A closer look at the Windows 7 Privacy Statement
Windows 7, just as the vast majority of software products, and certainly Cloud-based applications and services, harvests information from each end user and shares it with the mother company. This is, of course, not new to the latest iteration of Windows, as previous releases of the OS, including Windows Vista and Windows XP were also designed to contact Microsoft servers in order to provide with data gathered from user machines. The Redmond-based company is making no secret of the Windows 7 features that phone home, and, in fact, offers a full, although not exhaustive, disclosure on the Windows 7 Privacy Statement webpage (
http://windows.microsoft.com/en-HK/windows7/windows-7-privacy-statement).
However, even if the software giant is upfront about the information collected by Windows 7, sent and stored on Microsoft servers, it’s very unlikely that customers buying and running the operating system go to all the trouble of reading the Privacy Statement. Below, you will find excerpts from the official Windows 7 Privacy Statement provided by Microsoft, along with a list of the operating system’s features that connect to company servers. According to the maker, the privacy information related to the latest version of the Windows platform was updated in July 2009. It was on July 22 that Microsoft released Windows 7 to manufacturing, with general availability kicking in on October 22.
“The personal information we collect from you will be used by Microsoft and its controlled subsidiaries and affiliates to enable the features you use and provide the services or carry out the transactions you have requested or authorized. The information may also be used to analyze and improve Microsoft products and services,” Microsoft informs. “Except as described in this statement, personal information you provide will not be transferred to third parties without your consent. We occasionally hire other companies to provide limited services on our behalf, such as for performing statistical analysis of our services. We will only provide those companies the personal information they need to deliver the service, and they are prohibited from using that information for any other purpose.”
It is important to note that, at least in comparison to other companies, Microsoft does a better job when it comes down to protecting user privacy. Most recently, Mozilla Director of Community Development Asa Dotzler slapped Google over its search engine privacy policy, inferior to that of Bing, and went ahead and recommended that Firefox users “upgrade” their Firefox browsers to Bing in order to ensure that their data is better protected.
Let’s be perfectly clear on one aspect, both Microsoft and Google, but also additional companies gather user data, store it, and use it in a variety of purposes, first of all to better their products and services. At the same time, businesses are subject to the legislation of the specific countries they operate in, and will share the information they collect with authorities, if requested. Microsoft is simply superior to Google when it comes down to the way it handles and protects user information. However, this is not to say that it can’t be better. There are, of course, companies offering either applications or services that collect absolutely no end user data at all, but for the Redmond-based giant, such a move would imply delivering a poorer experience for Windows users.
“Microsoft may access or disclose information about you, including the content of your communications, in order to: (a) comply with the law or respond to lawful requests or legal process; (b) protect the rights or property of Microsoft or our customers, including the enforcement of our agreements or policies governing your use of the software; or (c) act on a good faith belief that such access or disclosure is necessary to protect the personal safety of Microsoft employees, customers, or the public,” the maker stated. “Information collected by or sent to Microsoft by Windows 7 may be stored and processed in the United States or any other country in which Microsoft or its affiliates, subsidiaries, or service providers maintain facilities. Microsoft abides by the safe harbor framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of data from the European Union, the European Economic Area, and Switzerland.”
Of course that in the end, your personal data is in the hands of a third-party, be it Microsoft, Google, or another company. What matters in this context is how those third parties understand to leverage the information, and the security measures protecting it from snooping employees and hacks. Companies that retain no user data also offer a guarantee that they will never leak it, or share it voluntarily or otherwise, with anybody, including authorities, because there’s no info to be shared. Organizations that do collect user information also have an inherent obligation to guarantee privacy, and in this regard, you’re better off with Microsoft and not with Google.
“Microsoft is committed to helping protect the security of your information. We use a variety of security technologies and procedures to help protect your information from unauthorized access, use, or disclosure. For example, we store the information you provide on computer systems with limited access, which are located in controlled facilities. When we transmit highly confidential information (such as a credit card number or password) over the Internet, we protect it through the use of encryption, such as the Secure Socket Layer (SSL) protocol,” the software giant said.
Phoning home
Below, you will find a list of all the Windows 7 features and components that phone home, in accordance with the Windows 7 Privacy Supplement provided by Microsoft. All the information disclosed is publicly accessible, and has been so even before the RTM of Windows Vista’s successor.
1. Activation: During activation, product key information is sent to Microsoft, such as: The Microsoft product code, which is a five-digit code that identifies the Windows 7 product you are activating. A channel ID or site code, which identifies where you obtained the Windows 7 product. For example, it identifies whether the product was sold at retail, is an evaluation copy, is subject to a volume licensing program, was pre-installed by the computer manufacturer, and so on. The date of installation. Information that helps confirm that the product key information has not been altered.
If you license Windows 7 on a subscription basis, information will also be sent about how your subscription works. Activation also sends to Microsoft a number generated from the computer's hardware configuration. The number does not represent any personal information or information about the software. It cannot be used to determine the make or model of the computer and it cannot be calculated to determine any additional information about your computer. Along with standard computer information, some additional language settings are collected.
Use of information - Microsoft uses the information to confirm that you have a licensed copy of the software and to confirm whether you are eligible for certain support programs. It is also aggregated for statistical analysis. Microsoft does not use the information to identify you or contact you.
Choice and control - Activation is mandatory and must be completed within a predefined grace period. If you choose not to activate the software, you cannot use it after the grace period expires. If you do not have a valid license for the software, you will not be able to activate it.
2. Device Information Retrieval: In order to retrieve relevant device information, this feature sends data to Microsoft, including your Device ID (for example, Hardware ID or Model ID of the device you are using), your locale, and the date that device information was last updated. The device information downloaded to your computer might include model name, description, device manufacturer logo, and device-related tasks.
Use of information - The information collected is used to help download relevant device information. No information sent is used to identify or contact you.
Choice and control - If you choose the recommended settings during Windows 7 setup, you turn on Device Information Retrieval. You can turn this feature off by going to Devices and Printers in Control Panel. Right-click your computer icon and then click “Device Installation Settings.” Select "No, let me choose what to do" and click to clear the "Replace generic device icons with enhanced icons" check box.3. Device Manager: To determine which updates apply to your hardware, configuration information, such as what printers and other devices you use, is collected from your computer and sent to Microsoft. Device Manager and the Update Driver Software Wizard work with Windows Update to collect this information.
Use of information - The information collected is used to determine which updates apply to your computer hardware and to installed devices. Microsoft does not use the information collected about your computer configuration to identify you or contact you.
Choice and control -
Device Manager is enabled by default, and cannot be disabled. However, Device Manager will only send configuration information to Microsoft and download updated drivers when you open the Update Driver Software Wizard and choose to update your driver software.
4. Dynamic Update: To install compatible drivers, Dynamic Update sends information to Microsoft about your computer's hardware. The types of updates Dynamic Update can download to your computer include: Installation updates: Important software updates for installation files to help ensure a successful installation. In-box driver updates: Important driver updates for the version of Windows that you are installing. Microsoft Windows Malicious Software Removal Tool updates: Updates for the latest version of this tool which can help remove malicious software such as viruses and worms if it detects them on your computer.
Use of information - Dynamic Update reports information about your computer's hardware to Microsoft to identify the correct drivers for your system.
Choice and control - At the start of Windows 7 setup, you will be given the choice to use Dynamic Update.
5. Event Viewer: Event logs contain event information generated by all users and the programs on the computer. By default, all users can view event log entries; however, administrators can choose to restrict access to event logs. You can access the event logs for your computer by opening Event Viewer. To learn how to open Event Viewer, see Windows Help and Support.
Use of information - Event information that is collected and sent to Microsoft when you click the Event Log Online Help link is used to locate and then provide you with additional information about the event. Unless you have previously consented to sending event information automatically, clicking the link will display a dialog box asking for your consent to send the information listed in the dialog box over the Internet. If you consent, the information is sent to a website to see if more information about the event is available, including solutions to problems that are recorded as an event. For Microsoft events, the event details will be sent to Microsoft. Microsoft does not use this information to contact you or identify you. For events associated with third-party programs, the information will be sent to the location specified by the third-party publisher or manufacturer. If you send information about events to third-party publishers or manufacturers, use of the information will be subject to the third party's privacy practices.
Choice and control - No event log information will be sent over the Internet unless you consent to send it.
6. Gadgets: Some gadgets, such as Currency, Stocks, and Weather, contact the Internet to collect information and might send additional information, such as a location for weather information.
Use of information - Information collected by Microsoft from Microsoft gadgets is used to provide functionality for the gadgets but is not used to identify or contact you. If you use a non-Microsoft gadget, use of the information will be subject to the gadget provider’s privacy practices.
Choice and control - Certain gadgets, such as Weather, might be pre-configured to contact the Internet when you first use them. However, you might be able to configure or close them later by going to Desktop Gadgets in Control Panel.
7. Games Folder: If you choose, the Games folder will retrieve information from Microsoft about the games you have installed. To do this, information including game identification numbers will be sent to Microsoft.
You can also choose to check for updates to some games by right-clicking the game icon and selecting Scan online for Update. Game version details and game identification numbers will be sent to Microsoft, and you will be notified of any updates that are available. You may choose to have Windows automatically scan and notify you about game updates from the options menu.
Some games, such as Internet Backgammon and Internet Spades, include a feature that will match you with players from around the world. If you choose to "Play," standard computer information and a GUID is sent to Microsoft to provide game play. No information collected is used to identify or contact you.
Use of information - The information sent to Microsoft is used to retrieve information for the games that you've installed. Microsoft does not use the information to identify you or contact you.
Choice and control - You can turn the information collection or the tracking features of the Games folder on or off. You can choose to retrieve and display game information and to track game playing times from the options menu. You can disable these features at any time by returning to the options menu. If you choose to quit an Internet game that comes with Windows 7, no information will be transferred to Microsoft.
8. Error Reporting for Handwriting Recognition: A list of recently corrected handwriting samples is stored in memory. You can choose to send these handwriting samples to Microsoft. No personal information is intentionally collected; however the samples you choose to send may include personal information. For each report, you can also choose to send a comment about the errors. Microsoft does not use collected information to identify you or contact you.
Use of information - If you choose to send a report, it will be used to improve future versions of the Microsoft handwriting recognition software. No information is sent to Microsoft unless you choose to send it.
Choice and control - You can select which recognition errors you would like to report. You can initiate a report using the Handwriting Recognition Error Reporting tool while using the Tablet Input Panel. The Handwriting Recognition Error Reporting tool will also open when you select an alternate recognition after inking on a Tablet PC or another device. You can select each handwriting sample to be included in the report and review the report before sending it to Microsoft. No reports are sent automatically.
9. Personalization Training: When you use Personalization Training, your handwriting samples are stored in memory. You can choose to send these handwriting samples to Microsoft. No personal information is intentionally collected; however the samples you choose to send may include personal information. Microsoft does not use the information to identify or contact you.
Use of information - If you choose to send your handwriting samples to Microsoft, they are used to improve future versions of the Microsoft handwriting recognition software.
Choice and control - At the end of every training session you have the choice to send handwriting samples to Microsoft. No data is shared with Microsoft if you select "don’t send ink samples."
10. IME Word Registration (available in Japanese IME only): Word registration reports can include the information you provide in the Add Word dialog box about the words being reported, and the software version number for IME. These reports may include personal information, for example if you add personal names using word registration, but Microsoft does not use the information to identify you or contact you. You will have the opportunity to review the data being sent with each report before you choose to send it.
Use of information - Microsoft uses the information to help improve input editing.
Choice and control - Each time you create a word registration report, you are asked if you want to send this report to Microsoft. You may view the information contained in the report before choosing whether to send it.
