Does Microsoft Copilot train on your data? Work vs personal

Microsoft sells several products called Copilot, and they don’t give the same answer on training. What decides it is the account you sign in with, more than the price or the app icon. Google’s assistant splits along a similar line, which our Gemini guide follows separately.

Below I separate the personal app from the work versions, then follow a work prompt to see who stores it, who can search it and which model answers it. Everything here comes from Microsoft’s own pages as they stood on 10 November 2026.

Personal app or work account: which Copilot are you using?

Look at the account picture in the corner before the logo. A personal Microsoft account, the kind behind Outlook.com or Xbox, puts you under the Microsoft Services Agreement and Privacy Statement. A work or school account from Microsoft Entra puts you under your employer’s contract with Microsoft.

The names won’t help you. Microsoft has dropped “365” from its work products, so the paid one is now Microsoft Copilot and the free work chat is Microsoft Copilot Chat. GitHub Copilot, the coding assistant, is a separate product with its own settings, and this page leaves it aside.

I doubt any answer to the training question, ours included, that skips the login. Pick yours below. Accounts sort the same way for OpenAI’s chatbot and what it does with your words.

Does the free Copilot app train on your conversations?

On 18 August 2026 Microsoft released an updated Copilot app for web, desktop and mobile, and wrote fresh support pages for it instead of editing the old ones. Both sets are still online, each with a banner naming the version it covers, and they disagree about training.

For the updated app, Microsoft’s support page on Copilot activity history says prompts, responses and file contents aren’t used to train foundation models. Optional feedback may help improve Copilot, without training those models. No retention period is given for chats.

The older app’s page, Microsoft Copilot privacy controls, keeps two switches under Privacy and adds that opting out doesn’t stop use for other product improvements, advertising, safety and compliance. If those switches still show in your settings, you’re on the older version. Updating the app beats relying on the toggle, in my judgement.

The Microsoft Privacy Statement, updated November 2026, still says consumer Copilot uses prompts and related data to provide and improve services, including relevant advertising. “Not used to train foundation models” is a narrower promise than “not used”. Uploaded pictures raise their own questions, which our guide to photos sent to AI assistants covers.

Privacy settings on a personal Microsoft account

The updated app’s privacy controls page lists six settings for personal accounts. Most sit under Settings, then Personalization. Single chats are deleted from the Chats list with More, then Delete; the full history lives in Microsoft’s privacy dashboard, which can also export it as a CSV file first.

Two of them get confused. One shared experience lets Copilot personalise Bing, Edge and MSN, and lets their activity shape Copilot; it doesn’t control ads. Allow ads personalization decides whether ads use your history and memories. With it off, generic ads still appear, picked from the current conversation.

Switching off Saved memories doesn’t delete what’s stored; Manage, next to it, does. The Edge import can bring cookies, passwords and payment details into Copilot; only US accounts get it. I see no reason to switch that one on. To clear several assistants at once, our deletion steps for each chatbot include Copilot.

Microsoft 365 Copilot and enterprise data protection

A work or school account changes the contract. Microsoft acts as a data processor under its Data Protection Addendum and Product Terms, and calls the package enterprise data protection. In EU and UK law, a GDPR processor may use personal data only on the customer’s documented instructions, as Article 28 requires.

Microsoft’s privacy page for Copilot Chat says prompts and responses are processed within the Microsoft 365 service boundary and aren’t used to train the underlying foundation models. The licensed Microsoft Copilot adds Microsoft Graph data, such as mail and files the user can open, under the same commitment.

Enterprise data protection costs nothing extra in Copilot Chat, and a green shield next to New Chat shows when it applies. If staff paste into free chatbots, I can’t think of a cheaper fix than moving them there. Write it into the AI rules everyone in the office signs.

Web grounding: the part that leaves the protected zone

One piece of a work prompt goes outside that contract. When Copilot decides the web would help, it turns your prompt into a search of a few words and sends it to Bing, stripped of user and tenant identifiers. Bing runs under the consumer Services Agreement, with Microsoft as an independent controller.

Microsoft’s footnotes draw the consequences. For US healthcare, HIPAA support doesn’t reach those queries, which sit outside the business associate agreement; 45 CFR 164.502(e) lets a covered entity pass health data to such a vendor only on assurances documented in writing. The EU Data Boundary doesn’t apply to them either.

A few words can still name a deal. For teams on health records or merger talks, I’d switch off web grounding for them, once IT confirms it is on. Prompt injection is another matter: our page on how data slips out of AI tools covers the Copilot flaw disclosed in June 2025.

Who can read your prompts at work: Exchange and eDiscovery

Before Copilot Chat answers, it logs the prompt and the response in Exchange, the store that holds your organisation’s email, for auditing and eDiscovery. Microsoft’s privacy page for the licensed Copilot adds that admins can view this data with Content search or Microsoft Purview, and set retention policies for it.

Users can delete their own Copilot activity history from the My Account portal. Whether the organisation’s copy goes with it depends on the retention policy someone set in Purview, so ask. A prompt that names a client becomes a business record that a court order or a client audit can reach.

I’d make sure every partner grasps this part of the work version: no training, yet a complete record of what everybody asked. Put your own numbers in below, and expect the AI section of a cyber insurance form to ask about that record.

Which AI models and regions handle a work prompt

Microsoft says Copilot runs on models it operates itself, GPT models on Azure among them, and on models run by OpenAI and by Anthropic as subprocessors under the same addendum. An admin decides about both through a setting called AI providers operating as Microsoft subprocessors, under Copilot in the Microsoft 365 admin center.

Defaults depend on where you are. Claude models are on for most commercial customers and off in the EU, EFTA and UK, outside the EU Data Boundary. Anthropic models with Data Retention stay off until an admin opts in; Anthropic then keeps most inputs and outputs up to 30 days, under its own terms.

That opt-in is the point at which I’d slow down, because it moves prompts outside Microsoft’s contract. Outside the EU, Microsoft says queries may be processed in the US, the EU or other regions. If neither suits you, a model on your own hardware is the other end of the choice.

Is Copilot safe for client or patient data?

Regulators haven’t banned these tools, but they set a bar. Australia’s privacy regulator, the OAIC, advises against entering personal information, sensitive information above all, into publicly available generative AI tools, and tells organisations to check whether a vendor can reuse what they type.

Training matters because a trained model can hold on to what it saw. The European Data Protection Board’s Opinion 28/2024 says models trained on personal data can’t, in all cases, be considered anonymous, so claims of anonymity are judged case by case.

Vendor promises also move, as Copilot’s did on 18 August 2026. The FTC has warned that quietly rewriting terms to allow AI training can be unfair or deceptive. A dated screenshot of the setting we rely on would be record enough for me.

Keeping client details out of the chat logs

Go back to the calculator: each of those stored prompts keeps whatever was typed, client names and diagnoses included, for as long as the retention policy runs. No Copilot setting edits that record afterwards. The edit has to happen before the paste, which is what the Nonimo app is for.

On Mac and Windows it swaps names and identifiers for labels on the machine itself, before Copilot gets the text, and restores the originals in the answer. In the app, the text being analysed doesn’t pass through our servers; the list of what does reach us is public.

For a whole office, IT can install the browser extension by policy in Chrome and Edge, so nobody has to remember, as explained for organisations. For an office already on Copilot Chat, the extension is what I’d choose: whatever Exchange keeps then carries labels where the names were.

Sources

• Microsoft Learn, Microsoft Copilot Chat privacy and protections. Service boundary, no training, green shield, Exchange logging and how Bing queries are built.
• Microsoft Support, Copilot for individuals: your activity history. The app updated on 18 August 2026: prompts, responses and file contents not used to train foundation models.
• 45 CFR 164.502(e), on govinfo.gov. HIPAA: disclosures to a business associate need satisfactory assurances, documented in a written agreement.
• EUR-Lex, Regulation (EU) 2016/679 (GDPR). Article 4(8) defines a processor; Article 28(3)(a) limits it to documented instructions.
• EDPB, Opinion 28/2024 on AI models. Adopted 18 December 2024; models trained on personal data are not always anonymous.
• FTC, AI (and other) companies: quietly changing your terms of service could be unfair or deceptive. 13 February 2024.
• OAIC, Guidance on privacy and the use of commercially available AI products. Keep personal and sensitive information out of public generative AI tools.

Accessed 10 November 2026.