Windows Privacy Settings: 20 Things to Change (11 & 10)

Windows 11 and 10 don't have one privacy switch — they have roughly two dozen of them, split across a Settings menu, a services list, and (on newer PCs) a Copilot+ menu most guides never open. Turning off the leaks means working through all three, not just the toggles under Settings > Privacy & security: location, microphone, diagnostic data, activity history, background apps, and the telemetry services running quietly in the background. Skip any one of them and Windows keeps sending data through the door you left open. Here's every setting, in the order that actually matters.

Jake's had this conversation twice this month. Both times a customer walked into his shop convinced their new laptop was "spying on them," and both times the actual problem was the same: nobody had ever opened the Privacy page during setup, because Windows doesn't make you.

That's the thing about these settings — they're not hidden, exactly. They're just easy to walk past. The Out-of-Box Experience asks you to sign in, connect to Wi-Fi, and accept a license agreement. It does not stop and ask which of twenty data-sharing toggles you want on. Every one of them defaults to whatever Microsoft decided was reasonable, and you find out what that was later, if you find out at all.

Windows 11: every privacy setting, one by one

Press Win + I to open Settings directly — it skips the Start menu search entirely. Click Privacy & security in the left-hand list. You'll land on a page split into three groups: Security, Windows permissions, and App permissions. Work through them top to bottom.

Windows permissions: location, camera, microphone, and the rest

These are per-device switches — turn one off and no app on the machine can use that sensor, no matter what its own settings say.

Location. Under Privacy & security > Location, turn off "Location services" at the top to kill it system-wide, or leave it on and scroll down to deny individual apps. Weather and Maps apps genuinely need it; a calculator app asking for your location does not.

Camera and Microphone. Same pattern — a master toggle, then a per-app list below it. If you video call rarely, turn the master switch off and flip it on only when you're about to join a call. It takes four seconds and closes the window the rest of the time.

Voice activation. This is the "Hey Copilot" wake-word listener. If you don't use it, turn it off — it means the microphone is not sitting in a low-power listening state waiting to hear its name.

Notifications and Account info. Notifications controls which apps can read the content of your notification banners (useful for automation tools, unnecessary for most apps). Account info controls which apps can see your name and profile picture — turn it off unless a specific app needs it to personalize your experience. One cosmetic side effect worth knowing about ahead of time: denying Account info can make some Microsoft Store apps show a generic gray avatar instead of your actual picture, and occasionally prompt a re-sign-in when you open the Store. It's harmless, just easy to mistake for something broken.

Contacts, Calendar, Phone calls, Call history, Email, Tasks, Messaging. Each is its own page with its own per-app list. On a desktop or laptop that never makes calls or sends texts, Phone calls and Call history can both be switched off entirely. Contacts and Calendar are worth leaving available only to the specific app you actually use for them — your email client, say — and denied to everything else. If you deny Contacts to an app that normally resolves phone numbers into names, expect it to start showing raw numbers instead of names on incoming calls or messages inside that app; that's the toggle working as intended, not a bug.

Radios, Other devices, Background apps. Radios covers Bluetooth discovery. Other devices covers syncing with devices Microsoft hasn't paired directly, useful mainly for some smart-home and health apps — leave it off unless you use one. Background apps is the big one: this is the master list of every app allowed to run, sync, and send data while you're not looking at it. Go through it and turn off anything you didn't install on purpose.

App diagnostics. This is separate from Windows' own diagnostic data (below) — it lets third-party apps read the list of other apps running on your PC, which is mostly used for crash reporting. Few apps need it; deny by default and grant it only if something breaks because of the denial.

Diagnostics & feedback, activity history, and search

Scroll to the Security group at the top of Privacy & security and open Diagnostics & feedback. This is the page that actually controls what Windows itself sends to Microsoft, separate from anything an individual app does.

Turn off "Send optional diagnostic data" — Windows always sends a smaller "required" set that keeps Windows Update and security functions working, and Microsoft doesn't let you disable that baseline on Home or Pro, but the optional layer on top is yours to switch off. Turn off "Tailored experiences," which is the setting that lets Microsoft use your diagnostic data to personalize tips and suggestions inside Windows. Set feedback frequency to "Never" if you don't want to be asked.

Back on the main Privacy & security page, open Activity history and turn off "Store my activity history on this device." This is the feature behind Task View's timeline of recently used apps and documents — useful if you want to pick up a document on a different PC, invasive if you'd rather Windows not keep that log at all.

Under General, near the top of the App permissions section, there's also "Let apps show me personalized ads by using my advertising ID." This is a per-Windows-account identifier that lets apps build an ad profile tied to you specifically, separate from any tracking a website does on its own. Turn it off.

If you have a Copilot+ PC: Recall and friends

Copilot+ PCs — the ones with a neural processing unit rated at 40+ TOPS, usually advertised on the box — ship with an extra layer of features an ordinary PC does not have: Recall, Click to Do, live-caption translation, and on-device photo and paint AI. Recall in particular takes periodic screenshots of your activity so you can search back through it later. If that's not something you want running, it's opt-in rather than something you have to hunt down and disable — Settings > Privacy & security > Recall & snapshots is where you'd manage it if you'd turned it on. On a PC without a Copilot+ badge, none of this applies; those features simply aren't present.

Windows 10: the same settings, older menu

Windows 10 reached the end of its support life on October 14, 2025. It still boots, still runs, and Defender definitions still update — but without enrolling in Extended Security Updates (ESU), it no longer receives free security patches, which makes tightening every privacy and security setting you can reach more worthwhile, not less. If you're not already enrolled, Settings > Windows Update has an "Enroll now" option; it's free if you back up your settings through Windows Backup, costs 1,000 Microsoft Rewards points, or runs a one-time roughly $30, and current coverage runs through October 2027.

The settings themselves live in the same place they always have: Settings > Privacy, opened with Win + I > Privacy. The categories match Windows 11 closely — General, Location, Camera, Microphone, Account info, Contacts, Calendar, and so on — so everything above under "Windows permissions" applies with only the page name different. A few things are worth calling out specifically because Windows 10's version of this page still shows them the old way:

General. Turn off "Let apps use advertising ID," "Let websites provide locally relevant content," and "Let Windows track app launches." That last one is the one most people miss — it feeds Windows' Start menu suggestions and is on by default.

Speech. If online speech recognition is on, turn it off unless you actively use voice dictation. Windows 10's version of this page is simpler than Windows 11's separate "Voice activation" category, but the effect is the same — it stops the microphone from being used to improve speech models.

Diagnostics & feedback. Same as Windows 11: turn off optional diagnostic data and tailored experiences, and set feedback frequency to Never.

Turning off the background telemetry services

The Settings toggles above cover what apps and Windows features are allowed to do. There's a second layer underneath them: three Windows services that run continuously and handle the actual sending of diagnostic data and error reports. Disabling them is optional — the Settings toggles already tell Windows what it's allowed to collect — but it's a legitimate belt-and-suspenders step if you want the collection mechanism itself switched off, not just told to send less.

Press Win + R, type services.msc — short for the Microsoft Management Console snap-in that lists and controls every Windows service, the small background programs that run without ever showing a window — and hit Enter. Scroll to find:

• Windows Error Reporting Service — sends crash reports to Microsoft when an app or driver fails.
• Connected User Experiences and Telemetry — the main pipeline for the diagnostic data the Settings toggles above control.
• Diagnostic Tracking Service — feeds usage data into that same pipeline.

Right-click each one, choose Properties, and change "Startup type" to Disabled. Click Stop if the service is currently running, then Apply, then OK. This works identically on Windows 11 and Windows 10.

When a setting is grayed out

Two things cause a privacy toggle to be locked instead of just off: a work or school Microsoft Entra account with a policy attached, or Group Policy Editor settings (gpedit.msc) applied on a Pro, Enterprise, or Education edition — gpedit is a Microsoft Management Console snap-in that lets an administrator lock specific Windows behaviors, and it doesn't exist on Home at all. If a toggle won't budge and you're on a personal Microsoft account on Home edition, it's almost always the first cause; on Pro it's worth checking gpedit.msc > Computer Configuration > Administrative Templates for a matching policy someone (possibly a previous owner, or a workplace image) turned on. If you don't know the password to remove a management policy that's locking these settings on a work-owned device, you're not getting around it — that lock is doing its job.

Edge cases: laptops, tablets, VMs, and remote desktop

Laptops with a physical camera shutter. A hardware shutter physically blocks the lens, which is a stronger guarantee than any software toggle. It doesn't replace the Camera setting, though — the operating system still reports the camera as "in use" to any app that requests it, shutter or not, so the two protections do different jobs and are worth keeping together.

Tablets and 2-in-1 devices. Every setting above applies the same way on a tablet as a laptop. The one thing worth double-checking is the on-screen keyboard's own suggestions and dictation options, found separately under Settings > Time & language > Typing, since typing-pattern learning there is not part of the Privacy & security page at all.

Remote Desktop. If you're connecting to a work or home PC over Remote Desktop, the privacy settings that apply are the ones on the machine you're connecting to, not the device you're sitting at. Checking Privacy & security on your laptop tells you nothing about what the remote PC is configured to collect.

Virtual machines. A Windows VM has its own completely separate copy of every setting covered here — disabling a service inside the host doesn't touch the guest, and vice versa. If you're unsure whether disabling one of the telemetry services above will cause a problem on a PC you can't afford to break, a VM is a genuinely useful place to test the change first and see what, if anything, stops working before you touch the real machine.

Do you need a third-party privacy tool?

Tools like O&O ShutUp10++ exist specifically to flip every setting on this page (and a few more obscure registry-level ones) in a single pass, with presets ranging from "recommended" to "everything off." They're genuinely useful if you set up PCs for other people regularly and don't want to click through Settings twenty times a machine — Jake keeps one on a USB stick for exactly that reason.

Before installing any tool like this, it's worth a moment's caution: check that it comes from a source you actually trust, and that it isn't quietly doing the opposite of what it promises. A privacy tool that requires an account sign-in, phones home for "updates" on every launch, or bundles extra installers alongside itself is working against its own pitch. Stick to well-known, actively maintained projects, and download from the vendor's own site rather than a third-party download aggregator.

Doing this across multiple PCs — and after a reset

None of these settings survive a clean install, a factory reset, or a brand-new PC out of the box — they're per-installation, not tied to your Microsoft account in the cloud. That means the same fifteen-minute pass is waiting for you again the next time you reset, reinstall, or set up a new machine, whether that's next month or in three years.

If you're setting up more than one machine at a time — a small office, a household with several kids' laptops, a shop floor — clicking through Settings on each one doesn't scale either. Two options that do:

An unattend.xml answer file applied during a fresh install can pre-set several of the diagnostic and telemetry options before the PC ever reaches the desktop, so new machines come up already configured instead of needing a pass afterward.

Group Policy Editor, on Pro, Enterprise, or Education editions, lets you set these under Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds, and the setting sticks even if a user later tries to turn it back on themselves — useful for shared or business machines, not something you'd bother with for your own PC at home.

For a single personal PC, the simplest version of "automation" is just keeping a short written note of which toggles you changed. It sounds unnecessary until the day you're staring at a freshly reset PC trying to remember whether you'd turned off Activity history or just meant to.

Frequently asked questions

Does turning off diagnostic data slow down Windows Update?

No. Windows Update runs on the required diagnostic data baseline, which you can't disable on Home or Pro and which isn't affected by turning off the optional layer. Updates still download and install on their normal schedule.

Will disabling Connected User Experiences and Telemetry break anything?

For most people, no. A small number of Microsoft's own diagnostic and feedback tools rely on it, so if a "Send feedback" button inside an app like Feedback Hub stops responding, that's the service being off — set it back to Manual startup rather than leaving it fully disabled if that happens.

Is my Microsoft account itself a privacy risk?

It's a bigger single point of data than any individual toggle on this page, since it ties your PC's settings, activity, and (if you use them) OneDrive files to one identity Microsoft can see across devices. It's not something most people can avoid entirely — both Home and Pro require one during setup for personal PCs — but you can go to Settings > Accounts > Your info afterward and choose "Sign in with a local account instead" if you'd rather not have the PC itself tied to that account day to day.

Should I turn off location services even for Find My Device?

That's a real trade-off, not a clean answer. Turning off Location services system-wide also disables Find My Device, which is genuinely useful if a laptop is lost or stolen. If that matters to you, leave the master Location toggle on and deny it individually to every app except Find My Device.

Why is my privacy setting grayed out on a work laptop?

A managed Microsoft Entra work or school account applies policy that can lock privacy settings so employees can't disable data controls IT relies on. You won't be able to change it from your side, and that's by design — it's worth asking IT directly what's locked and why, rather than trying to work around it.

Do these settings carry over if I upgrade from Windows 10 to Windows 11?

An in-place upgrade generally preserves your existing Settings > Privacy choices, since the underlying values map to the same features under new page names. It's still worth a fresh pass through the reorganized Windows 11 menu afterward, since a couple of categories (Voice activation, App diagnostics) exist as their own separate toggles in Windows 11 where they were bundled differently before.

Does a VPN replace any of these settings?

No — a VPN hides your network traffic and location from your internet provider and the sites you visit; it does nothing about what Windows itself or the apps installed on your PC collect locally. The two address completely different problems and most people benefit from doing both, not one instead of the other.

What's the difference between "required" and "optional" diagnostic data?

Required diagnostic data is the minimum Windows sends to keep security, Windows Update, and basic device health working, and Microsoft doesn't offer a way to switch it off on Home or Pro editions. Optional diagnostic data adds more detail on top of that — app usage patterns, browsing history within Microsoft's own apps, and error details — and that layer is the one you can turn off under Diagnostics & feedback.

I don't have a Copilot+ PC — do I still need to worry about Recall?

No. Recall and the rest of the Copilot+ feature set only exist on PCs with a qualifying neural processing unit, which is a specific piece of hardware most PCs sold before 2024 and many since don't have. If your PC isn't marketed as Copilot+, that menu and those features simply aren't present to configure.

Does turning off Background apps stop my antivirus from working?

No — Windows Security runs as a system service, not as a listed background app, so it isn't affected by that toggle. The Background apps list controls ordinary third-party and Microsoft Store apps, not built-in security components.

Is it worth paying for Windows 10 Extended Security Updates just for privacy reasons?

Not on its own — ESU is about continuing to receive security patches after October 14, 2025, which is a different problem from the settings on this page. But an unpatched PC is a bigger privacy risk than any single toggle here, since unpatched security holes are how attackers actually get at your data, so if you're staying on Windows 10 past its support date, ESU and the settings in this guide are worth doing together rather than one instead of the other.

Can apps still access my contacts if I deny it in Settings but grant it inside the app itself?

No. The Windows-level toggle is the outer gate — if it's denied there, the app's own internal permission screen is irrelevant, because Windows never hands over the data regardless of what the app asks for or what you agree to inside it.

Should I disable the microphone entirely or just deny specific apps?

Denying specific apps is usually the better default — it lets tools you actually use for calls or dictation keep working while blocking everything else. Turn off the master switch entirely only if you genuinely never use the microphone for anything, since re-enabling it later means remembering which apps to re-grant.

Does any of this stop websites from tracking me in the browser?

No — everything in this guide is Windows-level and app-level, not browser-level. Browser tracking (cookies, fingerprinting, ad networks) is controlled separately, inside your browser's own privacy and tracking-prevention settings.

Do these settings reset after a Windows reset or clean install?

Yes, every setting on this page. A reset or reinstall returns the machine to Microsoft's defaults, so the whole pass needs redoing afterward — there's no cloud-saved version of your choices tied to your Microsoft account that a fresh install picks back up automatically.

Is there a faster way to audit these settings than clicking through Settings by hand?

For a single PC, no reliable shortcut beats going through Privacy & security directly — there isn't an official, fully documented command-line equivalent for every one of these toggles. On a fleet of managed PCs, Group Policy is the supported route for setting and auditing them in bulk rather than editing individual registry keys by hand.

Revision note. Originally published March 18, 2016. Rewritten August 16, 2026 for Windows 11 and Windows 10. The single Privacy page this guide once pointed to has since moved to Privacy & security and split into more categories, Wi-Fi Sense and the old Cortana speech-training button are gone, and a Copilot+ layer now exists on newer hardware — the goal of the guide hasn't changed even though nearly every menu it points to has. If you've made it this far still unsure whether you got everything, you haven't missed the point of the exercise — you've just done more to protect your own data today than most people ever will.