Microsoft (Copilot)

Microsoft 365 Copilot's contractual protection is genuinely one of the strongest in this tab - your tenant's prompts are excluded from foundation-model training and retention is tenant-controlled - but it doesn't protect against the failure mode that actually happens, because Copilot inherits existing permissions and will cheerfully surface anything an employee technically has access to: the HR folder nobody locked down, the finance spreadsheet on an open SharePoint site, the old anyone-with-the-link file. In other words the tool converts sloppy file permissions into an instant, searchable disclosure engine, and the contract has nothing to say about it. Two other splits matter: consumer Copilot runs under entirely different terms than the enterprise product employees think they're using, and as of January 7, 2026 Microsoft enabled Anthropic as a default subprocessor whose processing sits outside the EU Data Boundary - disabled by default for EU and UK tenants, on by default for everyone else.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. None recorded — Unverified - heuristic first draft.

Arbitration

Y - the Microsoft Services Agreement contains a binding arbitration clause and class action waiver for US consumers, (individual arbitration before JAMS). There is NO general opt-out at sign-up: the only opt-out-type right (MSA § 15.f) lets a user reject a future change to section 15 by personally signing and mailing notice within 30 days of the change. Co-defendant with OpenAI in the NYT publisher litigation (see OpenAI row) - that is a copyright case, not a consumer-privacy case.

Contacts

Privacy contact. No published privacy email; Microsoft routes requests via microsoft.com/concern/privacy (30-day response commitment)

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA