How to Customize Privacy Settings in Windows 11 (25H2)

In today’s digital landscape, safeguarding your personal information has never been more important. Microsoft continuously collects data on user behavior through Windows 11(25H2), and while some of that data collection helps improve the OS, much of it goes beyond what most users are comfortable with. This guide walks you through 15 practical privacy settings you can adjust right now to take back control of your data on Windows 11.

1. App Permissions

App permissions let you decide which applications can access sensitive resources on your device — your camera, microphone, location, contacts, and more. Locking these down is the single most effective privacy step you can take in Windows 11(25H2).

Change Camera and Microphone Permissions

Unauthorized access to your camera or microphone is one of the most serious privacy risks on any PC. Fortunately, Windows 11 makes it easy to restrict which apps can use these devices.

Step 1: Open the Settings app with Windows + I and navigate to Privacy & security.

Step 2: Scroll down to the App permissions section and select Camera.

Step 3: To block all camera access system-wide, turn off the Camera access toggle.

Step 4: If you want some apps to retain camera access, leave Camera access enabled and scroll through the list below to individually toggle off apps you don’t trust.

Step 5: Go back to App permissions and select Microphone. Repeat the same process to restrict microphone access.

Disable Location Tracking

Windows and many apps use your device’s location to deliver local weather, map directions, and targeted content. If you’d rather keep your whereabouts private, here’s how to turn location tracking off.

Step 1: In Privacy & security, scroll to App permissions and select Location.

Step 2: To disable location tracking entirely, switch off Location services and click Turn off when prompted.

Step 3: If you want Windows to be able to locate a lost or stolen device, keep Location services on but disable Let apps access your location. This blocks apps from reading your location while preserving the device-find capability.

Step 4: For apps that genuinely need location access (like Maps or Weather), re-enable Let apps access your location and grant permission only to those specific trusted apps.

Step 5: Toggle off location access for any remaining apps that don’t need it.

Manage Account Info Permission

Some apps request access to your account name and profile picture. You can control exactly which apps are allowed to read this information.

Step 1: In Privacy & security, select Account info under App permissions.

Step 2: Review the app list and disable account info access for any app that doesn’t need it.

Adjust Calendar, Contacts, Phone Calls, and Messaging Permissions

These permissions govern whether apps can read your calendar events, contact list, phone call records, and messages. Limit access to only the apps that have a genuine need.

Step 1: Under App permissions, select each category — Calendar, Contacts, Phone calls, and Messaging — one at a time.

Step 2: For each category, toggle off access for apps that shouldn’t have it. For example, disable Contacts access for any app that has no legitimate reason to read your address book.

Manage Library Folders Permissions

You can control which apps can browse your Documents, Downloads, Music, Pictures, and Videos folders.

Step 1: In Privacy & security, navigate to each library folder under App permissions — such as Documents or Pictures.

Step 2: For each folder, toggle off access for apps that don’t need to read those files.

2. Disable Diagnostics and Feedback

Windows 11 sends diagnostic data to Microsoft — including information about the websites you visit and the apps you use — to help improve the operating system. You can limit how much of this data leaves your device.

Step 1: Right-click the Start menu and select Settings.

Step 2: Go to Privacy & security and click Diagnostics & feedback.

Step 3: Turn off Send optional diagnostic data.

Step 4: Also disable Improve inking and typing, Tailored experiences, and View diagnostic data to prevent additional data collection and personalization based on your usage.

3. Turn Off Ad Tracking

Windows 11 assigns an advertising ID to your account and uses it to serve personalized ads based on your browsing and app usage patterns. Turning this off stops that profiling.

Step 1: In Settings, go to Privacy & security and select General.

Step 2: Disable Let apps show me personalized ads by using my advertising ID.

4. Turn Off Activity History

Activity History logs what you do on your device — apps opened, files accessed, websites visited — and can sync that data to your Microsoft account. Disabling it keeps your activity private.

Step 1: In Privacy & security, click Activity history.

Step 2: Turn off Save my activity history on this device.

5. Manage Search Permissions

Windows Search permissions control whether your search results pull in content from Microsoft’s cloud services and whether your search history is stored locally.

Step 1: In Privacy & security, select Search permissions.

Step 2: Under SafeSearch, choose your preferred content filtering level: Strict, Moderate, or Off.

Step 3: To keep your search results limited to your device only, turn off both toggles under Cloud content search — for Microsoft account and Work or school account.

Step 4: In the History section, disable Search history on this device so Windows stops logging your local search queries.

6. Exclude Folders from Windows Search

If you store sensitive files in certain folders, you can prevent Windows Search from indexing those locations entirely — keeping their contents out of search results.

Step 1: Go to Settings > Privacy & security and click Searching Windows.

Step 2: Scroll down to Excluded folders and click Add an excluded folder.

Step 3: Browse to the folder you want to exclude from search indexing and click Select Folder.

7. Turn Off Online Speech Recognition

When Online Speech Recognition is active, voice data is transmitted to Microsoft’s servers for processing. If you don’t use voice commands or Cortana, there’s no reason to leave this on.

Step 1: In Privacy & security, select Speech under Windows permissions.

Step 2: Toggle off Online speech recognition.

8. Switch to a Local Account

Signing in with a Microsoft account syncs your settings, activity, and preferences to the cloud. Switching to a local account keeps all of that data stored only on your device.

Step 1: Open Settings and go to Accounts. If you haven’t done so already, create a new local account — and for full system access, set it as an Administrator account.

Step 2: To change the account type, click Other users and select the newly created local account.

Step 3: Click Change account type, select Administrator from the dropdown, and click OK.

Step 4: To convert your current Microsoft account to a local one, go to Your info under Accounts and click Sign in with a local account instead.

Step 5: Follow the on-screen instructions to set a local username and password.

Step 6: Click Sign out and finish to complete the switch to your local account.

9. Disable Shared Experiences

Shared Experiences syncs your app activity and settings across multiple devices through your Microsoft account. Turning it off prevents that data from being pushed to the cloud.

Step 1: Open Settings, go to Apps, and select Advanced app settings.

Step 2: Click Share across devices.

Step 3: Select Off to stop Windows from sharing your app activity across devices.

10. Enable Encrypted DNS

By default, DNS queries are sent unencrypted, meaning your internet service provider and other third parties can see every website you look up. Enabling DNS over HTTPS (DoH) encrypts those queries and keeps your browsing activity private.

Step 1: In Settings, go to Network & internet and click on your active network connection.

Step 2: Click Hardware properties.

Step 3: Next to DNS server assignment, click Edit.

Step 4: Select Manual from the dropdown and enable IPv4.

Step 5: Enter your preferred DNS server addresses in the Preferred DNS and Alternate DNS fields. For example, Google’s public DNS: 8.8.8.8 and 8.8.4.4. Cloudflare’s privacy-focused DNS (1.1.1.1 / 1.0.0.1) is another solid option.

Step 6: Set DNS over HTTPS to On (automatic template) for both DNS entries to enable encrypted queries.

Step 7: If your network uses IPv6, enable it and repeat the process with appropriate IPv6 DNS addresses.

Step 8: Click Save to apply the new DNS settings.

11. Remove Recommended Start Menu Items

The Recommended section in the Start menu displays recently opened apps and files, which can inadvertently reveal your activity to anyone who glances at your screen. You can disable it in a few clicks.

Step 1: Open Settings, select Personalization, and click Start.

Step 2: Turn off Show recently added apps and Show recently opened items in Start, Jump Lists, and File Explorer.

12. Stop Using OneDrive

OneDrive automatically backs up your files and syncs them to Microsoft’s cloud. If you prefer to keep your data entirely local, you can unlink OneDrive from your PC without uninstalling it.

Step 1: Click the OneDrive icon in the system tray (bottom-right corner). If it’s not visible, open OneDrive from the Start menu.

Step 2: Click the gear icon and select Settings.

Step 3: In the Account tab, click Unlink this PC and confirm by clicking Unlink account.

💡 Tip: After unlinking OneDrive, consider switching to a local backup solution like Windows Backup and Restore or File History to keep your data protected without cloud sync.

13. Clear Your Microsoft Cloud Data

Even after tightening your local settings, Microsoft may still hold data about you in the cloud — including location history, browsing activity, and search queries. You can delete it directly from the Microsoft Privacy Dashboard.

Step 1: Visit the Microsoft Privacy Dashboard and sign in with your Microsoft account.

Step 2: Navigate to the Privacy tab.

Step 3: Expand each data category — Location activity, Browsing history, Search history, App and service activity, and App and service performance data — and click Clear to permanently delete the stored data.

14. Disable Clipboard Syncing

Windows 11 can sync your clipboard history — including text and images you’ve copied — across devices via your Microsoft account. This could expose sensitive copied content like passwords or personal details. Turning it off keeps your clipboard strictly local.

Step 1: Open Settings, select System, and click Clipboard.

Step 2: Turn off Sync across your devices.

15. Use a VPN Connection

A VPN (Virtual Private Network) encrypts all traffic leaving your device, masks your IP address, and prevents your ISP and other third parties from monitoring your online activity. It’s one of the most effective tools for maintaining privacy on any network.

Step 1: Choose a reputable VPN service that aligns with your privacy requirements. Look for providers with a verified no-logs policy.

Step 2: Download and install the VPN application on your Windows 11 device.

Step 3: Connect to a VPN server. Once connected, your internet traffic is encrypted and your real IP address is hidden from websites, advertisers, and network observers.

✅ Pro Tip: For maximum privacy, combine a VPN with the encrypted DNS settings from Step 10 above. This covers both your browsing traffic and your DNS lookups.

Taking these 15 steps puts you in firm control of what Windows 11 (25H2) shares about you and with whom. No single measure is a silver bullet, but together they dramatically reduce your exposure — from app-level data collection and ad profiling to cloud sync and unencrypted DNS queries. Revisit these settings whenever a major Windows update rolls out, as Microsoft occasionally resets certain privacy preferences after upgrades.