windows os privacy
disable telemetry, recall, and cortana the safe way — and gain performance while you’re at it
what windows collects by default
tl;dr
a stock windows 11 install sends telemetry to microsoft on boot, on app launch, on typing (typing personalization), on browsing (via edge / bing / cortana suggestions), and now optionally on everything you look at on your screen (recall). most of it can be turned off, but the ui hides the switches under multiple layers of “improve your experience” nudging.
the categories worth turning off, roughly in order of impact:
- diagnostic data — the main telemetry stream. drops to “required only” at settings → privacy → diagnostics & feedback
- tailored experiences — lets microsoft use your telemetry to personalize ads and suggestions in the shell
- advertising id — a per-user id that lets microsoft/uwp apps track you across the system
- cortana — largely a background service now that the assistant surface is gone; still worth disabling
- recall — the ai screen-snapshot feature. off by default on most skus but a running attack-surface concern; disable and remove where possible
- copilot — the ai sidebar. minimal telemetry when unused but chatty when active
- online speech recognition — sends voice audio to microsoft servers
- activity history — syncs opened files / apps to microsoft cloud
- location history — even on desktops with no gps, this collects wifi/ip-based location
- edge / bing / start-menu web search — every search you do in the start menu becomes a bing query
before you touch anything
gotcha
create a system restore point (or a full image backup) before running any debloat tool. these tools work by modifying registry keys, group policy, scheduled tasks, and app packages — a rare edge case can leave you with a broken start menu or store, and rolling back is much faster than reinstalling.
- create a restore point (control panel → recovery → configure system restore → create)
- optional: full image backup with macrium reflect free or windows “create a system image”
- close everything — some tweaks take effect only after reboot
- if you use a microsoft account, know your recovery details before disabling any account features
- if bitlocker is on, know your recovery key
tool comparison
| tool | windows | best for |
|---|---|---|
| Win11Debloat | 11 (some 10 support) | opinionated, interactive powershell script. best out-of-box preset for windows 11. removes bloat apps, disables telemetry, cleans start menu, disables recall / copilot at the group-policy level. safe defaults; each step is a prompt so you can skip pieces |
| Privatezilla | 10 (11 partial) | gui app that toggles about 60 privacy settings and shows current state. good if you want a checklist you can revisit later. windows 10 is its home turf |
| Winaero Tweaker | 7 / 8 / 10 / 11 | the swiss army knife for windows tweaks — broader than just privacy. covers explorer, context menus, boot, taskbar, and a large privacy section. best if you also want to reshape the ui |
these three overlap by design. the workflow that works: run Win11Debloat first for the big-hammer defaults, then Privatezilla or Winaero for the finer knobs you want to keep control of. you can undo most changes in each of the three, but a restore point is faster and more reliable than the tools’ own undo.
what to actually disable
tl;dr — the checklist that hits the important 90%
- diagnostic data → required only
- advertising id → off
- tailored experiences → off
- online speech recognition → off
- activity history → off, clear existing
- location services → off (unless you need it for a specific app)
- start menu “show search highlights” and web results → off
- cortana background app → disabled
- recall → disabled via group policy (win11debloat does this)
- edge as system browser → replace with brave / firefox (see browser privacy)
- onedrive automatic backup of documents/pictures/desktop → off if you don’t use it (it’s on by default and silently syncs folders)
- widgets pane — disabled or uninstalled
- ads in start menu / lock screen / notifications — off
- “suggested content in settings” — off
gotchas
- windows update will occasionally reset some of these back to defaults during feature updates — re-run your tool after every feature update
- a microsoft account (vs local account) forces some settings back on; a local account gives you more sustainable privacy but loses some sync features. win11 tries hard to hide the “local account” option during setup — disconnect ethernet + wifi during oobe to force it
- completely uninstalling copilot / recall packages can break future feature updates. disabling them via group policy is the sustainable path
- edge cannot be fully uninstalled — it’s a system component. you can remove it from the taskbar / start menu and set another default browser, but the process still exists
- if you use windows hello, some biometric telemetry is required for the feature to work; disabling “improve inking & typing” is the compromise
- gamers: disable game bar telemetry but leave game mode / hags on — those are performance features, not privacy issues
- enterprise / education skus have finer-grained group policy controls that home sku lacks — if you have access to windows pro, prefer group policy over registry hacks for maintainability