I would be sceptical too, if I was still using Windows.

I’ve seen reports in the past that people found that syncing to the cloud was turned back on automatically after installing Windows updates.

I would not be surprised if Microsoft accidentally flip the setting back on for people who opted out of AI photo scanning.

And so if you can only turn it back off three times a year, it only takes Microsoft messing up and opting you back in three times in a year against your will and then you are stuck opted in to AI scanning for the rest of the year.

Like you said, they should be limiting the number of times it can be turned back on, not the number of times it can be turned off.

Yep. I have clients who operate under HIPAA rules who called me out of the blue wondering where their documents had gone. Microsoft left a cheery note on the desktop saying they had very helpfully uploaded ALL of their protected patient health data into an unauthorized cloud storage account without prior warning following one a Windows 10 update.

When I used to work as a technician at a medical school circa 2008, updating OS versions was a huge deal that required months of preparations and lots of employee training to ensure things like this didn't happen.

Not trying to say that you could have prevented this; I would not be surprised if Windows 10 enterprise decided to "helpfully" turn on auto updates and updated itself with its fun new "features" on next computer restart.

Why even use windows at that point? You can train your employees to use other operating systems that won't have dark patterns to leak sensitive data.

Can't speak for the medical school but my guess is familiarity. Can't remember what the Mac landscape was like at that point but it probably wasn't vetted enough for HIPAA. And windows 7 wasn't that shitty at the time.

And even so, let's say they didn't use Windows — I'd still expect the same rigor for any operating system update.

OneDrive is HIPAA, and IRS-740, and FIPS, for this reason. It’s an allowed store for all sorts of regulated data, so they don’t have to care about compliance risk.

I'm not sure the next Joint Commission audit will be totally cool with them randomly starting to store files in the cloud with zero policy/anything around the change.

How are they not legally liable for that?

If they are worried about the cost of initial ingestion then a gate on enabling would make a whole lot more sense than a gate on disabling.

Microsoft crossed that line so many years ago with their constant re-enabling without consent all the various anti-privacy stuff during upgrades.

> I wouldn't assume this was intentionally evil bad faith.

Then you are hopelessly naive.