Windows 11 privacy settings: what to turn off, what to leave alone
A practical privacy checklist for Windows 11: diagnostic data, advertising ID, location, activity history, speech, permissions and the settings that should stay on.
- Build
- 26300.9457
- Edition
- Home / Pro
- Architecture
- x64
- Support
- Checklist (E1)
- Evidence
- E1Official documentation
- Verified
- 2026-10-28
- Page type
- Checklist
The short answer
Section titled “The short answer”Privacy is a set of permissions and data flows, not one “telemetry off” switch. Turn off what you do not use, restrict app permissions, and keep security updates and Defender on.
Do not copy a “debloat” script that disables services, update components or Defender. It trades a small privacy gain for a large security and support risk.
The checklist
Section titled “The checklist”| Setting | Where | Recommendation |
|---|---|---|
| Diagnostic data | Settings → Privacy & security → Diagnostics & feedback | Required only; optional data off if you prefer |
| Tailored experiences | Same page | Off if you do not want personalised tips/ads |
| Advertising ID | Same page | Off |
| Location | Privacy & security → Location | Off unless maps/Find my device need it |
| Activity history | Privacy & security → Activity history | Off/clear if you do not use timeline sync |
| Speech | Privacy & security → Speech | Off if you do not use voice |
| Inking & typing personalisation | Privacy & security → Inking & typing | Off if you do not need the dictionary |
| App permissions | Privacy & security → Camera/Mic/etc. | Per-app; revoke unused |
| Background apps | Privacy & security → Background apps | Per-app; revoke unused |
| Feedback frequency | Diagnostics & feedback | “Never” if you do not want prompts |
Diagnostic data, honestly
Section titled “Diagnostic data, honestly”Windows has Required diagnostic data and Optional diagnostic data. On Home/Pro you can set the level; on Enterprise, group policy controls it. Required data is part of servicing and security; optional data is broader usage/diagnostic information.
If you set the minimum, do not expect zero network traffic or zero telemetry. “Off” in a consumer UI does not mean “no service ever contacts Microsoft”.
Permissions are the bigger win
Section titled “Permissions are the bigger win”A telemetry setting is abstract; a microphone permission is concrete:
- Revoke camera/microphone/location from apps you no longer use.
- Check startup apps and background permissions.
- Review browser extensions; they see more than Windows does.
- Use a password manager and 2FA; privacy without account security is theatre.
Enterprise and managed devices
Section titled “Enterprise and managed devices”Organisations should use:
- Group Policy/MDM for diagnostic data and privacy;
- Windows Update for Business rings;
- Defender for Endpoint or the organisation’s EDR;
- a documented retention policy.
Do not copy consumer registry tweaks into a managed fleet.
What not to do
Section titled “What not to do”- Do not disable Windows Update, Defender or the firewall “for privacy”.
- Do not run a random debloat script that removes Store, Edge or servicing components.
- Do not use a local account and then reuse the same weak password everywhere.
- Do not assume a VPN hides you from Microsoft account/Store activity.