Data collection by technology platforms affects employee privacy, vendor governance, and what information leaves a business environment through integrations, analytics, and telemetry. For organisations that take data handling seriously, understanding how and where tech giants collect data is a vendor risk and compliance issue, not just a consumer privacy concern.
Data collection is a governance and vendor-risk issue. It affects employee privacy obligations, Microsoft 365 and Google Workspace settings, audit trails, and what leaves your environment through integrations and analytics.
Key takeaways
- Identity and logged-in ecosystems replaced many cookie-only assumptions.
- Server-side event collection is common in analytics and marketing stacks.
- App telemetry and derived data create governance risk without obvious fields.
- Vendor due diligence should cover subprocessors, residency, and retention.
- Practical controls live in Microsoft 365, browser policy, MDM, and procurement.
What data collection means in a business context
Data collection is the capture of signals about people, devices, and activity. Some signals are explicit, such as profile fields, audit logs, and form submissions. Others are inferred from behaviour, telemetry, and patterns across services.
Consumer collection
Most people think of social media tracking and ad personalisation. Staff still interact with consumer platforms, often on devices that may also touch work systems, which can blur boundaries without clear policy and controls.
Business collection
Organisational accounts, identity systems, and collaboration platforms collect rich metadata for administration, security, reliability, and analytics. That data becomes part of your governance and compliance footprint.
Early examples such as Facebook Beacon were controversial because they made private behaviour visible without clear consent. The modern lesson is that collection has moved deeper into identity, telemetry, server-side events, and inference.
Where and how tech giants collect your data in 2026
Browser-level tracking has changed, but tracking did not disappear. Many organisations shifted toward logged-in identity, first-party signals, and server-side event collection. For business platforms, telemetry and audit trails remain major inputs.
1. Logged-in ecosystems and identity graphs
Google Workspace, Microsoft 365, Apple Business Manager, and LinkedIn connect activity across services using identity. Even when content is protected, metadata (who, when, where, and what system) can still be collected and analysed.
See Duo MFA and email security.
2. Server-side tracking and event APIs
Server-to-server event forwarding is common in modern marketing and analytics stacks. Instead of relying on a browser cookie, events can be sent from your infrastructure to analytics and advertising platforms.
- Maintain a tag and event inventory across websites and apps.
- Document what is collected and why, including any onward sharing.
- Apply consent and policy controls to align collection with your privacy position.
3. App telemetry and device signals
SaaS and device platforms collect telemetry for security, performance, and product improvement. This can include device identifiers, configuration, interaction patterns, crash logs, and network characteristics.
- Standardise endpoint policy and reduce unnecessary app permissions.
- Use MDM and endpoint management to enforce privacy settings.
- Protect and retain audit logs based on business requirements.
4. AI-driven inference and derived data
AI systems can infer attributes from patterns and content, creating derived data that was never directly collected. This matters for employee privacy, customer confidentiality, and how data is used across platforms.
- Define what staff can share with third-party AI tools.
- Classify data and apply access controls to high-risk sources.
- Review vendor terms around retention and training use.
5. Partner sharing and data brokers
Platforms may enrich signals using partner data and brokers. For organisations, the risk sits in subprocessors, onward sharing, and the ability to evidence what data is used where.
- Add subprocessors and sharing to vendor due diligence.
- Confirm data residency and cross-border handling for key systems.
- Ensure contract terms align with policy and governance.
Consider managed DMARC.
Where this shows up in enterprise-relevant services
The goal is not to avoid major platforms. It is to understand what is collected, configure the controls, and assess vendor risk.
Google Workspace
- Admin and security telemetry, usage analytics, and threat detection signals.
- Third-party marketplace apps and OAuth consent paths that expand data access.
- Sharing settings and link policies that expose data via access patterns.
Microsoft 365
- Identity and sign-in telemetry, conditional access signals, and audit logs.
- Collaboration metadata across Teams, SharePoint, OneDrive, and Exchange.
- App integrations and admin consent that broaden data sharing.
Resilience link: Microsoft 365 backup.
Apple Business Manager
- Device enrolment and management metadata linked to organisational identity.
- App deployment and compliance posture signals for managed devices.
- Policy decisions in MDM that influence visibility and collection.
LinkedIn and B2B advertising platforms
- Tracking for measurement, recruitment, and account-based marketing.
- Cross-device linkage and professional attribute-based profiling.
- Server-side event forwarding from web stacks and CRM tooling.
Emerging AI platforms
- Prompt and usage data, plus inferred intent and topic modelling.
- Retention risk depending on terms and enterprise controls.
- Exposure risk if staff paste internal content.
Control points you can own
- Identity hardening and MFA enforcement.
- Consent and integration governance.
- Endpoint policy, browser policy, and MDM configuration.
- Logging, retention, and recovery design.
Related pages: cyber security services and managed IT services.
Frequently asked questions
How do tech giants collect your data in 2026?
In 2026, major platforms collect data through logged-in ecosystems, app telemetry, server-side event collection, and partner sharing. For businesses, the most impactful sources are organisational accounts, identity systems, collaboration metadata, audit logs, and third-party integrations. The practical response is governance plus controls. Start with identity hardening, restrict app consent, standardise endpoint policy, and document where analytics events are exported.
Is this only a consumer privacy issue?
No. Consumer tracking is only one stream. Business platforms collect signals for administration, security, reliability, and analytics. Those signals can become part of your governance footprint, especially when integrations expand data sharing or when staff use unmanaged devices. The aim is to control collection, justify it, secure it, and align documentation with configuration.
What should IT managers ask vendors about data use?
Ask where data is stored and processed, who the subprocessors are, how long data is retained, and whether data is used for product improvement. Confirm what is exported through integrations and analytics, what controls exist to limit use, and what evidence is available. If you cannot get clear answers, treat it as risk and consider alternatives or compensating controls.
Does the cookie change mean tracking is over?
No. Browser controls can reduce some tracking, but many organisations shifted toward identity, first-party signals, and server-side event collection. In business environments, the larger sources are often platform telemetry and audit trails rather than cookies alone.
What are the first controls to implement?
Start with identity and integration governance. Enforce MFA and conditional access, reduce privileged roles, and review third-party app consent. Next, standardise endpoint and browser policy, and document analytics and server-side event exports. Finally, ensure tested backup and recovery and a clear incident response escalation path via cyber security services and managed IT services.
Practical support from Milnsbridge
If you are reviewing vendors, tightening Microsoft 365 governance, or updating privacy controls, Milnsbridge can help you move from intent to implementation with a practical, security-led approach.
Services that map to this topic
- Email security
- Managed DMARC
- Duo MFA
- Incident response
- Backup and recovery
- Microsoft 365 backup
- Cloud services
- Cloud compliance guidance
Concerned about how your business data is being handled? Milnsbridge offers endpoint protection powered by SentinelOne to secure every device, and enterprise email security to block phishing and data exfiltration. Our cyber security services are aligned to the ACSC Essential Eight framework.
For transparent per-seat pricing, see managed IT pricing.
Talk to our team or call 1300 300 293.
About the Author
Adrian Weir
Adrian Weir is the Managing Director and founder of Milnsbridge Managed IT Services, with over 30 years of global IT experience spanning Telstra, Citibank, Unilever, and hundreds of Sydney SMBs. A Microsoft Partner since 2002, Adrian leads a team of IT specialists delivering responsive, business-focused managed IT support across Greater Sydney.
Meet the Milnsbridge Team
