WHAT THE POLICIES SAY

Microsoft 365 is an enterprise/consumer productivity and cloud-storage bundle from Microsoft Corporation, governed by the general Microsoft Privacy Statement alongside product-specific data collection and data-protection addenda. Microsoft processes personal data in Microsoft 365 to deliver the services and for purposes outlined in the Product Terms and the Microsoft Online Services Data Protection Addendum, processing various types of personal data as part of delivering an integrated set of cloud-based services. Microsoft Corporation's broader ecosystem (which shares infrastructure, account systems, and advertising practices with Microsoft 365) carries a documented regulatory and incident history, including a 2022 French cookie-consent fine, a 2023 FTC children's-privacy settlement tied to Xbox, and a U.S. government review finding a 'cascade of security failures' behind a 2023 nation-state breach of Exchange Online — all of which inform, but are not exclusively about, the Microsoft 365 product itself.

TIMELINE

NO ENTRIES ON FILE YET.

ULTIMATE PARENT

TOOLS WE RECOMMEND

PLUS

RECEIPTS

12 ON FILE

COLLECTION

For 'essential services,' required service data collection cannot be disabled by the customer. For essential services, required service data is always collected and sent to Microsoft, and customers can't turn off these essential services because they're key to how Microsoft 365 apps function.

microsoft.com ↗

COLLECTION

Required diagnostic data is described as the minimum needed to keep the product secure and functioning. All diagnostic data Microsoft collects during the use of Microsoft 365 applications and services is pseudonymized, and required diagnostic data is the minimum amount of data needed to keep the product secure, up to date, and performing as expected.

support.microsoft.com ↗

[2009-07-27] · OWNERSHIP TRANSPARENCY

Microsoft 365's parent, Microsoft Corporation, is a publicly traded company registered with the SEC and headquartered at a disclosed address. Microsoft Corporation is registered with the U.S. Securities and Exchange Commission and lists its address as One Microsoft Way, Redmond, Washington, with common stock registered on NASDAQ.

sec.gov ↗

[2022-07-01] · OWNERSHIP TRANSPARENCY

Microsoft 365 is operated by Microsoft Corporation, a publicly traded company registered with the SEC under commission file number 001-37845, headquartered in Redmond, Washington, with securities traded on Nasdaq under ticker MSFT. Microsoft Corporation's Form 10-K identifies it as incorporated in Washington, with IRS ID 91-1144442, headquartered at One Microsoft Way, Redmond, Washington, under Commission File Number 001-37845. Its securities, including notes, trade under the symbol MSFT on NASDAQ.

sec.gov ↗

[2026-05-28] · OWNERSHIP TRANSPARENCY

Microsoft has no single controlling owner; ownership is dispersed among institutional and individual shareholders. Microsoft has no single owner; it is a publicly traded company on NASDAQ under the ticker MSFT, with its largest shareholders being institutional investors such as Vanguard Group and BlackRock, alongside company insiders.

tmgm.com ↗

SHARING

Microsoft's Trust Center states it does not share customer data with advertiser-supported services or mine it for marketing/advertising purposes. Microsoft states it does not share customer data with advertiser-supported services or mine it for any purposes, such as marketing research or advertising.

microsoft.com ↗

[2020-07-20] · SHARING

A 2020 class-action complaint alleged Microsoft shared Office 365 business-customer data with Facebook and other third parties. The complaint says that while Microsoft has repeatedly promised its business customers that it would only use their data to provide purchased services and would never share their data with third parties, Microsoft has regularly shared its business customers' data with Facebook and other third parties, even when neither the customers nor their contacts are Facebook users.

theregister.com ↗

[2024-09-18] · SHARING

Microsoft's privacy statement specifies that it does not use the content of emails, chats, video calls, voicemail, or stored documents/photos to target advertising, but does use other collected data for advertising on Microsoft and third-party properties.

privacy.microsoft.com ↗

[2025-02-26] · SHARING

Microsoft completed an 'EU Data Boundary' limiting cross-border transfer of Microsoft 365 customer data. With the completion of the boundary, European commercial and public sector customers are able to store and process their customer data and pseudonymized personal data for Microsoft core cloud services — including Microsoft 365 — within the EU and EFTA regions.

blogs.microsoft.com ↗

[2022-12-22] · TRACK RECORD

France's CNIL fined Microsoft €60m ($64m) in December 2022 over Bing's advertising-cookie consent practices. France's CNIL announced on December 22, 2022 it had fined Microsoft €60m ($64m), its largest fine that year, over advertising cookies.

infosecurity-magazine.com ↗

TRACKING TECH

Microsoft's personalized-ads opt-out relies on a cookie stored on the device to record the user's preference. If a user is not signed in with a Microsoft account and chooses not to share their data for ad personalization, a cookie is stored on the device to indicate their preference to opt out of sharing.

support.microsoft.com ↗

[2022-12-22] · TRACKING TECH

A French regulator found Bing (a Microsoft product) deposited advertising cookies before obtaining user consent. The CNIL found that Microsoft's search engine, Bing, had not set up a system allowing users to refuse cookies as simply as accepting them, and that when users visited the site, cookies were deposited on their terminal without their consent, used among others for advertising purposes.

infosecurity-magazine.com ↗

LAST REVIEWED 2026-08-27 · METHODOLOGY v1.7