Reviewed Jun 2026 · some cells re-verified 9 Aug 2026 · policies are checked weekly for changes · stated — every cell is read from Microsoft's published policy; none has been tested (run by us) yet.
1Portabilitystated
The dashboard export excludes email content — "emails, contacts, and chats are accessible through in-product experiences"; mail must be exported separately via Outlook.com settings.
Microsoft — download your data · accessed Jun 2026 ↗Connects to apps: Yes. Microsoft Graph lets you authorize an app via consumer OAuth (e.g.
Mail.Read +
offline_access for refresh tokens), with delta queries and change webhooks for scheduled, incremental access — a genuine grant / revoke API, with no CASA-equivalent gate.
Microsoft Graph — auth & permissions · accessed Jun 2026 ↗ 1Frictionstated
Self-serve, but split across surfaces — the dashboard archive and the mail export are separate flows. The privacy statement states no delivery timeframe for exports; its 30-day commitment covers responding to privacy questions and processing authenticated child-account deletions, not export delivery.
Microsoft — download your data · accessed 9 Aug 2026 ↗1Trains AIstated
Microsoft states it uses your voice and conversation activity with Copilot, including uploaded images and files, to train its generative AI models by default, with an opt-out covering future conversations. Org Entra ID accounts, Microsoft 365 Personal/Family, signed-out users and under-18s are excluded. The new Copilot app’s FAQ (Aug 2026) lists Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam as the locations excluded from training — the EEA, UK and Switzerland are no longer named. Conversation history may also personalize ads under a separate setting.
Microsoft — Privacy FAQ for Microsoft Copilot (new app) · accessed Jun 2026 ↗
Source-verified Jun 2026 from Microsoft’s own pages; Trains AI re-verified 2026-08-30 against the FAQ shipped with the new Copilot app (event ev-2026-0007). All cells are "stated" (read from published policy and support docs); we have not yet run a live export or account closure to mark any cell "tested."
Events
Breaches, policy changes, and export-format changes we’ve recorded at Microsoft — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →
10 Sep 2026Microsoft updated its Privacy Statement from July 2026 to September 2026. Two sentences were removed from the Copilot section: that in some markets your data can help train Microsoft Copilot AI models unless you opt out, and that you can opt out of personalization at any time. The training opt-out itself remains documented in Microsoft's Copilot Privacy FAQ, which did not change. Personalization is now described as covering memories you save and your interactions with Bing, Edge and MSN, managed through Copilot settings. Microsoft 365 Copilot no longer appears in this section, so the statement that you can view, export and delete Copilot activity history from the privacy dashboard now names only Microsoft Copilot. The reference to relevant advertising was also dropped from the sentence describing what Copilot does with your prompts.policy change
On the events page →
30 Aug 2026Microsoft shipped a new Copilot app with a new privacy FAQ. The locations excluded from model training changed: the old FAQ named the EEA, UK and Switzerland; the new one names Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam. Signed-out users and users under 18 are also excluded, and the training opt-out remains.policy change
On the events page →
Grade history
Every change to this company’s grade since it was first published, and why. All grade changes →
30 Aug 2026Trains AI on your datasource
The cited Copilot Privacy FAQ now covers only the older Copilot app; the FAQ shipped with the new app (Aug 18, 2026; event ev-2026-0007) replaces it. The score holds at 1 — trains on conversation activity by default with an opt-out, the same shape as OpenAI and Anthropic. The cell’s facts are updated: the training-excluded locations changed from the EEA, UK and Switzerland to six other countries, signed-out and under-18 users are excluded, and conversation history may personalize ads under a separate setting.
Microsoft — Privacy FAQ for Microsoft Copilot (new app) ↗Followed a published event →Previously: Microsoft — Copilot Privacy FAQ (older app)
9 Aug 2026Friction & speednote
Score unchanged. The note said the dashboard archive is delivered “within 30 days.” That figure no longer appears on the cited page in that sense — it now covers replies to privacy questions and authenticated child-account deletions. No export delivery timeframe is stated at all.
Microsoft — Privacy Statement ↗