Quick answer: Windows 11 sends Microsoft "required" diagnostic data by default, and on Home and Pro editions you can't turn that off completely through built-in settings. What you can do in about 10-15 minutes in Settings is disable optional diagnostic data, the advertising ID, personalization, activity history, location tracking, and Recall on Copilot+ PCs. If you're reading this on a work laptop, it's worth first understanding the difference between OS telemetry and corporate monitoring — covered separately in our piece on whether your employer can monitor your computer. A VPN handles a different front entirely — your traffic on the network and with your ISP, not the operating system's own telemetry.
What Windows 11 actually sends to Microsoft
Before turning anything off, it helps to know what's actually being collected. Microsoft describes two practical diagnostic data levels for Windows 11 — "Required" and "Optional." A third level, "Diagnostic data off" (Security), where no telemetry is sent at all, exists only on Enterprise, Education, and Server editions — Home and Pro simply don't show that option in the interface.
"Required" data has been the default since Windows 10 version 1903 and remains the baseline for Windows 11. It covers: device characteristics, the list of installed applications (needed to check compatibility before updates), driver information, crash counts, and part of the networking attributes — including, on devices with a cellular modem, the IMEI.
"Optional" data goes noticeably further: which programs you run and how long you use them, your Microsoft Edge browsing and search history, and enhanced error reporting — including memory dumps that could, in theory, accidentally capture a fragment of an open document or web page. This is the level worth turning off first if privacy matters to you more than helping Microsoft debug crashes.
All of this travels over an encrypted TLS connection with certificate pinning — intercepting it in transit is about as hard as intercepting your online banking traffic. The issue isn't how the data travels; it's what gets sent and to whom.
| Level | What's included | Available on |
|---|---|---|
| Diagnostic data off (Security) | Windows Update and Defender diagnostics are minimal, almost no telemetry is sent | Enterprise, Education, Server only |
| Required | Device characteristics, installed app list, drivers, crash counts, part of networking attributes | All editions, on by default |
| Optional | App usage time, Edge browsing/search history, enhanced error reports with memory dumps | All editions, can be turned off in Settings |
Can you fully disable telemetry in Windows 11?
Honestly — no, not on Home or Pro. The "Diagnostic data off" level simply isn't exposed in the interface on those editions; it's only visible and applicable through group policy on Enterprise, Education, or server versions of Windows. The most you can do on Home and Pro with built-in tools is reduce telemetry down to the "Required" minimum and additionally restrict memory dump and diagnostic log collection.
On Windows 11 Pro, the Local Group Policy Editor (gpedit.msc) helps here — Home doesn't have it at all. Through policy you can lock in the "Allow Diagnostic Data" setting to the required level so it doesn't reset after the next feature update, and additionally cap the volume of dumps and logs collected.
You'll also find third-party utilities like O&O ShutUp10++, Windows Privacy Dashboard, and similar "tweakers" that promise to disable telemetry more aggressively than the built-in settings. Some caution is warranted: these tools change system settings and the registry in ways Microsoft doesn't document or test, and there are known cases of updates breaking or Windows Defender misbehaving afterward. If you decide to try one anyway, create a system restore point first and only download it from the developer's official site, not a random mirror.
One more warning: don't try to block telemetry by editing the hosts file or firewall rules to block Microsoft's servers. Some of Microsoft's diagnostic and service endpoints double as the backbone for critical functions like Windows Update and signing into your Microsoft account. Block one of those "just in case," and you can end up with a system that stops updating or locks you out of your own account instead of gaining privacy.
How to disable tracking in Windows 11: step by step
Everything below lives inside Windows 11 Settings and takes 10-15 minutes total. Each section is an independent group of toggles — the order between them doesn't matter.
Diagnostics and feedback
Open Settings → Privacy & security → Diagnostics & feedback. Turn off "Send optional diagnostic data" (this leaves only the required level), turn off "Improve inking and typing" and "Tailored experiences" — the latter uses your app usage and diagnostic data to generate in-system tips and suggestions. In the same section you'll find feedback frequency — set it to "Never" — and a "Delete" button for diagnostic data already stored on the device.
General settings and the advertising ID
Next, go to Privacy & security → General. Four toggles are worth checking first: the advertising ID, which lets apps personalize ads based on your activity; app launch tracking for faster search and more relevant results; showing suggestions in the Settings app itself; and letting websites access your device's language list through the browser — that one is part of your fingerprint too. A deeper look at the advertising ID specifically is in our separate article on disabling the advertising ID.
Activity history, search, and location
In "Activity history," turn off "Let Windows collect my activities from this device" — if enabled, the system keeps a history of the apps you've run and documents you've opened and can use it to sync activity across your devices via your Microsoft account. In "Search permissions," disable cloud content and search history in the Start menu if you don't want search results shaped by your online activity. In "Location," you can turn location services off entirely or, more practically, restrict access to only the apps that genuinely need it — maps or weather, not everything — and separately clear your accumulated location history.
App permissions: camera, microphone, files
The same Privacy & security section holds a long list of permissions — camera, microphone, documents, the Downloads folder, contacts, and more. It's worth going through it once and revoking access from apps that don't need it by design: a calculator has no business accessing your microphone, and a PDF reader doesn't need your contact list. For a deeper look at which app permissions are actually risky and why they're worth auditing regularly, see our article on dangerous app permissions.
Group policy for Windows 11 Pro
If you're on Windows 11 Pro, also open gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Data Collection and Preview Builds. The "Allow Diagnostic Data" policy here lets you lock the value to "Send required diagnostic data" so it can't silently widen after an update. Right next to it are the "Limit Dump Collection" and "Limit Diagnostic Log Collection" policies, which narrow the volume of dumps and logs collected beyond what the regular Settings app exposes. Windows 11 Home has no Group Policy Editor at all — this step is Pro-and-above only.
Recall and Copilot: how to turn off AI screenshots
Recall is a feature that periodically takes screenshots and later lets you find a moment by the meaning of what was on screen at the time. Three things matter before you configure anything: it only runs on Copilot+ PCs — machines with a dedicated neural processing unit (NPU), which most ordinary laptops don't have; it's off by default and requires deliberate opt-in; and the snapshots and their processing happen locally on the device, with the database stored encrypted (device encryption or BitLocker) and access protected through Windows Hello Enhanced Sign-in Security.
If the feature exists on your machine, you manage it under Settings → Privacy & security → Recall & snapshots: you can stop saving new snapshots entirely, pause capture temporarily, exclude specific apps or websites from being captured — it's a good idea to add banking apps and messaging apps to that exclusion list right away — and delete already-saved snapshots outright. If "Recall & snapshots" simply isn't in your Privacy & security list, the feature doesn't exist on that device and there's nothing to configure.
The real practical risk with Recall isn't Microsoft itself — it's that screenshots amount to a visual history of everything you did on the computer. Anyone who gains access to your account or an unlocked session potentially sees that history too, unless it's protected further. Copilot is a separate AI assistant you can also unpin from the taskbar or disable its display in personalization settings if you don't want it around; it's unrelated to Recall directly, but part of the same broader question of how much AI is watching your screen.
Microsoft account vs. local account: what changes for privacy
When you install Windows 11 Home, the setup process pushes hard — effectively requires — signing in or creating a Microsoft account right there. The privacy difference is that with sync enabled through a Microsoft account, your system settings, saved Edge passwords, and browsing history go to Microsoft's servers, on top of whatever diagnostic level you've chosen.
Your Microsoft account has its own privacy dashboard at account.microsoft.com/privacy, where you can view and delete accumulated activity — search, location, browsing, and voice history tied to the account, if enabled. One more detail: with Device Encryption or BitLocker on Pro, the recovery key is saved to that same Microsoft account by default. That's convenient if you forget your password and still have the drive, but it also means access to your recovery key is effectively tied to your Microsoft account's security — keep a strong password and two-factor authentication on it.
How to check what Windows is collecting about you
To see the actual data that was sent, rather than guess from a description, install the Diagnostic Data Viewer app from the Microsoft Store — it's free. Enable viewing in the same "Diagnostics & feedback" section first; afterward the app shows a log of the specific events that were sent to Microsoft's servers, including their content.
The second source is the same account.microsoft.com/privacy dashboard, but for data tied to your Microsoft account rather than OS-level diagnostics. And the third is the "Delete" button for diagnostic data in "Diagnostics & feedback," which wipes what's already accumulated locally and in the cloud for that specific machine.
Where Windows privacy settings end and a VPN starts
It's worth separating two different privacy fronts that are easy to conflate. Windows telemetry is what the operating system itself reports to Microsoft about your device and how you use it. Network surveillance is what your ISP, a public Wi-Fi operator, or the websites you visit can see about your traffic. The settings in this article handle the first one; a VPN handles the second — and neither replaces the other.
| Who sees it | What they see | What handles it |
|---|---|---|
| Microsoft | OS diagnostics and account data (when sync is on) | The privacy settings and Recall controls in this article |
| Your ISP | DNS lookups, domains, and IP addresses you connect to | A VPN plus encrypted DNS |
| Public Wi-Fi | Your traffic on the shared network, risk of rogue access points and interception | A VPN |
| Websites and trackers | Browser fingerprint, cookies, on-page behavior | Browser settings and tracker blockers |
An honest caveat, with no illusions: a VPN does not turn off Windows telemetry. Diagnostic data your system sends under your Microsoft account still reaches Microsoft — it just travels encrypted through the VPN server instead of a direct connection. A VPN changes your visible IP address and hides your traffic's content from your ISP and from whatever network you're on — a separate, complementary measure, not a replacement. For a Windows machine in that setup, LiMP VPN for Windows with an automatic kill switch and a no-logs policy covers the network side while you handle the operating system's own privacy settings.
Checklist: Windows 11 privacy in 15 minutes
- Turn off optional diagnostic data in Diagnostics & feedback.
- Turn off the advertising ID and app launch tracking under General.
- Disable Tailored experiences and inking/typing improvement.
- Turn off activity history and Start menu cloud search history.
- Restrict location to apps that genuinely need it and clear location history.
- Check whether Recall exists, and either stop saving snapshots or exclude banking apps and messengers.
- Audit camera, microphone, and file permissions across installed apps.
- Turn on device encryption and use a VPN on public networks.
Frequently asked questions
Does telemetry slow down the computer?
There's usually no noticeable performance impact either way. Turning off optional diagnostic data is worth doing for privacy, not speed — don't expect a visible boost in responsiveness or frame rates.
Will Windows Update break if I restrict diagnostics?
At the "Required" level, updates keep working normally — that's the minimum Microsoft itself recommends keeping so Windows Update functions correctly. Problems usually come not from the Settings toggles but from trying to block Microsoft's servers via the hosts file or firewall, or from overly aggressive third-party tweaking tools.
Will a feature update reset my privacy settings?
It happens: after installing a major feature update, new privacy toggles sometimes appear or individual settings reset to their defaults. A good habit is to reopen Privacy & security after every feature update and check the list again.
Are tools like O&O ShutUp10++ safe for disabling tracking?
That's a whole class of third-party utilities, not one specific product, and quality varies. If you decide to try one, create a system restore point first and only download it from the developer's official website, never a third-party mirror.
Does my laptop have Recall?
Recall only runs on Copilot+ PCs with a dedicated NPU. The simplest check is opening Privacy & security: if "Recall & snapshots" isn't listed there, the feature simply doesn't exist on that machine.
Does a VPN hide my data from Microsoft?
No. A VPN changes your visible IP address and encrypts the connection to the VPN server, but data Windows sends under your Microsoft account still reaches Microsoft — just over a different network path. A VPN doesn't replace the privacy settings in this article; it complements them from the network side.
Do I still need separate antivirus software if Windows already watches for threats?
Built-in Microsoft Defender is enough for most home use cases. Turning off telemetry as described here doesn't touch Defender's cloud-delivered protection — they're different mechanisms: one handles system diagnostics, the other handles threat detection, and adjusting the first doesn't disable the second.