Microsoft OneDrive

"We combine data we collect from different contexts (for example, from your use of two Microsoft products) or obtain from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes. Microsoft Store uses information about the apps and services you use to make personalized app recommendations."

Microsoft combines user data across multiple products, services, and third-party sources to build unified profiles, enabling cross-service tracking and personalization across their entire ecosystem.

"We also share personal data among Microsoft-controlled affiliates and subsidiaries, including for the purposes described in this privacy statement. We also share personal data with vendors or agents working on our behalf for the purposes described in this statement. We also include web beacons or similar technologies in our electronic communications to determine whether you open and act on them."

Microsoft shares personal data broadly with affiliates, subsidiaries, vendors, third-party analytics providers, and advertising partners, including through embedded web beacons and third-party cookies on their sites.

"Location data. Data about your device's location, which can be either precise or imprecise. For example, we collect location data using Global Navigation Satellite System (GNSS) (e.g., GPS) and data about nearby cell towers and Wi-Fi hotspots. Location can also be inferred from a device's IP address or data in your account profile that indicates where it is located with less precision, such as at a city or postal code level."

Microsoft collects both precise and imprecise location data through GPS, cell towers, Wi-Fi hotspots, and IP address inference, enabling comprehensive location tracking across their products.

"Contacts and relationships. Data about your contacts and relationships if you use a product to share information with others, manage contacts, communicate with others, or improve your productivity. Biometric data and identifiers. Data about you resulting from specific technical processing relating to your physical, physiological, or behavioral characteristics which allow or confirm unique identification."

Microsoft collects extensive device data including contacts, biometric identifiers, keyboard/inking input, voice data, images, installed software, device identifiers like IMEI, and sensor data from devices like Xbox controllers and Kinect.

"Microsoft retains personal data for as long as necessary to provide the products and fulfill the transactions you have requested, or for other legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. Because these needs can vary for different data types, the context of our interactions with you or your use of products, actual retention periods can vary significantly."

Microsoft provides no clear, fixed data retention timelines, using vague criteria like 'as long as necessary' and 'legitimate purposes,' which effectively allows indefinite retention of personal data.

"This privacy statement explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes. Microsoft offers a wide range of products, including server products used to help operate enterprises worldwide, devices you use in your home, software that students use at school, and services developers use to create and host what's next."

The privacy statement is dated 'Last Updated: March 2026' with a 'What's new?' section, indicating Microsoft updates the policy unilaterally. Continued use of products constitutes acceptance of updated terms without requiring explicit consent.

"After you submit the request to close your child's account, we will wait 60 days before permanently deleting the account in case you change your mind or need to access something on the account before it is permanently closed and deleted. During the waiting period, the account is marked for closure and permanent deletion, but it still exists."

Microsoft imposes a 60-day waiting period before permanently deleting an account, during which all data is retained. While described for child accounts, this pattern applies to Microsoft account closure generally.