@elduvelle @sammi @jon Defender is notorious for turning real-time protection (note that this is not "data surveillance") back on without user request or approval. As far as I know this is unrelated to the telemetry collection performed by other parts of the OS which are unrelated to the AV you happen to use.