Microsoft’s commitment to GDPR, privacy and customers’ control of their own data
blogs.microsoft.com
blogs.microsoft.com
Microsoft privacy: inability to opt out of all data collection unless you pay for enterprise edition.
This makes a mockery of any policy.
Microsoft is scum. They have not changed from the 90s, they are just better at hiding it.
Really the deal breakers for me recently are:
1. Privacy defaults to none and can only be optimised for none in Windows 10. Only did they back down for enterprise customers because they know they wouldn’t get away with it.
2. Bundling of crapware.
3. Shipping on by default telemetry in dev toolchain (.net core)
4. Blinding marketing detracting from the masses of data collection.
5. Any attempts to confront this result in silence, “it’s good for you” or “tough shit”.
They’re not a good citizen. They just tell you they are.
Unfortunately my livelihood depends on them at least in the short term.
You can disable those ads. You can remove apps like Skype. Manually or with an app such as O&O Shut Up. I also use Classic Shell instead of the new start menu.
Really? I though that was just standard corporate marketing.
Do you buy a car and have to peel all the advertising stickers off the windscreen, disable the tracking devices and scrub candy crush off the dashboard.
Nope.
Yep, something akin to that. Nearly all dealerships - whether luxury brands or not - place some form of dealership identification / promotion on your car when you buy it and without asking permission. That can be a sticker in the door well, it can be an obnoxious attached badge physically on the car surface (never happens with luxury dealerships), it can be a license plate frame, and so on.
I hate them! I've scrubbed them off a few cars now.
My current one is an 08.
Agreed.
They're no longer selling software licences, but targeted ads based on what you do locally on your personal computer.
And people "allow" this by not jumping through hoops to disable it.
They're doing both, but Google does something like that as well (that doesn't make it right, but it puts it in perspective that its the newest rage), and Microsoft is a convicted monopolist. The old Microsoft was much more evil than the current.
What about Guitar Hero crap boundled with every Mac?
How dare they ship privacy respecting productivity software with their OS instead of Candy Crush!
But indeed, are we really comparing a productivity tool that isn't used to extract more money to a third-party game that thrives on in-app purchases?
I guess that Windows users are generally less upset about such bundling, since OEMs have done it for years.
Windows users, myself included, have always been upset about the bundling. When you buy a PC these days you have to spend about 2-3 hours removing all the crap from it or doing an install from scratch to remove the cocked up default windows install. I think that less upset is more toleration via attrition. Accepting the status quo.
In a stock install of Windows you will have Windows Store installs of Candy Crush and some other junk, but none of it is running when the machine boots. It's also very simple to delete, but it is annoying it is there in the first place.
Microsoft placed it into my library and you can't remove it unless you first install it and then uninstall it and I don't want to install it so I'm stuck with it. It's egregiously a dark pattern[0]. On the other hand Garage Band is first party code which presumably enjoys the same level of quality as the main OS so it's fine.
Same thing on iOS.
Edit: changed “the App Store” to “their app store”, since that’s a common term that Apple shouldn’t have been able to misappropriate.
In today's world where the OS is the web, that doesn't really apply.
GDPR - I would expect that, for windows (which I believe comes pre-loaded with spyware), you would have to explicitly opt in
> Microsoft privacy: inability to opt out of all data collection unless you pay for enterprise edition.
Which just proves that it isn't essential to be opted in
Can I now (in 4 days time), ask Microsoft for all the data it's hoovered up from my Windows 10 installation?
I've only seen people talking about GDPR as it applies to websites, but as far as I'm aware, it applies to all software.
Did you go to the dasboard linked in the article?
https://account.microsoft.com/privacy
It does show non-website data, such as voice queries, location data, media played, product & service performance, app & service activity, Cortana notebook (commute preferences, etc.). It seems that you can also clear this data in the dashboard.
Not only that but you can’t opt out from data collection at the moment.
https://docs.microsoft.com/en-us/windows/privacy/basic-level...
There's enough information in there to identify a machine and user via correlation.
Here's a full analytical report: https://www.lda.bayern.de/media/windows_10_report.pdf
[1] By contrast to anonymization, Article 4(5) of the GDPR defines pseudonymization as “the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information.” By holding the de-identified data separately from the “additional information,” the GDPR permits data handlers to use personal data more liberally without fear of infringing the rights of data subjects. This is because the data only becomes identifiable when both elements are held together.
[1] https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-...
(26)
The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person.
I have no clue what information they'd need from you to answer that question, but at least you can get a response without having to send a physical letter.
* I work at Microsoft.
And as others mentioned: the portal is useless for people without MS account. What about those?
How? Unless you have Windows 10 Enterprise Microsoft will not allow you to opt-out of basic telemetry.
> What do you see on your report that you want to stop?
Why does that matter?
I'd also suggest asking for proof. For that you will require non encrypted traffic streams and/or source code ...
I took those lines basically verbatim (translated from Danish) from Just-Eat's Danish website. I am pretty sure they're violating GDPR, based on what they say in their privacy policy. Collecting usage data and sending data to third-party marketing companies is not vital to running a food ordering website. A ToS is not a legally binding contract, and I have not been asked for direct consent to their use of my data.
The entire privacy policy is very well done (and beautifully designed, I may add). Clear options, transparency over who gets your data, ability to use the product without providing PII and all sorts of other goodies.
Specific quotes related to consent:
> If you have previously given consent to our processing your data you can freely withdraw such consent at any time. You can do this by emailing us at support@juro.com. If you do withdraw your consent, and if we do not have another legal basis for processing your information, then we will stop processing your personal data.
Disclaimer: I'm not affiliated with Juno nor am I their user. I just randomly stumbled upon their privacy policy.
Upon opening it, you'll see a button labeled "Cookie-instellingen aanpassen". Clicking on it allows you to fine tune their cookie policy. "Functional" and "Analytics" categories can't be disabled, while the other (third-party) cookies can.
The new e-Privacy Regulation coming into force next year will however, as presently drafted, provide an exception from consent for analytics programmes that only use gathered data on a per-site basis (so excluding Google Analytics for example).
I run a Pi-Hole [0] to redirect all advertising-related queries to a black hole. When tracking the most-blocked domains, Microsoft is at the very top [1].
For instance, when I enter "Office" into the start menu, Microsoft immediately sends a ping to bing.com and Microsoft's telemetry servers. That is, Microsoft is sending all of the data entered into the start menu to Microsoft's servers, even when using the 'Pro' version and with 'full' telemtry off.
When it was first detected that Microsoft was adding telemetry calls to all compiled programs in Windows [2], Microsoft said it was mostly for event debugging for programmers. Now I'm not so sure -- look at your Microsoft account privacy settings to see that Microsoft tracks when you open applications. (They say on the page that not all data is shown there).
Unforutnately, there is no way to opt out of this. You can "disable" full telemetry, but you still have to opt into "Basic" telemetry, which still sends your advertiser ID, the programs you run, and the queries you put into the start menu. I'm concerned that Microsoft is not going to stop here. They have a real incentive to capture as much data about you as they can -- they currently earn about $1 billion in advertising through Bing.com search queries. Unlike Google or especially Facebook, however, it's much more difficult to opt out of Microsoft's tracking -- so many people depend on Microsoft Office or other Windows programs that I can't fully switch to Linux.
I don't know how this is acceptable through GDPR. There are so many problems with what Microsoft is doing:
1. There is no way to opt out of telemetry
2. There is no way to see all of the data that Microsoft has collected
3. Microsoft has severe lock-in because so much software is written for Windows-only
4. Microsoft has an incentive to increase their telemetry, not decrease it.
[1] https://imgur.com/a/MbjtYJe
[2] https://old.reddit.com/r/cpp/comments/4ibauu/visual_studio_a...
This is an example of what you get on startup, and cannot be skipped: https://twitter.com/baekdal/status/996391978957987845
Further to that (without wanting to be cynical), it's probably also easier for MS to avoid the potentially complex jurisdictional issues that GDPR raises. One privacy code-base to rule them all.
Besides Apple's sky-high margins and complete control over the iPhone ecosystem, with a vice-like grip on app developers, no reason whatsoever.
If Microsoft made $400 per Windows PC that was sold, and 30 cents on every dollar of windows software ever sold (And had a competitor called Froogle with a steady 70% market share, whose business was based on user monetization), they'd probably be less interested in monetizing their users. I'm not entirely sure that's a world you'd want to live in, though.
Strong privacy offerings might cut that to - what? $6bn?
It's entirely plausible that companies will actually see their income increase.
Anyone who tried to disable the Windows 10 tracking knows what a load of shit that statement is.