PIPEDA Report of Findings #2018-004: Microsoft to obtain opt-in consent, enhance transparency for Windows 10 privacy settings
An anonymous complainant raised concerns that Microsoft Windows 10 defaulted several privacy settings to "on" during installation, and these settings were difficult to understand and change. The OPC investigated whether Microsoft obtained valid consent for collecting, using, and disclosing personal information via these default settings. Initial concerns about clarity and consistency were shared with Microsoft regarding the original Windows 10 version. Following the Creators Update, the OPC identified further issues, particularly regarding the meaningfulness of consent for Location, Diagnostics, Tailored Experiences, Relevant Ads, and Speech Recognition settings, noting confusion caused by conflating related practices. Microsoft cooperated and committed to implementing changes, including obtaining opt-in consent for all installation privacy settings, enhancing transparency, and correcting the functioning of Speech Recognition. The OPC found the complaint well-founded and conditionally resolved, pending Microsoft's implementation of these commitments by the end of 2018.
- 1Whether Microsoft obtained valid and meaningful consent for the collection, use, and disclosure of personal information through Windows 10 default privacy settings.
- 2Whether the initial Windows 10 (Version 1507) installation process provided sufficient prominence for customizing settings and adequate information via "Learn more" links.
- 3Whether the explanations for Advertising ID and Diagnostics settings in Version 1507 were clear, consistent, and comprehensive.
- 4Whether opt-out consent was appropriate for the Location setting in the Creators Update, and if Microsoft's explanations were sufficiently transparent regarding exceptions and the use of "de-identified location information."
- 5Whether "Full" Diagnostics should be the default setting, and if Microsoft's transparency regarding data collected at this level was adequate for meaningful consent.
- 6Whether Microsoft obtained valid consent for Tailored Experiences, particularly concerning the use of broad diagnostic data and the protection of sensitive information.
- 7Whether Microsoft's practices for Tailored Experiences complied with accountability requirements under Principle 4.1.4.
- 8Whether opt-out consent was appropriate for the Relevant Ads (Advertising ID) setting, and if Microsoft's communications clearly distinguished it from its own advertising program.
- 9Whether opt-out consent was appropriate for the Speech Recognition setting, given the sensitivity of voice data and its cloud-based nature.
- 10Whether Microsoft's explanations for Speech Recognition clearly distinguished between cloud-based and device-based functionality.
- 11Whether Microsoft consistently respected user choices regarding the Speech Recognition setting, especially when conflicting with Cortana settings.
- Consent for data collection: Complaint well-founded
- Clarity of privacy settings: Complaint well-founded
- Meaningfulness of consent: Complaint well-founded
- Transparency of practices: Commitments made by institution
- Functioning of Speech Recognition: Commitments made by institution
- Resolution of complaint: Conditionally resolved
Complaint well-founded and conditionally resolved
The OPC found that Microsoft's consent mechanisms for several Windows 10 privacy settings were not valid or meaningful, but Microsoft committed to implementing significant changes, including obtaining opt-in consent and enhancing transparency, to address these concerns.
Microsoft committed to obtaining opt-in consent for all installation privacy settings, enhancing privacy communications for transparency, augmenting privacy procedures to protect sensitive information, correcting the functioning of the Speech Recognition setting, and implementing measures to mitigate location tracking when the Location setting is off.
- subsection 6.1 PIPEDA
- Principle 4.3 PIPEDA
- Principle 4.3.2 PIPEDA
- Principle 4.3.4 PIPEDA
- Principle 4.3.5 PIPEDA
- Principle 4.3.6 PIPEDA
- Principle 4.1.4 PIPEDA
This summary is informational only and not legal advice.
Related by meaning
Decisions with similar reasoning and facts — found by AI across statutes and jurisdictions, not just keywords.
Coverage — 13 of 14 jurisdictions searchable
Fully searchable: Ontario, British Columbia, Alberta, Saskatchewan, Newfoundland and Labrador, Northwest Territories, New Brunswick, Manitoba.
Partial (recent decisions only): Federal (Canada) (651 of 1,631), Nova Scotia (49 of 472), Quebec (6 of 7,090), Prince Edward Island (2 of 279), Yukon (1 of 75).
Coming soon: Nunavut — being re-processed for AI search.
Find decisions like this one — by meaning, not keywords.
Related by meaning is a Pro feature. Upgrade to surface conceptually similar decisions across the corpus, powered by AI.
Upgrade to Pro