There's a bit of FUD here - all web searches (Google, Bing, whatever) go to first parties that sell tidbits of information about your searches and a bit of space on their web pages to third parties. That much has always been known. The allegation that it passes local PC searches directly to advertisers well, that seems a little unfounded. So I checked, I installed fiddler, set it up to proxy my Windows 8.1 preview Surface Pro, and typed in some search terms.

Here's what I found as a result of typing in "procmon":

With "Use Bing to search online" disabled

--

When I begin typing in the search box, there is a single GET request to https://www.windowssearch.com/settings?setlang=en-US&cc=US with generic cookies that indicate my device type (the User-Agent is WindowsConnectedSearch/1.0 (Windows NT 6.3.0.0.9431.7;x64;Microsoft+Corporation;Surface+with+Windows+8+Pro;Slate;6.3.0;Touch;) and some cookies that may indicate a device or installation ID. It appears consistent between search results. However, "procmon" is not sent, nor is the first letter of my search result, and typing additional letters doesn't result in any more queries.

With "Get search suggestions and web results from Bing" enabled but "personalized results" disabled

--

Bing gets my search term when I finish typing. An explicit GET request for https://windowssearch.com/suggestions?qprocmon&cc=US&setlang... is sent and the response is, of all things, XML formatted with an <rss> element and tags that appear to indicate it's valid RSS. The cookies sent are the same as above, and no requests are sent to "advertisers", except it's reasonable to believe Microsoft might set the price for keywords based on their popularity.

With full personalized results enabled

--

Bing gets the above, plus a request was sent to https://www.windowssearch.com/fd/auth/signin?..etc.. to sign me in when I ticked the box. The request also sent a header indicating my current latitude, longitude, and accuracy, and appeared to send additional headers. But none of that went directly to advertisers, although Microsoft I'm sure can share it with whomever they like.

Now, lastly, until I actually click one of the non-local search suggestions that show up (not the files that show up) I don't get any more search queries. If I click one of the suggestions, like "procmon64.exe", I don't get any requests to any domain except "www.windowssearch.com". Even though I get thumbnails of web pages and snippets of relevant text below them, my request never went to an advertiser directly.

As well, even if I type a loaded search term like, I'll use the band "One Direction" for example, and select the search suggestion, I get a page with some local files (apparently One Direction matched EntityFramework.xml in some Visual Studio projects... interesting), artist information, tracks by them, albums and videos, web pages, Store apps, and related searches. But most importantly, my machine never contacted any remote host other than www.windowssearch.com.

So what Microsoft is doing is more innocuous than what the privacy-paranoid users of Ghostery already prevent. There were no third party domain names reached, no advertisers directly sent my search results, and never was the content of any local file uploaded. None of the GETs had a body.

Also, and finally, group policy can be used to completely disable the requests and businesses could always filter or block the domain windowssearch.com.

I'm a proponent for privacy, but let's not spread FUD.