The short version
Windows reports to Microsoft by default, and the default level is not the quiet one. The band Microsoft calls Required already includes your IMEI and your mobile operator network alongside the usual hardware specs. The band above it, Optional, adds Edge browsing history, your search terms, a record of which programs you launched and how long they ran, and crash memory dumps that Microsoft itself warns may capture "parts of a file you were using when the problem occurred." The setting that stops all of it is restricted to Windows Server, Enterprise and Education editions, so on a Pro or Home machine the slider bottoms out one notch above silence. Here is exactly what each level holds, and what you can actually do about it.
The setting most people never open
Microsoft calls it diagnostic data. It used to be called telemetry. It got renamed twice, which is why half the guides online describe a menu that no longer exists. Microsoft's own support page spells out the shuffle: "Basic diagnostic data will be recategorized as Required diagnostic data and Full diagnostic data will be recategorized as Optional diagnostic data."[2]
Find the control here:
Windows 11: Start, then Settings, then Privacy & security, then Diagnostics & feedback.
Windows 10: Start, then Settings, then Privacy, then Diagnostics & feedback.[2]
Four levels, and the one you cannot reach
Microsoft's IT documentation describes four diagnostic data collection settings.[1]
Diagnostic data off (formerly Security).
Required diagnostic data (formerly Basic).
Enhanced.
Optional diagnostic data (formerly Full).
The numbers behind them, which is what you will meet in a registry editor or an MDM policy, are 0, 1, 2 and 3 in that order.[1]
Now the part that matters. Microsoft documents the off setting like this: "This is only available on Windows Server, Windows Enterprise, and Windows Education editions."[1] Read that list twice. Windows 11 Pro is not on it. Windows 10 Home is not on it. On a normal laptop the control stops at Required, and Required is not a low bar, as the next section shows.
Two more constraints worth knowing. Required "is the default setting for Windows 10, version 1903 and later,"[1] so if you never touched anything you are already there. And Enhanced is gone on current Windows: Microsoft states that setting "is not available on Windows 11 and Windows Server 2022."[1]
What Required already includes
This is where most people are wrong. Required is not a security-only band. It is not a heartbeat that says the machine booted. It is a detailed hardware and software inventory.
Microsoft's published list for Required diagnostic data covers device attributes such as camera resolution and display type, battery capacity and type, processor core count, architecture, speed and memory size, storage drive count, type and size, and the Windows edition.[1] It also covers a list of which apps are installed, driver activity, connected printers and external storage devices, and information about whether the machine meets the minimum requirements to upgrade.[1]
Then there is this line in the networking attributes:[1]
"Networking attributes, such as number of network adapters, speed of network adapters, mobile operator network, and IMEI number"
Your IMEI goes out at the default setting. The IMEI is the hardware identifier a cellular radio reports, and Microsoft's own documentation lists it as something Required collects, alongside which carrier's network you are attached to.
Microsoft Store activity rides along too, including "app downloads, installations, and updates," plus "Microsoft Store launches, page views, suspend and resumes, and obtaining licenses."[1] So are the number of crashes or hangs, app state changes such as "how much processor time and memory were used, and the total uptime for an app,"[1] and quality metrics like the percentage of uploaded events and the last upload time.[1]
Microsoft's framing of Required is "Minimum data required to keep the device secure, up to date, and performing as expected."[1] That is the company's own summary of an inventory that includes your IMEI. Both things are true at once, which is the whole problem with reading the privacy summary instead of the documentation.
What Optional adds on top
Optional, the old Full, layers additional data over Required: more about the device, its connectivity and configuration, health and logging information about system components, and then the parts that change the character of the collection entirely.[1]
Your browsing. "Browser activity, including browsing history and search terms, in Microsoft browsers (Microsoft Edge or Internet Explorer)."[1] Note the scope. This level collects browsing history and search terms from Microsoft browsers, and Microsoft does not describe collecting them from other browsers under this setting.
Your app usage. "App activity, such as which programs are launched on a device, how long they run, and how quickly they respond to input."[1] That is a workday reconstructed in aggregate: which tools you opened, and for how long.
Your memory. "Enhanced error reporting, including the memory state of the device when a system or app crash occurs (which may unintentionally contain user content, such as parts of a file you were using when the problem occurred)."[1]
Sit with that last one for a second. When something crashes, Windows can ship a snapshot of what was sitting in RAM. Microsoft is explicit in its own documentation that this can include fragments of what you were doing. If a document, a spreadsheet, a chat window or a bank page was open when a driver faulted, pieces of it can travel to Microsoft. Microsoft repeats the warning in its own note on crash dumps, which says they "may unintentionally contain personal data, such as portions of memory from a document and a web page."[1]
Microsoft does address whether the optional layer is load-bearing for your safety. Microsoft's support page says your device "will be just as secure and will operate normally" without it.[2] If that is your machine and you do not use Edge, the trade is not close.
How to turn it down
Start at Settings, then Privacy & security (Windows 11) or Privacy (Windows 10), then Diagnostics & feedback.[2] Under Diagnostic data, move the selector from Optional down to Required.[2] That is the whole fix for a normal consumer machine.
Then read this before you hit the delete button, because the button does less than you would hope. Microsoft's own warning: "selecting this option does not delete the diagnostic data that is associated with your Microsoft account, nor does it stop your diagnostic data from being sent to Microsoft."[2] Deleting on the device is not deleting everything. Anything tied to your Microsoft account goes through the privacy dashboard instead.[2]
If it is a work laptop, adjust your expectations. Microsoft notes that "if your organization has enrolled the device to services that rely on this data, your IT department might have a copy of this device's diagnostic data."[2] Your IT department already had it before you found the setting.
On Enterprise and Education editions, and on anything an administrator manages, the control lives in Group Policy: Computer Configuration, then Administrative Templates, then Windows Components, then Data Collection and Preview Builds, then Allow diagnostic data.[1] Two adjacent policies tighten the crash side further. Limit dump collection restricts Windows Error Reporting to kernel mini dumps and user mode triage dumps. Limit diagnostic log collection stops diagnostic logs from being sent back at all.[1] The MDM equivalents are System/AllowTelemetry, System/LimitDumpCollection and System/LimitDiagnosticLogCollection, with the last two available only on Windows 11 and Windows Server 2022.[1]
The switch you should not flip
Turning diagnostic data off is not free, and Microsoft is candid about the bill. Its guidance notes that "if your organization relies on Windows Update, the minimum recommended setting is Required diagnostic data. Because no Windows Update information is collected when diagnostic data is off, important information about update failures isn't sent."[1] Microsoft uses that information to fix the causes of failed updates, and a machine whose updates fail silently is a worse problem than a machine reporting its hardware inventory.
The broader warning is on the same set of documentation, aimed at exactly the kind of thread-hopping this site encourages: "Examples of settings that can lead to a less secure device configuration include: Windows Update, Automatic Root Certificates Update, and Microsoft Defender Antivirus. Accordingly, we do not recommend disabling any of these features."[3]
So: move the slider down to Required. Leave Defender, Windows Update and root certificate updates alone. The upside here is real and the downside is not.
Diagnostic data is not the only thing Windows sends
Turning the slider down does not quiet the operating system. Microsoft maintains its own list of Windows components that connect to Microsoft services, and it is long: Microsoft Store, OneDrive, Delivery Optimization, Windows Update, Microsoft Edge, Cortana and Search, Find My Device, Widgets, Cloud Clipboard, Storage health, Offline maps, Font streaming, License Manager, and more.[3] Microsoft's list also covers Windows privacy settings for feedback and diagnostics, background apps, app diagnostics, activity history, voice activation, and inking and typing.[3]
One entry surprises people who assume nothing leaves until a big upload starts. NCSI, the Network Connection Status Indicator that draws the little globe icon in your system tray, "sends a DNS request and HTTP query to http://www.msftconnecttest.com/connecttest.txt to determine if the device can communicate with the Internet."[3]
Microsoft documents how complete the shutdown would be, and the sentence is worth reading twice: "To prevent Windows from sending any data to Microsoft, configure diagnostic data at the Security level, turn off Microsoft Defender Antivirus diagnostic data and MSRT reporting, and turn off all of these connections."[3] Security level. The one setting Windows Pro and Home do not offer. Read it back and you can see the shape of the arrangement: the total-off switch exists, it is documented, and it is not yours.
Who can see it, and for how long
Microsoft's privacy statement is where the retention answer lives, and the answer is not a number. It says "actual retention periods can vary significantly," and ties the range to "the nature and sensitivity of the information."[4] So the honest answer to how long Microsoft holds diagnostic data from your PC is that the range depends on what the data is, rather than a fixed term you can hold Microsoft to.
On sharing, Microsoft's IT documentation states: "The principle of least privileged access guides access to Windows diagnostic data. Microsoft doesn't share personal data of our customers with third parties, except at the customer's discretion or for the limited purposes described in the Microsoft Privacy Statement. Microsoft may share business reports with hardware manufacturers and third-party partners that include aggregated and deidentified diagnostic data information."[1] Read the last clause carefully. Aggregated and deidentified business reports do go to hardware manufacturers and third-party partners. Just not about you specifically.
On legal process, Microsoft's privacy statement lists retaining, accessing and disclosing personal data in order to "Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies."[4] Microsoft publishes a Law Enforcement Requests Report for its consumer products. That commitment covers Microsoft personal data generally, which is the category your diagnostic data falls into rather than a separate set of terms.
What to do right now
Open the setting. Settings, then Privacy & security or Privacy, then Diagnostics & feedback. Take thirty seconds.[2]
Move Optional to Required. That is the single highest-value change on a Pro or Home machine, because it is the top of the ladder you can actually reach.[2]
If you run Edge, stop there. Optional collects browsing history and search terms from Edge and Microsoft says it is optional. Switching to a browser that does not report to Microsoft makes that part of the collection empty before you ever open the slider.[1]
Know what Required costs you. Your IMEI and your mobile operator network go out at that level by design.[1] If that is the part you cannot accept, the only setting that stops it is one Microsoft does not give you on this edition of Windows.[1]
If it is a work device, read it as a heads-up. Your IT department may already hold a copy of the diagnostic data from a machine you have been using for months.[2]
None of this stops Windows talking to Microsoft. It stops the most revealing layer. Given what the top layer contains, Edge history and a memory dump that may carry fragments of your open documents, that is a trade worth making in about thirty seconds. It is also the only one Microsoft has left you.