Edge Copilot Browser AI Privacy and Security: Tracking, Page Context and Group Policy

In an industry analysis published by TechRadar Pro, Pawel Kurzelewski, Head of Security at Opera, outlined why outdated assumptions about how browsers operate are leading both everyday users and IT decision-makers to misjudge online risks. As AI assistants and semi-autonomous agents move directly into the browser sidebar, misunderstanding where data is collected, what an AI assistant can actually see, and how privacy differs from security can lead to poorly targeted defenses.

For Windows administrators managing Microsoft Edge across corporate fleets—or power users configuring their own daily drivers—separating browser folklore from actual architecture is essential. Let’s break down the three core misconceptions Kurzelewski identified, test them against how modern browsers actually function, and look at the concrete Group Policy and security controls available on Windows today.

Misconception 1: "The Browser Itself Is Tracking Everything I Do"​

When you search for a specific piece of network hardware on one site and suddenly see advertisements for that exact switch following you across news outlets twenty minutes later, the knee-jerk reaction is to blame the browser. Because the browser is the window through which everything happens online, users frequently assume the software application itself is harvesting, storing, and monetizing their every click.

As Kurzelewski points out, witnessing activity is not the same thing as collecting and selling it. While browser vendors certainly have varying telemetry practices and business models, the vast majority of cross-site ad retargeting is driven by the websites themselves—specifically through embedded ad-tech scripts, tracking pixels, and third-party cookies. A single webpage may load scripts from dozens of external analytics and advertising companies that a visitor never consciously interacted with.

How Cross-Site Tracking Actually Works (and How Browsers Block It)​

According to Mozilla Developer Network (MDN) documentation on web privacy, cross-site profiling typically relies on third-party cookies—cookies set by a domain different from the URL in your address bar, often loaded via embedded <iframe> elements, images, or scripts. When the same third-party ad network or analytics provider is embedded across hundreds of unrelated websites, its servers can correlate those cookies to assemble a detailed dossier of your browsing habits.

Rather than being the primary culprit, the browser is actually the primary enforcement layer where users can inspect and block this behavior. It is the mechanism that forces websites to ask before accessing your physical location, flags insecure connections, exposes cookie storage, and blocks known trackers. However, default protections vary significantly depending on which icon you click on your Windows taskbar. According to MDN's breakdown of third-party cookie handling across major browsers:

What does this mean in practice? Does choosing a browser mean trusting the vendor's defaults, or taking the wheel yourself? Both. Even though Kurzelewski writes from the vantage point of a browser security executive at Opera, his core argument holds up under technical scrutiny: blaming "the browser" as a monolith ignores the fact that your browser's privacy settings menu is the single strongest lever you have to stop third-party web scripts from profiling you.

Section Summary: Cross-site ad tracking is predominantly conducted by embedded third-party scripts and cookies on websites rather than the browser binary itself. Because browsers handle third-party cookies and trackers differently out of the box, configuring built-in tracking prevention is your first line of defense.

Misconception 2: "Browser AI Assistants Automatically See Everything Open"​

The second major misconception revolves around the rapid integration of generative AI into the browser chrome. Many users—and more than a few cautious CISOs—assume that having an AI assistant embedded in the browser is an all-or-nothing proposition: if the AI is enabled, it must have omniscient visibility into every open tab, background banking session, and stored credential.

Kurzelewski argues that browser AI access does not have to be—and should not be—all-or-nothing. He compares browser AI permissions to enterprise employee onboarding: no competent IT department hands a new hire domain admin credentials to every server on day one, nor do they leave project access open indefinitely after a task is completed. Similarly, an AI assistant helping draft an email in one tab has no business reading an online banking session or an internal HR portal open in another window.

How Scoped AI Access Works in Microsoft Edge​

Instead of treating browser AI as a black box, Windows administrators can verify and restrict exactly what an assistant can read using documented platform policies. Microsoft Learn documentation for Microsoft Copilot Chat in Edge provides a concrete look at how context scoping and enterprise boundaries work in practice:

• Prompt Relevance and Consent: According to Microsoft Learn, Edge does not blindly dump every open tab into the AI model. Browsing context is shared with Copilot Chat based on the user's explicit prompt and consent to share page information. For instance, if a user asks a general question like "Help me plan a trip to Manhattan," Edge shares the active URL, page title, query, and conversation history. When page summarization is used, the summarized content (rather than the full webpage) may be retained and processed under enterprise data protection when signed in with a Microsoft Entra account.
• Controlling Side-Pane Context (EdgeEntraCopilotPageContext): For organizations running Microsoft Edge version 130 or later on Windows and macOS, administrators can govern Copilot's ability to read page content, browsing history, and video transcripts for Microsoft Entra profiles using the EdgeEntraCopilotPageContext Group Policy (located in SOFTWARE\Policies\Microsoft\Edge). Notice the regional default differences documented by Microsoft: if left unconfigured, access is enabled by default in non-EU regions and disabled by default in EU regions. Setting this policy to Disabled (0x00000000) strictly blocks Copilot in the Edge side pane from accessing page content, browsing history, or video transcripts.
• Automatic DLP Enforcement: Even when EdgeEntraCopilotPageContext is enabled, Microsoft notes that Copilot cannot access content on pages protected by Data Loss Prevention (DLP) policies configured through Microsoft Purview, Intune Mobile Application Management (MAM), or Microsoft Defender for Cloud Apps.
• Scoping Agentic Browsing (AllowBrowsingWithCopilot): Starting in Microsoft Edge version 148 on Windows and macOS, a separate policy—AllowBrowsingWithCopilot—controls whether users with an active Microsoft 365 Copilot subscription can explicitly invoke browsing with Copilot. By default, if unconfigured, this feature is off. More importantly, Microsoft's documentation specifies that browsing with Copilot only works on domains explicitly listed in the BrowsingWithCopilotAllowList policy and is blocked on domains in BrowsingWithCopilotBlockList. If an administrator configures no allow-list domains, the feature is effectively disabled across the fleet.

This is where Kurzelewski’s call for vendor scrutiny translates directly into Windows administration. "AI is inside the browser" and "AI has unrestricted access to the browser" are two completely different states. By auditing Group Policy templates (MSEdge.admx), checking regional defaults, and pairing browser policies with Purview DLP labels, IT teams can enforce strict least-privilege boundaries on browser AI.

Section Summary: Embedded AI assistants do not automatically read every open tab or window. In enterprise environments like Microsoft Edge for Business, access to page context is governed by user initiation, DLP boundaries, regional defaults, and explicit administrative policies such as EdgeEntraCopilotPageContext and domain allow-lists.

Misconception 3: "Privacy and Security Are the Same Thing"​

In casual tech discussions, "privacy" and "security" are tossed around as synonyms. In information technology, conflating the two is a recipe for blind spots.

As Kurzelewski defines them:

• Security is about preventing unauthorized access and stopping malicious activity.
• Privacy is about controlling what information is collected, shared, and retained.

Maximizing one does not automatically guarantee the other—and in some cases, they pull in opposite directions. Kurzelewski points to anonymity: high anonymity improves privacy by preventing activity from being traced back to an individual, yet extreme anonymity can hinder security teams trying to attribute and block malicious network traffic.

The AI Paradox: Cloud Privacy vs. Local Prompt Injection​

Nowhere is the split between privacy and security sharper than in browser AI tools:

1. High Security, Low Privacy: Imagine a cloud-backed browser AI assistant engineered with strict sandboxing, TLS encryption in transit, and rigorous identity authentication. From a pure security standpoint, it is hardened against external hackers. Yet if every webpage you summarize or every prompt you type is transmitted to a third-party AI vendor's servers and retained for model training, you still have a massive privacy and data-governance problem.
2. High Privacy, Low Security: Conversely, imagine a local Small Language Model (SLM) running entirely on your Windows PC's neural processing unit (NPU) inside the browser. Zero bytes of data leave your device, making it a triumph for data privacy. However, if that local AI agent is granted permission to take actions inside your browser—such as clicking buttons, filling forms, or reading emails—and it processes a malicious webpage, it can still be hijacked.

Security researchers at the OWASP Foundation classify this latter threat as Indirect Prompt Injection—a vulnerability where attackers embed hidden, malicious instructions inside untrusted web content (using techniques like white text on a white background, HTML comments, or non-printing Unicode characters) that an LLM later ingests. As Computerworld also highlighted in coverage of Brave’s AI browser security research, failing to maintain strict boundaries between trusted user instructions and untrusted webpage content while allowing the browser to take autonomous actions creates serious exploit potential. According to OWASP, a successful indirect prompt injection can trick an AI summarizer or agent into leaking sensitive session data or executing unauthorized commands in multi-step workflows, even if no external server was ever contacted by the browser vendor.

A Practical Audit Checklist for Windows Users and Admins​

To evaluate any browser or AI sidebar feature accurately, Kurzelewski recommends asking two separate questions: Is my browser safe enough to protect me from malicious activity? and Does my browser enable me to control the data I am giving to other companies?

Here is how you can put those two questions into action on Windows right now:

1. Audit Your Browser's Tracking Prevention: Open your browser settings (in Microsoft Edge, navigate to edge://settings/privacy) and verify whether tracking prevention is set to Basic, Balanced, or Strict, and inspect how third-party cookies are handled.
2. Check Your AI Context Toggles: If you use an integrated AI assistant, check whether page-context sharing is enabled by default. In Edge environments managed via Microsoft Entra, verify the state of the EdgeEntraCopilotPageContext policy (especially outside the EU, where it defaults to enabled if unconfigured).
3. Separate Summarization from Action: Distinguish between read-only AI features (summarizing an article) and agentic features that interact with web applications. If deploying agentic browsing features like browsing with Copilot in Edge 148+, restrict execution strictly to vetted internal or partner domains via BrowsingWithCopilotAllowList.
4. Verify Enterprise Data Protection: Ensure employees using browser AI for work are signed in with corporate identities (such as Microsoft Entra ID) that enforce commercial data protection and respect Purview DLP sensitivity labels, rather than logging in with personal consumer accounts.

Section Summary: Security protects you from attackers; privacy protects your data from unwanted collection and sharing. Cloud-based AI features require scrutiny over third-party data retention, while even purely local, private AI assistants require security guardrails against indirect prompt injection from hostile webpages.

The browser has evolved from a passive document viewer into an active control plane for identity, enterprise SaaS, and AI workflows. When we stop treating it like a simple window and start configuring it like the operating layer it has become, both our privacy posture and our security defenses get a whole lot sharper.