Microsoft 365 Copilot
Microsoft 365 Copilot (incl. Copilot Chat, Copilot Business, consumer Copilot)
Provider: Microsoft · Based in: According to the Microsoft Privacy Statement · Provider website
- Plans
- 7
- Sources
- 30
- As of
- 18 Oct
As of 18 Oct 2026. Based on our research on this date and the process described in the methodology. No guarantee of accuracy, not legal advice. The provider’s current documents take precedence. Found an error? Report a correction.
Incomplete. 5 points could not be verified in any provider source (see open points). This does not mean the matter is unproblematic; it means we have not checked it.
At a glance
- Hosting
- mixed: Microsoft Copilot, Copilot in Microsoft 365 Personal / Family, Microsoft 365 PremiumEU option: Microsoft 365 Copilot Business, Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium, Microsoft 365 Copilot, Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans
- Training on inputs
- opt-out available: Microsoft Copilotno: Copilot in Microsoft 365 Personal / Family, Microsoft 365 Premium, Microsoft 365 Copilot Business, Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium, Microsoft 365 Copilot, Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans
- DPA
- not publicly documented: Microsoft Copilot, Copilot in Microsoft 365 Personal / Family, Microsoft 365 Premiumyes: Microsoft 365 Copilot Business, Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium, Microsoft 365 Copilot, Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans
- Provider
- Microsoft
- Based in
- According to the Microsoft Privacy Statement (Last Updated: September 2026, q19): Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA; for the EEA, the UK and Switzerland, where Microsoft is controller, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, is controller alongside Microsoft Corporation. Contracting party for business customers: not named in the retrieved pages.
Values from 7 plans, each listed with the plans it applies to. Details and evidence are in the plan table.
Compare Microsoft 365 Copilot
Compare with another toolCompared plan by plan with other tools in the category Office & collaboration:
Details per plan
Short values per plan. Click a feature to open the evidence and notes for all plans; sources with retrieval dates are under “Evidence”.
| Feature | Microsoft Copilot (consumer, free, personal Microsoft account)Compare Microsoft 365 Copilot Microsoft Copilot (consumer, free, personal Microsoft account) with another tool | Copilot in Microsoft 365 Personal / Family (consumer)Compare Microsoft 365 Copilot Copilot in Microsoft 365 Personal / Family (consumer) with another tool | Microsoft 365 Premium (consumer)Compare Microsoft 365 Copilot Microsoft 365 Premium (consumer) with another tool | Microsoft 365 Copilot Business (Add-on)Compare Microsoft 365 Copilot Microsoft 365 Copilot Business (Add-on) with another tool | Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium (without add-on)Compare Microsoft 365 Copilot Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium (without add-on) with another tool |
|---|---|---|---|---|---|
| differs by plan | 0 | several tiers | 19.99 USD/mo… (further prices in the details) | several tiers | no additional cost with eligible… |
| Details: Price | 0 (free use; consumer pricing page not retrieved) | Microsoft 365 Personal: USD 9.99/month or USD 99.99/year; Microsoft 365 Family: USD 12.99/month or USD 129.99/year (US comparison page, q20). Germany (q28, as of 2026-10-18): Microsoft 365 Single EUR 10.00/month or EUR 99.00/year, Microsoft 365 Family EUR 13.00/month or EUR 129.00/year; no indication whether VAT is included. | USD 19.99/month or USD 199.99/year (US comparison page, q20). Germany (q28, as of 2026-10-18): EUR 22.00/month or EUR 219.00/year; no indication whether VAT is included. | Add-on: USD 18 per user/month with annual payment (promotional price, "Originally starting from $21.00 now starting from $18.00"), USD 25.20 monthly; qualifying plan required. Bundled: Business Standard with Copilot USD 23.50 (annual) / USD 28.20 (monthly); Business Premium with Copilot USD 32.00 / USD 38.40 (q12). Germany (q29, as of 2026-10-18, "prices plus VAT" (translated)): add-on Microsoft 365 Copilot Business EUR 15.60 per user/month with annual billing ("Originally starting from 18,20 € now starting from 15,60 €"), EUR 21.84 with a monthly subscription; bundles with Business Standard or Business Premium EUR 20.36 or EUR 27.73 (annual) and EUR 24.43 or EUR 33.28 (monthly). The page offers the filters "plans with Teams" and "plans without Teams" (translated labels); which filter the bundle prices in the page text belong to cannot be determined from the retrieved text | no additional cost with eligible Microsoft 365 plans ("Microsoft Copilot Chat is available at no additional cost for all Microsoft Entra account users with an eligible Microsoft 365 subscription.", q13); eligible plans include Microsoft 365 Business Premium, Business Standard and Business Basic (q24). Cost of the base plan not recorded. |
| yes | yes | yes | yes | yes | |
| Details: AI features included | yes | yes (Copilot in Microsoft 365 apps for subscribers) | yes (according to the comparison page, Premium includes "Everything in Microsoft 365 Family, plus" further Copilot features, q20; q22 names Premium as a plan "for home" with Copilot in Microsoft 365 apps) | yes (Copilot add-on for qualifying Business plans) | yes (chat with web data; work data only via upload/selection; basic features in Word/Excel/PowerPoint/OneNote without Priority Access, q6) |
| differs by plan | not publicly documented | not publicly documented | not publicly documented | yes | yes |
| Details: DPA | not publicly documented (consumer pages refer to the Microsoft privacy statement; no DPA named, q14/q15) | not publicly documented (consumer subscription; no DPA named in q14/q15) | not publicly documented | yes (according to q2, the DPA and Product Terms apply to Copilot use by organisations with Enterprise Data Protection; the comparison table on the Business pricing page lists the row "Enterprise Data Protection (EDP), management, compliance, and controls" for Copilot Business, q12) Provider’s DPA | yes (Enterprise Data Protection: DPA and Product Terms, Microsoft as processor, q2) Provider’s DPA |
| differs by plan | opt-out available | no | no | no | no |
| Details: Training on inputs | "Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training." Opt-out under Privacy > "Training on conversation activity" (q14, q15). Excluded, among others: users not signed in, under-18s, users in Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea, Vietnam (q14). Note: according to their own header text, q14 and q15 apply only to the older version of the Copilot app ("An updated version of the Microsoft Copilot app for web, desktop, and mobile devices is available as of August 18, 2026."). For the new version (article "your activity history", q27): "Prompts, responses, and your file contents when using the Microsoft Copilot app aren't used to train foundation models." According to q27, optional feedback is not used to train the foundation models. | "We do not train Copilot on data from the following types of users: ... Users of Copilot within Microsoft 365 apps with Personal or Family subscriptions." (q14) Article on Copilot in Microsoft 365 apps for home users (Personal, Family, Premium, Pro): "Prompts, responses, and your file contents when using Copilot in Microsoft 365 apps aren't used to train foundation models." (q22) | According to its header text, q22 applies "when you're using Copilot in Microsoft 365 apps for home, such as with a Microsoft 365 Personal, Family, Premium, or Pro plan": "Prompts, responses, and your file contents when using Copilot in Microsoft 365 apps aren't used to train foundation models." According to q22, optional feedback is used to improve Copilot, not to train the foundation models. | "Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs, including those used by Microsoft Copilot." (q1) The retrieved documentation does not distinguish between Business and Enterprise; the Business pricing page names "Enterprise Data Protection (EDP)" for Copilot Business (q12). | "Prompts and responses aren't used to train the underlying foundation models." (q16). Consumer page: users with an organisational Entra account are excluded from training (q14). |
| differs by plan | Conversation activity stored for 18… | Conversation activity 18 months by default | not publicly documented | Prompts and responses are stored in… | Prompts and responses are stored in… |
| Details: Data retention | Conversation activity stored for 18 months by default, deletion individually or entirely possible at any time; uploaded files up to 18 months (q14, q15). | Conversation activity 18 months by default (Copilot consumer FAQ, q14); q14 does not expressly state whether this applies identically to Copilot in M365 apps under a subscription. | not publicly documented | Prompts and responses are stored in Exchange (tenant) for audit/eDiscovery; retention configurable via Microsoft Purview; users can delete their Copilot history via the My Account portal (q1, q16). Fixed default period: not publicly documented on the retrieved pages. For "Anthropic models with Data Retention" (to be activated separately, Anthropic terms): Anthropic stores inputs/outputs for up to 30 days, in the case of suspected violations up to 2 years, classification scores up to 7 years (q3). DPA (version of 2026-05-22, q18): after expiry or termination of the subscription, customer data remains available for export in a limited-function account for 90 days and is then deleted within a further 90 days. Microsoft Purview (q26): the documentation describes periods only for configured retention policies (after expiry, items are moved to the SubstrateHolds folder, where they stay for at least 1 day; the timer job typically runs every 1–7 days). | Prompts and responses are stored in Exchange (tenant) for audit/eDiscovery; retention configurable via Microsoft Purview; users can delete their Copilot history via the My Account portal (q1, q16). Fixed default period: not publicly documented on the retrieved pages. For "Anthropic models with Data Retention" (to be activated separately, Anthropic terms): Anthropic stores inputs/outputs for up to 30 days, in the case of suspected violations up to 2 years, classification scores up to 7 years (q3). DPA (version of 2026-05-22, q18): after expiry or termination of the subscription, customer data remains available for export in a limited-function account for 90 days and is then deleted within a further 90 days. Microsoft Purview (q26): the documentation describes periods only for configured retention policies (after expiry, items are moved to the SubstrateHolds folder, where they stay for at least 1 day; the timer job typically runs every 1–7 days). |
| differs by plan | mixed | mixed | mixed | EU option | EU option |
| Details: Hosting | Microsoft Privacy Statement (September 2026, q19), section Storage and processing of personal data: "Personal data collected by Microsoft may be stored and processed in your region, in the United States, and in any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities." Major data centres in, among others, Austria, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, the UK, the USA; "Typically, the primary storage location is in your region or in the United States". Copilot-specific location statement: not documented. | Microsoft Privacy Statement (September 2026, q19), section Storage and processing of personal data: "Personal data collected by Microsoft may be stored and processed in your region, in the United States, and in any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities." Major data centres in, among others, Austria, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, the UK, the USA; "Typically, the primary storage location is in your region or in the United States". Copilot-specific location statement: not documented. | Microsoft Privacy Statement (September 2026, q19), section Storage and processing of personal data: "Personal data collected by Microsoft may be stored and processed in your region, in the United States, and in any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities." Major data centres in, among others, Austria, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, the UK, the USA; "Typically, the primary storage location is in your region or in the United States". Copilot-specific location statement: not documented. | Same arrangement as Microsoft 365 Copilot (Premium licence); a plan-specific deviation is not documented in the retrieved pages. According to q1/q6: calls to the LLM go to the nearest data centres in the region but may go to other regions at times of high utilisation; additional safeguards apply to EU users, "EU traffic stays within the EU Data Boundary". Exceptions according to the sources: (a) web search queries are excluded from the EU Data Boundary and the DPA (q2, q10); (b) Anthropic models are excluded from the EU Data Boundary (q2, q3); (c) Flex Routing: customers in the EU/EFTA can allow LLM inference outside the EU Data Boundary at peak load (USA, Canada or Australia); data at rest remains in the EUDB except for limited pseudonymised data; on by default for eligible tenants created after 2026-03-25, review of the setting recommended for older tenants (q4); (d) Copilot in Word/Excel/PowerPoint with Anthropic models: processing outside the EUDB (q5). Customers with Multi-Geo are not within the EUDB scope for Microsoft 365 (q4). | According to q1/q6: calls to the LLM go to the nearest data centres in the region but may go to other regions at times of high utilisation; additional safeguards apply to EU users, "EU traffic stays within the EU Data Boundary". Exceptions according to the sources: (a) web search queries are excluded from the EU Data Boundary and the DPA (q2, q10); (b) Anthropic models are excluded from the EU Data Boundary (q2, q3); (c) Flex Routing: customers in the EU/EFTA can allow LLM inference outside the EU Data Boundary at peak load (USA, Canada or Australia); data at rest remains in the EUDB except for limited pseudonymised data; on by default for eligible tenants created after 2026-03-25, review of the setting recommended for older tenants (q4); (d) Copilot in Word/Excel/PowerPoint with Anthropic models: processing outside the EUDB (q5). Customers with Multi-Geo are not within the EUDB scope for Microsoft 365 (q4). |
| list available | list available | list available | list available | list available | |
| Details: Sub-processors |
|
|
|
|
|
| differs by plan | 5 sources | 6 sources | 5 sources | 13 sources | 14 sources |
| Details: Sources with retrieval date |
|
|
|
|
|
Price and scope
- differs by plan
- 0
0 (free use; consumer pricing page not retrieved)
- yes
yes
Contract and data use
- differs by plan
- not publicly documented
not publicly documented (consumer pages refer to the Microsoft privacy statement; no DPA named, q14/q15)
- differs by plan
- opt-out available
"Except for certain categories of users or users who have opted out, Microsoft uses data from Bing, MSN, Copilot, and interactions with ads on Microsoft for AI training." Opt-out under Privacy > "Training on conversation activity" (q14, q15). Excluded, among others: users not signed in, under-18s, users in Brazil, China (excluding Hong Kong), Israel, Nigeria, South Korea, Vietnam (q14). Note: according to their own header text, q14 and q15 apply only to the older version of the Copilot app ("An updated version of the Microsoft Copilot app for web, desktop, and mobile devices is available as of August 18, 2026."). For the new version (article "your activity history", q27): "Prompts, responses, and your file contents when using the Microsoft Copilot app aren't used to train foundation models." According to q27, optional feedback is not used to train the foundation models.
- differs by plan
- Conversation activity stored for 18…
- Conversation activity stored for 18 months by default, deletion individually or entirely possible at any time; uploaded files up to 18 months (q14, q15).
Hosting and sharing
- differs by plan
- mixed
Microsoft Privacy Statement (September 2026, q19), section Storage and processing of personal data: "Personal data collected by Microsoft may be stored and processed in your region, in the United States, and in any other jurisdiction where Microsoft or its affiliates, subsidiaries, or service providers operate facilities." Major data centres in, among others, Austria, Finland, France, Germany, Ireland, Luxembourg, the Netherlands, the UK, the USA; "Typically, the primary storage location is in your region or in the United States". Copilot-specific location statement: not documented.
- list available
- not publicly documented (consumer pages do not name any sub-processors)
Evidence
- differs by plan
- 5 sources
- Privacy FAQ for Microsoft Copilot (Microsoft Support, consumer)Docs, retrieved 14 Oct 2026
- Microsoft Copilot privacy controls (Microsoft Support, consumer)Docs, retrieved 14 Oct 2026
- Microsoft Privacy Statement (Last Updated: September 2026)Privacy notice, retrieved 18 Oct 2026
- Microsoft Copilot for individuals: your data, privacy, and responsible AI (Microsoft Support)Privacy notice, retrieved 18 Oct 2026
- Microsoft Copilot for individuals: your activity history (Microsoft Support, new app version)Privacy notice, retrieved 18 Oct 2026
not documentedmeans: not publicly documented, not verifiable in any provider source. It does not mean “no”.
Third-country transfers
Microsoft Privacy Statement (September 2026, q19): Microsoft Corporation "complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework"; for other transfers, "standard contractual clauses approved by the European Commission" or adequacy decisions. The EU Data Boundary is a commitment to store and process customer data and personal data for Microsoft 365 services in the EU/EFTA, with "limited circumstances" for transfers outside (q11). For Copilot: Flex Routing (inference in the USA/Canada/Australia, if activated, q4), Anthropic models excluded (q3), web search queries excluded (q2, q10). DPA (version of 2026-05-22, q18), section Data Transfers: transfers out of the EU, EEA, UK and Switzerland are subject to the "2021 Standard Contractual Clauses" (for the UK additionally the IDTA); "Microsoft is certified to the EU-U.S. and Swiss-U.S. Data Privacy Frameworks, the UK Extension to the EU-U.S. Data Privacy Framework". For EU Data Boundary Services, Microsoft stores and processes customer data and personal data in the EU/EFTA "as set forth in the Product Terms". DPF List (retrieved 2026-10-18): Microsoft Corporation (Redmond, WA) active for the EU-U.S. DPF, the Swiss-U.S. DPF and the UK Extension (HR and non-HR data) (q25).
- Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (Microsoft Learn) (Docs), retrieved 18 Oct 2026
- Anthropic models in Microsoft Online Services (Microsoft Learn, as of 2026-09-18) (Docs), retrieved 18 Oct 2026
- Flex routing (EU and EFTA) (Microsoft Learn) (Docs), retrieved 18 Oct 2026
- Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat (Microsoft Learn) (Docs), retrieved 14 Oct 2026
- What is the EU Data Boundary? (Microsoft Learn) (Docs), retrieved 14 Oct 2026
- Microsoft Products and Services Data Protection Addendum (DPA), version of 2026-05-22 (Word download, evaluated) (DPA), retrieved 18 Oct 2026
- Microsoft Privacy Statement (Last Updated: September 2026) (Privacy notice), retrieved 18 Oct 2026
- Data Privacy Framework List – Microsoft Corporation (Official register), retrieved 18 Oct 2026
Certifications (as stated by the provider)
According to Microsoft Learn (q1): "Microsoft Copilot provides broad compliance offerings and certifications, including GDPR, ISO 27001, HIPAA, and the ISO 42001 standard for AI management systems"; data protection standard ISO/IEC 27018 named (q1, q2). HIPAA does not apply to web search queries (q2). Certifications for OpenAI-operated models are managed by OpenAI; these models are not FedRAMP High authorised (q8). For external models in Copilot Studio/Power Platform, each model provider manages its own certifications (q7). Audit reports/certificate numbers: not retrieved.
- Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn) (Docs), retrieved 18 Oct 2026
- Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (Microsoft Learn) (Docs), retrieved 18 Oct 2026
- Allow external language models for generative responses (Power Platform, Microsoft Learn, as of 2026-10-12) (Docs), retrieved 14 Oct 2026
- OpenAI as a subprocessor in Microsoft Online Services (Microsoft Learn) (Docs), retrieved 14 Oct 2026
AI Act
Functions: Chat with web and work data, summarising/drafting/analysing in Word, Excel, PowerPoint, Outlook, Teams, OneNote; Researcher; agents (Copilot Studio); model selection with models from Microsoft, OpenAI and Anthropic (q6, q3, q8).
Provider’s statement: Microsoft Trust Center, page "EU AI Act" (q21): "Microsoft is committed to building products and solutions that comply with the EU AI Act and helping our customers use AI compliantly." In addition, Microsoft refers to Responsible AI principles, an Application Card and a Responsible AI FAQ (q6, q17). A Copilot-specific statement on its role under the AI Act was not found.
Classification (for review, not legal advice): For review: customer typically a deployer (Art. 3(4)) of an AI system. Check Art. 50 when publishing AI-generated texts/images (para. 4 deployer; exception in the case of human review/editorial responsibility). Assess agent functions and use in HR/personnel decisions separately (Annex III). Not legal advice.
- Microsoft Copilot overview (licence tiers, EUDB, EDP; Microsoft Learn) (Docs), retrieved 18 Oct 2026
- Application card: Microsoft Copilot (for organizations) (Microsoft Learn) (Docs), retrieved 14 Oct 2026
- Microsoft Trust Center: EU AI Act (Trust Center), retrieved 14 Oct 2026
Current notes 2026
Evidenced facts: (1) Anthropic is a Microsoft sub-processor, also for Copilot Studio and Power Platform; the Product Terms and DPA apply, except for "Anthropic models with Data Retention" (q3). In Copilot Studio, Anthropic models are excluded from the EU Data Boundary; as external model providers for Copilot Studio/Power Platform, q7 (as of 2026-10-12; q7 no longer states a date of 2026-01-07) names OpenAI, Anthropic, Mistral and xAI, xAI models only for US tenants (q7). (2) According to Microsoft Learn, Anthropic models are "currently excluded from the EU Data Boundary" (q3); for customers in the EU/EFTA and the UK, the Anthropic setting is off by default (q3). (3) Since 2026-04-03, the Microsoft 365 admin center has a setting for Anthropic as the default model in Copilot in Microsoft 365 apps for the EU/EFTA/UK (q3); it is on by default for tenants created after 2026-03-25 (q5); the Anthropic "independent processor" toggle was switched off on 2026-05-01 (q5). (4) Flex Routing (EU/EFTA): on by default for eligible tenants created after 2026-03-25 (q4). The date 2026-04-17 stated in the template is not evidenced in the primary sources. (5) OpenAI as sub-processor: list 2026-06-23, available 2026-07-09, activated for eligible commercial customers from 2026-07-24 unless deactivated; OpenAI models are included in the EU Data Boundary, except for in-country processing (q8). (6) SpaceXAI: list 2026-09-10, available to eligible customers from 2026-09-18, Frontier programme only, not EU/EFTA/UK (q9). (7) New licence naming "Copilot Chat (Basic)", "Microsoft 365 Copilot (Basic)", "Microsoft 365 Copilot (Premium)" (q6).
Open points of the review
- Sub-processors: list only in the Service Trust Portal (a JavaScript application), cannot be evaluated by automated retrieval; number therefore not substantiated (the figure "~150 US subprocessors" from the previous dataset is not substantiated)
- Date since which Anthropic has been a Microsoft sub-processor: not stated in q3 (as of 2026-09-18), q7 or the Microsoft 365 Copilot release notes
- Fixed default retention period for prompts/responses without a configured Purview policy: not documented (the DPA only governs deletion after the end of the subscription)
- Business-specific privacy documentation: no dedicated page found; statements taken from the general Copilot documentation and the Business pricing page (EDP)
- Consumer plans: Copilot-specific statements on hosting location and sub-processors are missing; only the general privacy statement (Microsoft as controller, storage in the user's region and the USA, among others)
Frequently asked questions
Where does Microsoft 365 Copilot store data?
mixed (plans: Microsoft Copilot (consumer, free, personal Microsoft account), Copilot in Microsoft 365 Personal / Family (consumer), Microsoft 365 Premium (consumer)); EU hosting selectable (plans: Microsoft 365 Copilot Business (Add-on), Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium (without add-on), Microsoft 365 Copilot (premium licence, organisations, add-on), Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans (without add-on)). According to the provider, as of 18 Oct 2026.
Is there a DPA for Microsoft 365 Copilot?
not publicly documented in: Microsoft Copilot (consumer, free, personal Microsoft account), Copilot in Microsoft 365 Personal / Family (consumer), Microsoft 365 Premium (consumer); yes in: Microsoft 365 Copilot Business (Add-on), Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium (without add-on), Microsoft 365 Copilot (premium licence, organisations, add-on), Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans (without add-on). Based on our research, as of 18 Oct 2026.
Does Microsoft 365 Copilot use inputs for AI training?
opt-out available in: Microsoft Copilot (consumer, free, personal Microsoft account); no in: Copilot in Microsoft 365 Personal / Family (consumer), Microsoft 365 Premium (consumer), Microsoft 365 Copilot Business (Add-on), Copilot Chat with Entra account in Microsoft 365 Business Basic / Standard / Premium (without add-on), Microsoft 365 Copilot (premium licence, organisations, add-on), Copilot Chat with Entra account in Microsoft 365 / Office 365 E, F, G and A plans (without add-on). According to the provider, as of 18 Oct 2026.
Where is the provider based?
According to the Microsoft Privacy Statement: Microsoft Corporation, One Microsoft Way, Redmond, Washington 98052, USA; for the EEA, the UK and Switzerland, where Microsoft is controller, Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, is controller alongside Microsoft Corporation. Contracting party for business customers: not named in the retrieved pages. According to the provider, as of 18 Oct 2026.
All sources
- 01Data, Privacy, and Security for Microsoft Copilot (Microsoft Learn)Docs · retrieved 18 Oct 2026
- 02Enterprise data protection in Microsoft Copilot and Microsoft Copilot Chat (Microsoft Learn)Docs · retrieved 18 Oct 2026
- 03Anthropic models in Microsoft Online Services (Microsoft Learn, as of 2026-09-18)Docs · retrieved 18 Oct 2026
- 04Flex routing (EU and EFTA) (Microsoft Learn)Docs · retrieved 18 Oct 2026
- 05Copilot in Microsoft 365 apps with Anthropic models (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 06Microsoft Copilot overview (licence tiers, EUDB, EDP; Microsoft Learn)Docs · retrieved 18 Oct 2026
- 07Allow external language models for generative responses (Power Platform, Microsoft Learn, as of 2026-10-12)Docs · retrieved 14 Oct 2026
- 08OpenAI as a subprocessor in Microsoft Online Services (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 09SpaceXAI as a subprocessor in Microsoft Online Services (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 10Data, privacy, and security for web search in Microsoft Copilot and Microsoft Copilot Chat (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 11What is the EU Data Boundary? (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 12Microsoft Copilot Plans and Pricing (Microsoft)Pricing page · retrieved 18 Oct 2026
- 13Microsoft 365 Copilot for Enterprise (Microsoft)Pricing page · retrieved 14 Oct 2026
- 14Privacy FAQ for Microsoft Copilot (Microsoft Support, consumer)Docs · retrieved 14 Oct 2026
- 15Microsoft Copilot privacy controls (Microsoft Support, consumer)Docs · retrieved 14 Oct 2026
- 16Privacy and protections (Microsoft Copilot Chat, Microsoft Learn)Docs · retrieved 14 Oct 2026
- 17Application card: Microsoft Copilot (for organizations) (Microsoft Learn)Docs · retrieved 14 Oct 2026
- 18Microsoft Products and Services Data Protection Addendum (DPA), version of 2026-05-22 (Word download, evaluated)DPA · retrieved 18 Oct 2026
- 19Microsoft Privacy Statement (Last Updated: September 2026)Privacy notice · retrieved 18 Oct 2026
- 20Compare all Microsoft 365 plans (consumer, US)Pricing page · retrieved 14 Oct 2026
- 21Microsoft Trust Center: EU AI ActTrust Center · retrieved 14 Oct 2026
- 22Copilot in Microsoft 365 apps for home: your data and privacy (Microsoft Support)Privacy notice · retrieved 14 Oct 2026
- 23Microsoft Copilot for individuals: your data, privacy, and responsible AI (Microsoft Support)Privacy notice · retrieved 18 Oct 2026
- 24Manage Microsoft Copilot Chat (section Eligibility, as of 2026-10-12)Documentation · retrieved 14 Oct 2026
- 25Data Privacy Framework List – Microsoft CorporationOfficial register · retrieved 18 Oct 2026
- 26Learn about retention for Copilot and AI apps (Microsoft Learn, as of 2026-06-25)Documentation · retrieved 18 Oct 2026
- 27Microsoft Copilot for individuals: your activity history (Microsoft Support, new app version)Privacy notice · retrieved 18 Oct 2026
- 28Compare Microsoft 365 plans (consumer, Germany)Pricing page · retrieved 18 Oct 2026
- 29Microsoft Copilot pricing for small and medium-sized businesses (Germany)Pricing page · retrieved 18 Oct 2026
- 30Microsoft 365 Copilot for enterprises (Germany)Pricing page · retrieved 18 Oct 2026
More tools in Office & collaboration with an EU hosting option (in at least one plan)
- Asana AI · Based in: Asana, Inc., 633 Folsom Street, Suite 100, San Francisco, CA 94107-3600, USA
- Atlassian Rovo · Based in: Atlassian Pty Ltd
- ClickUp Brain · Based in: Mango Technologies, Inc. DBA ClickUp, 350 Tenth Ave, 5th floor, San Diego, CA 92101, USA
- Miro AI · Based in: RealtimeBoard, Inc. dba Miro, 315 Montgomery St Suite 900, San Francisco, CA 94104, USA
All tools in Office & collaboration · Tools with an EU hosting option
Further reading
All tools in the category: Office & collaboration. Microsoft 365 Copilot has at least one plan with an EU hosting option; see also AI tools with an EU hosting option. Figures across all tools: Data report.