# Windows 11 privacy settings: what to turn off, what to leave alone

> A practical privacy checklist for Windows 11: diagnostic data, advertising ID, location, activity history, speech, permissions and the settings that should stay on.

**Tested on**

- Build: 26300.9457
- Edition: Home / Pro
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-28

## The short answer

Privacy is a set of **permissions and data flows**, not one “telemetry off” switch. Turn off what you do not use, restrict app permissions, and keep security updates and Defender on.

Do not copy a “debloat” script that disables services, update components or Defender. It trades a small privacy gain for a large security and support risk.

## The checklist

| Setting | Where | Recommendation |
|---|---|---|
| Diagnostic data | Settings → Privacy & security → Diagnostics & feedback | Required only; optional data off if you prefer |
| Tailored experiences | Same page | Off if you do not want personalised tips/ads |
| Advertising ID | Same page | Off |
| Location | Privacy & security → Location | Off unless maps/Find my device need it |
| Activity history | Privacy & security → Activity history | Off/clear if you do not use timeline sync |
| Speech | Privacy & security → Speech | Off if you do not use voice |
| Inking & typing personalisation | Privacy & security → Inking & typing | Off if you do not need the dictionary |
| App permissions | Privacy & security → Camera/Mic/etc. | Per-app; revoke unused |
| Background apps | Privacy & security → Background apps | Per-app; revoke unused |
| Feedback frequency | Diagnostics & feedback | “Never” if you do not want prompts |

## Diagnostic data, honestly

Windows has **Required** diagnostic data and **Optional** diagnostic data. On Home/Pro you can set the level; on Enterprise, group policy controls it. Required data is part of servicing and security; optional data is broader usage/diagnostic information.

If you set the minimum, do not expect zero network traffic or zero telemetry. “Off” in a consumer UI does not mean “no service ever contacts Microsoft”.

## Permissions are the bigger win

A telemetry setting is abstract; a microphone permission is concrete:

- Revoke camera/microphone/location from apps you no longer use.
- Check startup apps and background permissions.
- Review browser extensions; they see more than Windows does.
- Use a password manager and 2FA; privacy without account security is theatre.

## Enterprise and managed devices

Organisations should use:

- Group Policy/MDM for diagnostic data and privacy;
- Windows Update for Business rings;
- Defender for Endpoint or the organisation’s EDR;
- a documented retention policy.

Do not copy consumer registry tweaks into a managed fleet.

## What not to do

- Do not disable Windows Update, Defender or the firewall “for privacy”.
- Do not run a random debloat script that removes Store, Edge or servicing components.
- Do not use a local account and then reuse the same weak password everywhere.
- Do not assume a VPN hides you from Microsoft account/Store activity.

## Sources

- [Microsoft — Windows privacy](https://learn.microsoft.com/en-us/windows/privacy/)
- [Microsoft — Diagnostic data](https://learn.microsoft.com/en-us/windows/privacy/configure-windows-diagnostic-data-in-your-organization)
- [Microsoft — Privacy dashboard](https://account.microsoft.com/privacy)

---

Source: https://windows.homes/en/windows/security/privacy/