← All pages

1. What the document is: Microsoft's general Privacy Statement. It has a dedicated "Artificial Intelligence and Copilot capabilities" section describing how prompts and conversation data are used across the Microsoft Copilot family of products.

What this wiki found — complete, every page

Presence facts, not verdicts — each flagged term links to its definition and the exact clause on this page. Absence of a badge means the term isn't currently flagged here, not that the page is risk-free.

Microsoft Copilot – Privacy Policy

Dataset: GenGA (Generative AI Governance Archive) — 11 AI services, 2025–present

GenGA (Generative AI Governance Archive) is this wiki’s Generative-AI dataset: raw policy snapshots captured by the Open Terms Archive genai-eu project across 11 GenAI providers (ChatGPT, Claude.ai, DeepSeek, Google Generative AI Services, Le Chat, Llama API, Meta AI, Microsoft Copilot, Perplexity, Qwen Chat, xAI). Unlike PGAv2, GenGA has no pre-tagged risk scores — all risk scoring and keyword tagging on these pages is LLM-assigned by direct reading, spanning 2025–present.

Note: This page contains documented policy clauses. Risk assessment is qualitative and context-dependent. For analysis of patterns across platforms, see:

• AI Act Substance Matrix
• Tier Bifurcation
• Scraper Enforcement Gap
• Methodology

Source: sources/GenGA/Microsoft Copilot/Privacy Policy/ (raw Markdown captures, Open Terms Archive genai-eu dataset — no pre-tagged JSONL exists for this source) Last updated: 2026-04-02

Note on methodology: No pre-computed risk_score/keyword fields exist for this source. Keyword tags and clause analysis on this page are LLM-assigned, using the same rubric/vocabulary as the PGAv2 pages plus new GenAI-specific tags (train AI/models, gdpr). Treat as first-pass analysis, not externally verified ground truth. This wiki’s risk-scoring system was retired project-wide on 2026-06-21 (see methodology.md §4) — no page, GenGA included, computes or displays a numeric risk score.

Skipped/incomplete captures: 2025-11-11T15-34-47Z.md, 2025-11-24T15-56-58Z.md, and 2025-12-08T23-36-08Z.md are all 5-line stub captures (only the page title and “Last Updated” header, no body) — likely truncated scrapes, not real content. Excluded from Version History; the first complete capture is 2026-01-30.

Document-bundling note: This capture is Microsoft’s entire general consumer Privacy Statement (covering Windows, Xbox, Bing, Microsoft 365, advertising, etc.); only the “Artificial Intelligence and Copilot capabilities” section is Copilot-specific and analyzed in detail below.

Overview

1. What the document is: Microsoft’s general Privacy Statement. It has a dedicated “Artificial Intelligence and Copilot capabilities” section describing how prompts and conversation data are used across the Microsoft Copilot family of products.

2. Input rights: Training is opt-out by default, but only in some regions: “In certain markets, we use conversation data to train the generative AI models in Copilot, unless you choose to opt-out of such training.” That implies training-by-default doesn’t apply worldwide, though the document doesn’t say which markets are excluded. Notable finding: Microsoft Copilot “uses your prompts and related information (like location and language) to provide and improve the Copilot services, including to provide relevant advertising” — an explicit link between your AI chat prompts and ad targeting. That’s the opposite of the “we do not use chats to target ads” disclaimers found in ChatGPT’s, Claude.ai’s, and Google’s equivalent documents elsewhere in this dataset.

3. Output restrictions: Not addressed in this section.

4. Non-explicit predatory clauses: A prior-conversation-history personalization feature — “Microsoft Copilot can use your prior conversation history to better personalise the product for you… based on… your interests and goals” — that comes with an opt-out, similar in structure to Google Gemini’s “Memory” feature documented elsewhere in this dataset. A separate marketing-communications clause discloses that promotional phone calls “may be generated using artificial intelligence” — an AI-generated telemarketing voice.

5. Regulatory references: GDPR explicitly cited, but with an unusual framing. Rather than describing Microsoft as a GDPR Processor throughout, the policy discloses that “Microsoft has taken on the added responsibilities of a data controller under GDPR when processing Personal Data in connection with its business operations incident to providing its services to Microsoft’s commercial customers” — for example billing, account management, and internal reporting. No EU AI Act citation found in this document; the AI-Act-aligned content lives in the companion Acceptable Use Policy instead.

6. Regional variation: The “certain markets” qualifier on default AI training is the clearest regional signal, though it’s left unspecified. Copilot also behaves differently depending on where it’s integrated — standalone app, Microsoft Edge, Xbox, Microsoft 365, or third-party chat platforms — each governed by that product’s own data-processing description.

7. Key risk to users: The ad-targeting-from-prompts disclosure is the standout risk here. Most GenAI providers in this dataset explicitly disclaim using chat content for advertising, which makes Microsoft’s affirmative use of Copilot prompts “to provide relevant advertising” a notable outlier worth flagging in any cross-provider comparison.

Flagged Keywords & Risks (LLM-assigned)

• train AI/models — “In certain markets, we use conversation data to train the generative AI models in Copilot, unless you choose to opt-out.” Why it matters: training is opt-out by default, but only in an unspecified list of markets — and this document also has the dataset’s most explicit prompt-to-advertising pipeline.
• gdpr — Microsoft discloses a dual role: GDPR Processor for customer data generally, but GDPR Controller for its own business-operations processing (billing, account management, internal reporting). Why it matters: this is a more nuanced controller/processor split than most other providers’ DPAs in this dataset disclose.

Regulatory & Research Context

Pandit et al. (2026), who directly analyzed Microsoft/Copilot’s terms, report that “all terms mentioned that inputs and outputs would also be used for other purposes beyond” the immediate service — a pattern this page documents concretely in the train AI/models clause’s region-gated opt-out-by-default training and, more strikingly, in the affirmative disclosure that Copilot “uses your prompts and related information… to provide relevant advertising,” an outlier even among the providers Pandit et al. examined. Edwards et al. (2025) note that privacy policies often “requir[e] reading comprehension abilities at university level,” a concern amplified here by the document’s bundling of the AI/Copilot section inside Microsoft’s much larger general consumer Privacy Statement, making the prompt-to-advertising and gdpr controller/processor disclosures easy to overlook.

Changes Summary

Version History

2026-01-30

• Explicit AI clause: YES
• Non-explicit predatory: YES
• Flagged keywords: train AI/models, gdpr

Clause: train AI/models

Microsoft will only use your Microsoft Copilot conversations to monitor performance, troubleshoot problems, diagnose bugs, prevent abuse, and to provide and improve Microsoft Copilot. In certain markets, we use conversation data to train the generative AI models in Copilot, unless you choose to opt-out of such training.

Clause: prompt-to-advertising (not separately concept-tagged)

Microsoft Copilot also uses your prompts and related information (like location and language) to provide and improve the Copilot services, including to provide relevant advertising.

Clause: gdpr

Microsoft has taken on the added responsibilities of a data controller under GDPR when processing Personal Data in connection with its business operations incident to providing its services to Microsoft’s commercial customers, such as billing and account management; compensation; internal reporting and business modelling; and financial reporting.

2026-03-12

train AI/models/gdpr unchanged from 2026-01-30.

Clause: AI-generated marketing calls (new, not separately concept-tagged)

If you consent to receiving marketing communications to a phone number you provide us, we may contact you for marketing purposes using an auto-dialler and/or artificial/prerecorded voice, which may be generated using artificial intelligence.

2026-04-02

All flagged clauses unchanged from 2026-03-12.