Windows Privacy Settings for Home Users Guide: What to Change and Why

A new Windows 11 PC shares more about how you use it than most people realise, and the controls are spread across a dozen Settings pages and your Microsoft account. Diagnostic data, activity history, the advertising ID, app permissions, location, search, speech and, on Copilot+ PCs, Recall all have their own switches, and some of them changed names in recent updates. This guide explains what each setting does according to Microsoft's own documentation, which choice suits most households, and what a setting cannot do. It is written for home users, families and people who look after a small office's PCs, and it assumes Windows 11; Windows 10 paths are similar but that version is out of mainstream support.

Key takeaways

• Diagnostic data can be reduced, not switched off, on Home and Pro. Choose Required rather than Optional; the "off" level exists only on Enterprise, Education and Server editions.
• Advertising settings change relevance, not volume. Turning off the advertising ID and Personalized offers stops Windows using your activity to tailor ads and tips, but Microsoft says you will not see fewer ads.
• App permissions only cover Store-style apps. Microsoft states that Windows privacy settings do not control how traditional desktop apps access your data, so what you install matters as much as any toggle.
• Some data lives in your Microsoft account, not on the PC. Search, location and browsing history tied to your account are cleared from the privacy dashboard at account.microsoft.com/privacy, not from Settings.
• Re-check after big updates. Microsoft has renamed and moved several of these settings between releases, so a review after each annual feature update catches new switches.

Where your data goes: the settings at a glance

Most controls are under Start > Settings > Privacy & security. The table summarises each one, where its data is kept, and the setting most home users should choose.

Diagnostics and feedback

Windows sends diagnostic data to Microsoft at one of two levels on consumer editions.

• Required: the minimum Microsoft says it needs to keep the device secure, up to date and working, such as device settings and capabilities.
• Optional: adds websites you browse, app activity, enhanced error reporting and memory state during crashes. Microsoft notes crash memory can occasionally include parts of a file you were using. Optional also includes everything in Required.
• Diagnostic Data Viewer: turn on View diagnostic data, then Open Diagnostic Data Viewer to see what is sent. It shows data in real time only, not history.
• Delete diagnostic data: the Delete button removes diagnostic data Microsoft holds for the device, but not data linked to your Microsoft account, and it does not stop future sending.
• Tailored experiences: renamed Personalized offers in newer Windows 11 builds ("Get personalized tips, ads, and recommendations based on my Windows activity"). Turn it off if you do not want diagnostic data used for suggestions.
• Improve inking & typing: sends samples of what you type or write to improve recognition and prediction. Microsoft says samples are split up and stripped of identifiers, but off is the cautious choice.
• Feedback frequency: set to Never if the prompts are unwanted.

For a small office managing PCs, Microsoft documents the Group Policy Allow diagnostic data under Computer Configuration > Administrative Templates > Windows Components > Data Collection and Preview Builds, and the MDM policy System/AllowTelemetry. Value 1 is Required and 3 is Optional; value 0 (diagnostic data off) applies only to Enterprise, Education and Server editions. The same path holds Limit dump collection and Limit diagnostic log collection, which reduce what is sent with crash reports.

Activity history and Timeline

Activity history records the apps and services you use, the files you open and the websites you browse. On current Windows 11 it is stored locally. Microsoft states that sending activity history to Microsoft was deprecated from Windows 11 22H2 and 23H2, but older versions still send it if the option is enabled.

1. Go to Settings > Privacy & security > Activity history.
2. Turn off Store my activity history on this device.
3. Select Clear history next to Clear activity history for this account.

Microsoft says cloud copies from before the January 2024 update (KB5034204) can be removed with the same button, and other cloud data is deleted automatically within 30 days of its last sync. Activity history is also a forensic record: anyone with access to your account can see what you opened, which is a reason to turn it off on shared PCs.

Advertising ID and recommendations

These switches sit on the General page, or on the newer Recommendations & offers page that is replacing it.

• Let apps show me personalized ads by using my advertising ID: each user has a unique ID that apps and ad networks can use. Turning it off makes ads less relevant, not fewer, and turning it back on issues a new ID. It does not affect website cookies; for those see the Browser Privacy and Security Settings Guide.
• Let websites show me locally relevant content by accessing my language list: lets sites read your language preferences. Low risk, but it adds to browser fingerprinting.
• Let Windows improve Start and search results by tracking app launches: local ranking of your most used apps. Turn off on shared PCs if you do not want others to see what you use most.
• Show me suggested content in the Settings app: suggestions for features and apps. Off removes promotional prompts.

Microsoft's ad preferences for your account are separate, at account.microsoft.com/privacy/ad-settings.

App permissions: camera, microphone, location and more

Each permission has its own page under Settings > Privacy & security, where you choose which apps can use it. Microsoft lists over 30 capabilities; these are the ones worth reviewing first.

The desktop app gap: Microsoft's documentation states that Windows privacy settings do not control how desktop apps access personal data, and that an app which installs its own driver can reach the camera or microphone directly. Microsoft's own advice is to install only from trusted sources, read the app's privacy settings, and physically disconnect or disable hardware when you need certainty. A camera cover is a sensible low-tech addition.

Location

• Location services: the device-wide switch, visible to administrators only.
• Let apps access your location: the per-user switch, with per-app choices and the date and time each app last used your location.
• Notify when apps request location: keep on so you see unexpected requests.
• Default location: an address apps use when a precise fix is not available; leave blank unless needed.
• Location history: Microsoft removed local location history storage in March 2025. History tied to your account is cleared at account.microsoft.com with Clear location activity.

Two limits are worth knowing. When location is on, Windows sends nearby Wi-Fi access point data to Microsoft in de-identified form, which Microsoft says it may share with location partners. And third-party apps can still estimate your location from Wi-Fi, Bluetooth or mobile signals even when Windows location is off.

Search, speech and typing

• Search permissions: SafeSearch (Strict, Moderate or Off); Cloud content search for your Microsoft account and for work or school accounts; and Clear device search history. Turn off cloud content search for the Microsoft account if you do not want OneDrive and Outlook results mixed into Start search. Web search history tied to your account is on the privacy dashboard.
• Online speech recognition: when on, voice is sent to Microsoft to create transcriptions. When off, only on-device features such as Narrator work. Contributing voice clips is a separate, optional choice in voice typing settings (Windows key + H).
• Custom inking and typing word list: a personal dictionary tied to your Microsoft account. Turning it off clears the list.

Recall on Copilot+ PCs

Recall takes periodic snapshots of the screen so you can search what you have seen. According to Microsoft it is available only on Copilot+ PCs, is off by default and must be turned on by each user, stores and analyses snapshots locally, encrypts them with keys protected by the TPM and tied to Windows Hello, and requires a biometric sign-in option. Sensitive information filtering is on by default and tries to exclude passwords, national ID numbers and card numbers.

• If you do not want it: leave Save snapshots off under Settings > Privacy & security > Recall & snapshots, or remove Recall through Turn Windows features on or off.
• If you use it: exclude banking, health and password manager apps and sites, set a short retention period, and keep sensitive information filtering on. Private browsing windows are not saved.
• Shared PCs: snapshots are per user and other users cannot decrypt them, but anyone who can unlock your session can search your history.

Where identity fits

Several settings follow your Microsoft account rather than the device: search history, location activity, the custom word list and ad settings. That makes account security part of privacy. Use a strong sign-in with passkeys or an authenticator, review signed-in devices, and give each family member their own Windows account so activity history, Recall and permissions are not shared. See the Microsoft Account Security Guide and the Windows 11 Security Settings Guide.

A 20-minute privacy review

1. Update first. Install pending updates so you see the current settings pages; older builds can still send activity history to Microsoft.
2. Diagnostics & feedback: set Required, turn off Personalized offers (or Tailored experiences) and Improve inking & typing, and press Delete under Delete diagnostic data.
3. Activity history: turn off storage and clear history.
4. General or Recommendations & offers: turn off the advertising ID and suggested content.
5. App permissions: walk through Camera, Microphone, Location, Contacts and the file permissions; remove apps that do not need access.
6. Search and Speech: clear device search history; decide on cloud content search and online speech recognition.
7. Recall: if present, confirm it is off or configured with filters.
8. Privacy dashboard: sign in at account.microsoft.com/privacy and clear search, browsing and location activity you do not want kept.

Undoing a change: every setting above can be switched back on the same page. The exceptions are deletions (history, diagnostic data, word list), which are permanent, and the advertising ID, which comes back as a new ID.

Choosing how far to go: a single-user laptop gains most from the advertising, diagnostics and permissions steps. A shared family PC gains most from separate accounts and turning off activity history and Recall. A small office should set diagnostic data and advertising policies centrally rather than relying on each user. See the Family Cyber Security Plan Template.

Checking it stays that way

Home users do not have a monitoring team, so measure with a few simple checks.

• Settings drift after updates: repeat the review after each annual feature update and note any new switches.
• Apps with camera, microphone or location access: count them; the number should only grow when you install something deliberately.
• Unexpected location use: look at the last-accessed times on the Location page.
• Dashboard data: check the privacy dashboard every few months for categories that are filling up.
• Accounts per person: one Windows account per family member on shared PCs.

Common failure patterns

• Clearing the PC but not the account. Account-linked search and location history stays on the privacy dashboard until you clear it there.
• Trusting toggles for desktop software. A desktop app with broad access is not limited by the camera, microphone or location pages.
• Sharing one Windows account. Activity history, Recall snapshots and app launch tracking then expose each person's activity to everyone else.
• Using registry "debloat" scripts from the internet. Unknown scripts can disable security updates or Defender; prefer the documented settings and policies above.
• Setting once and forgetting. Renamed pages such as Recommendations & offers can introduce new switches that default to on.

Framework mapping

For a small office that manages its PCs, these settings support recognised controls.

Practitioner checklist

• Set diagnostic data to Required and delete existing diagnostic data.
• Turn off Personalized offers or Tailored experiences, the advertising ID and Settings suggestions.
• Turn off and clear activity history, especially on shared PCs.
• Review camera, microphone, location, contacts and file permissions app by app.
• Remove desktop apps you do not trust, since Windows permissions do not restrict them.
• Decide on cloud content search and online speech recognition, and clear device search history.
• Keep Recall off or configured with app and website filters and short retention.
• Clear account-linked history on the Microsoft privacy dashboard.
• Give each person their own Windows account and secure the Microsoft account sign-in.
• Repeat the review after every Windows feature update.

Standards and references

• Microsoft Support: Diagnostics, feedback, and privacy in Windows
• Microsoft Support: Windows activity history and your privacy
• Microsoft Support: Privacy settings for Recommendations and offers in Windows 11
• Microsoft Support: App permissions
• Microsoft Support: Windows desktop apps and privacy
• Microsoft Support: Windows location service and privacy
• Microsoft Support: Privacy and control over your Recall experience
• Microsoft Learn: Configure Windows diagnostic data in your organization

Related NHI Mgmt Group resources: Windows 11 Security Settings Guide · Mac Security Settings for Home Users Guide · Browser Privacy and Security Settings Guide · Microsoft Account Security Guide · Windows 10 End of Support for Home Users Guide