The statement reiterates what Microsoft Director of Product Albert Penello told us in September regarding the Xbox One's use of facial recognition to automatically log in users. This data "does not leave the console" and can be deleted from the local console at any time. In addition, Microsoft says that the string of numbers used internally to represent your recognition model can't be deciphered and tied back to you in any way.
Any skeletal models generated by Kinect are destroyed after a given gameplay session, Microsoft says, including any models sent over the Internet during an online gameplay session. These skeletons are also not personally identifiable from the raw data, Microsoft says, nor is any facial expression data collected by Kinect.