data report card

Data Report Card · Microsoft

Microsoft Data Report Card

Microsoft account · Outlook.com
Data
Practices
2Access1Portability1Friction2Deletion1Sells1Trains AI
=
C
8/12
Agent
Readiness
2Access 1Portability 2API access
=
B
5/6

Agent Readiness is a derived signal — a synthesis of two existing cells (Access, Portability) plus one sourced factor (API access), not an independently measured grade. API access scale: Best (2) consumer-grantable API · Moderate (1) partial / encumbered · Restrictive (0) manual export only. What is Agent Readiness?

Help me make a request →
Reviewed Jun 2026  ·  some cells re-verified 9 Aug 2026 · policies are checked weekly for changes  ·  stated — every cell is read from Microsoft's published policy; none has been tested (run by us) yet.
2Accessstated
Privacy dashboard gives a comprehensive self-serve view; "Download your data" archive is available within 30 days, no fee.
Microsoft account — privacy dashboard · accessed Jun 2026 ↗
1Portabilitystated
The dashboard export excludes email content — "emails, contacts, and chats are accessible through in-product experiences"; mail must be exported separately via Outlook.com settings.
Microsoft — download your data · accessed Jun 2026 ↗
1Frictionstated
Self-serve, but split across surfaces — the dashboard archive and the mail export are separate flows. The privacy statement states no delivery timeframe for exports; its 30-day commitment covers responding to privacy questions and processing authenticated child-account deletions, not export delivery.
Microsoft — download your data · accessed 9 Aug 2026 ↗
2Deletionstated
Self-serve account closure with a user-selectable 30- or 60-day grace period, then permanent deletion.
Microsoft — close your account · accessed Jun 2026 ↗
1Sells / sharesstated
Runs interest-based advertising including Xandr; opt-out via Microsoft's ad opt-out page, stored in a cookie with a 5-year expiry.
Microsoft Privacy Statement · accessed Jun 2026 ↗
1Trains AIstated
Microsoft states it uses your voice and conversation activity with Copilot, including uploaded images and files, to train its generative AI models by default, with an opt-out covering future conversations. Org Entra ID accounts, Microsoft 365 Personal/Family, signed-out users and under-18s are excluded. The new Copilot app’s FAQ (Aug 2026) lists Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam as the locations excluded from training — the EEA, UK and Switzerland are no longer named. Conversation history may also personalize ads under a separate setting.
Microsoft — Privacy FAQ for Microsoft Copilot (new app) · accessed Jun 2026 ↗
2API access — feeds Agent Readiness, not the /12stated
Microsoft Graph lets you authorize an app via consumer OAuth (e.g. Mail.Read + offline_access for refresh tokens), with delta queries and change webhooks for scheduled, incremental access — a genuine grant / revoke API, with no CASA-equivalent gate.
Microsoft Graph — auth & permissions · accessed Jun 2026 ↗
Source-verified Jun 2026 from Microsoft’s own pages; Trains AI re-verified 2026-08-30 against the FAQ shipped with the new Copilot app (event ev-2026-0007). All cells are "stated" (read from published policy and support docs); we have not yet run a live export or account closure to mark any cell "tested."

Events

Breaches, policy changes, and export-format changes we’ve recorded at Microsoft — other parties’ actions, alongside the enforcement record above. An event never changes a grade by itself. All events →

30 Aug 2026Microsoft shipped a new Copilot app with a new privacy FAQ. The locations excluded from model training changed: the old FAQ named the EEA, UK and Switzerland; the new one names Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea and Vietnam. Signed-out users and users under 18 are also excluded, and the training opt-out remains.policy change
On the events page →

Grade history

Every change to this company’s grade since it was first published, and why. All grade changes →

30 Aug 2026Trains AI on your datasource

The cited Copilot Privacy FAQ now covers only the older Copilot app; the FAQ shipped with the new app (Aug 18, 2026; event ev-2026-0007) replaces it. The score holds at 1 — trains on conversation activity by default with an opt-out, the same shape as OpenAI and Anthropic. The cell’s facts are updated: the training-excluded locations changed from the EEA, UK and Switzerland to six other countries, signed-out and under-18 users are excluded, and conversation history may personalize ads under a separate setting.

Microsoft — Privacy FAQ for Microsoft Copilot (new app) ↗Followed a published event →
Previously: Microsoft — Copilot Privacy FAQ (older app)
9 Aug 2026Friction & speednote

Score unchanged. The note said the dashboard archive is delivered “within 30 days.” That figure no longer appears on the cited page in that sense — it now covers replies to privacy questions and authenticated child-account deletions. No export delivery timeframe is stated at all.

Microsoft — Privacy Statement ↗

How to request your data from Microsoft

  1. Go to https://account.microsoft.com/privacy/download-data — Microsoft's data-request entry point.
  2. account.microsoft.com → Download your data.
  3. Expected wait: within 30 days — Microsoft's stated turnaround (we haven't independently timed a request yet).
  4. No self-serve option, or want a formal request? Contact Microsoft — Privacy Response: https://microsoft.com/en-us/privacy/privacy-support-requests.

These steps reflect Microsoft's documented process as of Jun 2026. The wait time is the company's stated figure, not yet independently measured by us.

Help me make a request →