Each card below is one plan tier. Every fact comes from Microsoft’s own published page, with a short quote and the link. Where the page does not say, I write “not stated” and do not guess. Plans and policies change, so open the source before you decide.
Microsoft Copilot by plan
Free or consumer
Copilot app and website for consumers
May train; no off switch confirmed
- Training on your data
Microsoft's general privacy statement says it may use your data to develop and train its AI models. I did not find a Copilot-specific page for the consumer app that I could read, so treat this as the general rule.
Vendor wording: “we may use your data to develop, train, and fine-tune our AI models, including large language models (LLMs)”
Microsoft Privacy Statement, checked 2026-10-17
- Retention
Not stated. No retention period found on a page I could read for the consumer app.
- Admin controls
Not applicable. Individual accounts have no admin console.
- The setting to change
Not stated. I could not confirm a model-training switch for the consumer Copilot app from a Microsoft page.
- BAA (HIPAA)
Not stated. No BAA is described for the consumer Copilot app.
Paid individual
Microsoft 365 Personal and Family (Copilot in Microsoft 365 apps)
Not used for training by default
- Training on your data
Microsoft says prompts, responses and your file contents in Copilot in Microsoft 365 apps are not used to train foundation models. Optional feedback may be used to improve Copilot, but not to train the foundation models.
Vendor wording: “Prompts, responses, and your file contents when using Copilot in Microsoft 365 apps aren't used to train foundation models.”
Microsoft Support: Copilot in Microsoft 365 apps for home, your data and privacy, checked 2026-10-17
- Retention
Not stated. The home-plan page I read gives no retention period.
- Admin controls
Not applicable. Personal and Family plans have no admin console.
- The setting to change
Not applicable. Nothing to switch off per Microsoft: these are not used for foundation-model training.
- BAA (HIPAA)
Not stated. No BAA is described for Personal and Family plans.
Team or business
Microsoft 365 Copilot and Copilot Chat on business plans
Not used for training by default
- Training on your data
Microsoft says prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs. Copilot Chat has enterprise data protection under Microsoft's Data Protection Addendum.
Vendor wording: “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs”
Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot, checked 2026-10-17
- Retention
Microsoft stores prompts and responses as Copilot activity history. Admins can set retention policies for Copilot chat interactions in Microsoft Purview.
Vendor wording: “Admins can also use Microsoft Purview to set retention policies for the data related to chat interactions with Copilot”
Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot, checked 2026-10-17
- Admin controls
Copilot follows your identity model, permissions, sensitivity labels and retention policies. Admins can search stored data in Content search or Purview and manage feedback. Microsoft notes the controls vary by plan.
Vendor wording: “The specific controls and policies will vary depending on the underlying plan.”
Microsoft Learn: Enterprise data protection in Microsoft Copilot and Copilot Chat, checked 2026-10-17
- The setting to change
Not applicable. Nothing to switch off: not used for foundation-model training.
- BAA (HIPAA)
Microsoft says Copilot supports HIPAA compliance for properly configured implementations, under its Data Protection Addendum and BAA. Web search queries are not covered by the BAA.
Vendor wording: “HIPAA compliance doesn't apply to web search queries as they aren't covered by the DPA and Business Associate Agreement (BAA).”
Microsoft Learn: Enterprise data protection in Microsoft Copilot and Copilot Chat, checked 2026-10-17
Enterprise
Microsoft 365 Copilot on enterprise plans
Not used for training by default
- Training on your data
Same commitment as business plans: prompts, responses and Microsoft Graph data are not used to train foundation LLMs.
Vendor wording: “aren't used to train foundation LLMs, including those used by Microsoft Copilot”
Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot, checked 2026-10-17
- Retention
Admins set retention for Copilot chat interactions in Microsoft Purview and can view stored data with Content search or Purview.
Vendor wording: “To view and manage this stored data, admins can use Content search or Microsoft Purview.”
Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot, checked 2026-10-17
- Admin controls
Copilot inherits your sensitivity labels, retention policies and access controls, and supports logging of interactions.
Vendor wording: “Copilot respects your identity model and permissions”
Microsoft Learn: Enterprise data protection in Microsoft Copilot and Copilot Chat, checked 2026-10-17
- The setting to change
Not applicable. Nothing to switch off: not used for foundation-model training.
- BAA (HIPAA)
Same as business plans: HIPAA support for properly configured implementations under the DPA and BAA; web search queries are not covered.
Vendor wording: “support HIPAA compliance for properly configured implementations”
Microsoft Learn: Enterprise data protection in Microsoft Copilot and Copilot Chat, checked 2026-10-17
Worth knowing
- Microsoft's pages for Microsoft 365 Copilot do not split small-business plans from enterprise plans, so the team and enterprise rows rest on the same pages.
- Copilot has several surfaces under one name: the free consumer app, Copilot in Microsoft 365 apps at home, Copilot Chat at work, and Microsoft 365 Copilot. Check which one your team opens.
Sources
- Microsoft Learn: Data, privacy, and security for Microsoft 365 Copilot, checked 2026-10-17
- Microsoft Learn: Microsoft Copilot Chat privacy and protections, checked 2026-10-17
- Microsoft Learn: Enterprise data protection in Microsoft Copilot and Copilot Chat, checked 2026-10-17
- Microsoft Support: Copilot in Microsoft 365 apps for home, your data and privacy (read from the Internet Archive copy of this page, snapshot 2026-08-26), checked 2026-10-17
- Microsoft Privacy Statement (read from the Internet Archive copy of this page, snapshot 2026-10-17), checked 2026-10-17