Most people blast through the Windows 11 setup, click “next” on everything, and never open the privacy settings again. And honestly, that’s by design. Microsoft ships Windows 11 with nearly all data-sharing options switched on by default. Unless you actively go looking, you won’t know what’s being collected or where it ends up.
The obvious stuff like location and camera access tends to get noticed. But there are a few buried settings that quietly share way more than you’d expect. Here’s what they actually do and which ones you should turn off.
Diagnostic Data and Tailored Experiences
Under Settings > Privacy & security > Diagnostics & feedback, there are two tiers of diagnostic data: required and optional. Required diagnostics cover basic device info and error reports. Optional diagnostics, which are turned on by default, send a lot more. We’re talking browsing data from Microsoft Edge, app usage patterns, details about how you interact with different Windows features.
Then there’s the Tailored experiences toggle. This one takes your diagnostic data and uses it to personalise ads, tips and recommendations across Windows. If you turn it off, you’ll still get ads in the Start menu, but they won’t be targeted based on your activity.
Activity History and Cloud Sync
Windows 11 used to sync your activity history (apps opened, files accessed, websites visited in Edge) across devices through your Microsoft account. Microsoft deprecated that cloud sync in January 2024, and on newer builds the Activity History settings page has been removed entirely.
If you’re running an older version of Windows 11, check under Settings > Privacy & security > Activity history and turn off “Store my activity history on this device.” On current builds, activity history is local-only, but Windows still tracks what you do on the device for search and recommendation features.
Something else most people miss: clipboard history can sync across devices too. So if you’ve ever copied a password or a bit of sensitive text, that data could be sitting in Microsoft’s cloud without you realising.
File Storage and Where Your Data Actually Lives
OneDrive is baked deep into Windows 11. By default, it backs up your Desktop, Documents and Pictures folders to Microsoft’s cloud. Handy, sure. But OneDrive doesn’t use end-to-end encryption. Microsoft holds the encryption keys, which means the company can technically access your files. OneDrive does have a “Personal Vault” folder that adds extra identity verification before you can open it, but Microsoft still holds the encryption keys for those files too. The same goes for anyone who compromises your account or gets a valid legal request.
If file privacy is a priority, pairing Windows with free cloud storage that uses end-to-end encryption will give you a level of protection that Windows’ own settings can’t offer. With end-to-end encryption, your files get encrypted on your device before they leave it. Not even the storage provider can read them.
Advertising ID and App Permissions
Every Windows 11 device comes with a unique advertising ID that lets apps and ad networks track your behaviour across the system. You can reset or disable it under Settings > Privacy & security > General. While you’re in there, turn off the options that let Windows track app launches to improve search results and show suggested content.
There’s also a setting most people don’t know exists: inking and typing personalisation. Under Settings > Privacy & security > Inking & typing personalisation, Windows builds a personal dictionary based on what you type and write. That data feeds text suggestions and handwriting recognition. If you don’t use either feature, turn it off.
App permissions are another thing most people set once and forget about. Head to Privacy & security > App permissions and go through the list. Check which apps have access to your microphone, camera, contacts, and file system. You’ll probably find a few apps with permissions they have no business having.
What a Settings Audit Won’t Fix
Tweaking these settings will cut down on how much data leaves your machine, but it won’t stop tracking completely. Windows telemetry at the “required” level still sends data to Microsoft, and some features like Windows Update need a connection to work. Going fully offline, of course, isn’t realistic, but make sure the data you do share is data you’ve actively chosen to share, and that your files are stored somewhere only you can access.
Run through these settings once every few months, because Windows updates have a habit of resetting things quietly. And if you’re on a work machine, check with your IT team first, as some of these toggles may be managed by group policy.
About the author
Lydia White works as an inbound marketing expert for Niche In Bound, a leading UK-based agency dedicated to helping brands thrive in the ever-evolving digital landscape.
