operating our business, meeting our contractual and legal obligations, improving and developing our products and services, protecting the safety and security of our systems and customers, and resolving disputes. Because these needs can vary for different data types and the context of our interactions with you or your use of our products, actual retention periods can vary significantly. See relevant product documentation for more information.

Criteria used to determine retention periods include:

• The purposes for which we use the information. For example, when you store a document in OneDrive, we maintain the data until you actively delete it.
• The nature and sensitivity of the information. For example, we maintain a shortened retention period for precise geolocation information.
• Legal, contractual, and other similar obligations we are subject to, including data retention laws, government orders to preserve data relevant to an investigation, or data retained for the purposes of litigation. Conversely, we’ll remove unlawful content where required by law.

We disclose your personal data with your consent, as necessary to complete any transaction or provide any product you have requested or authorized, or as needed to carry out any other purpose described in How we use personal data section. For example, we provide your content to third parties when you tell us to do so, such as when you send an email to a friend or link accounts with another service.

If you use a work or school account or use a Microsoft product provided by an organization you are affiliated with, such as an employer or school, we disclose certain data such as interaction data and diagnostic data to enable your organization to manage the products.

We will disclose payment data to banks and other payment transaction processors and financial services providers to fulfill your purchases with us, and for fraud prevention and credit risk reduction. If you save a payment method (such as a card) to an account used by you and other Microsoft account holders, your purchase receipts may be available to anyone else who uses and has access to the same payment method to make a purchase from Microsoft.

When you permit push notifications for Microsoft products or applications on a non-Windows device, we may send data to an external notification provider to deliver push notifications. Your device’s push notification services are governed by their own service-specific terms and privacy statements.

We also disclose personal data for digital advertising purposes. Please see the Advertising section for more information about how personal data is used for advertising.

In addition, we enable access to personal data among Microsoft-controlled affiliates and subsidiaries, including for the purposes described in this privacy statement. We also provide personal data to vendors or agents working on our behalf for the purposes described in this statement, such as companies we hire to provide customer service support. These companies must comply with our data privacy and security standards and may not use your data for other purposes. We may also disclose personal data as part of corporate transactions such as mergers or asset sales.

Finally, we retain, access, transfer, disclose, and preserve personal data, including your content (like the content of your emails in Outlook.com or files in OneDrive), when we have a good faith belief that it is necessary to do any of the following:

• Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies.
• Protect the safety of our customers, organizations, and the public — for example, to prevent spam; stop attempts to defraud or otherwise cause harm, or to detect, prevent, and combat harmful or illegal behavior including the creation and sharing of harmful or illegal content.
• Operate and maintain the security of our products, including to prevent or stop an attack on our computer systems or networks.
• Protect the rights or property of Microsoft, including enforcing the terms governing the use of our services. If we receive information indicating our services are used to traffic in stolen property, we may refer the matter to law enforcement.

For more information about data we disclose in response to requests from law enforcement and other government agencies, please see our Law Enforcement Requests Report.

Please note that some of our products include links to or otherwise enable you to access products of third parties whose privacy practices differ from those of Microsoft. For example, third party applications or extensions that run on Windows or Edge browser may collect personal data based on their own practices. If you provide personal data to any of those products, your data is governed by their privacy policies.

You can make choices about the collection and use of your data by Microsoft. You can control your personal data that Microsoft has obtained, and exercise your data protection rights, by contacting Microsoft or using various tools we provide (described below).

Microsoft provides you with the following data protection rights regardless of your location:

• If Microsoft obtained your consent to use your personal data, you can withdraw that consent at any time.
• You have the right to be informed about the collection and use of your personal data.
• You can request access to, erasure of, and updates to your personal data.
• If you’d like to port your data elsewhere, you can use tools Microsoft provides to do so, or if none are available, you can contact Microsoft for assistance.
• You can also object to or restrict the use of your personal data by Microsoft. For example, you can object at any time to our use of your personal data for direct marketing purposes or where we are performing a task in the public interest or pursuing our legitimate interests or those of a third party.

In some cases, your ability to access or control your personal data will be limited, as required or permitted by applicable law. If your organization, such as your employer, school, or service provider, provides you with access to and is administering your use of Microsoft products, contact your organization to learn more about how to access and control your personal data.

The tools most useful to access and control your personal data that Microsoft has obtained depends on our interactions with you and your use of our products. The following is a general list of tools we provide to help you control your personal data; specific products may provide additional controls. Please refer to the product specific sections below for more information about how you can access your data through other in-product features.

• Bing. If you are signed into Bing with your Microsoft account, you can view and clear your stored search and chat history on your privacy dashboard. If you are not signed in, you can view and clear stored search history associated with your device in your Bing settings.
• Microsoft Copilot. If you are signed into Microsoft Copilot with your Microsoft account, you can view, access, export and delete Copilot activity history from your privacy dashboard. You can also use in-product controls to manage your data within the Microsoft Copilot website or app.
• Microsoft account. You can visit the Microsoft account website if you want to access, edit, or remove your account’s profile and payment information, change your password, add security information or close your account.
• Microsoft privacy dashboard. You can control some of the data Microsoft processes via your Microsoft account on the Microsoft privacy dashboard. For example, you can view and clear the browsing, search, and location data associated with your Microsoft account.
• Microsoft Store. You can access your Microsoft Store profile and account information by visiting Microsoft Store and selecting View account or Order history.
• Microsoft Teams for personal use. You can find out how to export or delete Teams data relating to your personal Microsoft account by visiting this page.
• OneDrive. You can view, download, and delete your files and photos in OneDrive by signing into your OneDrive.
• Outlook.com. You can download your emails in Outlook.com by signing into your account and navigating to your Privacy and data settings.
• Skype. If you wish to access, edit, or remove some profile information for Skype or change your password, sign in to your account. If you wish to export your Skype chat history and files shared on Skype, you can request a copy.
• XBOX. If you use the XBOX network or XBOX.com, you can view or edit your personal data, including billing and account information, privacy settings, and online safety and data sharing preferences by accessing My XBOX on the XBOX console or on XBOX.com.

Not all personal data processed by Microsoft can be accessed or controlled via the tools above. If you want to access or control personal data processed by Microsoft that is not available via the tools above or directly through the Microsoft products you use, you can contact Microsoft at the address in the How to contact us section or by visiting our privacy support and requests page.

Your communications preferences

You can choose whether to receive promotional communications from Microsoft by email, SMS, mail, or phone. To opt out of promotional emails or SMS, follow the directions in the message. For more options – including managing contact info, Microsoft-wide contact preferences, email subscriptions, and sharing info with partners – sign in to your personal Microsoft account, and visit your communication permissions page. If you don't have a Microsoft account, you can manage your Microsoft email contact preferences by using this web form. These choices do not apply to mandatory service communications or other informational messages with their own unsubscribe method.

Your advertising choices

To opt out of receiving personalized advertising from Microsoft (including Xandr) visit our Personalized ads and offers page. You can also see our third party ad partners and opt out of data sharing for personalized ads at our Third-party ad settings page. When you’re logged into your Microsoft account, your opt out choice will be associated with your account and applied across devices whenever you are signed in. If you are not signed in and choose to opt out, your preference is stored in a browser-specific cookie on your device, valid for five years; if you delete cookies, you must opt out again.

For Microsoft-controlled ads in Windows apps, use the opt-out linked to your personal Microsoft account, or turn off the advertising ID in Windows settings to opt out of personalized advertising.

Data used for personalized advertising is also used for other required purposes, such as product delivery, analytics, and fraud detection. You will still see ads even if you opt out of personalized ads, but they may be less relevant to you.

You can opt out of personalized advertising from third-party partners by visiting their sites. Please see our Advertising section below for more information.

Browser-based controls

When you use a browser, you can control your personal data using certain features. For example:

• Cookie controls. You can control the data stored by cookies and withdraw consent to cookies by using the browser-based cookie controls described in the Cookies section.
• Tracking protections. You can control the data third-party sites can collect about you using Tracking Protection in Microsoft Edge. This feature will block third-party content, including cookies, from any site that is listed in a Tracking Protection List you add.
• Universal Opt-Outs. Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions. Microsoft will turn off sharing your data with third parties for personalized ads and turn off the “Share my data with third parties for personalized ads” toggle if we receive a GPC signal from you when you visit our sites.

We use cookies and similar technologies to store and honor your preferences and settings, enable you to sign-in, provide personalized advertising, combat fraud, analyze how our products perform, and fulfill other legitimate purposes described below. Some cookies are placed by third parties acting on our behalf. Microsoft apps use additional identifiers, such as the Advertising ID in Windows, for similar purposes, and many of our websites and applications also contain web beacons or other similar technologies, as described below.

How we use cookies and similar technologies

• Preferences and settings. We use cookies to store and save your choices – like language settings or your ad preferences – so you don’t need to set them again.
• Sign-in and authentication. We use cookies to verify your identity and keep you signed in securely. When you sign in with a Microsoft account, we store a unique ID number and the time you signed in in an encrypted cookie on your device, so you don’t have to repeatedly sign in.
• Security. We use cookies to protect our products and detect fraud and abuse.
• Storing information. We use cookies to remember information you provide, such as items in your shopping cart.
• Social media. Some of our websites include social media cookies, which may let you share content with social media services if you’re signed in with them.
• Feedback. We use cookies so you can give feedback on our websites.
• Personalized advertising. We use cookies to personalize ads based on your activity. You can opt out as described in the How to access and control your personal data section of this privacy statement. We also use web beacons and similar technologies to understand which Microsoft ads displayed on third-party websites and digital platforms drive visitors to our sites and apps. These tools also help us deliver ads on external sites and platforms. See below for more information about web beacons and analytics services.
• Ad delivery and reporting. We use cookies to record ad views and clicks, such as which ads you have seen. This helps us, for example, avoid showing the same ad repeatedly.
• Analytics. We use cookies to gather usage and performance data, such as visitor counts and other statistics about our websites and products.
• Performance. We use cookies to help us understand and improve how our products and websites work, like gathering data to help with load balancing and uptime.

Where required, we obtain your consent prior to placing or using optional cookies. Please see the How to control cookies section below for more information.

Some of the cookies we commonly use and some of the purposes they may be used for are listed below. This list is not exhaustive, but it is intended to illustrate the primary purposes for which we typically set cookies. If you visit one of our websites, the site will set some or all of the following cookies:

• MSCC. Contains user choices for most Microsoft properties.
• MUID, MC1, MSFPC, and ai_user. Identifies unique web browsers visiting Microsoft sites. These cookies are used for necessary operational purposes. With consent, these cookies may also be used for advertising.
• ESTSAUTH, ESTSAUTHLIGHT, ESTSAUTHPERSISTENT. Helps to authenticate you when you sign in with your Microsoft account.
• MS0. Identifies a specific session.
• NAP. Contains an encrypted version of your country, postal code, age, gender, language and occupation, if known, based on your Microsoft account profile.
• MR. Resets or refreshes the MUID cookie.
• x-ms-gateway-slice, ARRAffinity, ARRAffinitySameSite, ASLBSA, and ASLBSACORS. Identifies a gateway for load balancing.
• TOptOut. Records your decision not to receive personalized advertising delivered by Microsoft. Where required, we place this cookie by default and remove it when you consent to personalized advertising.
• ApplicationGatewayAffinity and ApplicationGatewayAffinityCORS.  Used for load balancing purposes and to ensure requests for a user session are handled by the same server.
• esctx, _RequestVerificationToken, .AspNetCore.Correlation, and .AspNetCore.Nonce. Assist with the security of your website visit and stability of the services provided to you by helping prevent fraud and malicious attacks.

We may also use the cookies of other Microsoft affiliates, companies, and partners, such as LinkedIn and Xandr.

Third-Party Cookies

In addition to the cookies Microsoft sets when you visit our websites, we also use cookies from third parties to enhance the services on our sites. Some third parties can also set cookies when you visit Microsoft sites. For example, when we hire companies to perform services on our behalf, like site analytics, and when companies deliver content on our sites, like videos, news, or ads.

These companies use the data they process in accordance with their privacy policies, which may enable them to collect and combine information about your activities across websites, apps, or online services.

The following types of third-party cookies may be used, depending on the context, service or product, as well as your settings and permissions:

• Social media cookies. These cookies help us and third parties show you ads and content tailored to your interests, based on your social media profiles and activity on our websites.
• Analytics cookies. Analytics cookies from third parties collect information on how you use our websites to help us improve them and allow third parties to develop and improve their own products. They may also be used for advertising purposes.
• Advertising cookies. Advertising cookies record which ads you’ve seen, which ads you’ve clicked, or the purchases you’ve made after clicking. They show you ads relevant to you, like ads based on your social media interests and website browsing history.
• Required cookies. Required cookies enable core website functions, such as login, preferences, shopping carts, performance, and security.

For a list of the third parties that set cookies on our websites, please visit our third party cookie inventory. On some of our websites, a list of third parties is available directly on the site and may not be included in our third party cookie inventory. Please consult the third party websites or privacy notices for more information on their privacy practices with respect to their cookies that may be set on our websites.

How to control cookies

Most web browsers automatically accept cookies but provide controls that allow you to block or delete them. For example, in Microsoft Edge, you can block or delete cookies by selecting Settings > Privacy and services > Clear Browsing data > Cookies and other site data. For more information about how to view, block, or delete your cookies in Microsoft Edge, please see our Manage cookies in Microsoft Edge page. If you use a different browser, refer to that browser’s instructions. If you choose to block cookies, you cannot sign in or use some of those features, and preferences that are dependent on cookies will be lost. If you delete your cookies, any settings and preferences controlled by those cookies, including advertising preferences, are deleted and will need to be recreated.

Where required, we obtain your consent before placing or using optional cookies that are not (i) strictly necessary to provide the website; or (ii) for the purpose of facilitating a communication. We separate these optional cookies by purpose, including advertising, analytics, and social media purposes. Where consent is required, you can adjust your choices by clicking “Manage cookies” in the footer of the website or through the settings made available on the website. Certain features of Microsoft products depend on cookies.

Additional privacy controls that can impact cookies, including the tracking protections feature of Microsoft browsers, are described in the How to access and control your personal data section of this privacy statement.

Web beacons and analytics services

Some Microsoft webpages use electronic tags called web beacons to deliver cookies, count visitors, and deliver products. We also use web beacons or similar technologies in our communications to determine whether you open and act on them.

We sometimes place our web beacons on other companies’ websites or ads to help us understand how interactions with Microsoft advertisements lead to actions, such as purchases, or to learn about your activity on partner sites in connection with Microsoft products or services.

Microsoft products often include web beacons or similar technologies from third-party analytics providers. These providers help us compile statistics about our campaigns and operations. They may set or read their own cookies or identifiers on your device to collect information about your online activities across websites and apps. However, we prohibit these providers from using web beacons on our sites to collect or access information that directly identifies you, such as your name or email address. You can opt out of data collection or use by some of these analytics providers by visiting any of the following sites: Adjust, AppsFlyer, Clicktale, Flurry Analytics, Google Analytics (requires you to install a browser add-on), Kissmetrics, Mixpanel, Nielsen, Acuity Ads, WebTrends, or Optimizely.

Other similar technologies

Our products can also use other similar technologies to store and read data files on your computer. This is typically done to maintain your preferences or to improve speed and performance by storing certain files locally. These technologies can also store a unique identifier for your computer, which can then track behavior.

A Microsoft account is a personal account that lets you sign into Microsoft products and those of select partners. This account includes personal data such as your credentials, name and contact data, payment data, device and usage data, contacts, information about your activities, and interests and favorites. Signing into your Microsoft account helps personalize your experience, provides consistent experiences across products and devices, enables cloud storage, lets you make payments with stored payment methods, and enables other features.

A work or school account, also known as a Microsoft Entra ID account, is an account that is provided and managed by your organization, such as your employer or school. You can use it to sign in to Microsoft products and third-party products that your organization provides. If you sign into Microsoft products with a work or school account, please note:

• Your organization controls your account and can access and process your data, including your communications, files, and content in products you use with your account.
• Your use of these products is subject to your organization’s policies. Review your organization’s privacy and security policies before using your work or school account for personal use.
• If you lose access to your work or school account (for example, if you change employers), you may also lose access to products or content purchased or accessed with that account.
• If you use a work or school email address to create a Microsoft account, your organization may access your data associated with your Microsoft account.
• Microsoft is not responsible for your organization’s privacy or security practices, which may differ from our own standards.
• Direct any privacy questions or requests (such as to access, correct, or delete your data) to your administrator. See the Products provided by your organization – Notice to end users section for more information about your rights.

Contact your organization if you’re unsure if your account is a work or school account.

A third-party account is a Microsoft account that you or your service provider (such as a cable or internet service provider) create that is tied to your email address with your service provider’s domain. Your service provider has control over your account, including the ability to access or delete your account. You should carefully review the terms the third party provided to you to help you understand what the service provider can do with your account and data.

Your Microsoft account. The data associated with your Microsoft account, and how that data is used, depends on how you use the account.

• Creating your Microsoft account. When you create a Microsoft account, you'll be asked to provide certain personal data and we'll assign you a unique ID. For some products, like those involving payments, a real name is required, but many products can be used without it. Data such as your display name, email address, and phone number can help others find you on Microsoft products (for example, on Microsoft Teams for personal use). In some cases, you may need to switch to a personal email address to continue accessing consumer-oriented products like the XBOX network.
• Signing in to your Microsoft account. When you sign in to your Microsoft account, we log details like the date and time, product accessed, sign-in name, account and device identifiers, IP address, and operating system and browser information.
• Signing in to Microsoft products. Signing in to Microsoft products enables improved personalization, provides consistent experiences across products, permits cloud storage access, and lets you make payments using information stored in your account, along with other settings and features. Information saved to your account may be available across Microsoft products. If you add your account to a Windows device (version 8 or higher), Windows will automatically sign you in to Microsoft products on that device. When signed in, some products will show your name or username and profile photo (if you have one) in Microsoft products, communications, and public posts. Learn more about your Microsoft account, your data, and your choices.
• Signing in to third-party products. If you sign in to a third-party product or make payments to third-party merchants using your Microsoft account, Microsoft shares data with the third party as needed, including your account version number and whether your account has been deactivated. Third parties may use or share your data per their own privacy policies. You should carefully review the privacy policies for each product or merchant you use to understand how your data will be handled.

For users under the age of 13 or as specified by law in their jurisdiction, certain Microsoft products and services will either block users under that age or require parental or guardian consent or authorization before use, including when creating an account. See the How we use personal data section for more information about how we provide age appropriate experiences.

When we receive parental consent or authorization, the child's account is treated much like any other account, and the child will be able to use Microsoft services such as Outlook, Bing, and XBOX, and communicate or share data with other users. We will not knowingly ask children under the age of consent to provide more data than is necessary to provide the product.

As mentioned in the Advertising section, we do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18 years of age. For more details, see the Microsoft account section of this privacy statement and Learn more about parental consent and Microsoft child accounts.

Parents or guardians (“parents”) can change or revoke consent at any time. As the organizer of a Microsoft family group, parents can manage their child’s information and settings on the Family Safety page and view or delete a child’s data on the privacy dashboard. Accounts created with parental consent are automatically added to consenting adult’s family group. For child accounts that don’t need parental consent to be created, parents can add the child account to their family group after account creation. See the Microsoft Family Safety section for more information.

Accessing and deleting child data. For Microsoft products and services that require parental consent, parents can view and delete certain data about their child, such as browsing history, search history, location activity, and app usage by signing into the parent’s privacy dashboard.

Some Microsoft products, including XBOX, also have their own in-product controls. Please note that a parent’s ability to access and/or delete their child’s personal information may vary depending on the laws where they’re located. For more details on controlling data within Microsoft products, visit our Privacy Frequently Asked Questions (FAQs).

If your child’s account is not part of your Microsoft Family group and you do not have access to their activity on your privacy dashboard, submit a request related to your child’s data through the privacy support form. The privacy team will ask for account verification before fulfilling the request. We process authenticated deletion requests within 30 days of receipt.

To delete all your child’s personal information, request deletion of the child’s account using the close your account form. Sign in to your child’s account, ensure the correct account is shown, and follow the instructions. See Learn more about how to close a Microsoft account.

After requesting account closure, the account is marked for deletion, but we will wait 60 days before permanently deleting the account in case you change your mind or need to access information. After 60 days, the account will be permanently deleted.

For more information on XBOX features, in-product controls, and the associated personal data collection, use, and disclosure, please see the XBOX section of this privacy statement.

Personal data collected by Microsoft may be stored and processed in your region, in the United States, and in any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities. Microsoft maintains major data centers in Australia, Austria, Brazil, Canada, Finland, France, Germany, Hong Kong, India, Ireland, Japan, Korea, Luxembourg, Malaysia, the Netherlands, Singapore, South Africa, the United Kingdom, and the United States. Typically, the primary storage location is in your region or in the United States, often with a backup to a data center in another region. Storage location(s) are chosen in order to operate and provide our services efficiently, improve performance, and create redundancies in order to protect the data in the event of an outage or other problem.

We transfer personal data from the country of origin to other countries, including those that may not offer the same level of data protection as determined by the European Commission or your local data protection authority. In such cases, we implement legal safeguards-such as standard contractual clauses approved by the European Commission – to help protect your rights and ensure your data remains protected. The EU has also determined that certain non-EU countries have an “adequate” level of personal data protection, similar to EU law. For more information on the EU’s adequacy decisions and other methods of protecting personal data in countries where Microsoft processes data, please visit the European Commission website.

Please refer to the Reasons we share personal data section for more information on Microsoft’s sharing of data, which include when we transfer data to another country.

Microsoft Corporation complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.  Microsoft Corporation has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.  Microsoft Corporation has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

In the context of an onward transfer, Microsoft Corporation has responsibility for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on our behalf. Microsoft Corporation remains liable under the DPF if our agent processes such personal data in a manner inconsistent with the DPF, unless Microsoft Corporation can prove that we are not responsible for the event giving rise to the damage. If there is any conflict between the terms in this privacy statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern.  To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit the U.S. Department of Commerce’s Data Privacy Framework website. The controlled U.S. subsidiaries of Microsoft Corporation, as identified in our self-certification submission, also adhere to the DPF Principles—for more info, see the list of Microsoft U.S. Entities Covered by Data Privacy Framework Certification.

If you have a question or complaint related to participation by Microsoft in the DPF Frameworks, we encourage you to contact us via our privacy support and requests page. For any complaints related to the DPF Frameworks that Microsoft cannot resolve directly, we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities, for resolving disputes with EU individuals, the UK Information Commissioner for resolving disputes with UK individuals, and the Swiss Federal Data Protection and Information Commissioner (FDPIC) for resolving disputes with Swiss individuals. Please contact us if you’d like us to direct you to your data protection authority contacts. As further explained in the DPF Principles, binding arbitration is available to address residual complaints not resolved by other means. Microsoft is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

Individuals whose personal data is protected by Japan’s Act on the Protection of Personal Information should refer to the article on the Japanese Personal Information Protection Commission‘s website (only published in Japanese) for more information on the commission’s review of certain countries’ personal data protection systems.  For individuals in Japan, please click here for additional information on the processing of information under the Telecommunications Business Act (in Japanese only).

Advertising helps us provide, support, and improve some of our products. Microsoft does not use what you say in email, human-to-human chat, video calls or voice mail, or your documents, photos, or other personal files stored on your device or cloud storage to target ads to you. We use other data for advertising on Microsoft and third-party properties.

Ads may be shown that relate to the current interaction you are having with us, such as your Copilot conversations (including files you share); your current location; transactions; product usage; search queries; or the content you’re viewing. For example, if you search “pizza places in Seattle” on Bing, you may see ads for local restaurants in Seattle in your search results.

Where permitted, ads can also be personalized using information about you collected over time, like demographic data, location, search queries, interests, purchase history, favorites, usage of our products and sites, and information from advertisers and partners. We call these kinds of ads "personalized advertising." For example, viewing gaming content on XBOX.com may result in you later seeing game ads on MSN.

Personalized ads use cookies combined with information we collect when your browser interacts with our sites (like your IP address.) Data from cookies will not be used for personalized ads if you opt-out of receiving such ads. To learn more about Microsoft’s use of data to deliver personalized advertising and to opt out of receiving personalized advertising from Microsoft, please visit our personalized ads & offers settings page, and see our Opting Out section below.

Certain products have their own personalized ads settings. For example, if you’re signed in with your Microsoft account, subject to your privacy settings, we use your online activity in Microsoft Edge to show you personalized ads. You can adjust your Edge privacy settings under Microsoft Edge > Settings > Privacy and Services. In Windows, if the advertising ID is enabled in your Windows privacy settings, third parties can access and use it to deliver ads in apps.

Further details regarding our advertising-related uses of data:

• Advertising industry best practices and commitments. Microsoft participates in industry self-regulatory programs and adheres to the NAI Self-Regulatory Framework. We also adhere to the following self-regulatory programs:
  • In the US: Digital Advertising Alliance (DAA)
  • In Europe: European Interactive Digital Advertising Alliance (EDAA)
  • In Canada: Ad Choices: Digital Advertising Alliance of Canada (DAAC)  / Choix de Pub: l'Alliance de la publicité numérique du Canada (DAAC)
• Children and advertising. We do not deliver personalized advertising to children whose birthdate in their Microsoft account identifies them as under 18 years of age.
• Sensitive Data: Microsoft Advertising does not collect, process, or disclose personal data that qualifies as “sensitive data” under applicable U.S. state data privacy laws for the purposes of providing personalized advertising.

Opting Out. To opt out of receiving personalized advertising from Microsoft, visit our personalized ads and offers page. To opt out of sharing data with third parties for personalized ads, please visit our third-party ad settings page. When you’re logged into your Microsoft account, your opt out choice will be associated with your account and applied across devices whenever you are signed in. If you are not signed in and choose to opt out, your preference is stored in a browser-specific cookie on your device, valid for five years; if you delete cookies, you must opt out again.

Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions. Microsoft will turn off sharing your data with third parties for personalized ads and turn off the “Share my data with third parties for personalized ads” toggle if we receive a GPC signal from you when you visit our sites.

Data collected by or disclosed to other advertising companies. Advertisers sometimes include their own or other advertising partners’ web beacons within their ads that we display, enabling them to set and read their own cookies. In some cases, we share reports with advertisers about the data we have collected on their sites or ads. Additionally, Microsoft partners with Xandr (a Microsoft Company) and third-party ad companies to help provide some of our advertising services, and we also allow other third-party ad companies to display advertisements on our sites. These third parties may place cookies on your devices and collect data about your online activities across websites or online services. These companies currently include, but are not limited to: Facebook, Media.net, Outbrain, Taboola and Yahoo. See our Cookies and similar technologies section for more information.

We may provide collected data to internal and external partners, including Xandr, other subsidiaries and affiliates, Yahoo, Facebook, or Trade Desk to help make sure the ads you see in our products and theirs, or on other sites, are more relevant to you. Individuals in the United Kingdom can learn more about The Trade Desk’s advertising practices in the U.K. and opt out of The Trade Desk’s processing of their data here. Many of these companies participate in the DAA (U.S.), EDAA (Europe) or DAAC (Canada), which provide industry-wide choice tools to opt out of ad targeting from participating companies.

The Microsoft Copilot family of services, products, and solutions leverages generative AI technologies to generate outputs. Microsoft’s collection and use of data may differ depending on the service and the intended functionality in a given scenario. 

Our use of AI is subject to Microsoft’s AI Principles and Microsoft’s Responsible AI Standard, and our collection and use of personal data in developing and deploying our AI features is consistent with our commitments outlined throughout our privacy statement. You can find out more about the tools, practices, and policies Microsoft has created to uphold our responsible AI principles here.

The Microsoft Copilot website and app (on Windows, Mac, iOS, and Android) are the core of the consumer Copilot experience, where you can search the web, create content, and interact with features like Copilot Vision, as well as let Microsoft Copilot interact with other apps, services, and websites to take actions on your behalf. When you use Microsoft Copilot, it will use your prompts, location, language, and related settings to provide helpful responses and improve services.

For users in some markets, Microsoft Copilot can use your conversation history (including any memories you save) to personalize your experience. We may also offer you the ability to personalize your Microsoft Copilot experience using your interactions with our other products and services, like Bing, Edge, and MSN. You can manage your memories and control personalization features using the settings in Microsoft Copilot at any time.

Microsoft Copilot also uses prompts and related data to provide and improve services, including relevant advertising. You can manage your prompt history in product and on the Microsoft Privacy Dashboard, and can adjust your location, language, and other additional privacy settings in product. For more information about these capabilities and your choices, see Microsoft Copilot for individuals: your privacy controls and choices.

We also use your conversation data to monitor performance, troubleshoot and fix bugs and issues, prevent abuse, and to provide and improve Microsoft Copilot. Please review the Transparency Note for Microsoft Copilot for information on our safety practices and our efforts to ensure that Microsoft Copilot is consistent with our Responsible AI principles.

Microsoft Copilot also appears in other Microsoft products like Microsoft Edge and XBOX. In these cases, data is generally used according to each product’s primary uses. For more information, see the Microsoft Edge and XBOX sections of this privacy statement.

If you use Microsoft Copilot in third-party products and services, such as messaging platforms, Microsoft processes your data as described here, but the third party’s privacy policies and data processing activities may also apply.

For enterprise customers, Microsoft Copilot offers enhanced data protection and customization. Data is collected and used as described in the Enterprise and Developer Products section.

The Microsoft Copilot features that appear in Microsoft 365 apps as part of a Microsoft 365 Personal, Microsoft 365 Family, or Microsoft 365 Premium subscription provide AI-powered productivity capabilities through real-time conversational experiences. We do so by applying large language model (LLM) processing on the content you choose to provide in Microsoft 365 apps including Word, Excel, OneNote, Outlook, and PowerPoint. Microsoft Copilot in Microsoft 365 is not available for use in Office desktop licenses. When used with available Microsoft 365 apps, Microsoft Copilot will use the content in your files only when you ask it to perform a specific action on that specific content – for example, when you ask Microsoft Copilot to help you rewrite a paragraph in a Word document or ask Microsoft Copilot to generate a to-do list from your notes in OneNote. Similar to connected experiences, required service data is collected during your use of Microsoft Copilot which includes information related to its operation that is needed to keep the underlying service secure, up to date, and performing as expected. If you use Microsoft Copilot features in Microsoft 365 apps, Microsoft Copilot handles data as described in the Productivity and Communications section of this privacy statement.

See the Microsoft Copilot Privacy Center and Frequently asked questions about Copilot in Microsoft 365 subscriptions for more information.

Copilot Health is a consumer Copilot offering specifically developed to provide personalized assistance focused on health and wellness. Copilot Health allows you to upload health-related data including your personal health records and data from wearable devices. Copilot Health can use that data, along with your prompts and chat history, to provide you with personalized information and recommendations.

The information you choose to submit to Copilot Health is used to provide and operate the Copilot Health service. It is not used to develop or train generative AI models, and it is not used for advertising or marketing purposes. Please see the Copilot Health FAQs for more information.

Enterprise and Developer Products are Microsoft products and related software offered to and designed primarily for use by organizations and developers. For example:

• Enterprise Online Services (referred to as “Online Services” in the Product Terms) that our enterprise customers contract with us for, such as Microsoft 365, Microsoft Azure, Microsoft Dynamics 365, and Microsoft Intune.
• Other enterprise and developer cloud-based services, such as Azure PlayFab Services (to learn more see Azure PlayFab Terms of Service).
• Other enterprise and developer software, such as Windows Server, SQL Server, Visual Studio, System Center, Azure Stack and open-source software like Bot Framework solutions (“Developer Software”).
• Appliances and hardware used for storage infrastructure (“Enterprise Appliances”).
• Professional services referred to in the Product Terms that are available with Enterprise Online Services, such as onboarding services, data migration services, data science services, or services to supplement existing features in the Enterprise Online Services. To learn more, see Microsoft Professional Services.

In the event of a conflict between this Microsoft privacy statement and the terms of any agreement(s) between a customer and Microsoft for Enterprise and Developer Products, the terms of those agreement(s) will control.

You can also learn more about our Enterprise and Developer Products’ features and settings, including choices that impact your privacy or your end users’ privacy, in product documentation.

When a customer like your employer or school uses, purchases, or subscribes to Enterprise and Developer Products, or obtains support for our professional services with such products, Microsoft collects and generates data to provide the service, conduct our business operations, and communicate with the customer. For example:

• When a customer engages with a Microsoft sales representative, we collect the customer’s name and contact data, along with information about the customer’s organization, to support that engagement.
• When a customer interacts with a Microsoft support professional, we collect device and usage data or error reports to diagnose and resolve problems.
• When Microsoft sends communications to a customer, we use data to personalize the content of the communication.

The Enterprise and Developer Products enable our customers to purchase, subscribe to, or use other products and online services from Microsoft or third parties with different privacy practices. Those products and online services are governed by their respective privacy statements and policies.

Products provided by your organization—notice to end users

If you use a Microsoft product with a work or school account, that organization can:

• Control and administer your Microsoft product and product account, including controlling your access to, and the privacy-related settings of, the product or your account.
• Access and process your data, including the interaction data, diagnostic data, and the contents of your communications and files associated with your Microsoft product and accounts.

If your organization provides you with access to Microsoft products, your use of those products is subject to your organization’s policies. For privacy questions or to exercise your data protection rights, please contact your organization’s administrator. Microsoft is not responsible for the privacy or security practices of our customers, including your work or school, which may differ from this privacy statement.

When you use a Microsoft product provided by your organization, Microsoft processes your personal data as described in the contract with your organization and as needed to provide the product and Microsoft’s related business operations. For questions about Microsoft’s processing of your data for your organization, contact your organization. If you have questions about Microsoft’s business operations in connection with providing products to your organization as provided in the Product Terms, contact Microsoft as described in the How to contact us section.

For Microsoft products provided by your K-12 school, including Microsoft 365 Education, Microsoft will:

• not collect or use student personal data beyond that needed for authorized educational or school purposes;
• not sell or rent student personal data;
• not use or share student personal data for advertising or similar commercial purposes, such as providing personalized advertising to students;
• not build a personal profile of a student, other than for supporting authorized educational or school purposes or as authorized by the parent, guardian, or student of appropriate age; and
• require that our vendors who receive student personal data in order to provide our educational services to implement these same commitments for student personal data.

Back to top

Applicable Terms for Enterprise online services

To provide our Enterprise Online Services, Microsoft processes, uses, and stores data as described in the Product Terms, Microsoft Products and Services Data Protection Addendum (Products and Services DPA), and the Microsoft Trust Center.

Back to top

Enterprise and developer software and enterprise appliances

Enterprise and developer software and enterprise appliances collect data to operate effectively and provide the best experiences. The types of data collected depend on the features you use and your organization’s configuration and settings but is generally limited to device and usage data. Customers and, where applicable, end users may have choices about the data provided. Examples include:

• Device and usage data collected during installation or upgrade to address technical issues.
• Device and usage data from product usage to improve security and functionality.
• Optional error reports sent to Microsoft to help diagnose problems and deliver support.

Microsoft uses this data to provide and improve our products, deliver customer support, activate products, communicate with users, and operate our business in compliance with applicable data protection laws.

HoloLens. HoloLens headsets are self-contained Windows computers with Wi-Fi connectivity that enable a mixed reality experience for apps and solutions. Microsoft collects diagnostic data to solve problems and to keep Windows running on HoloLens up to date, secure, and operating properly. Diagnostic data also helps us improve HoloLens and related Microsoft products and services depending on the diagnostic data settings you’ve chosen for your device. See the Diagnostic Data section for more information.

HoloLens also processes and collects data related to the HoloLens experience and device, which include cameras, microphones, and infrared sensors that enable motions and voice to navigate.

• If you choose, cameras can be used to sign you in automatically using your iris. To do this, HoloLens takes an image of your iris and measures distances between key points to create and store a numeric value that represents only you. This data stays on the HoloLens and is not shared with anyone, and you can choose to delete this data from your HoloLens at any time.
• HoloLens also detects hand gestures intended for system interactions (such as menu navigation, pan/zoom, and scroll). This data is processed on your HoloLens device and is not stored.
• HoloLens derives tracking points based on your environment which allows it to understand surfaces in space and allows you to place digital assets on them. There are no images associated with this environmental data and it is stored locally on the HoloLens device. You can choose to delete this data from your HoloLens at any time.

The headset's microphones enable voice commands for navigation, controlling apps, or to enter search terms. Learn more about voice data collection.

Productivity and communications products are applications, software, and services like Microsoft 365, Microsoft Teams, OneDrive and others that you can use to create, store, and share documents, as well as communicate with others. These services will use your data depending on their features and how you use them – for example, we will collect usage data as well as information about your communications when you use Microsoft Teams, including the time and date and users that are part of the communication. Please see below for more details about these services, their features, and how they use data.