licensing software privacy eula
Windows 10 Eula Privacy Rights
<p>Many are claiming that Windows 10's data collection is <a href="http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/" rel="noreferrer">much more invasive than previous Microsoft products</a>, even claiming that <a href="http://www.geek.com/microsoft/microsoft-clears-the-air-on-windows-10-keylogger-1606160/" rel="noreferrer">Windows 10 ships with a keylogger</a> and reports every keystroke back to Microsoft. Most locally, <a href="https://security.stackexchange.com/questions/96713/how-does-windows-10-allow-microsoft-to-spy-on-you">this question</a> on the Stack Exchange network makes some of the same claims.</p>
<p>However, it seems that many of those sources have conflated the developer pre-release version of Windows 10 with the official release, and I'm having trouble separating the wheat from the chaff. My goal in asking this question is to look past the sensationalist reporting and see what rights Microsoft holds.</p>
<p>The official <a href="http://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm" rel="noreferrer">End-User License Agreement</a> for the final retail release of Windows 10 says the following:</p>
<blockquote>
<p><strong>Privacy; Consent to Use of Data.</strong> Your privacy is important to us. Some of the software features send or receive information when using those features. Many of these features can be switched off in the user interface, or you can choose not to use them. By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features.</p>
</blockquote>
<p>The referenced <a href="http://www.microsoft.com/en-us/privacystatement/default.aspx" rel="noreferrer">Microsoft Privacy Statement</a> says the following:</p>
<blockquote>
<p>Microsoft collects data to operate effectively and provide you the best experiences with our services. [...] We get some of it by recording how you interact with our services by, for example, using technologies like cookies, and receiving error reports or usage data from software running on your device. We also obtain data from third parties (including other companies).</p>
<p>Microsoft uses the data we collect to provide you the services we offer, which includes using data to improve and personalize your experiences. [...] We use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files to target ads to you.</p>
<p>Windows 10 (&quot;Windows&quot;) is a personalized computing environment that enables you to seamlessly roam and access services, preferences and content across your computing devices from phones to tablets to the Surface Hub. Rather than residing as a static software program on your device, key components of Windows are cloud-based, and both cloud and local elements of Windows are updated regularly, providing you with the latest improvements and features. In order to provide this computing experience, we collect data about you, your device, and the way you use Windows. And because Windows is personal to you, we give you choices about the personal data we collect and how we use it.</p>
</blockquote>
<hr />
<p>Putting aside the technical question of what information the software actually does collect (which would be off topic)...</p>
<p>From a legal standpoint, in the retail version of Windows 10:</p>
<ul>
<li>How does Microsoft's claim to user data differ from previous versions of Windows?</li>
<li>Does Microsoft have the right to record arbitrary keystrokes or clicks made while using their operating system and send that data to external servers?</li>
<li>Does Microsoft have the right to share user usage data with third parties (such as advertising agencies), either at a price or without compensation? Despite saying that they currently don't use data directly from our personal files for this purpose, do they have a right to begin doing so at any time?</li>
</ul>

<p>(<strong>2019 update</strong> See comments for my exchange with @benrg updating this 2015 answer. In particular, they do a fair job of representing a much less &quot;paranoid&quot; take on MS's take on users' privacy than my highly skeptical one. Also, the links in the answer below are to the latest versions of the respective documents. Archive.org has 2015 versions at <a href="https://web.archive.org/web/20150801002634/https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm" rel="nofollow noreferrer">2015 EULA</a> and <a href="https://web.archive.org/web/20150930181210/http://www.microsoft.com/en-us/privacystatement/default.aspx" rel="nofollow noreferrer">2105 privacy statement</a>.)</p>
<p><a href="https://en.wikipedia.org/wiki/IANAL" rel="nofollow noreferrer">IANAL</a>. This answer is just a broad picture. It's a simple explanation of Microsoft's own words, as they were at the time of originally writing this (just after the final release of Windows 10).</p>
<p><strong>TL;DR:</strong></p>
<ul>
<li><p><strong>Microsoft does <em>not</em> recognize users' privacy rights.</strong> The <a href="https://privacy.microsoft.com/en-US/" rel="nofollow noreferrer">Microsoft Privacy document</a> does not say <em>anything</em> positive about privacy in this document that isn't contradicted by their own words elsewhere in the same document.</p>
</li>
<li><p><strong>Microsoft <em>does</em> explicitly reserve rights to share users' private data</strong> with just about anyone and everyone.</p>
</li>
<li><p><strong>Microsoft explicitly disallows legal recourse regarding privacy.</strong> The <a href="https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm" rel="nofollow noreferrer">Windows 10 EULA</a> comprehensively denies legal recourse related to privacy (and indeed anything other than IP disputes).</p>
</li>
</ul>
<hr />
<h1>It's Microsoft's offerings as a whole, not (just) Windows 10</h1>
<p>The key document to focus on is <a href="https://privacy.microsoft.com/en-US/" rel="nofollow noreferrer">Microsoft's Privacy policy document</a>.</p>
<p>This policy applies to many Microsoft products and services, including, but definitely not limited to, Windows 10.</p>
<h1>Microsoft reserve the right to share your private data</h1>
<p>Quoting the &quot;Privacy&quot; document, Microsoft reserves the right to share users' private data:</p>
<blockquote>
<p>among Microsoft-controlled affiliates and subsidiaries</p>
<p>with vendors or agents working on our behalf</p>
<p>as part of a corporate transaction such as a merger or sale of assets</p>
<p>[to] comply with applicable law</p>
<p>[to] respond to valid legal process</p>
<p>[to] protect our customers, for example to prevent spam</p>
<p>[to] operate and maintain the security of our services</p>
<p>[to] protect the rights or property of Microsoft</p>
<p>as necessary to complete any transaction or provide any service you have requested or authorized</p>
</blockquote>
<h1>Do users have any privacy rights?</h1>
<p>One can presumably fight for one's (perceived) rights even if Microsoft attempts to deny them.</p>
<p>However, from the <a href="https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/UseTerms_Retail_Windows_10_English.htm" rel="nofollow noreferrer">English Windows 10 EULA</a>:</p>
<blockquote>
<p>you and we agree to try for 60 days to resolve [a dispute] informally. If we can’t, you and we agree to binding individual arbitration ... and not to sue in court</p>
</blockquote>
<p>Additionally, collective action or any other form of representative action is explicitly disallowed.</p>
<h1>Windows 10 data collection defaults to &quot;Full&quot; mode</h1>
<p>You've said that <em>what</em> data is collected is off topic. But I think it's worth recognizing that, with Windows 10, Microsoft have made the most popular install option collect and send to their cloud all data collected from your local device (&quot;Full&quot; collection) and have effectively made it a breach of contract to reduce it below a minimal level (&quot;Basic&quot; collection) that they get to determine and change as they see fit. And they can pretty much enforce the latter; if you hack a system to stop &quot;Basic&quot; data being sent to MS, they explicitly disable updates for that system.</p>

<p>To quote from the Microsoft Privacy Statement: "<em>We use data to help make the ads we show you more relevant to you. However, we do not use what you say in email, chat, video calls or voice mail, or your documents, photos or other personal files <strong>to target ads to you</strong>."</em><br>
So they do not use it to target ads - but they have an open field on anything else they wish to do with the content of email, chat, video calls and voicemail.  This 'free' version of windows appears to be a development version and it is sending back debug information to Microsoft.  If your personal photos, social security number or credit card details are sent to Microsoft they will not use them for targeting ads but appear to have carte blanche to use them for anything else. </p>
