Microsoft Corporation, the parent company of LinkedIn, publishes a consolidated Microsoft Privacy Statement covering Windows, Office/Microsoft 365, Xbox, and other products, and discloses that it shares data with named advertising partners and uses cookies, web beacons, and an Advertising ID for personalization and ad measurement. The company's data practices have drawn sustained regulatory scrutiny, including a 2023 FTC settlement over children's data collection on Xbox, a 2018-2019 Dutch/Irish GDPR inquiry into Windows and Office telemetry, and a 2024 U.S. government review finding that a 2023 nation-state intrusion into Microsoft-hosted government email was traceable to internal security shortcomings. Microsoft's corporate and subsidiary structure is disclosed in periodic SEC filings, which as a publicly traded company it is required to file.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2024-03-20]
The U.S. Department of Homeland Security's Cyber Safety Review Board found in its April 2024 report that the 2023 Storm-0558 intrusion into Microsoft-hosted Exchange Online mailboxes — which compromised accounts including U.S. State and Commerce Department officials — resulted from a cascade of security failures and reflected a corporate culture that deprioritized enterprise security investment at Microsoft.
In 2023, Microsoft agreed to pay $20 million in civil penalties to settle FTC charges that it violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children who signed up for Xbox Live without notifying parents or obtaining consent, and by retaining children's data longer than permitted.
Receipted federal filings: FEC campaign-finance records and LDA lobbying disclosures. A tie is a disclosed transaction or filing, not a claim of influence or wrongdoing.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Environment and Public Works, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Banking, Housing, and Urban Affairs, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Appropriations, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Energy and Natural Resources, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Agriculture, Nutrition, and Forestry, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on Commerce, Science, and Transportation, per LDA Form LD-2.
MICROSOFT CORPORATION reported lobbying activity before the Senate on TEC-coded issues, where the official serves on the Senate Committee on the Judiciary, per LDA Form LD-2.
Microsoft's data collection summary for Windows classifies personal data collected from customers into 'Required' and 'Optional' categories, stating Required data is necessary to keep products secure and up to date, while Optional data is not strictly necessary and can be disabled by users.
The FTC's 2023 complaint against Microsoft alleged that the Xbox Live sign-up process asked children under 13 for their name, date of birth, email address, and phone number before parental consent was obtained, and that Microsoft did not fully disclose to parents that it also collected data such as a child's profile picture.
Microsoft Corporation, as a publicly traded company, files an Exhibit 21 'Subsidiaries of Registrant' list with its annual Form 10-K filed with the U.S. Securities and Exchange Commission, disclosing its significant corporate subsidiaries.
The Microsoft Privacy Statement discloses that collected data may be provided to internal and external partners — including Xandr, other Microsoft subsidiaries and affiliates, Yahoo, Facebook, and The Trade Desk — to help make ads shown in Microsoft's and their products more relevant.
As part of the 2023 FTC settlement, Microsoft is required to notify third-party video game publishers when it discloses a child's personal information to them, so that publishers apply COPPA protections to that child's data.
A 2018 report commissioned by the Dutch Ministry of Justice and Security concluded that Microsoft's Office ProPlus and Office 365 telemetry collection, including capture of email subject lines and sentences processed by spelling/translation tools, was conducted at large scale without adequate documentation and raised concerns of GDPR non-compliance, according to contemporaneous reporting on the investigation.
In 2019, the Dutch Data Protection Authority asked Ireland's Data Protection Commission to investigate 'new, potentially unlawful' aspects of Windows 10 telemetry data collection, following an earlier 2017 Dutch finding that Windows 10 telemetry collection did not adequately inform users or obtain specific consent.
In 2023, Microsoft agreed to pay $20 million in civil penalties to settle FTC charges that it violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children who signed up for Xbox Live without notifying parents or obtaining consent, and by retaining children's data longer than permitted.
The U.S. Department of Homeland Security's Cyber Safety Review Board found in its April 2024 report that the 2023 Storm-0558 intrusion into Microsoft-hosted Exchange Online mailboxes — which compromised accounts including U.S. State and Commerce Department officials — resulted from a cascade of security failures and reflected a corporate culture that deprioritized enterprise security investment at Microsoft.
Microsoft's Privacy Statement discloses use of cookies for sign-in and authentication, use of web beacons to count visitors and measure ad interactions (including on other companies' websites), and use of an 'Advertising ID' identifier in Windows for personalization and ad measurement.
Microsoft's support documentation states that Microsoft allows third parties to set analytics cookies on Microsoft websites to understand usage patterns, and that advertising cookies are used by Microsoft and third parties to record which ads a visitor has seen and clicked.