This is Microsoft's policy, which also covers Microsoft Family Safety, Microsoft OneDrive, Microsoft Translator, Xbox Cloud Gaming, and Xbox Game Pass.
Snapshot of the source text at fetch time, not a live mirror of the policy page.
Plain-English summary
Microsoft's policy indicates that organizations and service providers may have significant control over user accounts and data, particularly with work/school or third-party accounts (risk_flags-1, risk_flags-2, risk_flags-3, risk_flags-4). The company collects a wide array of personal data, which can be used for developing and training AI models (data_use-2, data_use-3). Data retention periods are variable, and personal content may be disclosed for legal or safety reasons (data_use-5, risk_flags-5). Additionally, purchase receipts may be visible to users of shared payment methods, and third-party privacy practices may differ (gotchas-2, gotchas-3, gotchas-4).
85% confidence
Ask Verbaterm
Follow up on findings with grounded answers from this review. Not legal advice.
Risk Flags
1 finding
These findings highlight clauses that could pose a notable risk to the user. They are usually material, hard-to-reverse, and may have significant impact on the user.
high95% confidence
Third-party control over Microsoft accounts tied to service provider email
If a Microsoft account is tied to a service provider's email address, that service provider has control over the account, including the ability to access or delete it.
Why it matters: If your Microsoft account is linked to an email address from a service provider (like a cable or internet company), that provider can control, access, or delete your account.
A third-party account is a Microsoft account that you or your service provider (such as a cable or internet service provider) create that is tied to your email address with your service provider’s domain. Your service provider has control over your account, including the ability to access or delete your account.
Microsoft account, paragraph 7 · Citation strength: strong
Data Use
4 findings
These findings concern how the user's data is collected, processed, and shared. These can include broad data collection, sharing with third parties, and using data for purposes beyond the primary service.
medium95% confidence
Collection of data from affiliates, subsidiaries, and third parties
Microsoft obtains data about users from its affiliates, subsidiaries, and third parties.
Why it matters: Microsoft collects data about you not just from your direct interactions, but also from its own related companies and external third parties, which could broaden the scope of information they hold about you.
We also obtain data about users from Microsoft affiliates, subsidiaries, and third parties.
Personal data we collect, paragraph 1 · Citation strength: strong
medium90% confidence
Use of data for AI model development and training
Microsoft may use your data to develop, train, and fine-tune its AI models, including large language models (LLMs), as part of its efforts to improve and develop products.
Why it matters: Your data may be used to develop and train Microsoft's AI models, including LLMs, which could involve your personal information contributing to the advancement of artificial intelligence technologies.
As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models.
How we use personal data, paragraph 2 · Citation strength: strong
medium90% confidence
Data disclosure for digital advertising and personalized ads
Microsoft discloses personal data for digital advertising purposes, and uses cookies to personalize ads based on your activity, both on Microsoft and third-party properties.
Why it matters: Your personal data will be used and disclosed for digital advertising, including personalized ads based on your activity across different platforms, meaning you may see targeted advertisements.
We also disclose personal data for digital advertising purposes. Please see the Advertising section for more information about how personal data is used for advertising.
Reasons we disclose personal data, paragraph 6 · Citation strength: strong
medium90% confidence
Data retention periods can vary significantly
Actual retention periods for personal data can vary significantly depending on data types and the context of interactions or product use.
Why it matters: Your personal data may be retained for varying lengths of time, which can make it difficult to predict how long specific pieces of your information will be stored by Microsoft.
Because these needs can vary for different data types and the context of our interactions with you or your use of our products, actual retention periods can vary significantly.
Our retention of personal data, paragraph 1 · Citation strength: strong
Cancellation and Renewal
Not clearly stated
These findings relate to the conditions and ease of canceling services or managing renewals, including potential difficulties or automatic charges.
?
Not clearly stated
No cited billing terms — wording is unclear
This policy does not clearly state information regarding cancellation or renewal practices. Therefore, Verbaterm could not generate any findings for this section.
Gotchas
3 findings
These findings highlight potentially tricky or obscure clauses that could be easily overlooked by users, often with negative implications.
medium95% confidence
Service provider control over third-party accounts
A Microsoft account created with a service provider's domain (e.g., cable or internet provider) is controlled by that service provider, including their ability to access or delete the account.
Why it matters: If your Microsoft account is tied to an email address from a service provider, that provider has control over your account and data, potentially allowing them to access or delete it according to their own terms.
A third-party account is a Microsoft account that you or your service provider (such as a cable or internet service provider) create that is tied to your email address with your service provider’s domain. Your service provider has control over your account, including the ability to access or delete your account.
Microsoft account, paragraph 7 · Citation strength: strong
low90% confidence
Payment receipts accessible to shared payment method users
If you save a payment method to an account used by multiple Microsoft account holders, your purchase receipts may be available to anyone else who uses and has access to the same payment method.
Why it matters: If you share a payment method on a Microsoft account with others, they might be able to view your purchase receipts, potentially exposing your spending habits.
If you save a payment method (such as a card) to an account used by you and other Microsoft account holders, your purchase receipts may be available to anyone else who uses and has access to the same payment method to make a purchase from Microsoft.
Reasons we disclose personal data, paragraph 4 · Citation strength: strong
low90% confidence
Data from third-party cookies subject to their privacy policies
Third-party companies use data processed through cookies in accordance with their own privacy policies, which may allow them to collect and combine information about your activities across various online services.
Why it matters: When third-party cookies are present on Microsoft sites, the data collected by those cookies is handled under the third parties' privacy policies, potentially allowing them to combine your activity data from different websites, apps, and online services.
These companies use the data they process in accordance with their privacy policies, which may enable them to collect and combine information about your activities across websites, apps, or online services.
These findings highlight clauses that are designed to protect the user or offer them control over their data and experience.
Protection95% confidence
Opt-out from promotional communications
You can choose not to receive promotional communications from Microsoft via email, SMS, mail, or phone by following instructions in messages or managing preferences on your communication permissions page or a web form.
Why it helps: Users can control the promotional communications they receive from Microsoft, reducing unwanted marketing messages.
You can choose whether to receive promotional communications from Microsoft by email, SMS, mail, or phone. To opt out of promotional emails or SMS, follow the directions in the message. For more options – including managing contact info, Microsoft-wide contact preferences, email subscriptions, and sharing info with partners – sign in to your personal Microsoft account, and visit your communication permissions page. If you don't have a Microsoft account, you can manage your Microsoft email contact preferences by using this web form . These choices do not apply to mandatory service communications or other informational messages with their own unsubscribe method.
How to access and control your personal data, paragraph 12 · Citation strength: strong
Protection95% confidence
Opt-out from personalized advertising
You can opt out of receiving personalized advertising from Microsoft and its third-party ad partners through specific pages or by turning off the advertising ID in Windows settings.
Why it helps: Users have options to prevent their data from being used for personalized advertising, which can reduce targeted ads and enhance privacy.
To opt out of receiving personalized advertising from Microsoft (including Xandr) visit our Personalized ads and offers page . You can also see our third party ad partners and opt out of data sharing for personalized ads at our Third-party ad settings page . When you’re logged into your Microsoft account, your opt out choice will be associated with your account and applied across devices whenever you are signed in. If you are not signed in and choose to opt out, your preference is stored in a browser-specific cookie on your device, valid for five years; if you delete cookies, you must opt out again.
How to access and control your personal data, paragraph 14 · Citation strength: strong
Protection95% confidence
Cookie controls and consent for optional cookies
You can control data collected by cookies through browser settings, and Microsoft obtains consent before placing or using optional cookies that are not strictly necessary.
Why it helps: Users have control over the cookies used, including the ability to block or delete them, and consent is required for optional cookies, giving users agency over their online tracking.
You can control the data collected by cookies, web beacons, and similar technologies. For example, you can use controls in your internet browser to limit how the websites you visit are able to use or to clear or to block cookies. Where required, we obtain your consent prior to placing or using optional cookies that are not (i) strictly necessary to provide the website or service; or (ii) for the purpose of facilitating a communication. Where consent is required, you may withdraw consent to optional cookies by clicking “Manage cookies” in the footer of the website.
Cookies and similar technologies, paragraph 4 · Citation strength: strong
Protection95% confidence
Response to Global Privacy Control (GPC) signal
Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions, which will turn off sharing your data with third parties for personalized ads.
Why it helps: Users can use a universal browser setting (GPC) to opt out of data sharing for personalized ads, providing a streamlined way to manage privacy across sites that support it.
Microsoft receives and responds to the Global Privacy Control (GPC) browser opt-out signal in certain jurisdictions. Microsoft will turn off sharing your data with third parties for personalized ads and turn off the “Share my data with third parties for personalized ads” toggle if we receive a GPC signal from you when you visit our sites.
How to access and control your personal data, paragraph 20 · Citation strength: strong
Protection95% confidence
Use of age information for age-appropriate experiences and protections
Microsoft uses information associated with your Microsoft account, including date of birth or age range signals, to provide age-appropriate experiences, apply protections, and comply with regulations.
Why it helps: Microsoft uses age-related information to provide safer, age-appropriate experiences and apply necessary protections across its services, which helps ensure content and settings are suitable for different age groups.
Providing Age Appropriate Experiences . We use information associated with your Microsoft account to provide more age-appropriate experiences across our services. This may include information you provide, such as your date of birth or settings you choose in your account, information from your use of Microsoft services, such as how you interact with features, content, and products, or information from partners or verification services, such as age range signals received from app stores. We use this information to help us apply age-appropriate protections, settings, and experiences.
Specifically, we use data to:, paragraph 1 · Citation strength: strong
Report an issue
Flag a citation problem, stale policy text, or incorrect company match.
Verbaterm boundaries
This public review is informational only and is not legal advice. Verbaterm shows only findings tied to the cited source snapshot above.