Microsoft Tracks Everything: What's True and What's Paranoia

What Microsoft actually collects

The honest core: Windows 11 sends Microsoft a steady stream of diagnostic data — app launches, crashes, hardware inventory, feature usage — even when you set it to the minimum "Required" level. The Diagnostic Data Viewer, a free Microsoft tool, shows you the raw events rather than asking you to trust anyone's blog post. On top of that sit the opt-in extras: activity history synced to your Microsoft account, an advertising ID apps can read, and Start menu searches forwarded to Bing when web results are enabled.

That's more collection than most users assume, and it's fair to dislike it. What it is not is surveillance-grade hoovering. No keystroke content, no documents, no microphone audio and no screenshots ride along in that stream. Distinguishing "too much telemetry for my taste" from "Windows is a keylogger" is the entire game.

• Diagnostic data — app and system events, crashes, hardware inventory, always at some level
• Activity history — a timeline of app and file usage, only if sync to your Microsoft account is on
• Advertising ID — a per-profile identifier apps may use for personalization, toggleable
• Start menu search — typed queries go online the moment web suggestions are enabled
• What's not collected: keystroke content, your documents, microphone audio, screen captures

Where the paranoia outruns the evidence

The viral claims — "Windows logs everything you type", "it uploads your files", "the mic is always hot" — all trace back to a kernel of truth stretched into fiction. There is a typing-and-inking telemetry feature, but it ships off, collects recognition samples only when you opt in, and the setting to disable it sits right in Settings. There is file collection — by OneDrive, which is what you installed it for. And the microphone is gated by per-app permissions you can audit in Privacy & security.

The other persistent myth is that blocking Microsoft's telemetry servers via the hosts file makes you safe. In practice, blunt host-file blocking breaks Windows Update, the Store and sometimes activation, and telemetry moves anyway. You gain breakage, not privacy.

What to actually switch off

Open Settings > Privacy & security and do four things: set Diagnostics & feedback to the lowest data level, turn off "Improve inking and typing", kill the advertising ID under General, and disable activity history sync. Add a local account instead of a Microsoft account if you want the timeline gone entirely. Ten minutes, no third-party tools, and you've removed the bulk of what Microsoft actually collects.

If your concern is traces on the machine itself, that's a different job. Recent files, search history and usage artifacts that Windows stores locally don't go to any server, but anyone with access to the PC can read them. A dedicated cleaner like Kleaner PRO wipes that local side in one pass, while the settings above keep the server side quiet.

Questions and Answers

Read next