Workflow & Automation · microsoft.comMicrosoft 365 Copilot
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“SwiftKey prediction technology learns from the way you use language to build a personalized language model. This model is an optimized view of the words and phrases that you use most often in context and reflects your unique writing style. The model itself contains the words you commonly type arranged in a way that enables SwiftKey’s algorithms to make…”
Watch: Commercial use
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
Declares the software is licensed not sold, reserves all rights not expressly granted to Microsoft, and introduces the list of specific prohibited uses that follow, establishing the restrictive scope of the software license.
Restricts governmental use of Bird's eye imagery from specified countries without separate written approval from Microsoft, creating a specific permission requirement for a defined category of use.
Microsoft carves out communications content from ad targeting but broadly uses interaction and behavioral data across its ecosystem and third-party properties. Automated profiling for advertising is disclosed. Users have limited control unless they opt out.
How to read this page: Overall risk rates what Microsoft 365 Copilot's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 1035 verified, verbatim-cited findings below — read the citations.
Based on 1136 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Terms of ServiceVerified - read in full - 26 citationsstaticLast captured 2026-08-28
- Privacy PolicyVerified - read in full - 391 citationsstaticLast captured 2026-08-28
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
This segment grants Microsoft a worldwide, royalty-free intellectual property license to use user content to provide, protect, and improve Microsoft products and services, including making copies, retaining, transmitting, reformatting, displaying, and distributing content, and expressly permits use of publicly posted content in promotional materials, which encompasses potential training and operational use of user content.
" b. To the extent necessary to provide the Services to you and others, to protect you and the Services, and to improve Microsoft products and services, you grant to Microsoft a worldwide and royalty-free intellectual property license to use..."
Clarifies that the MPEG LA codec notice does not restrict normal business uses of the software that are personal to the business, provided such use does not involve redistribution to third parties or creation of VIDEO STANDARDS-compliant material for third-party distribution.
" For clarification purposes only, this notice does not limit or inhibit the use of the software provided under these Terms for normal business uses that are personal to that business which do not include (i) redistribution of the software t..."
This clause specifies which diagnostic data categories are used to personalize offers depending on the user's diagnostic data tier selection (Required vs. Optional), and notes that some personalization may occur locally on the device without data leaving it, defining the data use scope for the Personalized offers feature.
" When Personalized offers is on, Windows may use your required diagnostic data to personalize offers. This data may include information about your device, its settings and capabilities, and whether it is performing properly. If you have dec..."
Cross-product and third-party data combination creates detailed user profiles beyond what any single interaction would reveal. The 'other legitimate purposes' catch-all is vague and could be interpreted expansively, creating legal and privacy risk for users.
"In carrying out these purposes, we combine data we collect from different contexts (for example, from your use of two Microsoft products) or obtain from third parties to give you a more seamless, consistent, and personalized experience, to ..."
Explicitly restricts Microsoft from using content of emails, chats, video calls, voicemail, documents, or personal files to target ads, while permitting use of interaction data collected through Microsoft properties and third-party properties for advertising purposes.
"For example, we may predict your interest in gaming and communicate with you about new games you may like. Advertising . Microsoft does not use what you say in email, human-to-human chat, video calls, or voice mail, or your documents, phot..."
Establishes the procedure for parents who lack dashboard access to submit child data requests via a privacy support form, including an account verification requirement before the request is fulfilled.
" If your child’s account is not a part of your Microsoft family group and you do not have access to your child’s activity on your privacy dashboard, then you need to submit a request related to your child’s data through the privacy support..."
This clause repeats the disclaimer that third-party products accessible through Enterprise and Developer Products are governed by their own privacy policies (duplicate of 384).
" The Enterprise and Developer Products enable you to purchase, subscribe to, or use other products and online services from Microsoft or third parties with different privacy practices, and those other products and online services are govern..."
This clause describes Microsoft's obligation to process Support Data for the purpose of providing technical support and in accordance with the Products and Services DPA, incorporating that document as the governing framework for support data handling.
" Support Data . Customers provide or authorize Microsoft to collect data in connection with obtaining technical support for the Enterprise Online Services. We process Support Data to provide technical support and as described in the Produc..."
Clause A states that Smart App Control is automatically enabled if a device qualifies after evaluation, while Clause B states that Smart App Control is not enabled, presenting opposing claims about its enablement status.
" Where supported, Smart App Control checks software installed on your device to identify potential threats. On supported devices, it begins in evaluation mode using data collected by Microsoft Defender SmartScreen—such as file names, hashes, download locations, and digital certificates—to determine if Smart App Control is suitable for your device. If your device qualifies, Smart App Control is automatically enabled for added protection; otherwise, it remains permanently off. For unsupported or unsuitable devices, Microsoft Defender SmartScreen continues to provide protection. When Smart App Control is active, it blocks and alerts you about apps identified as malicious, potentially unwanted, or unknown and unsigned before they open, run or install. Learn more about Smart App Control ."
" Where supported, Smart App Control helps check software that is installed and runs on your device to determine if it is malicious, potentially unwanted, or poses other threats to you and your device. On a supported device, Smart App Control starts in evaluation mode and the data we collect for Microsoft Defender SmartScreen such as file name, a hash of the file’s contents, the download location, and the file’s digital certificates, is used to help determine whether your device is a good candidate to use Smart App Control for additional security protection. Smart App Control is not enabled and will not block during evaluation mode. Some devices may not be good candidates if Smart App Control would otherwise get in the way and interfere with a user’s otherwise intended and legitimate tasks – for instance, developers who use a lot of unsigned files. If you are a good candidate for Smart App Control, then it will automatically be turned on, and will provide additional protection to your device beyond Microsoft Defender SmartScreen. Otherwise, Smart App Control will be unavailable and permanently turned off. If your device is unsupported or not a good candidate for Smart App Control, Microsoft Defender SmartScreen will continue to help protect your device. When Smart App Control is enabled and identifies an app as malicious, potentially unwanted, or unknown and unsigned, it will block and notify you prior to opening, running, or installing the app. Learn more about Smart App Control ."
Within one documentClause A implies potential data use by or sharing with third-party lens services, while Clause B explicitly states the data is 'never sent to SwiftKey or any third party'.
Within one documentClause A states users can choose to sync a comprehensive list of data types in Microsoft Edge, including browsing history, passwords, and payment information, while Clause B provides a significantly narrower list for Edge, omitting these key data types, which could mislead users about what data is synced.
" Microsoft collects data necessary to provide features you request in Microsoft Edge. When signed into Microsoft Edge using your Microsoft personal account or work or school account, Microsoft Edge will sync your browser data saved on your device across other signed-in devices. You may choose which browser data to sync, including your favorites, browsing history, extensions and associated data, settings, open tabs, autofill form entries (such as your name, address, and phone number), passwords, payment information, and other data types as they become available. If you choose to sync extensions that you acquired from third-party web stores, a copy of those extensions will be downloaded directly from those web stores on your synced device(s). If you have turned on Password Monitor, your saved credentials are hashed, encrypted and sent to Microsoft’s Password Monitor service to warn you if your credentials were detected as part of a malicious attack or a breach. Microsoft does not retain this data after the check is complete. You can disable or configure syncing in the Microsoft Edge settings."
" Some Microsoft browser information saved on your device will be synced across other devices when you sign in with your Microsoft account so you can access your data on all your signed-in browsers across your devices. For instance, in Internet Explorer, this information includes your browsing history and favorites; and in Microsoft Edge, it includes your favorites, reading lists, autofill form entries (such as your name, address, and phone number), and may include data for extensions that you have installed. As an example, if you sync your Microsoft Edge reading list across devices, copies of the content you choose to save to your reading list will be sent to each synced device for later viewing. You can disable syncing in Internet Explorer by going to Start > Settings > Accounts > Sync your settings . (For more information, see the Sync settings section of this privacy statement.) You can also disable syncing of Microsoft Edge browser information by turning off the sync option in Microsoft Edge Settings."
Within one document
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" Microsoft will only use your Microsoft Copilot conversations to monitor performance, troubleshoot problems, diagnose bugs, prevent abuse, and to provide and improve Microsoft Copilot. In certain markets, we use conversation data to train the generative AI models in Copilot, unless you choose to opt-out of such training. More information about how your data is protected and the controls we offer in Microsoft Copilot is available here ."
This clause restricts Microsoft's use of Copilot conversation data to specific purposes (performance monitoring, troubleshooting, bug diagnosis, abuse prevention, service improvement) and conditionally permits use of conversation data to train generative AI models only in certain markets unless users opt out.
AI-generated interpretation, not legal advice.
" b. The software is licensed, not sold, and Microsoft reserves all rights to the software not expressly granted by Microsoft, whether by implication, estoppel, or otherwise. This license does not give you any right to, and you may not: "
Declares the software is licensed not sold, reserves all rights not expressly granted to Microsoft, and introduces the list of specific prohibited uses that follow, establishing the restrictive scope of the software license.
AI-generated interpretation, not legal advice.
" ii. Bing Maps. You may not use Bird’s eye imagery of the United States, Canada, Mexico, New Zealand, Australia or Japan for governmental use without our separate written approval."
Restricts governmental use of Bird's eye imagery from specified countries without separate written approval from Microsoft, creating a specific permission requirement for a defined category of use.
AI-generated interpretation, not legal advice.
"Microsoft does not use what you say in email, human-to-human chat, video calls, or voice mail, or your documents, photos, or other personal files to target ads to you. We use data we collect through our interactions with you, through some of our first-party products, services, apps, and web properties (Microsoft properties), and on third-party web properties, for advertising on our Microsoft properties and on third-party properties. We may use automated processes to help make advertising more relevant to you."
Microsoft carves out communications content from ad targeting but broadly uses interaction and behavioral data across its ecosystem and third-party properties. Automated profiling for advertising is disclosed. Users have limited control unless they opt out.
AI-generated interpretation, not legal advice.
"Microsoft collects data from you, through our interactions with you and through our products for a variety of purposes described below, including to operate effectively and provide you with the best experiences with our products. You provide some of this data directly, such as when you create a Microsoft account, administer your organization’s licensing account, submit a search query to Bing, register for a Microsoft event, upload a document to OneDrive, sign up for Microsoft 365, or contact us for support. We get some of it by collecting data about your interactions, use, and experience with our products and communications. In addition, we receive data from Microsoft affiliates, subsidiaries, and third parties."
The clause establishes a wide data collection mandate across all Microsoft products and services. The reference to 'a variety of purposes described below' without enumerating them in the quoted clause creates ambiguity about the full scope of use, which is a risk for users who may not read the full statement.
AI-generated interpretation, not legal advice.
"When you opt out, your preference is stored in a cookie that is specific to the web browser you are using. The opt-out cookie has an expiration date of five years. If you delete the cookies on your device, you need to opt out again."
Tying privacy preferences to a cookie that can be inadvertently deleted creates a fragile consent/withdrawal mechanism. Regulators (e.g., under GDPR and ePrivacy) expect that opt-out preferences are durable and not easily lost through normal browser maintenance.
AI-generated interpretation, not legal advice.
" Contextual data from your device and some basic account data are used to show you appropriate messaging in Windows regardless of whether the Personalized offers setting or the use of data from other Microsoft products to personalize offers are turned off. For example, this data is used to make sure content is in the correct language and appropriate for your age group."
This clause establishes an exception to user opt-out controls, stating that contextual device data and basic account data will still be used for appropriate messaging (e.g., language and age-appropriate content) regardless of Personalized offers or cross-product data settings being turned off.
AI-generated interpretation, not legal advice.
"In carrying out these purposes, we combine data we collect from different contexts (for example, from your use of two Microsoft products) or obtain from third parties to give you a more seamless, consistent, and personalized experience, to make informed business decisions, and for other legitimate purposes."
Cross-product and third-party data combination creates detailed user profiles beyond what any single interaction would reveal. The 'other legitimate purposes' catch-all is vague and could be interpreted expansively, creating legal and privacy risk for users.
AI-generated interpretation, not legal advice.
"For example, we may predict your interest in gaming and communicate with you about new games you may like. Advertising . Microsoft does not use what you say in email, human-to-human chat, video calls, or voice mail, or your documents, photos, or other personal files to target ads to you. We use data we collect through our interactions with you, through some of our first-party products, services, apps, and web properties (Microsoft properties), and on third-party web properties, for advertising on our Microsoft properties and on third-party properties. We may use automated processes to help make advertising more relevant to you. For more information about how your data is used for advertising, see the Advertising section of this privacy statement. Prize promotions and events . We use your data to administer prize promotions and events available in our physical Microsoft Stores. For example, if you enter into a prize promotion, we may use your data to select a winner and provide the prize to you if you win. Or, if you register for a coding workshop or gaming event, we will add your name to the list of expected attendees. Transacting commerce . We use data to carry out your transactions with us. For example, we process payment information to provide customers with product subscriptions and use contact information to deliver goods purchased from the Microsoft Store. Reporting and business operations . We use data to analyze our operations and perform business intelligence. "
Explicitly restricts Microsoft from using content of emails, chats, video calls, voicemail, documents, or personal files to target ads, while permitting use of interaction data collected through Microsoft properties and third-party properties for advertising purposes.
AI-generated interpretation, not legal advice.
" In some cases, your ability to access or control your personal data will be limited, as required or permitted by applicable law."
Limits the scope of user data access and control rights by providing that applicable law may restrict or permit limitations on those rights in certain circumstances.
AI-generated interpretation, not legal advice.
" Finally, Microsoft products often contain web beacons or similar technologies from third-party analytics providers, which help us compile aggregated statistics about the effectiveness of our promotional campaigns or other operations. These technologies enable the analytics providers to set or read their own cookies or other identifiers on your device, through which they can collect information about your online activities across applications, websites, or other products. However, we prohibit these analytics providers from using web beacons on our sites to collect or access information that directly identifies you (such as your name or email address). You can opt out of data collection or use by some of these analytics providers by visiting any of the following sites: Adjust , AppsFlyer , Clicktale , Flurry Analytics , Google Analytics (requires you to install a browser add-on), Kissmetrics , Mixpanel , Nielsen , Acuity Ads , WebTrends , or Optimizely ."
This clause restricts third-party analytics providers from using web beacons on Microsoft sites to collect or access information beyond what is permitted, while also describing the data collection practices of those providers through their own identifiers.
AI-generated interpretation, not legal advice.
" Anti-cheat and fraud prevention . Providing a fair gameplay environment is important to us. We prohibit cheating, hacking, account stealing, and any other unauthorized or fraudulent activity when your child uses an Xbox online game or any network-connected app on their Xbox console, PC, or mobile device. In order to detect and prevent fraud and cheating, we may use anti-cheat and fraud prevention tools, applications, and other technologies. Such technologies may create digital signatures (known as “hashes”) using certain information collected from their Xbox console, PC, or mobile device, and how they use that device. This can include information about the browser, device, activities, game identifiers, and operating system."
Prohibits cheating, hacking, account stealing, and unauthorized or fraudulent activity on Xbox, and authorizes the use of anti-cheat and fraud prevention technologies including creation of digital hashes from device information to detect violations.
AI-generated interpretation, not legal advice.
" Some web-based experiences or third-party apps that surface on Windows could use other technologies (such as Bluetooth, IP address, cellular modem, etc.) or cloud-based location services to determine your device’s location with varying degrees of accuracy even when you’ve turned off the device location setting."
Describes that third-party web-based experiences and apps may use alternative technologies to determine device location even when the Windows location setting is disabled, creating an exception to user location controls.
AI-generated interpretation, not legal advice.
"Microsoft uses the data we collect to provide you with rich, interactive experiences. In particular, we use data to: Provide our products, which includes updating, securing, and troubleshooting, as well as providing support. It also includes sharing data, when it is required to provide the service or carry out the transactions you request. Improve and develop our products. Personalize our products and make recommendations. Advertise and market to you, which includes sending promotional communications, targeting advertising, and presenting you with relevant offers"
The policy explicitly enumerates advertising and targeted marketing as a permitted use of collected personal data. Users who expect their data to be used only for service delivery may be surprised by this scope. No distinction is made by product tier here.
AI-generated interpretation, not legal advice.
"Bot usage data . Interactions with bots and skills available through Microsoft products, including bots and skills provided by third parties."
This clause means that even when users interact with third-party bots/skills within Microsoft products, those interactions are captured as Microsoft data, creating dual data collection by both Microsoft and the third party.
AI-generated interpretation, not legal advice.
"Social Media cookies. We and third parties use social media cookies to show you ads and content based on your social media profiles and activity on our websites. They’re used to connect your activity on our websites to your social media profiles so the ads and content you see on our websites and on social media will better reflect your interests."
Cross-platform profiling links Microsoft site behavior to social media identities, enabling detailed targeting and raising data minimization concerns.
AI-generated interpretation, not legal advice.
"We use cookies and similar technologies for storing and honoring your preferences and settings, enabling you to sign in, providing interest-based advertising, combating fraud, analyzing how our products perform, and fulfilling other legitimate purposes. Microsoft apps use additional identifiers, such as the advertising ID in Windows described in the Advertising ID section of this privacy statement, for similar purpose"
The catch-all 'other legitimate purposes' language alongside advertising use expands the permissible scope of data processing beyond what a user might reasonably anticipate, a concern under GDPR Article 5(1)(b) purpose limitation and CCPA disclosure requirements.
AI-generated interpretation, not legal advice.
"Your privacy is important to us. Please read the Microsoft Privacy Statement (https://go.microsoft.com/fwlink/?LinkId=521839) (the " Privacy Statement ") as it describes the types of data we collect from you and your devices (" Data "), how we use your Data, and the legal bases we have to process your Data. The Privacy Statement also describes how Microsoft uses your content, which is your communications with others; postings submitted by you to Microsoft via the Services; and the files, photos, documents, audio, digital works, livestreams and videos that you upload, store, broadcast, create, generate, or share through the Services or inputs that you submit in order to generate content (" Your Content "). Where processing is based on consent and to the extent permitted by law, by agreeing to these Terms, you consent to Microsoft’s collection, use and disclosure of Your Content and Data as described in the Privacy Statement."
The consent is embedded in the act of agreeing to the Terms, making it a blanket consent rather than granular opt-in. The scope of 'Your Content' explicitly captures AI-generated inputs, which raises data-use risk for users who did not carefully review the Privacy Statement.
AI-generated interpretation, not legal advice.
Common questions about Microsoft 365 Copilot's policies
- Does Microsoft 365 Copilot train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 5 verified findings from Microsoft 365 Copilot's published policy. Informational only, not legal advice.
- Can you use Microsoft 365 Copilot's output commercially?
- Commercial use allowed — with conditions — based on 12 verified findings from Microsoft 365 Copilot's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Microsoft 365 Copilot's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
75 verified clausesClauses in Microsoft 365 Copilot's policies that work in your favour — commitments the platform made to you.
- Privacy & data useads & tracking use
“You can choose whether you wish to receive promotional communications from Microsoft by email, SMS, physical mail, and telephone. If you receive promotional email or SMS messages from us and would like to opt out, you can do so by following the directions in t…”
Grants users the right to opt out of receiving promotional communications from Microsoft across multiple channels (email, SMS, physical mail, telephone) and specifies the procedures for exercising that right, including i…
📍 Privacy Policy › “Your communications preferences”Jump to exact text → - Privacy & data useproduct telemetry/usage tracking
“Inking and typing Recognition . You also can choose to help Microsoft improve inking and typing recognition by sending inking and typing diagnostic data. If you choose to do so, Microsoft will collect samples of the content you type or write to improve feature…”
This clause describes the optional permission users may grant for Microsoft to collect inking and typing diagnostic data to improve recognition features, and explains how Microsoft processes and de-identifies such data,…
📍 Privacy Policy › “Diagnostics”Jump to exact text → - Privacy & data usesensitive data (biometric/location/health)
“If you choose, cameras can be used to sign you in automatically using your iris. To do this, HoloLens takes an image of your iris and measures distances between key points to create and store a numeric value that represents only you. This data stays on the Hol…”
This segment describes the iris authentication data processing procedure, including how the numeric value is created, stored on-device, not shared, and can be deleted, as well as hand gesture data processing that is not…
📍 Privacy Policy › “Enterprise and developer software and enterprise appliances”Jump to exact text → - Privacy & data useproduct telemetry/usage tracking
“PC Manager will block pop-ups based on ad-block rules and the pop-up windows selected by you through custom block. If you agree to join the “Microsoft PC Manager Pop-up Plan,” when you block pop-up windows through custom block, you can help us optimize the pop…”
Explains that if the user joins the PC Manager Pop-up Plan, screenshots and window metadata are sent to Microsoft, retained only for a short period, and then deleted, establishing data-collection, use, and retention obli…
📍 Privacy Policy › “Windows apps”Jump to exact text → - Privacy & data use
“You have choices when it comes to the technology you use and the data you share. When we ask you to provide personal data, you can decline. Many of our products require some personal data to provide you with a service. If you choose not to provide data -requir…”
Identifies the legal bases Microsoft relies upon for processing personal data — consent, legitimate interests, contractual necessity, and legal obligation — defining the legal justifications that govern all downstream pr…
📍 Privacy Policy › “Personal data we collect”Jump to exact text → - Privacy & data usesensitive data (biometric/location/health)
“Windows Hello provides instant access to your devices through biometric authentication. If you turn it on, Windows Hello uses your face, fingerprint, or iris to identify you based on a set of unique points or features that are extracted from the image and stor…”
States that biometric verification data (face, fingerprint, iris template) is stored only on-device, does not leave the device, remains until removed by the user, and is removed after significant inactivity, establishing…
📍 Privacy Policy › “Windows Hello”Jump to exact text →
+ 69 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
9 verified clausesWhat Microsoft 365 Copilot requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Commercial useconduct restrictions
“ii. Additional Outlook Terms. Outlook includes use of Bing Maps. Any content provided through Bing Maps, including geocodes, can only be used within the product through which the content is provided. Your use of Bing Maps is governed by the Bing Maps End Use…”
Incorporates the Bing Maps End User Terms of Use and the Microsoft Privacy Statement by reference as governing terms for Bing Maps content used within Outlook, and restricts use of geocodes to within the providing produc…
📍 Terms of Service › “Microsoft 365 Apps and Services”Jump to exact text → - Commercial useconduct restrictions
“For clarification purposes only, this notice does not limit or inhibit the use of the software provided under these Terms for normal business uses that are personal to that business which do not include (i) redistribution of the software to third parties, or (…”
Clarifies that the MPEG LA codec notice does not restrict normal business uses of the software that are personal to the business, provided such use does not involve redistribution to third parties or creation of VIDEO ST…
📍 Terms of Service › “NOTICES”Jump to exact text → - Commercial useconduct restrictions
“ii. Reverse Engineering. You may not use the AI services to discover any underlying components of the models, algorithms, and systems. For example, you may not try to determine and remove the weights of models or extract any parts of the AI services from your…”
Prohibits users from using AI services to reverse-engineer underlying models, algorithms, weights, or system components, protecting the confidentiality and intellectual property of Microsoft's AI infrastructure.
📍 Terms of Service › “AI Services”Jump to exact text → - Commercial useconduct restrictions
“b. The software is licensed, not sold, and Microsoft reserves all rights to the software not expressly granted by Microsoft, whether by implication, estoppel, or otherwise. This license does not give you any right to, and you may not:”
Declares the software is licensed not sold, reserves all rights not expressly granted to Microsoft, and introduces the list of specific prohibited uses that follow, establishing the restrictive scope of the software lice…
📍 Terms of Service › “Software License”Jump to exact text → - Commercial useconduct restrictions
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”
Prohibits use of AI services or data derived from them to create, train, or improve any AI technology directly or indirectly, constituting a binding restriction on downstream training use of AI outputs.
📍 Terms of Service › “AI Services”Jump to exact text →
+ 4 more verified clauses of this kind on this platform, cited in full in the report.
What the policies actually cover
12 topics- Product telemetry & usage tracking23 protective197 clauses
- Advertising & tracking7 protective63 clauses
- Sale or sharing of personal data2 protective4 clauses
- Sensitive data (biometric, location, health)7 protective21 clauses
- Children's data5 protective15 clauses
- Government & law-enforcement disclosure1 clause
- Data shared with other AI providers1 clause
- Does not train on your content3 protective3 clauses
- Trains by default, opt-out available2 clauses
- Human review of your content3 clauses
- Breach-notification promises3 protective4 clauses
- Conduct restrictions9 obligations9 clauses
94 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Verified training clauses point in different directions: the Privacy Policy, Privacy Policy › “SwiftKey” describes use of content for training or improvement, while the Privacy Policy, Privacy Policy › “Collection of data from children” states content is not used for training. The clauses may govern different products, tiers, or data categories — the documents' text alone does not resolve it. Surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause restricts commercial use.
“The use of Skype is for your personal and noncommercial use. You are permitted to use Skype at work for your own business communications.”Open source citation
The clause restricts commercial use.
“The articles, text, photos, maps, videos, video players, and third-party material available on Bing and MSN, including through Microsoft bots, applications and programs, are for your noncommercial, personal use only. Other uses, including downloading, copying, or redistributing these materials, or using these materials or products to build your own products, are permitted only to the extent specifically authorized...”Open source citation
The clause restricts commercial use.
“g. Cortana. i. Personal Noncommercial Use. Cortana is Microsoft’s personal assistant Service. The features, services and content provided by Cortana (collectively "Cortana Services" ) are only for your personal and noncommercial use. ii. Functionality and Content. Cortana provides a range of features, some of which are personalized. Cortana Services may allow you to access services, information or function...”Open source citation
The clause restricts commercial use.
“The Xbox online service, ("Xbox Network"), Xbox Game Studios games (https://www.xbox.com/xbox-game-studios), applications, subscriptions (e.g., Xbox Game Pass subscription service offerings), services (e.g., Xbox Live and Xbox Cloud Gaming), and content provided by Microsoft (collectively, the " Xbox Services ") are only for your personal and noncommercial use.”Open source citation
The clause restricts commercial use.
“f. Bing and MSN. i. Bing and MSN Materials. The articles, text, photos, maps, videos, video players, and third-party material available on Bing and MSN, including through Microsoft bots, applications and programs, are for your noncommercial, personal use only. Other uses, including downloading, copying, or redistributing these materials, or using these materials or products to build your own products, are permitte...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | commercial use | conditional | MEDIUM | 16 |
| All applicable tiers | data retention | conditional | MEDIUM | 19 |
| Basic | commercial use | conditional | MEDIUM | 6 |
| Team / Business | commercial use | conditional | MEDIUM | 2 |
| Team / Business | data retention | conditional | MEDIUM | 7 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
model training worsened from low/no training claim to high/training permitted.
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”Before citation
“Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations. Improve and develop our products. As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here . Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.”After citation
model training improved from high/training permitted to low/no training claim.
“Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations. Improve and develop our products. As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here . Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.”Before citation
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”After citation
model training worsened from low/no training claim to high/training permitted.
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”Before citation
“Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations. Improve and develop our products. As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here . Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.”After citation
model training improved from high/training permitted to low/no training claim.
“Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations. Improve and develop our products. As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here . Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.”Before citation
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”After citation
model training worsened from low/no training claim to high/training permitted.
“iv. Limits on use of data from the AI Services. You may not use the AI services, or data from the AI services, to create, train, or improve (directly or indirectly) any AI technology.”Before citation
“Provide our products, which includes updating, securing, and troubleshooting, as well as providing support and making recommendations. Improve and develop our products. As part of our efforts to improve and develop our products, we may use your data to develop and train our AI models. Learn more here . Advertise and market to you, which includes sending promotional communications, personalized advertising, and presenting relevant offers.”After citation
Latest stance: arbitration or waiver on governing law disputes
“If you have a question or complaint related to participation by Microsoft in the DPF Frameworks, we encourage you to contact us via our privacy support and requests page. For any complaints related to the DPF Frameworks that Microsoft cannot resolve directly, we have chosen to cooperate with the relevant EU Data Protection Authority, or a panel established by the European data protection authorities, for resolving disputes with EU individuals, the UK Information Commissioner for resolving disputes with UK individuals, and the Swiss Federal Data Protection and Information Commissioner (FDPIC) for resolving disputes with Swiss individuals. Please contact us if you’d like us to direct you to your data protection authority contacts. As further explained in the DPF Principles, binding arbitration is available to address residual complaints not resolved by other means. Microsoft is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).”Open timeline citation
Latest stance: training with opt out on training use
“We will also use your conversation data to monitor performance, troubleshoot and fix bugs and issues, prevent abuse, and to provide and improve Microsoft Copilot. In some markets, this data can help train our AI models in Microsoft Copilot unless you opt out. Learn more about your choices and data protection here . Please also review the Transparency Note for Microsoft Copilot for information on our safety practices and our efforts to ensure that Copilot is consistent with our Responsible AI principles.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“Sharing data from Bing and Bing-powered experiences with third parties . We share some de-identified data from Bing and Bing-powered experiences with selected third parties. Before we do so, we run the data through a process designed to remove certain sensitive data that users may have included in the search terms themselves (such as social security numbers or credit card numbers). We require these third parties to keep the data secure and to not use the data for purposes other than for which it is provided.”Open timeline citation
Latest stance: third party or vendor sharing on privacy data use
“When you submit feedback about a problem to Microsoft, diagnostic data is sent to help improve Microsoft products and services. The Feedback Hub will either send this data automatically or give you the option to send it, depending on your diagnostic data settings in the Diagnostics & feedback section of Windows settings. Additional personal data may be collected based on the type of feedback you provide to better troubleshoot specific issues – for example, location data when providing feedback about location services. Microsoft may also share your feedback and related data with partners, like device manufacturers or firmware developers to assist in resolving issues with products and services that work with Windows. Learn more about diagnostic data in Windows .”Open timeline citation
Capture recency
- Terms of Service:Last captured 2026-08-28· verified 2026-08-03
- Privacy Policy:Last captured 2026-08-28· verified 2026-08-28
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↓ 62 fewer findings this quarter vs last (469 vs 531). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Microsoft 365 Copilot's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Microsoft 365 Copilot's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.