Microsoft Defender Antivirus vs Norton AntiVirus Plus Comparison

• Included in Windows: Built into Windows; not sold separately

• AntiVirus Plus for 1 device, renewal: $59.99 a year after the first year; the cart says the plan 'Automatically renews at $59.99/ year'
• AntiVirus Plus for 1 device, first year: Intro: $29.99 for the first year
• AntiVirus Plus for 5 devices, renewal: $84.99 a year after the first year ($39.99 in the first year); from the cart
• Norton 360 Deluxe for 5 devices, renewal: $124.99 a year after the first year ($49.99 in the first year); from the cart

Cloud-delivered protection is on by default. When the app cannot decide about a file on the device, it sends the file's metadata to Microsoft: hashes, file name and size, signer, the process that touched it, the download address and IP, the hashed file path, and the device's OS version, locale and geographical location. If that is not enough, Microsoft can request the file itself. The default setting sends 'safe samples' such as .exe, .dll and .bat files automatically and asks you before sending a file likely to contain personal data. You can switch off sample submission or cloud-delivered protection in Windows Security; Microsoft's documentation says detection metadata is still sent when sample submission is off.

The Products Privacy Notice (last updated 25 Sep 2026) lists, for the desktop security products, 'Files identified as potential or known malware (36 months)', file metadata including file paths, application names, and 'URLs/Websites visited and associated metadata (36 months)', used among other things for 'file sample analysis'. Norton's settings article says Norton Community Watch sends information about potential security risks to Norton and, when a possible risk is detected, information on running processes, visited URLs and general system information; it can be switched off, but 'critical data will still be sent even if this option is turned off.' On phones, Safe SMS collects text messages that contain links or come from senders not in your contacts and keeps them, with personal identifiers removed, for up to five years.

Microsoft's privacy statement says Defender Antivirus automatically sends reports about suspected malware and unwanted software and may send files for inspection, asking first if a report may contain personal data. Windows required diagnostic data, which includes a Defender health event with a Defender machine ID, is stored with unique identifiers and used to keep Windows secure and to improve Windows. If you turn on the Windows setting Personalized offers, Windows diagnostic data is also used for tips, ads and recommendations. The statement also says Microsoft discloses personal data for digital advertising, and in response to valid legal process from law enforcement and government agencies.

Gen Digital's General Privacy Notice, which Norton's Privacy Center says applies to Norton, says 'We do not sell your personal data to third parties', but also that the group uses data 'to serve you with relevant advertising and content, both on our properties and on third-party properties' and that 'Where permitted by applicable law, we may share personal data with third parties for advertising purposes.' Norton's cookies and analytics notice lists Google Analytics, Adobe Analytics, Quantum Metric, AppsFlyer, Singular and Firebase as analytics tools in its products. The App Store listing of the iPhone app says identifiers and usage data 'may be used to track you across apps and websites owned by other companies'. The desktop app shows promotional notifications by default; they can be switched off in Settings.

Microsoft Corporation, One Microsoft Way, Redmond, Washington, is the data controller; for the European Economic Area, the UK and Switzerland it is Microsoft Ireland Operations Limited in Dublin. Microsoft takes part in the EU–US, UK and Swiss data privacy frameworks.

Norton is a brand of Gen Digital Inc., whose privacy team is in Tempe, Arizona; the group's general privacy notice says it may disclose data to public authorities and in legal proceedings. For users in the European Economic Area the controller of personal data for Norton products is NortonLifeLock Ireland Limited in Dublin, so EU data protection law applies to them.

Microsoft was founded in 1975 and trades on the stock market as MSFT. Its antivirus began in 2009 as Microsoft Security Essentials, became Windows Defender in Windows 8 and 10, and was renamed Microsoft Defender Antivirus in 2020.

Norton was a consumer brand of Symantec. On 4 November 2019 Symantec sold its enterprise security business to Broadcom and renamed itself NortonLifeLock Inc.; on 7 November 2022 NortonLifeLock took the name Gen Digital Inc. The company is listed on NASDAQ under the symbol GEN.