I Went Looking for Microsoft Clarity. I Found a Privacy Rabbit Hole.

So I Was Just Looking For An Analytics Tool And Then This Happened

Okay so funny story. I was looking for a free analytics tool for this blog, nothing serious, just wanted to see where the eleven people who read this thing actually come from. Microsoft Clarity kept popping up. Free heatmaps, session recordings, whatever. Fine, normal Tuesday, I’ll just install it and move on with my life.

Except I have this dumb habit where I actually read the privacy statement before installing something on my own site, and three tabs later I’m not thinking about heatmaps anymore, I’m thinking about Copilot training data and a newspaper lawsuit and, weirdly, some German regulators. This is basically how every research rabbit hole in my life goes. I open one boring document and forty minutes later I’ve forgotten what I was originally doing.

Anyway. Here’s what’s actually in there.

Your Data Trains The AI Unless You Say Otherwise

Copilot uses your stuff for AI training by default. Bing activity, MSN, your actual Copilot conversations, your voice if you’ve used voice mode, any images or files you’ve uploaded. All of it goes in unless you dig through settings and turn it off yourself.

I don’t think this is illegal, everyone does some version of it now. But sit with the framing for a second, the default assumption is “we take it unless you object,” not the other way around. Most people are never going to find that toggle. Honestly most people don’t know the toggle exists.

18 Months, Officially. Maybe Longer, Unofficially

Copilot conversation activity gets kept for 18 months by default, which I checked that specific number, it’s real, it’s in their support docs plainly. There’s also a claim floating around about ad-personalization data eventually going out to something like five years for signed-in users. I couldn’t independently confirm that second number anywhere outside the original document, so don’t take my word on the five-year figure specifically. The 18 months I’ll stand behind. That’s already longer than I assumed, for what it’s worth, before I went looking.

If you’ve never sat down and read one of these full retention pages front to back, I’d actually recommend it once, just so you know what “by default” means in practice for the accounts you already have.

The Human Review Thing Has No Off Switch

If Microsoft suspects a code of conduct violation, there’s a human review step, and there’s no opt out from it. Which, fine, I suppose. But… what do they do with data they collected? Like does this get trained on?Say an abusive material is there, they caught it, then do they actually discard it or train the ai on it to get better flagging? How do they train abusive material? All these questions are left unanswered by micoslop… sorry micosoft

Six Countries Are Just… Excluded

Also one more thing, reading through, Microsoft apparently excludes a handful of countries entirely from AI training. Brazil, China, Israel, Nigeria, South Korea, Vietnam, roughly. Too lazy to check again so these are recollections from what I read and again straight from their own statement, I haven’t found it independently confirmed anywhere else.

My issue is why THOSE six?, Brazil’s got LGPD, South Korea’s got PIPA, those are actual serious data protection frameworks. Vietnam and Nigeria are, I assume, different reasons entirely, maybe political risk rather than a specific privacy law. Lumping six very different countries into one exclusion list without explaining any of it is kind of a cop-out, honestly, and I wish someone with actual legal reporting chops would go dig into why each one specifically got carved out.

Copilot Vision processes biometric stuff. Faces, hands, whatever’s in frame. You consent once and that covers every future Copilot experience involving image or video, indefinitely, until presumably you go dig up wherever the revoke button lives.

A one-time for yes for an ongoing biometric capability is the exact shape of thing that’s caused legal headaches for other companies before, Illinois has a whole law around this (BIPA), and it’s usually the kind of thing that regulators come back around to eventually, even years later.

The Actual Lawsuits Part

Okay, that’s what’s written down in the privacy statement itself. Now the stuff happening around it in actual courtrooms, which honestly might be the bigger story.

Roughly 400 local newspapers, give or take, sued Microsoft and OpenAI back in late June over how ChatGPT and Copilot got trained. I believe it’s technically a handful of publishing groups bundled together representing that many individual newspaper titles — don’t quote me on the exact legal structure, I’m fuzzy on it. If the papers win, that’s real money, and possibly Microsoft having to retrain models or start paying licensing fees. My honest guess is this drags for years. Copyright cases like this usually do, and a lot of similar fights in other industries quietly end in licensing deals instead of a dramatic verdict nobody expects one anytime soon, myself included.

There’s also a separate thing where the New York Times and some other plaintiffs asked a judge to sanction OpenAI over claims about deleted or messed-with evidence during discovery. I think this one’s more interesting than the newspaper suit actually. Copilot leans on OpenAI’s tech, so if that sanctions fight goes badly, it’s probably not staying contained to just OpenAI.

Then GitHub Copilot has its own separate wrinkle. Sometime earlier this year individual-tier users got auto-enrolled into training data collection, opt-out instead of opt-in again, while Business and Enterprise tiers are exempt. So freelancers and solo devs on the cheap tiers are default-in. Companies paying for Enterprise are covered automatically. As far as I could tell that part checks out and isn’t just dev forum paranoia, though I’ll admit dev forums do have a habit of turning “opt-out by default” into “they’re stealing your code,” which isn’t quite the same claim even if it rhymes.

The EU Thing Almost Nobody’s Talking About

This one I mostly found buried in the docs, not anywhere with a big headline, so I want to flag that up front. For EU business tenants set up after March 2026, apparently there’s a setting called Flex Routing that ships turned on by default, and it lets Copilot processing happen outside the EU during high-demand periods, meaning your prompts might get routed somewhere else instead of staying in Europe. An admin can turn it off. It’s just already on unless someone finds it.

German regulators reportedly flagged some concern about Microsoft’s standard Copilot data terms too, no fine attached as far as I saw, just a documented concern from one country’s authority. That’s usually either the start of something or it fizzles out completely and nobody remembers it happened. Could go either way.

So Is There Actually A Pattern Or Am I Just Tired

Look, individually none of this is a smoking gun. Opt-out training isn’t illegal. An 18 month retention window isn’t illegal. Flex Routing defaulting to on isn’t illegal, an admin can flip it off. But put next to each other, six or seven separate defaults, all leaning the same direction, all requiring the user to go find the safer option instead of starting there, it feels less like a coincidence and more like corporate shit housery. And this is a company that blotted a paid OS.And meanwhile, at the exact same time all this consumer-facing “trust us, you’re in control” language is out there, Microsoft’s also fighting multiple lawsuits over how the underlying training data got sourced to begin with, plus that OpenAI sanctions mess that could bleed into their own product. Two different conversations, happening in parallel, that most coverage treats as unrelated stories when they’re really just two ends of the same rope.

Anyway. I went looking for a heatmap tool. Still haven’t installed Clarity actually, I got distracted before I finished the setup. Might go back and do that later. Or not.