Windows 11 is a fantastic operating system, but out of the box, it behaves more like a data-harvesting platform than a private workspace. During the initial setup, Microsoft enables dozens of background trackers designed to monitor your app usage, build an advertising profile, and feed your activity into their cloud AI training models.
With the recent rollout of Copilot+ PCs and continuous background diagnostics, taking control of your local data has never been more important. You do not need to be a cybersecurity expert to lock down your machine; you just need to know which toggles to flip.
Here are the 10 most critical privacy settings you need to change in Windows 11 right now to reclaim your digital footprint.
1. Disable Windows Recall and Snapshots
Introduced for newer AI-powered PCs, Windows Recall takes constant screenshots of your active desktop so an AI agent can "remember" what you were working on. While Microsoft encrypts this locally, having a constant photographic log of your banking screens, private chats, and passwords is a massive security risk.
- Go to Settings > Privacy & security > Recall & snapshots.
- Toggle the feature completely Off.
- Click Delete snapshots to wipe any images it has already captured of your desktop.
2. Turn Off Optional Diagnostic Data (Telemetry)
By default, Windows sends massive amounts of data back to Microsoft servers to "improve performance." While some of this is required to fetch security patches, the "Optional" tier includes snapshots of your browser history and memory dumps from app crashes.
- Navigate to Settings > Privacy & security > Diagnostics & feedback.
- Expand the Diagnostic data menu and toggle off Send optional diagnostic data.
- Scroll down slightly and click Delete diagnostic data to purge the logs currently stored on Microsoft's servers.
Shutting off heavy telemetry is also a fantastic way to free up processing power. If you are trying to make Windows 11 faster by turning off background processes, cutting the constant outbound connection to Microsoft is step one.
3. Disable Your Global Advertising ID
Every Windows 11 user is assigned a unique Advertising ID. Third-party app developers use this ID to track your behavior across different applications to serve you targeted ads inside free software.
- Go to Settings > Privacy & security > General.
- Turn off Let apps show me personalized ads by using my advertising ID.
4. Stop App Launch Tracking
Windows monitors exactly which programs you open and how often you use them to "personalize" your Start Menu recommendations. This is completely unnecessary telemetry.
- In that same General privacy menu, find Let Windows improve Start and search results by tracking app launches.
- Toggle it Off.
5. Disable Cloud Content Search
When you press the Windows key and search for a local file (like a PDF on your desktop), Windows automatically sends that query to Bing to fetch web results. Not only does this expose your local file names to the internet, but it also slows down your Start menu.
You can turn this off safely by applying one of the most useful Windows Registry Editor tweaks. Navigating to the Explorer policy key and setting DisableSearchBoxSuggestions to 1 forces your search bar to remain completely local and lightning-fast.
6. Revoke Timeline & Activity History
Windows logs the websites you visit and the documents you edit to sync your "Activity History" across multiple devices logged into your Microsoft account. If you only use one PC, this feature just acts as a cloud-based surveillance log.
- Go to Settings > Privacy & security > Activity history.
- Turn off Store my activity history on this device.
- Click Clear history for the account listed below.
7. Turn Off "Suggested Content" in Settings
Microsoft frequently injects advertisements for OneDrive storage upgrades, Microsoft 365 subscriptions, and Edge browser prompts directly into your Settings app under the guise of "suggestions."
- Navigate to Settings > Privacy & security > General.
- Toggle off Show me suggested content in the Settings app.
8. Enable DNS over HTTPS (DoH)
Your Internet Service Provider (ISP) can see every website domain you visit. Enabling DNS over HTTPS natively in Windows 11 encrypts your web traffic requests at the system level, stopping your ISP from selling your browsing habits.
- Go to Settings > Network & internet > Wi-Fi (or Ethernet).
- Click Hardware properties.
- Next to DNS server assignment, click Edit.
- Change it to Manual, turn on IPv4, and set your Preferred DNS to a secure provider (like Cloudflare's
1.1.1.1). Change the encryption dropdown to Requires (DoH).
%20in%20Windows%2011.webp "Configuring Secure DNS over HTTPS (DoH) in Windows 11")
If you want to protect your actual IP address alongside your DNS queries, you should also consider routing your connection through a secure tunnel. Check our guide on why free VPNs are dangerous and which apps to trust to handle your network encryption properly.
9. Disable Inking and Typing Personalization
To improve its autocorrect and predictive text algorithms, Windows sends samples of the words you type and draw back to Microsoft's linguistic servers. You should never allow an operating system to log your raw keystrokes.
- Go to Settings > Privacy & security > Inking & typing personalization.
- Toggle off Custom inking and typing dictionary.
10. Audit App Permissions (Microphone & Location)
You might be surprised by how many background apps have access to your exact GPS location or microphone. Standard desktop applications rarely need this level of access.
- Go to Settings > Privacy & security.
- Scroll down to the App permissions section.
- Click on Location and turn off access for weather widgets, news apps, and the Microsoft Store.
- Repeat this process for the Microphone and Camera menus, ensuring only essential apps (like Zoom or Discord) have access.
Final Thoughts on PC Integrity
Toggling off these native tracking features secures your local environment, but true privacy also requires protecting what you allow onto the machine. Downloading random `.exe` files from Google searches often bypasses these privacy settings entirely by injecting spyware straight into your system folders. To keep your PC permanently clean, start using package managers instead of web browsers. Our tutorial on the safer way to install Windows apps will show you how to pull verified, clean software directly from the command line.
