So it's been about three weeks since I let Windows 10 onto my main machine, and I finally sat down last Saturday afternoon and went through every privacy setting one by one instead of just clicking "Express Settings" like a person in a hurry. Turns out Express Settings is doing a lot more talking to Redmond than I was comfortable with. Here's what I turned off, and why, in case you're still putting off the upgrade or you already did the express install and want to go back and fix it.
Wi-Fi Sense, immediately
This is the one that actually made me put my coffee down. Wi-Fi Sense will share your wifi network's password with your Outlook.com contacts, your Skype contacts, and (if you opt in) your Facebook friends, so they can connect automatically when they're near your house without ever seeing the actual password. Microsoft's pitch is that it's convenient. My pitch is that I don't want three hundred people I vaguely know from a decade of email having any pathway into my home network, encrypted handshake or not. It's under Settings > Network & Internet > Wi-Fi > Manage Wi-Fi Settings, and there's a toggle for each connection type. Turn them all off. It only takes a few seconds.
The advertising ID
Windows 10 assigns your account a unique advertising identifier that apps can use to build a profile of you across the OS, similar to how iOS and Android already do this. You can kill it under Settings > Privacy > General, the toggle says "Let apps use my advertising ID for experiences across apps." I turned it off, mostly on principle. I doubt it changes the ads I see much, but I'd rather not hand over the plumbing for free.
Update Delivery Optimization
This one I actually didn't know about until a reader emailed me (thanks, Dave), and it's kind of a big deal. By default, Windows 10 will use your bandwidth to send update files to other PCs, not just on your own network but out on the open internet. It's peer to peer distribution for Windows Update, and the default setting is "PCs on my local network, and PCs on the Internet." You'll find it buried under Settings > Update & Security > Advanced Options > Choose how updates are delivered. I switched mine to local network only. I'm on a home connection with a monthly cap and I don't need my upstream getting eaten by some stranger's PC three states away downloading a cumulative update.
Diagnostics, dialed back to Basic
Under Settings > Privacy > Feedback & Diagnostics you get a choice of how much telemetry gets sent back to Microsoft, and the options are basically Basic, Enhanced, and Full. Full sends a genuinely alarming amount, including things like browsing history in some cases. I dropped mine to Basic. It's still sending something, there's no fully off switch on Home or Pro, which bugs me, but Basic is the least bad option available.
The stuff I left alone
Cortana I actually kept on, which surprised me. I was fully prepared to hate it, but typing "remind me to call the dentist at 9am tomorrow" into the search bar and having it just work is genuinely useful, and I already know Google has my search history anyway so I'm not exactly gaining privacy by turning off Cortana specifically. Pick your battles.
One complaint that has nothing to do with privacy: the "Get Windows 10" tray icon is still showing up on my other laptop, the one I haven't upgraded yet, nagging me every single morning, even though I've already told it twice I'm not ready. It's the most persistent piece of software Microsoft has shipped since that paperclip, and I say that as someone who mostly likes what they did with this release.
None of this is meant to talk you out of upgrading. The OS itself has been solid for me, faster boot times on the same hardware, Edge is fine for daily browsing even if it's missing extensions still. I just don't think the default settings are set up with your interests in mind, and it took me longer than it should have to find all the switches. If you've already upgraded, go check these four things tonight. It's maybe fifteen minutes of clicking.