Microsoft’s licensing index lists a worldwide English edition of the Microsoft Products and Services Data Protection Addendum (DPA) dated November 1, 2026. Heise reported that the update took effect that day. The clause reproduced by LegalCheck says Microsoft may report apparent child sexual exploitation and abuse material (CSEA) to the National Center for Missing and Exploited Children (NCMEC) or another authority if Microsoft becomes aware of it while providing a Microsoft Online Service.
What the reported clause says
The wording makes awareness the condition for a possible report. “May report” gives Microsoft discretion; it does not say a report must be made in every case. The clause names NCMEC and permits reporting to another authority. LegalCheck notes that “apparent” can be read as obvious or suspected, leaving that term open to interpretation.
The clause describes when Microsoft may report material; it does not lay out how Microsoft becomes aware of it.
Does this establish systematic searches of customer data?
The wording sets a reporting trigger but does not describe how awareness occurs. Heise reported attorney Stefan Hessel’s interpretation that the clause itself does not authorize systematic searches of customer servers.
Spanglett Legal describes hash matching and other detection in hosted consumer services. Its review found no Microsoft document describing comparable scanning of Microsoft 365 tenant content. That finding is specific to the review’s scope; it does not establish whether such scanning occurs.
What the edition date means for a customer agreement
The November 1 date identifies the edition listed by Microsoft. LegalCheck’s German legal analysis says updated DPA terms generally apply to existing subscriptions at renewal or when a new contract is made, subject to exceptions discussed in that analysis. That is a German legal analysis, not a determination of the terms governing every U.S. customer’s agreement.
