Cloud-delivered protection

Actually Derek, I think that Microsoft's Privacy Statement is clearer about all of this in their Privacy Statement than you might perceive.

However, I'm not certain if that's an issue with interpretation or merely not having read the portions specific to Windows Defender itself, which are found within the Product-specific details section for Windows - Security and Safety Features.

In the excerpt I've included at the end below, I've highlighted the pertinent portions either by underlining or using bold text.  Note that the underlined sections indicate what it will do by default.  However, also note that in the case of an actual file upload, the bolded text portion will always apply.

So as this states; "If a report is likely to contain personal data, the report is not sent automatically, and you'll be prompted before it is sent."

Windows Defender makes this determination based upon whether the file is an executable only file type, since others which might contain data such as Office files, though these may also contain macros which are executable as well, would of course prompt you before sending these personal types of files.

Since neither of the underlined portions actually sends an entire file without considering first whether it might contain personal data, but rather only information about the file including a "hash" and other identifying items like file name, file system location and any certificates it contains,  you'll always have control over whether any actual data you've personally created is sent.

In fact, since all of these decisions and actions other than your own are occurring on machines, no human will typically ever even see most of these uploaded files.  Instead they are automatically uploaded to servers where they are examined by the Artificial Intelligence programs in the "Cloud", which compare these to the many thousands of other samples Microsoft is receiving daily.  Only if your specific file happened to be singled out by these algorithms as something highly exceptional (from a potential malware standpoint) is a human ever likely to view them at all.

To better understand what I mean, brief through the "Machine learning, behavioral analysis, and other evolutions" section of this Antivirus evolved – Windows Security blogarticle about Windows Defender.  You'll see from the numbers mentioned in that section that the greatest quantity of threats are handled automatically either on the local client or within "the Microsoft Intelligent Security Graph (ISG), which is informed by trillions of signals from billions of sources".

So unless a particular file was requested that contained truly personal data, which might compromise me either financially or personally, I'd never truly be concerned with responding to a request to upload most files, even some of those containing less important data.

Rob

"Windows Defender SmartScreen. Windows Defender SmartScreen helps protect you when using our services by checking downloaded files and web content for malicious software, potentially unsafe web content, and other threats to you or your device. When checking a file, data about that file is sent to Microsoft, including the file name, a hash of the file's contents, the download location, and the file's digital certificates. If Windows Defender SmartScreen identifies the file as unknown or potentially unsafe, you will see a warning prior to opening the file. When checking web content, data about the content and your device is sent to Microsoft, including the full web address of the content. If Windows Defender SmartScreen detects that content is potentially unsafe, you will see a warning in place of the content. Windows Defender SmartScreen can be turned on or off in Settings.

Windows Defender Antivirus. Windows Defender Antivirus looks for malware and other unwanted software on your device. Windows Defender Antivirus is automatically turned on to help protect your device if no other antimalware software is actively protecting your device. If Windows Defender Antivirus is turned on, it will monitor the security status of your device. When Windows Defender Antivirus is turned on, or is running because Limited Periodic Scanning is enabled, it will automatically send reports to Microsoft that contain data about suspected malware and other unwanted software, and it may also send files that could contain malware. If a report is likely to contain personal data, the report is not sent automatically, and you'll be prompted before it is sent. You can configure Windows Defender Antivirus not to send reports and suspected malware to Microsoft."

Only thing the 'cloud' might do is upload something that appears suspicious for further analysis  - things that do computing things they haven't seen in the wild.   Show me some chemist text and I'll say, yep, looks like some chemistry thingies.  It painful for me trying to remember how to spell acetaminophen & just trying to write the word caffeine makes me nervous.

Recall only one downloaded & appeared instantly suspect - was in a zip package that never was unzipped.   CCleaner that made the news a while back.   Rare here to discover computer virus -  my virus mostly would come delivered by the us postal service & fedex sneezing on my paper mail and package deliveries.