What Windows 11 Actually Collects
Windows 11 sends Microsoft diagnostic data (telemetry), uses an advertising ID to personalise ads, and logs activity history, app launches, and search terms. You cannot reduce required diagnostics to zero on Home or Pro, but everything optional can be switched off, and the difference is substantial.
Two categories are worth separating:
- Required diagnostic data — device details, settings, crash reports. Microsoft uses it to decide which updates are safe for your hardware. Cannot be disabled on Home or Pro.
- Optional diagnostic data — which apps you use and for how long, browsing in Edge, inking and typing samples. All of this can be turned off, and turning it off costs you nothing you will notice.
Cleaning up the OS in general? Pair this with how to debloat Windows 11.
Step 1: Minimise Diagnostic Data
- Settings → Privacy & security → Diagnostics & feedback.
- Turn off Send optional diagnostic data.
- Expand Tailored experiences and turn it off—this is what lets Microsoft use diagnostic data for personalised tips and ads.
- Expand Improve inking and typing and turn it off. This stops samples of what you type being sent for handwriting and typing models.
- Set Feedback frequency to Never.
- Under Delete diagnostic data, click Delete.
Step 2: Turn Off the Advertising ID
- Settings → Privacy & security → General.
- Turn off all four:
- Let apps show me personalized ads using my advertising ID
- Let websites show me locally relevant content by accessing my language list
- Let Windows improve Start and search results by tracking app launches
- Show me suggested content in the Settings app
Step 3: Stop Activity History
- Settings → Privacy & security → Activity history.
- Untick Store my activity history on this device.
- Click Clear history to wipe what has already been recorded.
- If you use a Microsoft account, also clear the cloud-side copy at
account.microsoft.com/privacy→ Activity history.
Step 4: Lock Down App Permissions
This is where the meaningful privacy gain is—far more than telemetry sliders.
- Settings → Privacy & security → scroll to App permissions.
- Work through Location, Camera, Microphone, Account info, Contacts, Calendar, and File system.
- In each, turn the master switch off if you never use it, or leave it on and disable individual apps that have no business needing it.
- Under Location, click Clear next to location history.
- Check App diagnostics—it lets one app read information about others, and very few need it.
Step 5: Trim Search and Cloud Sync
- Settings → Privacy & security → Search permissions.
- Turn off Microsoft account and Work or School account under Cloud content search—this stops your local Start-menu searches being sent to Bing.
- Turn off Show search highlights.
- Under History, turn off Search history on this device and click Clear device search history.
- If you do not use OneDrive, sign out of it to stop background sync—related: fix OneDrive sync issues.
Step 6: Group Policy (Pro and Enterprise)
On Windows 11 Pro you can set a lower telemetry level than the Settings app offers.
- Press
Win + R, typegpedit.msc, press Enter. - Go to Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds.
- Open Allow Diagnostic Data, set it to Enabled, and choose the lowest level available. On Pro this is Send required diagnostic data; the Diagnostic data off option only fully applies on Enterprise and Education.
- In the same folder, enable Do not show feedback notifications.
Step 7: Check the Cloud Side
Local settings do not touch what Microsoft already holds. Visit account.microsoft.com/privacy while signed in and clear:
- Browsing history
- Search history
- Location activity
- App and service activity
- Voice activity
Also review Settings → Accounts → Windows backup → Remember my preferences, which syncs settings across devices through your account.
What This Does and Does Not Achieve
It does: stop optional usage telemetry, remove ad personalisation, stop your Start-menu searches reaching Bing, and shut off app access to your camera, mic, and location.
It does not: make Windows anonymous. Required diagnostics continue, a Microsoft account still ties the device to you, and your ISP and the sites you visit see what they always did. If network-level privacy is the goal, that is a different job—see how to set up a VPN on Windows 11.
What Not to Do
- Don't disable Windows Update or Microsoft Defender in the name of privacy. You would trade telemetry for a genuine security hole. Keep them working: Windows Defender not working.
- Don't run "privacy tool" scripts that disable dozens of services. They routinely break the Microsoft Store, Windows Update, and Xbox sign-in, and the damage is hard to reverse.
- Don't block Microsoft telemetry endpoints in the hosts file. Windows ignores much of it, and it breaks activation and update checks.
Next Steps
- Harden the rest of the system: remove viruses and malware.
- Review what has access to your accounts: review and revoke app access and sessions.
Related guides
Set Up UAC and a Standard User Account in Windows 11
Running as administrator gives every program you open full control of the PC. Set UAC to always notify and move daily use to a standard account without losing anything.
Enable Controlled Folder Access in Windows 11
Controlled Folder Access stops unknown apps writing to Documents and Pictures, blocking ransomware before it encrypts. Turn it on and allow the apps you trust.
Enable Core Isolation and Memory Integrity in Windows 11
Memory Integrity blocks malicious drivers from loading into the Windows kernel. Turn it on, and fix the incompatible driver error that stops it switching on.
Enable LSA Protection and Credential Guard in Windows 11
Stop password-stealing tools reading saved credentials out of memory. Turn on LSA protection on any Windows 11 PC, and Credential Guard on Pro and Enterprise.
How to Secure Remote Desktop (RDP) in Windows 11
RDP exposed to the internet is a top ransomware entry point. Lock it down with Network Level Authentication, lockout policy, and a VPN instead of port forwarding.