How to Set Up Windows 11 Privacy & Security Settings in 2026
Fresh install, brand-new PC. Windows has already turned on ad tracking. It’s sending diagnostic data to Microsoft. It’s ready to hand your camera and microphone to any app that asks. Nobody flipped those switches for you. They came switched on.
Good news: fixing all of it takes about 15 minutes. You need nothing beyond the Settings app you already have. Here’s every privacy area worth checking, in the order that makes sense to change them.
What Is Privacy & Security in Windows 11?
Privacy & security is where Microsoft finally put all the scattered privacy controls from Windows 10 into one place. It covers advertising, diagnostics, activity tracking, app permissions, encryption, and (new for 2026) the toggles for Copilot and other AI features. It ships with every edition of Windows 11. You don’t need to install a thing.
Before You Begin
Make sure you have:
- [ ] A PC running Windows 11 (Home, Pro, or Enterprise all work)
- [ ] Administrator access to your account, needed for the encryption check
- [ ] About 15-20 minutes with no interruptions
- [ ] Your Microsoft account password handy, if you use one to sign in
| Requirement | Details |
|---|---|
| Device | Windows 11 PC (any edition) |
| OS version | Windows 11, any current update |
| Account | Local or Microsoft account; some steps differ slightly for each |
| Access level | Administrator, for BitLocker/device encryption |
If you’re setting up a brand-new PC rather than auditing an existing one, do this pass right after the initial setup screens. Do it before you install apps that might ask for their own permissions.
Step-by-Step Guide
Step 1: Understand why the defaults favor data collection
Microsoft ships new Windows 11 installs with ad personalization, optional diagnostic data, and activity tracking all switched on. That’s not an accident. Opting everyone in by default gives Microsoft and its ad partners more usable data. None of it is dangerous by itself, but it adds up. An advertiser can link your behavior across apps using your advertising ID. Microsoft can use your usage patterns to personalize tips and ads inside Settings. Apps can quietly read your location or microphone the first time they ask, and you may never see that prompt again.
The fix isn’t complicated, just scattered. Open Settings > Privacy & security and you’ll see every one of these controls in one scrollable pane on the left: General, Diagnostics & feedback, Activity history, App permissions, and (on newer builds) a Copilot/AI section. Press Windows key + I to jump straight there.
Step 2: Turn off the advertising ID and personalized ads
The advertising ID is a unique code Windows assigns your user account. It lets apps from different developers recognize you as the same person. That’s how they build a profile of your interests. Turning it off won’t make ads disappear. Apps still need to pay the bills somehow. But it does stop them from linking your activity across apps to target you specifically.
- Go to Settings > Privacy & security > General.
- Turn off Let apps show me personalized ads by using my advertising ID.
- On the same page, turn off Let websites show me locally relevant content by using my language list if you don’t want sites guessing your region from your language settings.
- Turn off Show me suggested content in the Settings app to stop Microsoft from surfacing promotional tips here.
Tip: This local toggle only affects your Windows account. If you also sign in to a Microsoft account on the web, visit account.microsoft.com/privacy later. Turn off ad personalization tied to your Microsoft account across all your devices, not just this PC.
Step 3: Set diagnostic data to the minimum and turn off tailored experiences
Windows always sends required diagnostic data back to Microsoft. This is basic device, security, and update health information it needs to keep Windows Update and driver delivery working. That part isn’t optional, and it’s fine, it’s not really about you. Optional diagnostic data is the layer you actually control. It adds browsing and usage history, app activity, and more detailed error reports. Turning it off doesn’t stop Windows from phoning home entirely. It just stops the extra, non-essential collection.
- Go to Settings > Privacy & security > Diagnostics & feedback.
- Under Diagnostic data, select Send required diagnostic data only (turn off Send optional diagnostic data if it appears as a separate switch on your build).
- Turn off Tailored experiences. This stops Microsoft from using your diagnostic data to personalize tips, ads, and recommendations shown in Windows.
- Scroll down and turn off Improve inking & typing recognition if you don’t want samples of your handwriting or typing sent for product improvement.
- Optionally, click Delete under View diagnostic data to clear what’s already been collected on this device.
Step 4: Turn off activity history and clear what’s already stored
Activity history is a local timeline of the apps, documents, and websites you’ve used recently. It powers features like the Alt + Tab-style recent-activity view. If you’re signed in with a Microsoft account, it can also sync that timeline to Microsoft’s servers so it follows you between devices. Here’s the part people miss: turning off the toggle stops new activity from being recorded, but it doesn’t delete what’s already saved. You have to clear that separately.
- Go to Settings > Privacy & security > Activity history.
- Turn off Store my activity history on this device.
- Click Clear activity history on the same page to delete what’s already stored locally.
- If you’re signed in with a Microsoft account, open a browser and go to account.microsoft.com/privacy. Clear the activity history and browsing data synced to the cloud from that dashboard.
Step 5: Review App permissions for location, camera, and microphone
Windows manages app permissions in two layers. A master switch controls whether a feature is available to any app at all. A per-app list underneath it controls each app individually. This is the single most common reason people think they turned something off and it “still works”: they only changed one of the two. Check both.
- Go to Settings > Privacy & security > App permissions to see the full list of categories, including Location, Camera, Microphone, Contacts, Calendar, and more.
- Click Location. Turn off Location services at the top if you don’t want any app using it, or leave it on and turn off individual apps you don’t trust in the list below (mapping and weather apps are reasonable exceptions).
- Click Camera. Turn off Camera access entirely if you rarely use it, or leave the master switch on and disable specific apps you don’t want triggering it, especially anything you didn’t install yourself.
- Click Microphone and repeat the same check: master switch first, then the per-app list.
Tip: Scroll further down the App permissions list and give the same two-minute check to Contacts, Calendar, and Documents. Those three quietly rack up the most access requests over time as you install new apps.
Step 6: Check device encryption and back up your BitLocker recovery key
Windows 11 encrypts your system drive by default on most modern hardware. If your laptop gets lost or stolen, the data on it is unreadable without the recovery key. You may see “Device encryption” (Home edition) or full “BitLocker” (Pro/Enterprise) depending on your hardware and edition. Both work the same way underneath.
- Go to Settings > Privacy & security and look for Device encryption. If it’s missing, sign in with a Microsoft account first, some Home-edition devices only show this option once you’re signed in.
- Confirm the status reads On. If it reads Off, click to turn it on (your device needs a TPM and Modern Standby support; older or custom-built desktops sometimes don’t qualify).
- Click Back up your recovery key and choose to save it to your Microsoft account (easiest to retrieve later), a USB drive, or a printed copy.
- On Pro or Enterprise editions, you can also search Start for “Manage BitLocker” to see a more detailed drive-by-drive encryption status and manage the recovery key from there.
Warning: Never rely on memory for your recovery key. If Windows ever asks for it after a hardware change or failed boot and you don’t have it saved, your files are gone for good.
Step 7: Review Copilot and AI data-sharing toggles
Windows Copilot and its underlying AI features can use context from what’s on your screen or your recent activity to answer questions more usefully. How much it shares, and whether it’s on at all, is controlled in two separate places: the OS and the browser.
- Go to Settings > Privacy & security > General (or the dedicated AI & Copilot section if your build shows one) and review any toggle for Copilot accessing app content or on-screen context. Turn it off if you don’t use Copilot or want to limit what it sees.
- If your PC is a Copilot+ PC with the Recall feature, go to Settings > Privacy & security > Recall & snapshots and confirm it’s off unless you’ve deliberately chosen to use it. Recall is opt-in and takes periodic screenshots of your activity for AI search.
- Open Microsoft Edge and click the Copilot icon to open the sidebar.
- Click the gear/settings icon inside the Copilot sidebar and review the toggle for sharing page content with Copilot while you browse. Turn it off if you don’t want Edge feeding page context to Copilot automatically.
Step 8: Lock down sign-in and account privacy basics
The last layer isn’t about data collection. It’s about what a stranger glancing at your unlocked or sleeping PC can see or access.
- Go to Settings > Accounts > Sign-in options.
- Under Additional settings, turn on For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device if every account on the PC supports it.
- Set If you’ve been away, when should Windows require you to sign in again to When PC wakes up from sleep.
- Scroll to Dynamic lock and pair a Bluetooth phone if you want Windows to lock automatically when you walk away.
- If your account email or full name shows on the lock screen and you’d rather it didn’t, go to Settings > Accounts > Your info and switch to a local account, or use a nickname on your Microsoft account profile instead.
Step 9: Run through the closing checklist
Once you’ve been through Steps 2-8, confirm every toggle below matches what you intended:
- [ ] Advertising ID and personalized ads: off
- [ ] Optional diagnostic data: off, required only
- [ ] Tailored experiences: off
- [ ] Activity history (store on device): off, and history cleared
- [ ] Microsoft account activity/ads (account.microsoft.com/privacy): reviewed
- [ ] Location: master switch and per-app list reviewed
- [ ] Camera: master switch and per-app list reviewed
- [ ] Microphone: master switch and per-app list reviewed
- [ ] Device encryption/BitLocker: confirmed on, recovery key backed up
- [ ] Copilot/AI data-sharing (Windows and Edge sidebar): reviewed
- [ ] Recall/AI snapshots (Copilot+ PCs only): off unless intentionally enabled
- [ ] Sign-in required after sleep: enabled
Configuration
Most of these settings are toggles with no extra configuration, but a few have levels worth knowing:
| Setting | Options | Recommended for most people |
|---|---|---|
| Diagnostic data | Required only / Optional | Required only |
| Location services | On (all apps) / On (selected apps) / Off | On for maps/weather, off for the rest |
| Camera/Microphone access | On (all apps) / On (selected apps) / Off | On for calling apps, off for everything else |
| Device encryption | On / Off | On, with recovery key backed up in two places |
| Sign-in requirement | Never / 1 min / On wake | On wake |
Tips and Troubleshooting
“Device encryption” doesn’t appear in Settings at all
Why it happens: Your PC’s hardware doesn’t meet the requirements for automatic device encryption (typically a missing TPM or lack of Modern Standby support), or you haven’t signed in with a Microsoft account yet on a Home edition device.
Fix: Sign in with a Microsoft account and check again. If it’s still missing on a Pro or Enterprise machine, search Start for “Manage BitLocker” to check and enable encryption manually.
Diagnostic data is off but Windows still feels like it’s sending data
Why it happens: Required diagnostic data always flows to Microsoft for security and Windows Update purposes. It’s the one layer Settings won’t let you fully disable.
Fix: Confirm Send optional diagnostic data and Tailored experiences are both off on the Diagnostics & feedback page. That’s the maximum reduction available without third-party tools, which fall outside what’s covered here.
Camera or microphone still seems to activate for one app
Why it happens: The master access switch and the individual app toggle are separate controls, and it’s easy to change only one.
Fix: Open Settings > Privacy & security > Camera (or Microphone), confirm the top switch is on, then scroll down and turn off the specific app in the list underneath.
Activity syncs across devices even though the local toggle is off
Why it happens: The local Activity history toggle and Microsoft-account-linked ad/activity tracking live in two different systems.
Fix: Turn off the local toggle in Settings, then also clear and manage cloud-synced activity from account.microsoft.com/privacy while signed in.
Wrapping Up
Short on time? Do Steps 2 through 5 first: advertising ID, diagnostics, activity history, app permissions. That block covers most of what quietly leaks data day to day. Steps 6 and 7 matter less on a normal Tuesday, but you’ll be glad you did them the day your laptop goes missing or Copilot starts reading more of your screen than you expected.
None of this is a one-time chore, either. New Windows updates have a habit of quietly re-enabling a toggle or two. Run back through this checklist every few months.
| Step | Action | Applies To |
|---|---|---|
| 2 | Turn off advertising ID | All Windows 11 PCs |
| 3 | Set required-only diagnostics, disable tailored experiences | All Windows 11 PCs |
| 4 | Disable and clear activity history | All Windows 11 PCs |
| 5 | Audit location, camera, microphone permissions | All Windows 11 PCs |
| 6 | Confirm encryption, back up recovery key | Devices with TPM/Modern Standby |
| 7 | Review Copilot and Edge sidebar data sharing | PCs using Copilot or Edge |
| 8 | Tighten sign-in and lock screen settings | All Windows 11 PCs |
Resources
- Windows privacy settings (Microsoft Support)
- Microsoft Privacy, Windows (Learn docs)
- Turn on device encryption
- Microsoft account privacy dashboard
- 5 Best Windows 11 Privacy Tools
- How to Enable or Disable the AI Agent in the Windows 11 Taskbar
- Change privacy settings in Windows
- Change Windows Privacy Settings
