16

Many are claiming that Windows 10's data collection is much more invasive than previous Microsoft products, even claiming that Windows 10 ships with a keylogger and reports every keystroke back to Microsoft. Most locally, this question on the Stack Exchange network makes some of the same claims.

However, it seems that many of those sources have conflated the developer pre-release version of Windows 10 with the official release, and I'm having trouble separating the wheat from the chaff. My goal in asking this question is to look past the sensationalist reporting and see what rights Microsoft holds.

The official End-User License Agreement for the final retail release of Windows 10 says the following:

Privacy; Consent to Use of Data. Your privacy is important to us. Some of the software features send or receive information when using those features. Many of these features can be switched off in the user interface, or you can choose not to use them. By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features.

The referenced Microsoft Privacy Statement says the following:

Microsoft collects data to operate effectively and provide you the best experiences with our services. [...] We get some of it by recording how you interact with our services by, for example, using technologies like cookies, and receiving error reports or usage data from software running on your device. We also obtain data from third parties (including other companies).

Microsoft uses the data we collect to provide you the services we offer, which includes using data to improve and personalize your experiences. [...] We use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you.

Windows 10 ("Windows") is a personalized computing environment that enables you to seamlessly roam and access services, preferences and content across your computing devices from phones to tablets to the Surface Hub. Rather than residing as a static software program on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it.

Putting aside the technical question of what information the software actually does collect (which would be off topic)...

From a legal standpoint, in the retail version of Windows 10:

  • How does Microsoft's claim to user data differ from previous versions of Windows?
  • Does Microsoft have the right to record arbitrary keystrokes or clicks made while using their operating system and send that data to external servers?
  • Does Microsoft have the right to share user usage data with third parties (such as advertising agencies), either at a price or without compensation? Despite saying that they currently don't use data directly from our personal files for this purpose, do they have a right to begin doing so at any time?
Improve this question
4
  • In what country? Data privacy laws vary by country, and Microsoft's EULA does not override a country's data privacy laws.
    – cpast
    Aug 14, 2015 at 19:57
  • @cpast in that case, i suppose asking about the united states would cover the largest audience.
    – Woodrow Barlow
    Aug 14, 2015 at 19:59
  • I don't know why everybody is so worked up. Most of these provisions have been in their privacy agreements for as long as I can remember, which is over two decades. Why is there suddenly such a ruckus?
    – David A. Gray
    Aug 21, 2015 at 19:33
  • @DavidA.Gray People are just recently actually reading the things
    – cat
    Sep 28, 2016 at 2:03

2 Answers 2

Reset to default
14

(2019 update See comments for my exchange with @benrg updating this 2015 answer. In particular, they do a fair job of representing a much less "paranoid" take on MS's take on users' privacy than my highly skeptical one. Also, the links in the answer below are to the latest versions of the respective documents. Archive.org has 2015 versions at 2015 EULA and 2105 privacy statement.)

IANAL. This answer is just a broad picture. It's a simple explanation of Microsoft's own words, as they were at the time of originally writing this (just after the final release of Windows 10).

TL;DR:

  • Microsoft does not recognize users' privacy rights. The Microsoft Privacy document does not say anything positive about privacy in this document that isn't contradicted by their own words elsewhere in the same document.

  • Microsoft does explicitly reserve rights to share users' private data with just about anyone and everyone.

  • Microsoft explicitly disallows legal recourse regarding privacy. The Windows 10 EULA comprehensively denies legal recourse related to privacy (and indeed anything other than IP disputes).

It's Microsoft's offerings as a whole, not (just) Windows 10

The key document to focus on is Microsoft's Privacy policy document.

This policy applies to many Microsoft products and services, including, but definitely not limited to, Windows 10.

Microsoft reserve the right to share your private data

Quoting the "Privacy" document, Microsoft reserves the right to share users' private data:

among Microsoft-controlled affiliates and subsidiaries

with vendors or agents working on our behalf

as part of a corporate transaction such as a merger or sale of assets

[to] comply with applicable law

[to] respond to valid legal process

[to] protect our customers, for example to prevent spam

[to] operate and maintain the security of our services

[to] protect the rights or property of Microsoft

as necessary to complete any transaction or provide any service you have requested or authorized

Do users have any privacy rights?

One can presumably fight for one's (perceived) rights even if Microsoft attempts to deny them.

However, from the English Windows 10 EULA:

you and we agree to try for 60 days to resolve [a dispute] informally. If we can’t, you and we agree to binding individual arbitration ... and not to sue in court

Additionally, collective action or any other form of representative action is explicitly disallowed.

Windows 10 data collection defaults to "Full" mode

You've said that what data is collected is off topic. But I think it's worth recognizing that, with Windows 10, Microsoft have made the most popular install option collect and send to their cloud all data collected from your local device ("Full" collection) and have effectively made it a breach of contract to reduce it below a minimal level ("Basic" collection) that they get to determine and change as they see fit. And they can pretty much enforce the latter; if you hack a system to stop "Basic" data being sent to MS, they explicitly disable updates for that system.

Improve this answer
7
  • [...]if you hack a system to stop "Basic" data being sent to MS, they explicitly disable updates for that system.[...] In this case, how about applying updates manually? Is it possible?
    – Asad Malik
    Aug 27, 2015 at 16:50
  • @AsadMalik I don't know. Also, I'm thinking of deleting the last section because it's off topic.
    – raiph
    Feb 19, 2016 at 21:22
  • This answer is awful. It quotes clauses that apply to data stored on Microsoft servers, but omits to mention that fact, leaving readers to conclude that it refers to files stored on their own computers. It seems to imply that "full collection" means sending all files from your computer to Microsoft, which it doesn't. It claims without reference that Windows updates are disabled if you choose "basic collection", which appears absurd on its face. Why would OP post a question that was explicitly about separating wheat from chaff, and then accept this scaremongering answer from a non-lawyer?
    – benrg
    Dec 6, 2019 at 21:11
  • @benrg. My answer was in response to the documents as they were in 2015. MS reserved the right to move any data handled under their license to any location they chose, and the license covered any data handled by covered MS client software. I said Windows updates were disabled if one disabled basic collection, not if one enabled it. MS put amazing contractual limits on recourse in the event someone felt MS had included too much of their private data in basic collection. I don't know why my answer got upvotes and was accepted by the OP but perhaps it's because readers agreed with my summary.
    – raiph
    Dec 7, 2019 at 0:15
  • 1
    @benrg. I read it in 2015, in its entirety, several times, before answering. The text "online services" is not in it. "The data we collect depends on the services ... you use." Services include Windows: "components of Windows are cloud-based". MS promised in 2017 to do better due to user and government pressure but remained "vague about exactly what is disclosed". Do you trust MS? I read the fine print.
    – raiph
    Dec 7, 2019 at 23:16
1

To quote from the Microsoft Privacy Statement: "We use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you."
So they do not use it to target ads - but they have an open field on anything else they wish to do with the content of email, chat, video calls and voicemail. This 'free' version of windows appears to be a development version and it is sending back debug information to Microsoft. If your personal photos, social security number or credit card details are sent to Microsoft they will not use them for targeting ads but appear to have carte blanche to use them for anything else.

Improve this answer
1
  • This was already quoted in the question, and I think it was implicit in the sub-questions.
    – HDE 226868
    Sep 14, 2015 at 19:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .