← Gaming
F

Xbox Series X

Fail
Microsoft · 🇺🇸 United States
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
Manufacturer: Microsoft

⚠️ The bottom line

Microsoft's Gaming Copilot arrived on Xbox with a secret: switched on by default, silently taking screenshots, running OCR to extract every word of text, and shipping it to Microsoft for AI training. When users discovered this, Microsoft didn't apologize — they "publicly defended the feature." Every message typed in a game, every username on screen, every notification — captured and fed into Microsoft's AI pipeline. You weren't asked. Microsoft boasts about removing 368 million pieces of harmful content from Xbox while the FTC fined them $20 million for hoovering up children's data without parents' permission. Kids under 13 signed up for Xbox Live and Microsoft kept everything — avatars, photos, personal details — even when parents never finished consent. The company that couldn't follow basic child privacy law now wants its AI assistant to screenshot your children's gaming sessions.

Legal jurisdiction
🇺🇸 United States (headquarters)
⚠CLOUD Act read more →
US govt can demand your data from this company even if stored overseas
⚠FISA §702 / PRISM read more →
NSA collects stored emails, photos, messages without individual warrants
●Geofence warrants read more →
Police can demand location data for everyone near a crime scene
Spying
0/4 N/A
Is someone spying on me?
Data Sharing
3/4 HIGH
Who gets my data?
Security
0/4 N/A
Is it actually secure?
Honesty
2/4 MODERATE
Can I trust what they say?
Kids at risk
CONFIGURE High-risk areas that can be partially mitigated with settings changes.
4Contradictions
1Critical
3High
0Medium
3Sources
Findings by concern
Data Sharing 3/4 HIGH 3 findings
⚠️ criticalpolicy claims vs firmware analysis
Microsoft's Gaming Copilot arrived on Xbox with a secret: switched on by default, silently taking screenshots, running OCR to extract every word of text, and shipping it to Microsoft for AI training. When users discovered this, Microsoft didn't apologize — they "publicly defended the feature." Every message typed in a game, every username on screen, every notification — captured and fed into Microsoft's AI pipeline. You weren't asked.

What they claim: Gaming Copilot AI is an optional helper providing tips during gameplay.

What we found: In October 2025, Gaming Copilot was enabled by default, capturing screenshots via OCR and sending text to Microsoft for AI training without clear consent. 2026 rollout extends to entire Xbox user base. GDPR concerns raised in EU.

⚡ highpolicy claims vs app permissions
Microsoft promises gaming data is only shared with publishers "to support games." Then Microsoft bought Activision Blizzard for $68.7 billion, becoming the publisher of Call of Duty, WoW, and Candy Crush. Now "sharing with the publisher" means sharing with itself — merging 400 million gamers' habits into the same company running one of the world's largest ad networks. The privacy policy didn't change. The meaning of it did.

What they claim: Microsoft gives users control over data through the Privacy Dashboard.

What we found: The $68.7 billion Activision Blizzard acquisition merged behavioral data from 400 million monthly players — Call of Duty, WoW, Candy Crush — into Microsoft's advertising ecosystem. When Microsoft is both console maker and publisher, sharing data with publishers means sharing with itself.

⚡ highpolicy claims vs app permissions
Microsoft frames Xbox data as a choice between "Required" and "Optional." The required part alone sends 8MB per day from your console. You must sign in with a Microsoft account tying gaming to the same profile used for Bing, LinkedIn, and Outlook. The "choice" is between giving Microsoft a lot of data or giving them even more.

What they claim: Xbox data collection is divided into Required and Optional giving users control.

What we found: A mandatory Microsoft account links gaming to Bing, Outlook, LinkedIn, and advertising. The average Xbox sends 8MB of data per day. Even with Optional disabled, Required data includes hardware diagnostics, game launch data, and crash reports revealing play patterns.

Honesty 2/4 MODERATE 1 finding
⚡ highpolicy claims vs regulatory findings
Microsoft boasts about removing 368 million pieces of harmful content from Xbox while the FTC fined them $20 million for hoovering up children's data without parents' permission. Kids under 13 signed up for Xbox Live and Microsoft kept everything — avatars, photos, personal details — even when parents never finished consent. The company that couldn't follow basic child privacy law now wants its AI assistant to screenshot your children's gaming sessions.

What they claim: Microsoft says Xbox is safe for families with robust parental controls.

What we found: The FTC fined Microsoft $20 million in 2023 for COPPA violations — collecting children's data without parental consent on Xbox Live. Microsoft retained children's avatars, photos, and personal info even when parents didn't complete consent.

What happened to real people
Documented incidents involving Microsoft products and user data.
First PRISM participant (2007). 31% of US legal demands come with secrecy orders — 1,974 gag orders in H1 2025 alone. Users never told their data was demanded. [source]
Storm-0558: Chinese hackers used a stolen Microsoft signing key to access US government officials' email accounts. Microsoft's own infrastructure was the attack vector. [source]
What your data is worth to governments
Microsoft complied with 6,288 government data requests in H1 2025. That's 31% of demands include secrecy orders. Microsoft has been a confirmed PRISM participant since 2007. Under this programme, the NSA collects stored communications. The company is legally prohibited from telling you. Jurisdiction: US (CLOUD Act, FISA Section 702, Patriot Act).
Documented: First PRISM participant (2007). 31% of US legal demands come with secrecy orders — 1,974 gag orders in H1 2025 alone. Users never told their data was demanded.
Documented: Storm-0558: Chinese hackers used a stolen Microsoft signing key to access US government officials' email accounts. Microsoft's own infrastructure was the attack vector.
What is PRISM? · What is the CLOUD Act? · Transparency report
Sources