What Windows collects, and what you can switch off

Ask whether Windows spies on you and you’ll be handed two useless answers. One says it’s a keylogger posting your documents to advertisers. The other says it’s a few crash reports and you need to calm down. Both are wrong, and what’s left over is more awkward than either.

Three things that aren’t true

Windows used to upload your activity history, that rolling list of apps you opened and files you touched. It doesn’t any more. Microsoft removed the option to send it in an update on 23 January 2024, and it stays on the machine now. A lot of articles still say otherwise, because they were written earlier and nobody went back.

Recall doesn’t send your screenshots anywhere. Microsoft’s documentation leaves no room: “No internet or cloud connections are required or used to save and analyze snapshots. Snapshots aren’t sent to Microsoft.” Recall has real problems and they get their own section, but every one of them happens on your desk.

Microsoft also states flatly that it doesn’t mine your files or your mail for advertising: “Microsoft does not use what you say in emails, human-to-human chat, video calls or voice mail, or your documents, photos, or other personal files stored on your device or cloud storage to target ads to you.”

Those are three of the most repeated claims about Windows and not one of them survives contact with the documentation. So here’s the part that does.

The floor is not zero

Windows has four diagnostic data levels. Off, Required, Enhanced, Optional. Required is the default.

Microsoft’s documentation describes the first level, then adds a sentence: “This is only available on Windows Server, Windows Enterprise, and Windows Education editions.”

Windows 11 Home is absent from that list. So is Windows 11 Pro. If you bought your computer in a shop, there is no supported way to stop it sending diagnostic data to Microsoft. No toggle, no policy, no setting. The lowest available position is Required, and Required collects at 100 per cent sampling, so nothing is thinned or skipped along the way.

“Basic” is doing a lot of work as a label. Microsoft’s own field documentation puts the IMEI number of a machine with mobile data into the Required tier. Also the list of which applications are installed. Also how much processor time and memory each one consumed and how long it ran. Also your Microsoft Store behaviour, spelled out as “app downloads, installations, and updates” along with “Microsoft Store launches, page views, suspend and resumes, and obtaining licenses”. Very little of that helps anybody fix a crash.

What it feeds

Microsoft is direct about one use of it: “If you choose to turn on Tailored experiences, we will use your Windows diagnostic data to offer you personalized tips, ads, and recommendations to enhance Microsoft experiences.”

Ads. Microsoft’s word, in Microsoft’s sentence, about diagnostic data.

The advertising identifier produces a similar flash of candour. Windows gives every user a unique advertising ID that apps can read. You’re allowed to turn it off, and Microsoft tells you what that accomplishes: “Turning the advertising ID off will not reduce the number of ads you see, but it may mean that ads are less interesting and relevant to you.”

Read that twice. The switch doesn’t reduce the advertising. It makes the advertising worse at its job while leaving the quantity alone.

For a sense of scale, Microsoft’s search and news advertising revenue grew by 1.6 billion dollars in the 2025 financial year, up 13 per cent, which the company attributed to higher search volume and higher revenue per search.

The account

Microsoft’s specification page for Windows 11 puts it plainly: “Windows 11 Pro for personal use and Windows 11 Home require internet connectivity and a Microsoft account during initial device setup.”

There were ways around that. A small script called bypassnro was the common one, and Microsoft deleted it in March 2025, explaining that the deletion would “enhance security and user experience of Windows 11”.

In October 2025 it went further, and this wording repays slow reading:

We are removing known mechanisms for creating a local account in the Windows Setup experience (OOBE). While these mechanisms were often used to bypass Microsoft account setup, they also inadvertently skip critical setup screens, potentially causing users to exit OOBE with a device that is not fully configured for use. Users will need to complete OOBE with internet and a Microsoft account, to ensure device is setup correctly.

Something was taken away from you, and the taking is explained as a service to you. Your computer, by this account, is not correctly set up until it has been attached to an account at Microsoft.

Unless you live in Europe

This is the part that settles whether any of the above is necessary.

In June 2025 Microsoft published a list of changes it was making to Windows for the Digital Markets Act. In the European Economic Area you can uninstall the Microsoft Store. Edge stops asking to be your default browser unless you open Edge yourself. Microsoft’s own apps open links in the browser you chose rather than in Edge. Windows Search offers third-party search providers alongside Bing.

Since March 2024, again in the European Economic Area only, Edge’s diagnostic data is collected separately from Windows diagnostic data and has its own settings.

Organisations in the EEA are also enrolled automatically in an arrangement where Microsoft handles diagnostic data as a processor rather than as the controller of it. Elsewhere you reach that arrangement by buying a qualifying enterprise subscription. Microsoft’s wording: “If you don’t sign up for any of these enterprise services, Microsoft will act as controller for the diagnostic data.”

Recall’s snapshot export feature, likewise, exists only on machines in the EEA.

None of that is technically difficult, and all of it ships today, in the same operating system, to thirty countries. The only thing separating those countries from yours is a statute.

Recall, on your desk

The snapshots stay local, encrypted, keys held in the TPM, the whole thing gated behind Windows Hello and sealed in a hardware-isolated enclave. As architecture it’s serious work.

It leaks anyway, twice over. The Register tested the sensitive-information filter in August 2025 and got Recall to capture credit card numbers, a plain-text password sitting in an unlabelled file, and a PayPal username, largely by removing the surrounding labels the filter watches for. Then in March 2026 the researcher Alex Hagenah demonstrated that once you have authenticated, an ordinary program running as you, holding no administrator rights, can read the decrypted screenshots by attaching to the process that draws the timeline. Microsoft closed the case that April with no patch, on the grounds that the technique “operates within the current, documented security design of Recall”.

That assessment is correct. Which is the trouble with it.

The case for collecting any of this

Crash data fixes crashes. A company shipping one operating system to a billion machines, across every combination of hardware anyone has ever bolted together, has no other way of learning that a given driver on a given chipset falls over after a given update. Most of what sits in the Required tier is what you would collect if that were your honest aim.

Microsoft documents it better than most, too. The field-level lists are public and you can go and read what each event carries. Almost nothing on your phone offers you that.

So the complaint isn’t collection. It’s that the floor isn’t zero, that the floor is specifically not zero on the editions ordinary people are sold, and that the same company ships a lower floor to Europe because Europe passed a law about it.

What Linux collects, accurately

Not nothing.

Ubuntu shows a screen during installation offering to send system details to Canonical, with Yes already ticked. You untick it or it goes. What goes is a one-off description of your hardware, once per release, rather than a running feed.

Fedora counts machines using a value sent when your system contacts a package mirror, roughly weekly. It’s deliberately built with no persistent identifier of any kind, which is thoughtful design rather than an accident, and Fedora’s broader desktop metrics proposal was dropped and closed rather than shipped.

Linux Mint ships no operating system telemetry at all. Its website runs analytics on some pages and logs addresses the way every web server does, and the Firefox that comes with it has its own telemetry that answers to Mozilla, not to Mint.

The difference isn’t purity. It’s that every one of those can be switched off by any user on any edition, and none of them is the entry fee for using the computer.

If you want to see what the first few days look like, your first week on Linux covers the settings worth looking at straight away.