AI Privacy Tracker · Version 110426
Microsoft Copilot
Plain-English resources for lawyers, judges, and government attorneys who use AI, or want to.
Microsoft Copilot · Microsoft
Microsoft Copilot at a glance
Fit for client confidences after your usual vendor checks.
Keep client confidences and secrets out. Settings lower the risk but do not change the color.
Personal accounts: Microsoft does not say how fast deleted chats are erased. Work accounts: the organization's retention policies decide.
| Plan | Rating | Trains on your data? | How long kept | Can the provider read it? |
|---|---|---|---|---|
| Copilot, free, personal accountFree | Red | Unclear | 18 months (older app) | Yes; no opt-out offered |
| Copilot with Microsoft 365 Personal, Family, Premium, or ProPersonal $9.99/mo or $99.99/yr; Family $12.99/mo or $129.99/yr; Premium $19.99/mo or $199.99/yr (Copilot Pro retired); Microsoft 365 Pro $99.99/mo (monthly billing only) | Red | Not inside Word, Excel, PowerPoint | Not stated | Yes in the Copilot app |
| Copilot Chat with a work accountIncluded at no extra cost with eligible Microsoft 365 business plans; agents billed by use | Green | No | Firm sets via Purview | None documented |
| Microsoft Copilot, paid enterprise licenseEnterprise $30/user/mo paid yearly; Business add-on $21/user/mo ($18 promotional through Dec. 31, 2026) | Green | No | Firm sets via Purview | None documented |
Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. Select a plan for its full entry.
Deleting a chat
What deleting does on Microsoft Copilot
- Copilot on a personal account: what happens after a chat is deleted
- Not stated by the provider. Microsoft does not say how quickly deleted chats are removed from its systems. Provider page
- Copies kept anyway
- Saved memories are stored separately and are not deleted with the chat. Microsoft does not say whether chats already reviewed by staff or used for improvement are kept.
In short: deleting removes a chat from view, but it does not undo what has already happened to it. On business plans, the organization's retention settings decide how long chats are kept; each plan below explains how.
Plan by plan
Every Microsoft Copilot plan in detail
Open a plan for its rating, the settings that lower the risk, and short quotations from Microsoft's own policy with links.
Copilot, free, personal accountRedRated Red. The free tier can show ads chosen from what you type. Turning off ad personalization still allows ads based on the current chat. Microsoft's terms also let its staff review chats, with no way to opt out, and the consumer terms make no promise of confidentiality. No setting changes the rating.
Microsoft Copilot, free, personal Microsoft account. You use Copilot (copilot.microsoft.com, the Copilot app on Windows, Mac, or phone, or Copilot in Edge) signed in with a personal Microsoft account, such as an outlook.com, hotmail.com, or personal email address, with no paid Microsoft 365 subscription. Microsoft says Copilot shows a green shield when a work account protected by its business terms is signed in. Without the green shield, consumer terms apply. The same Copilot app accepts both kinds of account. Price: Free.
Microsoft says the new Copilot app (from Aug. 18, 2026) does not use prompts, responses, or files to train "foundation models." Its terms still let it use your content to improve Copilot. People may review chats. The free tier may show ads, and those ads can be personalized from your chat history.
Settings that lower the risk
- Allow ads personalizationWhat it does: Stops ads being chosen from your chat history and saved memories (generic ads based on the current chat can still appear).
- Saved memoriesWhat it does: Stops Copilot remembering details from your chats; turning it off does not delete memories already saved.
- One shared experienceWhat it does: Stops Copilot sharing personalization with Bing, Edge, and MSN.
- See ads that interest youWhat it does: Microsoft-wide personalized ads setting.
- Training on conversation activity; Training on voice conversationsWhat it does: In the pre-Aug. 18, 2026 app, these stop future chats being used to train Microsoft's AI models. The new app shows no training toggle.
Worth knowing
- Microsoft's own terms warn users not to share anything they would not want Microsoft to review.
- Connecting email, calendars, or cloud storage gives Copilot access to that content under the same consumer terms.
- Turning Memory off does not delete memories already saved.
What the policy says
“You shouldn't share any information with Copilot that you don't want us to review.”
Copilot Terms of Use, Important Disclosures & Warnings, Effective Aug. 18, 2026. Read the source
“If you use Copilot without a paid Microsoft 365 subscription, Copilot may include advertising.”
Copilot Terms of Use, Important Disclosures & Warnings, Effective Aug. 18, 2026. Read the source
“aren't used to train foundation models.”
Microsoft Copilot for individuals: your activity history, Your activity history, Aug. 18, 2026. Read the source
Your data, in plain English
- How long it is kept
- Not stated for the new app. The older app kept conversation history 18 months by default and uploaded files "no longer than 18 months". Copilot Vision images are deleted within 30 days after the conversation ends.
- What happens after you delete
- Not stated by the provider. Microsoft does not say how quickly deleted chats are removed from its systems.
- Copies kept anyway
- Saved memories are stored separately and are not deleted with the chat. Microsoft does not say whether chats already reviewed by staff or used for improvement are kept.
- Temporary chat
- Not documented for personal accounts. Microsoft's consumer privacy pages describe no temporary or private chat mode.
- Memory
- Yes. "Saved memories" lets Copilot remember details and preferences from your chats. Microsoft's new pages do not state the default; the older app's personalization was on by default. Turning memory off does not delete memories already saved.
- Who at the provider can read it
- Yes. Microsoft's terms say Copilot may involve manual (human) processing and warn not to share anything you do not want Microsoft to review. The new app offers no opt-out; the older app's FAQ said none was available and that outside research organizations may review conversations.
- Who else receives it
- Advertisers: the free tier may show ads, and personalized ads may use chat history and saved memories if allowed.
- Bing, Edge, and MSN through One shared experience.
- Models from OpenAI and other developers power Copilot.
- Microsoft discloses data to comply with law or valid legal process, including law enforcement.
- Data may be processed in the US or wherever Microsoft or its service providers operate.
- Contract
- Consumer terms: Microsoft Services Agreement, Copilot Terms of Use (effective Aug. 18, 2026), and Microsoft Privacy Statement; Microsoft is the controller, no data processing agreement.
All sources for this plan (11)
- Copilot Terms of Use, Ownership of Content. Supports: use to improve Copilot.
- Privacy FAQ for Microsoft Copilot (older app), Are Copilot conversations human reviewed?; Can I opt-out...; default storage. Supports: no human-review opt-out; external research organizations; 18-month retention (older app).
- Microsoft Copilot for individuals: your privacy controls and choices, Memory; Chat history; Personalized advertising. Supports: settings names and paths; delete one chat.
- Manage your Copilot activity history in the privacy dashboard, Copilot apps. Supports: delete all activity history.
- Microsoft Copilot privacy controls (older app), Model training. Supports: older-app training toggles and paths.
- Microsoft Privacy Statement, Artificial Intelligence and Copilot capabilities; Reasons we disclose personal data. Supports: Privacy Statement training and legal-process language.
- Microsoft Copilot for individuals: your data, privacy, and responsible AI, Governing terms. Supports: governing terms; personal accounts only.
- Transparency Note for Microsoft Copilot, Uploading images to Copilot Vision. Supports: Vision images deleted within 30 days.
Last checked against Microsoft's pages on October 25, 2026.
- Whether the new consumer app uses chats for any training beyond "foundation models"; the Privacy Statement still says Microsoft may use data to train its AI models, and no opt-out is documented in the new app.
- Whether a temporary or private chat mode exists for personal accounts.
- Whether consumer prompts are sent to third-party model providers (e.g., Anthropic) and on what terms.
Copilot Chat with a work accountGreenRated Green when you sign in with a work account. Under its Data Protection Addendum, Microsoft acts as the organization's processor. Microsoft does not train on the data. Chats are stored in the organization's own Microsoft 365 tenant, where the organization's retention policies apply. A green shield at the top of the screen shows that these protections are on.
Microsoft Copilot Chat with a work account (free; formerly Microsoft 365 Copilot Chat). Your firm uses Microsoft 365 for business, and you sign in to Copilot with your firm email (a Microsoft Entra work account), without a paid Copilot license. Microsoft says Copilot shows a green shield when a work account protected by its business terms is signed in. Without the green shield, consumer terms apply. The same Copilot app accepts both kinds of account. Price: Included at no extra cost with eligible Microsoft 365 business plans; agents billed by use.
Microsoft does not use prompts and responses to train foundation models. Microsoft's data protection addendum covers them. They are stored in the firm's own Microsoft 365 tenant. The firm sets retention there, and can search them for eDiscovery.
Settings that lower the risk
- Green shieldWhat it does: Confirms enterprise data protection applies to this chat.
- Allow web search in CopilotWhat it does: Web search queries go to Bing outside the data protection addendum and the HIPAA BAA.
- AI providers operating as Microsoft subprocessors (Anthropic models)What it does: Anthropic models are on by default for most commercial tenants outside the EU, EFTA, and UK.
Worth knowing
- Without the green shield, Copilot is most likely running on a personal account and consumer terms.
- Feedback can attach your prompt, response, and chat history if you allow it, and firm admins can see it with your name.
- Third-party agents run under their own terms.
What the policy says
“featuring a green shield along the top of the user interface”
Microsoft Copilot Chat Privacy and Protections, Enterprise data protection, Last updated Aug. 24, 2026. Read the source
“Copilot Chat does not use your data to train foundation models.”
Microsoft Copilot Chat Privacy and Protections, Training, Last updated Aug. 24, 2026. Read the source
“covered by the terms of the Microsoft Products and Services Data Protection Addendum (DPA)”
Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, Overview, Last updated Aug. 18, 2026. Read the source
Your data, in plain English
- How long it is kept
- Prompts and responses are stored in the firm's Exchange tenant for audit and eDiscovery, and uploaded files in your OneDrive for Business. The firm sets the keep period through Microsoft Purview retention policies; the controls available depend on the firm's Microsoft 365 plan, so ask IT. Web search citations stay in the chat for 24 hours.
- What happens after you delete
- Deleted items move to a hidden folder for at least one day, then are purged the next time a background job runs (typically within 1 to 7 days). Microsoft's example shows it can take up to about 16 days before an item stops appearing in eDiscovery searches. A litigation or eDiscovery hold suspends deletion.
- Copies kept anyway
- A Purview retention policy, Litigation Hold, or eDiscovery hold suspends permanent deletion, so the firm may keep chats you deleted. Files you saved with Copilot's help are not removed.
- Temporary chat
- Copilot Chat offers temporary chats. A temporary chat does not appear in history. It does not use or store personalized information. The firm's retention policy may still keep it, and IT may still access it.
- Memory
- Yes, Copilot Memory saves key information when on. The "Chat history & work insights" toggle (in chat settings) controls use of past chats; turning it off deletes inferences after 30 days.
- Who at the provider can read it
- Microsoft says Copilot services have opted out of Azure abuse monitoring, which includes human review; no Microsoft human review is documented. The firm's own admins can view logged prompts and responses through audit and eDiscovery tools, and feedback with your name.
- Who else receives it
- No advertising use under the data protection addendum. Web search queries go to Bing, where Microsoft acts as an independent controller outside the addendum. Anthropic models act as Microsoft subprocessors by default in most US tenants. Microsoft's addendum limits disclosure to law enforcement to cases required by law.
- Contract
- Microsoft Products and Services Data Protection Addendum and Product Terms, with Microsoft as processor; HIPAA supported for properly configured use, excluding web search.
All sources for this plan (14)
- Microsoft Copilot Chat Privacy and Protections, Retention; Web search. Supports: Exchange storage; Purview retention; OneDrive uploads; web search.
- Frequently asked questions about Microsoft Copilot Chat, EDP. Supports: EDP requires Entra sign-in.
- Copilot App Updates for Personal, Work, and School Accounts, Accounts. Supports: account switcher; accounts remain separate.
- Delete your Microsoft Copilot activity history, Steps. Supports: delete all activity (work).
- How Microsoft Copilot Chat history works, Delete a chat. Supports: delete one chat; chat history toggle.
- Personalize what Microsoft Copilot remembers, Temporary chat; Copilot Memory. Supports: temporary chat; memory.
- Learn about retention for Copilot & AI apps, How retention works. Supports: deletion mechanics and holds.
- Data, privacy, and security for web search in Microsoft 365 Copilot and Microsoft Copilot, Allow web search in Copilot. Supports: web search outside DPA; admin policy.
- Anthropic models in Microsoft Online Services, Overview. Supports: Anthropic on by default.
- Data, Privacy, and Security for Microsoft Copilot, Abuse monitoring. Supports: abuse monitoring opted out.
- Providing feedback (Microsoft Copilot), Feedback. Supports: feedback visible to admins.
Last checked against Microsoft's pages on October 25, 2026.
Microsoft Copilot, paid enterprise licenseGreenRated Green. Under its Data Protection Addendum, Microsoft acts as the organization's processor. Microsoft does not train on the data. Chats stay in the organization's own tenant, under its retention policies. This is the most protective Microsoft option. The main exposure is internal. Copilot can find anything the user already has permission to open.
Microsoft Copilot, paid enterprise license (formerly Microsoft 365 Copilot). Your firm pays for a Copilot license on top of Microsoft 365, so Copilot works inside Word, Outlook, Teams, and other apps and can search the firm's mail and files. You sign in with your firm email. Microsoft says Copilot shows a green shield when a work account protected by its business terms is signed in. Without the green shield, consumer terms apply. The same Copilot app accepts both kinds of account. Price: Enterprise $30/user/mo paid yearly; Business add-on $21/user/mo ($18 promotional through Dec. 31, 2026).
Microsoft does not use prompts, responses, or firm data to train foundation models. Microsoft acts as the firm's processor under its data protection addendum. That addendum forbids using the data for advertising. The firm controls retention, audit, and eDiscovery through Purview.
Settings that lower the risk
- Green shieldWhat it does: Confirms enterprise data protection applies.
- Allow web search in CopilotWhat it does: Web search queries leave the data protection addendum and the HIPAA BAA.
- AI providers operating as Microsoft subprocessors; Anthropic models with Data RetentionWhat it does: Anthropic models are on by default; the optional "with Data Retention" models fall outside Microsoft's DPA.
- SharePoint and Teams sharing, sensitivity labels, ethical wallsWhat it does: Copilot surfaces any file a user can open, so over-broad sharing becomes searchable.
Worth knowing
- Over-broad sharing settings and missing ethical walls become visible through Copilot, because it searches everything a user can open.
- Data sent through "Anthropic models with Data Retention" falls outside Microsoft's DPA, and Anthropic may keep it up to 30 days (flagged content longer).
- Feedback can attach prompts and content and is visible to firm admins with your name.
What the policy says
“Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs”
Data, Privacy, and Security for Microsoft Copilot, Overview, Last updated Aug. 18, 2026. Read the source
“with Microsoft acting as a data processor”
Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat, Overview, Last updated Aug. 18, 2026. Read the source
“Microsoft Copilot only surfaces organizational data to which individual users have at least view permissions.”
Data, Privacy, and Security for Microsoft Copilot, How Microsoft Copilot uses your data, Last updated Aug. 18, 2026. Read the source
Your data, in plain English
- How long it is kept
- Stored encrypted as your Copilot activity history in the firm's tenant; the firm sets the keep period with Purview retention policies. After the subscription ends, Microsoft keeps data 90 days in a limited-function account so the firm can export it, then deletes it within a further 90 days.
- What happens after you delete
- Deleted items move to a hidden folder for at least one day, then are purged the next time a background job runs (typically within 1 to 7 days). Microsoft's example shows it can take up to about 16 days before an item stops appearing in eDiscovery searches. A litigation or eDiscovery hold suspends deletion.
- Copies kept anyway
- Purview retention policies, Litigation Hold, and eDiscovery holds suspend permanent deletion. Files you saved are not removed.
- Temporary chat
- Copilot offers temporary chats. They do not appear in history, but the firm's retention policy may still keep them.
- Memory
- Yes, Copilot Memory and the "Chat history & work insights" toggle; turning the toggle off deletes inferences after 30 days.
- Who at the provider can read it
- No Microsoft human review documented: Copilot services opted out of Azure abuse monitoring. Microsoft personnel are bound by a confidentiality commitment. Firm admins can see chats through audit and eDiscovery.
- Who else receives it
- No advertising, profiling, or market research use under the addendum. Web search goes to Bing outside the addendum. Anthropic models act as subprocessors by default (outside the EU, EFTA, and UK). Third-party agents follow their own terms. Microsoft will not give law enforcement access unless required by law and will try to redirect demands to the firm.
- Contract
- Microsoft Products and Services Data Protection Addendum (May 2026) and Product Terms, Microsoft as processor; HIPAA BAA included for covered customers.
All sources for this plan (11)
- Data, privacy, and security for web search in Microsoft 365 Copilot and Microsoft Copilot, Web search. Supports: web search outside DPA.
- Data, Privacy, and Security for Microsoft Copilot, Abuse monitoring; Retention. Supports: abuse monitoring opted out; Purview retention.
- Microsoft Products and Services Data Protection Addendum (DPA), Processing to Provide Customer the Products and Services; Disclosure of Processed Data; Data Retention and Deletion. Supports: DPA terms: no ads, confidentiality, law enforcement, BAA, 90-day post-termination.
- Anthropic models in Microsoft Online Services, Overview. Supports: Anthropic subprocessor and Data Retention models.
- Delete your Microsoft Copilot activity history, Steps. Supports: delete all activity (work).
- Learn about retention for Copilot & AI apps, How retention works. Supports: deletion mechanics and holds.
- Copilot enterprise and business pricing, Plans. Supports: prices.
- Microsoft Copilot Chat Privacy and Protections, Enterprise data protection. Supports: green shield.
Last checked against Microsoft's pages on October 25, 2026.
- Copilot-specific SOC 2 Type II report not checked in the Service Trust Portal.
- Whether any court preservation order reaches Microsoft Copilot customer content.
Our criteria
How we rate
Each color answers one question: may a D.C. lawyer put client confidences and secrets into this plan? Each plan has one color, set by its contract. The settings in each entry lower the risk but do not change the color. The full method, with the ethics rules behind each test, is on the tracker page.
Fit for client confidences and secrets, after your usual vendor checks. All five are true:
- (1)A contract forbids the provider to train AI models on your content or use it for its own purposes.
- (2)A contract makes your content confidential and requires notice of a subpoena or government demand.
- (3)Staff and subcontractors see it only to run, support, or secure the service. Any outside AI model company is bound by the same terms.
- (4)Your organization can delete it or set how long it is kept.
- (5)The contract requires notice of a security breach, and an independent audit (SOC 2 Type II or ISO 27001) covers the service.
Use for client confidences only after you deal with the gap. A business contract forbids training and limits use, but at least one Green condition is missing. Common gaps:
- (1)Your organization cannot delete content or set retention.
- (2)An outside AI model company works under its own terms.
- (3)The contract lets the provider use your content, even de-identified, for its own purposes.
- (4)The contract does not treat your content as confidential.
- (5)The contract bars personal data, which client files contain.
Keep client confidences and secrets out. At least one of these is true:
- (1)The provider trains AI models on your content, or its terms let it.
- (2)Your content is used to choose ads.
- (3)Only consumer terms apply, so no contract keeps your content confidential.
Turning training off does not change the color. The only exception is the client's informed consent (D.C. Rule 1.6(e)(1)), and D.C. Bar Opinion 388 says clients typically should not be asked to consent to disclosures this broad.
Last checked against the provider's own pages on October 25, 2026. Quotations are kept short and link to the full page. Where the provider does not say something, we say so rather than guess. Ratings describe each provider's published standard terms; large customers often sign negotiated agreements that may differ. General information prepared by the BADC Young Lawyers Section AI Committee, not legal advice. Spotted an error or a change? Write to YLS@badc.org with the subject "Tracker correction."
Questions about the AI Committee, or want to get involved? Write to us directly.
YLS@badc.org