Strengthening privacy in Windows 11 step by step

Windows 11 can leak far more personal information than you might think if you leave it with its default settings. Telemetry, activity history, personalized ads, cloud syncing, excessive app permissions… it all adds up. The good news is that the system itself includes a host of controls that, when properly configured, allow you to keep it fairly secure while still making it usable.

This article brings together and reorganizes in a practical way everything explained in official Microsoft guides and advanced privacy manuals , including how to pre-configure Windows 11 using scripts for Windows 10/11, along with more "real-world" recommendations (GDPR, best practices, quick tips , and a few commands). The idea is to enable you to seriously strengthen privacy in Windows 11, whether you're a home user or manage computers in a business.

What data does Windows 11 collect and why should you care?

Before you start disabling things willy-nilly, it's a good idea to understand what Windows 11 is collecting about you , how it's organized into categories, and how far you can limit that collection. Microsoft distinguishes between required and optional data, but from a privacy standpoint, it's wise to review both.

The required diagnostic data is the "minimum" that the system sends to Microsoft to keep Windows updated, check compatibility with new versions, validate licenses, monitor critical errors, and ensure a certain level of security. This includes data about the hardware, Windows version, drivers , general device status, and little else; it is sent in aggregate, and you cannot completely disable this part.

Optional diagnostic data is a different story altogether : it includes more details about how you use your device, the applications you run, how they perform, what errors you encounter, some of your web activity (especially if you use Edge), configuration preferences, and advanced performance information. This data is useful for Microsoft, but for you, it represents an additional risk of digital footprint.

To all that, we must add other sources of personal data : activity history, location, cloud searches, personalized dictionary, OneDrive, personalized experiences, advertising ID, voice, writing, browsing, synchronization between devices, "Find My Device", Cortana (where it is still available) and a long etcetera of connected experiences.

If you work under GDPR or any data protection regulations , your goal should be to apply the principle of minimization: share only what is strictly necessary. The great thing about Windows 11 is that almost all of this can be modulated with Settings options, Group Policy, or MDM, and even audited with tools like Diagnostic Data Viewer.

Controlling diagnostics, telemetry, and feedback in Windows 11

The first step in strengthening privacy in Windows 11 is telemetry , that is, the diagnostic and usage data that is sent to Microsoft more or less constantly. Here you'll cover both the user-visible aspects and, if you're interested, the "pro" level with policies and commands.

From the Settings app, you can significantly reduce the amount of information that comes out of your device . Go to Settings > Privacy and security > Diagnostics and feedback (in some translations it appears as Feedback and diagnostics) and carefully review each section. The goal is to keep only the necessary data.

In the Diagnostic Data section, select the most restrictive option available , usually called “Required Diagnostic Data” or “Mandatory.” This prevents optional information about apps, navigation, and other fine details from being sent. While you can't completely disable telemetry, you significantly reduce its exposure.

Also disable the additional features linked to telemetry : the "Improve handwriting and typing" option collects examples of how you write to refine recognition; "Personalized experiences" uses your diagnostic data for recommendations and ads; and the "Diagnostic data viewer" itself can reserve up to 1 GB of local disk to store records that in many cases you don't need.

Don't forget the "Delete diagnostic data" button . On that same panel, you'll find an option called "Delete diagnostic data" that instructs Microsoft to erase the data already stored on its servers for that device. If you have a strong privacy policy, it's a good idea to click this button regularly (for example, once a month or after significant configuration changes).

If you prefer the quick route and don't mind using the console , consult the PowerShell telemetry guide . You can essentially put telemetry into a coma with two key services: DiagTrack and dmwappushservice. Open Command Prompt as administrator and run:

sc config DiagTrack start= disabled
sc config dmwappushservice start= disabled

These commands change the startup mode of the diagnostic tracking and push services to disabled, further reducing data transmission. If you want to revert this at any time, simply repeat the commands, changing "disabled" to "enabled".

Adjust activity history, search, and connected experiences

Windows 11 is designed to remember virtually everything you do : which apps you run, which documents you open, which websites you visit, and even what you search for locally and in the cloud. It's convenient for resuming tasks, but it's also a goldmine of information about your habits.

Activity history is configured in Settings > Privacy and security > Activity history . Here you can prevent the system from recording your activities and syncing that information across devices associated with your account. Uncheck the option to store history on the device and use the button to delete saved history. You may also want to consider using tools to clean up orphaned profiles.

In the Windows Permissions section, you'll find several key switches . First, go to General and review these options:

• Advertising IDWhen you allow apps to show personalized ads using your advertising identifier, you're essentially giving them free rein to track your interests in detail. The sensible thing to do for enhanced privacy is to disable this feature.
• Relevant content by languageThis allows websites to read your list of configured languages ​​in Windows. It's not the end of the world, but it's still profiling information; you can safely turn it off.
• Application launch trackingThis allows Windows to monitor which programs you open to improve the Start menu results. If you don't want Microsoft to have this information, uncheck the box.
• Suggested content in SettingsBasically, internal recommendations and promotions; you can also remove it without losing real functionality.

Next, go to Search Permissions within Privacy and Security . Here you can:

• Disable online searches integrated into the Windows search boxpreventing every term you type from going to Bing.
• Block or limit cloud content searches (OneDrive, SharePoint(Outlook), which is important if you handle sensitive data.
• Turn off search history on this device and delete what has already been recorded, so that there is no local log of everything you have searched for.

In the "Searching in Windows" section, you can manage how your local files are indexed . The index is very useful for finding things quickly, but in return, it generates a complete map of what you have and where it's located. Here, you can choose the indexing mode and, most importantly, add folders to the exclusions list so that their contents are not indexed or appear in the results (ideal for sensitive documents or work files).

Another sensitive point is "Find My Device ," which is also located under Privacy and Security . This feature uses your device's location to help locate it if it's lost or stolen. On laptops, it might make sense to keep it enabled if you agree to share your data, but on desktop computers, it's usually completely unnecessary; disabling it prevents Windows from periodically sending coordinates to Microsoft.

Voice, typing, keyboard, and recognition: what to disable

Windows 11 tries to learn how you speak and type to personalize the experience , from text suggestions to speech recognition. This sounds great, but it involves collecting speech, handwriting, and typing samples that, in one way or another, end up being processed by Microsoft.

Go to Settings > Privacy & security > Speech and locate the Online speech recognition setting . Turning it off prevents apps that use Microsoft's cloud-based speech engine from sending your commands and dictation to their servers for processing. If you also want to remove other AI-based features, you can see how to remove AI from Windows 11. You'll still have local speech recognition where it's supported, but without exposing external recordings.

Under Speech, you'll find the "Input and handwriting personalization" section . Here, Windows uses what you write (with a keyboard or stylus) to create a personalized dictionary that improves suggestions. Microsoft states that this data is stored locally and, at most, synced with your OneDrive; however, for maximum security, disable storage of this word list and delete any existing data.

The good news is that disabling these options doesn't break the system ; you'll simply lose some convenience in the suggestions or recognition. If you prioritize privacy over convenience, it's a fairly reasonable trade-off, especially for teams or those handling sensitive data.

In corporate environments, you can go even further by controlling these same aspects via Group Policy or MDM . Microsoft documents policies such as AllowInputPersonalization to block input personalization, or specific settings to prevent online speech recognition on all computers in the organization from a central point.

Location, find my device, and app permissions

One of the most criticized aspects of Windows 11 is the number of permissions that applications receive by default : location, camera, microphone, notifications, access to documents… If you want serious privacy protection, it's time to thoroughly clean up this area.

Start with Windows permissions related to location . Go to Settings > Privacy & security > Windows permissions > Location (or within App permissions, depending on your version). From here you can:

• Cut off the device's global access to the locationso that neither the system nor the apps can read it.
• Allow Windows to access the location but then filter which specific apps can use it.
• Clear location history registered on the device.

For most users who want high privacy , it makes sense to disable location globally and only turn it on occasionally when really needed (for example, on a travel laptop and for a specific app).

Now scroll down to the “App permissions” section within Privacy and security . Here you’ll see a long list of categories: Location, Camera, Microphone, Voice activation, Notifications, Account information, Contacts, Calendar, Phone calls, Call history, Email, Tasks, Messages, Radio signals (Bluetooth, etc.), Other devices, App diagnostics, Automatic file downloads , Documents, Downloads, Music, Pictures, Videos, File system, Screenshot borders, Screenshots, and apps…

The pattern is always the same for each permit :

• First, a switch to allow the device use that type of resource (for example, camera).
• Second, another switch to authorize or not that the applications can request access.
• Finally, a list of all the apps that have requested that permission, with their own individual toggle switch.

If you want to be aggressive, you can disable app access to most categories and only enable those that make sense . For example, microphone and camera access only for your trusted video calling client, and learn how to tell if your camera is blocked if you suspect misuse. File system access only for specific file managers or backup programs, and so on. You'll also see options to clear related histories (e.g., previous location usage).

Keep in mind that some pre-installed apps come with more permissions than are reasonable , especially in clean installations. It's quite common to find several apps with access to location, camera, or microphone even if the user has never opened them. A manual review here can make a big difference to your exposure profile; you can clean up permissions with O&O AppBuster when necessary.

Personalized ads, Microsoft account, OneDrive, and cloud experiences

The other major aspect of privacy in Windows 11 is everything related to your Microsoft account and cloud services : synchronization of settings, backups, personalized advertising, OneDrive, shared experiences across multiple devices, etc.

The first thing you should consider is whether you want to use a local account instead of a Microsoft account . When you sign in with your Microsoft account (such as an @outlook or @hotmail email), the system syncs preferences, passwords, history, and other data across devices, but it also links your activity to that online identity. To change this, go to Settings > Accounts > Your info and choose the option "Sign in with a local account instead." Follow the wizard, and if you use BitLocker, make sure you have backups of your recovery keys.

Regarding advertising, you've already disabled your Ads ID under Privacy > General , but there are still a few loose ends. It's also advisable to review the privacy settings on your Microsoft account website, where you can adjust personalized ads in services like Outlook, Xbox , Bing, and Edge, and delete browsing data associated with your MSA.

OneDrive deserves its own section . It's very useful as an automatic backup, but from a privacy standpoint, it means your documents end up stored on external servers. If you don't use it or don't want your files to leave your computer, click the OneDrive icon in the notification area, go to Settings > Account , and click "Unlink this PC." Files already in the cloud won't be magically deleted, but your PC will stop syncing.

Windows Backup can also upload information to the cloud about your preferences, apps, and settings. In Settings > Accounts > Windows Backup, turn off the "Remember my preferences" and "Remember my apps" options if you want the system to stop storing this data in your Microsoft account.

Another feature to disable to strengthen privacy is "Share across devices ," which allows compatible apps to sync information across multiple devices where you use the same account. Go to Settings > Apps > Advanced app settings and turn off the "Share across devices" option. Check apps like Phone Link for additional settings. Less syncing means less exposed data.

VPN, proxy, DNS, and connections to Microsoft services

All of the above controls what Windows collects and sends, but it's missing the channel through which the information travels: your internet connection . Here are three tools worth tweaking: VPN, proxy, and DNS servers.

Setting up a system-level VPN routes all your computer's traffic through an encrypted tunnel , hiding your real IP address from the websites you visit and making it harder for third parties to track you. In Windows 11, you configure it in Settings > Network & Internet > VPN , where you can add a new connection by specifying the server, VPN type, and credentials. It's preferable to use a trusted provider (or set up your own VPN) rather than free services, which often make money by exploiting the data they supposedly protect.

In the same Network and Internet section, you have the Proxy section . From there you can:

• Allow Windows to automatically detect proxy settings (useful in corporate networks).
• Manually define a proxy server through which your HTTP/HTTPS requests will pass.
• Use a script Of configuration if your organization provides it.

Using a proxy allows you to place an intermediary server between your computer and the Internet , which adds an extra layer of anonymity depending on how it is configured and who manages it.

Finally, changing your DNS can improve both privacy and security . By default, you use your ISP's DNS servers, which can log your queries and even block access. Some public DNS providers prioritize privacy, quickly deleting logs and filtering out malicious domains. To change your DNS settings, open the classic "Network Connections" panel, go to your network adapter's properties, select Internet Protocol Version 4 (TCP/IPv4) , and manually specify the DNS addresses you want to use.

If you're in a business and concerned about the number of connection points to Microsoft services , it's worth reviewing the documentation for "Managing connections from Windows operating system components to Microsoft services," and in particular, the "limited functionality baseline." That guide explains which endpoints can be blocked without completely breaking the system, and what functionality sacrifices each setting entails.

Advanced tools: Diagnostic data viewer and group policies

When you want to go beyond "click-click" in Settings and need to audit or control dozens or hundreds of computers, two key pieces come into play: the Diagnostic Data Viewer and administrative policies (GPO/MDM).

The Diagnostic Data Viewer is an official Microsoft app, available from the Store , that lets you see in real time what data Windows is sending from your device. To activate it, go to Settings > Privacy & security > Diagnostics & feedback , enable the "View diagnostic data" option, and then open the link to download it from the Store.

Once inside, you'll see the logs organized by event, in JSON format , with fields such as date, event type (Windows Kernel, General Windows, error reports, etc.), and detailed content. You can use the search bar to find specific terms like "microphone" or "location," and apply filters by category to avoid getting lost in the sea of ​​data.

An advanced trick involves "forcing" the emptying of pending data and starting from scratch. halting the diagnostic tracking service with PowerShell: Stop-Service -Force DiagTrackNext, you review the generated data in the viewer and, if you see anything that doesn't look right, you fine-tune the privacy settings. You can even export the critical JSON data to an encrypted document to maintain an auditable record of what's leaving the system.

For IT administrators, Group Policy Objects (GPOs) and Management Domain Manager (MDM) policies offer much finer control over all these settings. Microsoft documents, for example:

• Allow telemetry / Allow diagnostic data: defines the level of data (from minimum to optional) that is sent from all computers joined to the domain.
• Disable advertising ID to prevent advertising identifiers at the system level.
• Block Cortanapersonalized experiences, location, online voice recognition, or sending activities to the cloud.
• Restrict the user from lowering (or raising) the level of diagnostic data on their own..
• Prevent the user from deleting diagnostic data whether the organization needs to keep them for internal compliance, or just the opposite: force their elimination.

Additionally, there is a specific configuration called “Windows Diagnostic Data Processor” for enterprise environments in Windows 10/11 Enterprise, Pro, and Education. This option allows the organization to assume the role of data controller under the GDPR, with the ability to handle access, export, and deletion requests associated with Microsoft Entra (Azure AD) identities.

In that context, Microsoft also recommends limiting the use of personal Microsoft accounts on corporate devices, restricting the sending of feedback from the Feedback Hub app, and carefully managing any additional services that may escape the governance of that diagnostic data.

Beyond Windows: browser, search engine, and software you install

Even if you set Windows 11 to extremely hardened security, your privacy can still be compromised by your online activity . Your browser, search engine, and third-party applications are just as, if not more, important than your operating system settings.

Regarding your browser, consider using one that prioritizes privacy , or at least configure yours to reduce tracking: block third-party cookies, disable the sending of usage data, adjust autofill and sync settings, and review which extensions you install. Even if you use Edge or Chrome, you can strengthen the settings to prevent them from sending more information than necessary to their respective providers.

The default search engine also plays a significant role . Google and Bing are very powerful, but their model relies on profiling you to show you ads, which involves collecting your search queries and clicks. There are alternative search engines that promise not to track or build profiles, and these can be a good complement to the privacy measures in Windows 11.

Finally, be careful with the software you install . Even if you control system permissions, a malicious or overly curious application can try to circumvent restrictions. Always check the source, read the permissions it requests, avoid cracks and dubious programs, and whenever possible, opt for reputable open-source tools whose functionality can be audited.

If you combine all these Windows 11 settings with prudent browsing, good installation practices, and the use of private VPNs/DNS , you can significantly reduce the amount of data your PC shares with Microsoft, other major platforms, and unknown third parties, while maintaining a stable, up-to-date, and reasonably comfortable system for everyday use. Furthermore, applying techniques for secure Windows debloat will further improve your vulnerability surface.