Giving you more meaningful choices to control your privacy

Giving you more meaningful choices to control your privacy

  • Comments 22
  • Likes

A few months ago I authored a post that sets the context for some of the privacy discussion that’s currently happening, and how we think about privacy in Windows Live.

This post describes the new privacy features in Windows Live, including a new way to differentiate between sharing with your close friends and with your acquaintances, and more control over how you share with your Facebook and MySpace friends. Sometime after this post, Ori Amiga will discuss the Messenger Connect experience, which empowers you to take your Windows Live data to other sites and applications and the privacy principles that guided our work in that area.

There has been a lot of attention and scrutiny paid to privacy by the industry, regulators, and the public recently, and it has become increasingly clear that privacy controls need to be simple and comprehensible. Users want better controls, and so we're introducing a set of simplified privacy controls in Windows Live that provide an easy way to help you ensure your information and activities are visible only to the people you want.

We evaluated our privacy features in the previous version of Windows Live, and worked on making things as simple and understandable as possible while continuing to offer granular controls for customizing your settings. Privacy is a complex area in online services, since not all users have the same expectations or needs, and we, like other services, offer a rich set of sharing features.

Our privacy principles

We designed these features with the following principles in mind:

  • People care very much about their privacy
  • People want to control how much of their information is made public
  • People want simple, intuitive options to control the publishing of their information
  • Privacy controls need to be flexible to accommodate different privacy needs
  • Privacy controls need to allow individuals to set different levels of access for different contacts

To help users quickly and easily make informed decisions about what information about them is shared online, we created a privacy selector with three simple choices.

Privacy selector

This is the experience that you'll see on your Profile page when our new web services are released (Messenger has a similar screen). We focused here on a simple set of choices that allow you to set your main privacy preferences across all of Windows Live.

Privacy selector on your profile

The three choices represent a simple high, medium, and low setting across the spectrum of privacy preferences. Not all users are the same: some people want to share just about everything with just about everybody, and others want to strictly limit who can see what. Most people are somewhere in the middle, which is where we put our new default, "Limited," where only friends can see your activities, photos and other stuff you post on Windows Live, but old friends can still find you if they do a web search for your name.

The “Limited” option is in many ways more restrictive than our previous default settings. For example, your photo albums are no longer public by default, and only your friends can comment on your stuff or send you notes. The “Private” option is exactly what it sounds like. Most of your information and activities are visible to only your friends, and non-friends won't find your profile in search results, or see your information. However, it’s important to note that if you comment on your friends' photos, posts or other activities, your comment along with your name and picture will be visible to people you may not be friends with.

Close friends vs. acquaintances

In doing our research for this release, we heard from a lot of customers (and friends) that deciding whether to accept or ignore a friend request was not so straightforward. As social networking services become a core part of our daily fabric, more and more people you know and meet are inviting you to be friends. This presents some challenges when all friends are treated the same. We call this problem the “reluctant accept” or the “polite decline,” and we think the solution is to treat your close friends differently from your acquaintances.

When you receive an invitation to be someone’s friend, you will see a new check box:

Picture of a new friend invitation

Limited access friends

Selecting “Limit the access this person has to my stuff and my info” will restrict what this friend can see and do. For example, your new friend will not be able to send you instant messages, see all your photos, or have access to your contact information, but they can still see social updates about the activities you decide to share with all your friends. It’s important to highlight that your friend is never notified that you limited their access to some information.

Polite declines

If you click “No, thanks” (the “polite decline”), the requestor will still have access to the public information on your profile, for example, your first name and picture, but they won’t have access to any of the information or activity that you've limited to only your friends. If you have public activity such as blog posts, the requestor will see those in their social updates in Messenger or on Windows Live Home.

In designing this we felt it was critical to make it as simple as possible to deal with the flood of friend requests that people are now getting. We wanted to avoid making you manage different and confusing “lists” of friends, and then having to do extra work to configure which lists have access to what content. By providing a simple choice between accepting, accepting and limiting, or declining an invitation, you won’t have to spend a lot of time thinking about what do to, or wondering what will happen when you accept or decline.

Managing what your friends can see

You also have control over how much access each of your friends has to your stuff and your activity. Your list of friends works together with the main privacy selector, shown above, and the permission settings on individual activities, should you choose to set those separately.

Across Windows Live, you will see the following permissions choices:

  • Everyone (public) – this means the whole internet has access, and this content is findable via web search.
  • My friends and their friends – this includes all your friends and acquaintances, including those with limited access, plus all of their friends.
  • Friends – this includes all your friends and acquaintances, including those with limited access.
  • Some friends – this is just your close friends, because it excludes any friends whose access you've limited.
  • Just me – no one but you has access.

One place you'll see these options appear is in the new permissions control for individual items like photo albums or shared documents, shown below. As you can see, you can set the permission for access to each item you share anywhere from most restrictive ("Just me") to least restrictive ("Everyone").

Picture of the new permissions control

Sharing with Facebook and MySpace friends

Additionally, you'll see that if you choose Friends or higher as a setting, those activities will be published to your other connected services (like Facebook, MySpace, and soon, LinkedIn). When any update from Windows Live appears on a connected social network, it will follow the privacy controls of that network.

For example, if I upload some photos from my latest adventure in San Diego, an update about that activity will appear in Windows Live and on Facebook, ensuring that all my friends know about the new album as soon as I upload it to SkyDrive. I set the permissions on the photo album to Public, but the update about this album is only published to my Facebook and Windows Live friends.

Here is the activity as seen on Windows Live:

Picture of my photo album on Windows Live

And on Facebook:

Picture of my photo album on Facebook

This also works for Office docs, allowing you to publish Word, Excel, PowerPoint, and OneNote docs on your connected networks.

Choose your default privacy setting

The new privacy settings page, shown below, replaces the very detailed permissions page from the previous release that some found overly complex. You can visit this page at any time by clicking a link on your profile page to view or change the privacy settings used as your default across Windows Live. This page goes into a little more detail than the privacy selector we showed you earlier, which you see the first few times you sign in to the new Windows Live Profile or Messenger.


Of course, you can also customize the privacy settings for an individual photo album, document, or other activity, and the page for that item will indicate that you are using custom settings.

Advanced privacy settings

But if you want even more control, click Advanced on the Privacy settings page to find dozens of granular settings presented in an easy to understand layout.

The advance settings page presents each privacy setting organized into categories, with easy-to-use sliders that allow you to set permissions from most restrictive to least restrictive:


Furthermore, you can expand many items like Basic information and Contact information, to see exactly what is included in that category.


You can also customize the sharing option for your new SkyDrive photo albums and file folders, and view settings for all your existing albums and folders, too.


Additional privacy and profile changes

When you sign into the new Windows Live Messenger or the new Windows Live Profile page for the first time, you'll be notified of a couple of important privacy changes and be given the opportunity to change your privacy settings accordingly.

1. Your Messenger friends and Profile friends are merged into one list.

Starting in this release, there is only one type of friend relationship in Windows Live: Messenger friends. We made this change because we heard lots of feedback that people didn’t understand the difference between Profile friends and Messenger friends. Now they're all just "friends," but you can easily limit access to your more private information for some of those friends.

2. Your have just one name: your full name, and just one profile picture, which are both part of your profile, and always visible to friends.

In the past there was a lot inconsistency across different Windows Live products. For example, you could have two pictures, one that appeared to your Messenger friends and another that appeared on your Profile. Additionally, you could choose to show only a "display name" in some places, while in other places, your full name would appear, and in still others, only your first name. To cut through all this confusion, we had to rethink our model from the ground up, design what we wanted to have, and then work to transition our users.

The end result is that your full name and picture will always be visible to your friends, but you have complete control over who your friends are. Your full name does not become available to friends until we've informed you that this is happening, and given you an opportunity to change some settings if you want to. You can, of course, change your full name to whatever you want it to be, and you can always choose the Private setting if you don't want your profile to be visible to non-friends or findable in a web search. 

This change was important to ensure that our network is one where people can find you using your real name; people who see your comments, photos, and invitations know who they came from; and your appearance is consistent across all of our web and client applications.

For some, the move away from a separate display name will be perceived as a loss of functionality. But this change, along with numerous other enhancements, will help curb abuse and scams on our network.

Balancing simplicity and granular control

It’s important to note that, while we worked to simplify the default privacy settings, anyone who wants to can still control detailed privacy settings for dozens of individual items, including contact info, activities on connected services, and individual photo albums and document folders. If you do a lot of fine-tuning, we make it easy to see what you've shared: on each of your friends’ profile pages, you can click to see what you've shared with that person, and change your settings.

Picture of What I've shared with Jeff Kunins

Final thoughts

I hope that this post offered some insight into our approach around designing the privacy features in this release. We believe that our approach respects the great diversity in customer needs, but of course, there is always room for improvement, so please let us know what you think.

We know we have an immense responsibility to help our customers through the transition from the previous release, and so we took care to ensure that changes are clear to you in the product, as they are happening.

We've worked hard to offer the best set of privacy tools to protect your memories, activities, and information while providing an environment that's great for sharing and connecting with your friends.

Omar Shahine
Principal Lead Program Manager, Windows Live

You must be logged in to comment. Sign in or Join Now
  • I feel that only allowing one name will cause people to think about there own privacy. Privacy is a big thing at the moment for me and for many others (which you can see through a simple internet search on the topic). Removing this feature causes problems and many users (including me) will stop using the program, or use an older version because of this. Why remove a feature that is fine as it is? With this being removed it could be the beginning of the end for WLM.

  • Display names need to be brought back or my buddies and I will just switch to Pidgin.  WLM is not the only game in town and Microsoft should, at at the very least, attempt to do better than to insult it's users by framing this huge loss of functionality as "perceived".

    This lapse in judgement on Microsoft's part removes one of the few remaining features differentiating WLM from the competition.

    Also, there should be a better way to provide feedback.  Perhaps a feedback button in the title bar like Windows 7 RC had.  It's a pain to have to make a separate account just to post a comment here.  If you look at the windowslivehelp messenger forum you can clearly see that this display name feature change is very unwanted.

  • I think removing display names is a terrible idea.

    I used to have both a personal email and a email I use for contacting companies. The personal email was also used for Messenger. Recently I decided to redirect my mail into the 1 account and log into messenger in the 2nd account aswell. Not everyone I add in messenger will be someone I know in real life, so I wouldn't want to share my full name with them. So with this new 'feature', I can change my name in Messenger, but then all my emails will be sent with my fake name. Or I can lose the privacy I had by sharing my name with all contacts.

    I understand some of the benefits, but this should just be a default setting, rather than removing Display names completely.

    Judging by the impressions on this blog alone, 1 person doesn't mind and the rest also agree that it is a bad idea for privacy. No-one has commented on it being a beneficial feature.

    One of the benefits of the internet is that you can make friends with people from across the world easily. Unfortunately this will make people reluctant and I think that a lot of comments will be made if this feature is still removed in the final version.

    I personally don't see how this will reduce the amount of scams, it is not difficult to create a fake name, all this means is that genuine users will lose functionality.

    I'll continue to test the beta for the moment, but from what I've seen so far this version seems to be a step back. I love the idea of social networking updates but the first thing I had to do in messenger was set it to 'Compact View' as the layout for networking updates was cramped and disorganised. Obviously this is beta software and so I can't give a full opinion but if things follow down the same path I think I'll roll back to the older versions, where it was simple yet functional.  Now it seems needlessly more complex (e.g. the layout, having to go to a webpage just to change simple options), that combined with the privacy problem mentioned above are making me lose faith in WLM.

  • @Mackay, I appreciate the feedback. However, we feel it's important to have a consistent representation of our customers across Windows Live. As such we feel that the approach to encourage and use a first and last name across our services best serves the needs of all our customers.

  • Mackay
    1 Posts

    I like the new layout of this but not being able to have a customizable display name is such a downer on it for me. You should be able to pick between full name, first name only, last name only or a selected display name. I think im probably going to downgrade for a while until you can get to pick a display name like in all the old ones.

  • @ShadowChaser

    To adddress your points:

    1. Nothing is shared with anyone on your contact list unless you are friends with them or the item you are sharing is Public etc

    2. You can continue to share photos and documents to individuals, or categries of your friends such as Coworkers, Friends, Family etc.

  • I agree with RicarDog completely. Most people on the web have four major classifications of contacts - Family, Friends, Coworkers, and "Online". One of the greatest aspects of the Internet is the ability to communicate with people that I don't know personally - for example, people that might share common interests that I know based on their online identity.

    I want to share my photos, personal information, and other details to my friends, family, and coworkers. I *DO NOT* want to share information to the "strangers" I talk to on my contact list.

    Think about the problem from a user's perspective, not a "data perspective":

    * A user can type in any name they want, and you cannot ensure accuracy

    * Users wishing to abuse the system can still create multiple accounts and enter "fake" names, photos, genders, ages, etc

    * Young children use messenger and require anonyminity (my own family as an example)

    * Adopting an online identity is "fun" for many users. Out of the people on my own Messenger contact list, about 90% have an "online identity" that they use rather than their "real identity". It's something that's fun about the internet, and that shouldn't be forgotten when designing Messenger.

    * Users communicate with people outside of their "normal lives" - common interests online. Lets use my wife as an example - she posts photographs online to DeviantART - a social networking site for artists. The site is the opposite of facebook and encourages anonymous identities rather than real ones. She communicates with her "friends" from that site using Messenger and her "online name" (rather than real name). The new Messenger does not support this model at all.

    * Facebook is successful, sure, but why not also target the things Facebook does *badly*, like the countless social networks people have online, separate from "real life"?

    Instead of fighting what users want (and forcing real names), why not do both? Why not have the ability to let me enter my real name into my profile for my real-life contacts to see, but also let me create an "limited rights profile" or "alternate identity" for the contacts I don't know as well? Everyone wins.

    In the current implementation, all that will happen is people will create multiple accounts with fake names. I've already renamed my Live account and entered a fake name as a result of the change, and so have many others on my contact list in the past day or two.

    You're not giving users what they want, not solving any problems, and ignoring a market that other social network don't target.

  • Regarding merging Messenger and profile names, I have to disagree. This is both a loss of functionality and a privacy issue, plus it won't help curb abuse and scams at all. Let me explain.

    The ability to have different names in different places is not an inconsistency, and it's much closer to how relationships work in real life. We have different social circles and in each of them we might be best known by different nicknames. That's why you should not only keep the display name independent from your first/last name, but also allow MULTIPLE display names, one for each contact group.

    Secondly, regarding the privacy issue, we don't use Messenger only for our close friends. We may have to talk to customers, strangers and other kinds of contacts that are not really trustworthy to know our real names. You would say, then change your first/last name to something else. But then again, contacts in a social website are not necessarily the same as our IM contacts. I don't have customers or strangers in my social network, but I have them in Messenger. I see that you want to merge both groups, but I believe this is not how most people would like to handle it. So, for now on, I'd have to create different accounts (Live IDs), one for social networking with friends, one for not-so-friends, etc. Unfortunately, this is very unpractical since I'd have to keep switching my accounts (and multiple instances of Messenger are not allowed anyway).

    I see you have done the "limited access" feature, but this does not allow a different name for that group.

    Finally, about abuse and scams, how would this help? People can still abuse and make scams by creating fake accounts or using fake first/last names, you just moved the problem for another place, while taking away the privacy of real people who want to have that feature.

    Please, hear what the users have to say and reconsider this decision. Thank you for listening.

  • Windows Live Services needs much better customer support.

    I realize that this is a free service but the forms are littered with people that have the same problem I do... portions of our accounts are broken.

    I cannot upload photos to my skydrive. When I try to get help through the forms I'm ignored.

    This isn't a problem with me not knowing how to use the service but a problem (or corruption)with my actual account and I cannot get anyone to help me with it.

  • Stephen
    3 Posts

    I am really loving all of the new features of Windows Live and look forward to using all of the new services. However, I have an issue with the Limited settings for Privacy. There are in fact some people I want to add to ONLY be able to message me on WL Messenger yet NOT be able to see my WL Profile and updates and photos etc. It seems you've given us only the ability to do the opposite. That seems a bit strange to me. Acquaintances are sometimes met that one merely wants to be able to chat with only without giving out all of one's information. Please look into changing this. I am surprised no one else has noticed this or maybe I am missing the settings for that. I apologize in advance if that's the case.

  • @Styles - Our priority with Messenger for Mac is to provide fundamental features at a high quality that extend the office for Mac productivity experience. We will continue to examine new features, but don’t have anything to share at this time. Messenger for Mac 8 will release with Office for Mac 2011 later this year.

  • Sara
    1 Posts

    I honestly found this update complicated and very limited with it's privacy features, not to mention how WLS removed the statistics feature. I dislike the similarity of the new features with FB's, but I suppose I'm the only who feels this way.

    Thanks for the article. I skimmed through it, but will do read it to have a better idea on how to get around things later.

  • Gyussz
    3 Posts

    I agree with Leonard, many Windows Live Messenger user gonna use fake name, but I'm sure lots of people will complain about this, or many people will stay on wave 3 because of this change. By the way I don't have any problem with it.

  • i like advanced privacy features. i haven't read this post full. i will read later and reply. need to go soon to eat.

  • and also more to expand with the Twitter one.

    If I were to get a Windows Phnoe 7 device I am going to have to update my Facebook and Windows Live status from the Me hub, then move into a different app to update my Twitter status.

    Probbaly one of the biggest reasons as to why Twitter needs to be supported..

  • @Jeff

    Happy to help.  Thanks for the reply.

  • @Mackenzie -- thanks much for the feedback, we really appreciate it.  We're adding more partner services all the time (you're right we'd love to see Foursquare as well), and later this summer we'll be further opening up the partner program so that any site who exposes an ActivityStreams-compliant feed (an open standard we, Facebook, Google, MySpace, and others are supporting) can self-onboard as a WL partner.   Thanks for the request for "Like" on FB posts, as you'd expect we're already hearing that quite a bit, and of course it's something we're considering for subsequent releases :)

  • Oh and 3!

    When I update my Windows Live Profile status it does not update my Twitter status.  Would of been a big plus if this would of been able to happen.  Probbaly would have moved away from TweetDeck...

  • Love what has happened to profiles atm.  A few requests though.

    1.  Would like to see a few more services.  A big one that I thought may have been included was foursquare.  It seems that foursquare has been getting more and moire popular so I think people would like this.  Also an Xbox Live service would be good.

    2.  Being able to like Facebook statuses from Messenger Social.


  • Two small comments.

    1) "For some, the move away from a separate display name will be perceived as a loss of functionality. But this change, along with numerous other enhancements, will help curb abuse and scams on our network." >> This may be true, but also this will encourage lots of people to simply enter a fictitious last name (not unseen in the previous versions of Windows Live)

    2) A bit off topic, but I'm really annoyed. In the old system I had my Twitter account linked to my profile. In the new Windows Live, Twitter support is gone. And we were NOT NOTIFIED. Is that really fair? Even after the update, my linked status to Twitter was visible on my profile, though my tweet-feed was not displayed. Explanations from a manager please?

  • Styles
    1 Posts

    Hi.  Off topic, but please pass this on.

    When I look at this on the Windows Live Essentials website:

    I don't really see any features that Messenger for Mac would have.

    Please, for the love of everything holy.  The Messenger iPhone app looks like it's shaping up pretty well.. but Messenger for Mac is a joke.  It's a joke against everything the Windows Live team stands for.   I think now they've added video chat, it's only just brought up to par with the version of Windows Messenger on Windows XP.  Could you PLEASE, PLEASE, PLEASE bring it up to the standard of Windows Live Messenger?  You can't even offline message, change scenes, or really do anything.

    .. umm, and how many years has it been?

    It's not a question of not giving the competition the features in Messenger, but rather a question of, where's the standards?  Why is this making Microsoft look bad to both mac users and everyone around them who owns a mac?  I believe it's bad publicity, and it should be fixed ASAP before the next release of Office on Mac (which by the way, is very feature similar).  I can't believe it's taken this many years.


    A disgruntled user.

  • I wanted to add a note that the ability to mark a friend as "limited" who is already a friend is not yet enabled and will be in the coming weeks. At this time marking someone as limited is possible when accepting an invitation from a friend.