Microsoft Relaunches Controversial Recall Feature for Copilot+ PCs Amid Privacy Concerns

Microsoft relaunches Recall on Copilot+ PCs after privacy overhaul

Editor's take: We already have too much personal information floating around on the internet, and it's seemingly leaked on a monthly basis. So, is having snapshots of your screen taken every few seconds, stored and indexed - even locally - safe? These images could contain sensitive information that anyone with access to your computer can see. To me, it sounds like a bad idea. Let me hear your thoughts in the comments. Microsoft has officially launched its controversial Recall feature, but only for users of new Copilot+ PCs. The AI-powered tool, which captures screenshots every few seconds to build a searchable timeline of on-screen activity, returns nearly a year after Microsoft postponed it following a wave of privacy backlash. This time, the company disabled it by default and made it removable. Unveiled in 2024 alongside Microsoft's Copilot+ PC initiative, Recall aimed to act as an AI memory for the device. It indexes everything from visited websites to opened documents and past chats, allowing users to "scroll back" in time with natural language queries. However, early builds showed that Recall often captured sensitive material - passwords, private messages, and financial data - without redaction. Security researchers and privacy advocates quickly raised concerns about the tool's implications. Critics warned that if an attacker or malicious software gained access to Recall's local archive, it could expose a user's most private data. Microsoft responded by pulling the feature from preview builds, placing it in beta for five months, and reworking its privacy safeguards. Over the last couple of weeks, Windows Insiders tested the updated version in the preview channel, presumably without complaint. The updated feature launching this week includes several key changes. Most notably, Recall is now an opt-in feature. Users must manually enable it, and data is processed locally on the device - not uploaded to the cloud. Access to Recall's timeline also requires Windows Hello biometric authentication. Microsoft has added controls to pause data capture, exclude certain apps or websites, and delete stored content. Users can uninstall Recall completely through the system settings menu. To do so, go to Settings > System > Installed apps, search for "Recall," and select Uninstall. To opt-in, head to Settings > Privacy & Security > Recall & snapshots and toggle the switch. Microsoft is launching Recall exclusively on Copilot+ PCs, a new class of Windows 11 laptops with built-in NPUs for local AI processing. Most existing PCs are not compatible and will not receive the feature.

Windows 11's Most Controversial AI Feature Is Back, and It'll Never Be Secure

After close to a full yearâ€"enough time that a SpongeBob SquarePants episode would fly the card "One Eternity Later"â€"Microsoft's Recall feature for Copilot+ PCs are back, along with even more AI. Soon, everybody with a new Windows 11 laptop will have the opportunity to dive into Microsoft's auto-screenshotting, "photographic memory" feature, or otherwise desperately try to delete it. If a feature that records everything on your screen doesn’t float your boat, Microsoft hopes an improved, "contextual" Windows Search function will actually offer a better OS experience. Recall has been available to certain Windows Insider beta users for the last few months, but this will be the first time the feature will reach a general audience. In a blog post, Microsoft described everything that's the same and different with this "opt-in" iteration of what it showed last May. The software automatically screenshots what you do on your PC. AI interprets those screenshots and allows users to search through them to find that one website or document you were working on but has since slipped your mind. Unlike its first iteration, the software now requires a Windows Hello biometric or PIN login for every time you want to access your screen grabs. Microsoft said these features will be rolling out to all users over the next month. Microsoft has already detailed how users can disable or curtail Recall, though anybody logging into Windows 11 with the update should be able to enable or disable it on launch. What's more, the company said you can completely remove it from your PC. You can further determine how much data the screenshots take up on your PC (a minimum of 25GB with 512GB or 1TB of storage). Recall users may also manually filter which websites won't get screenshotted with any Chromium-based browser, including Google Chrome, Microsoft Edge, Firefox, and Opera. If you still have no interest in Recall, Microsoft hopes you may be enticed by a few other AI features coming to Windows 11. The most pertinent for most users is a new "improved" Windows search. With the update, the Windows 11 taskbar or File Explorer search function should be much better at understanding what you're looking for, even if you enter vague or conversational text. For example, if you search "mountains" into the desktop task bar, you should be able to pull up a slideshow of family photos from your files. The other headline feature is Click to Do. It's akin to the right-click on Mac with Apple Intelligence or Gemini on Chromebook, but the gist is by hitting the Windows Key+mouse click, it will let users access writing summaries or rewriting for text. If you use Click to Do on an image, you should be able to do a visual search on Bing, blur photo backgrounds, or erase objects in an image with a Magic Eraser-like tool through the Photos app, without needing to go to a separate app. This is different from the Copilot key that takes up keyboard space on most Copilot+ PCs. That key normally brings up the Copilot app for accessing Microsoft’s AI chatbot. Those features may be useful to some, but they’re not exactly the thing that sells a new laptop as a true "AI PC." Let's recall when Microsoft recalled Recall just a month after the company revealed its auto-screenshotting feature at its 2024 Build developer conference. Security researchers quickly grew concerned that the software was capable of scraping sensitive info, like bank or social security numbers. It didn't take long for experts to point out glaring holes in the software that let anybody with access to the PC read the AI's screenshot logs, potentially revealing users' activity, emails, passwords, and more. Despite Microsoft's efforts, Recall won't ever be a fully secure system. As some security bloggers have noted in the weeks up to full release, if you send any sensitive info to a friend or loved one's PC that's also running Recall, that PC may also scrape it up. There’s a strong chance the AI will fail to avoid screenshotting your checking account number if you’re not working on any protected webpage or app. The feature will likely continue to be controversial, even if most users decline to use it.

Windows Recall is too risky for your Copilot+ PC. Turn it off, now

Microsoft's controversial Windows Recall has now been generally released, and it poses as much of a risk to your privacy as it could be a boon to your productivity. Recall is just one of several new features that either have or will be arriving on Copilot+ PC, Microsoft said Friday. Recall, Windows' improved semantic search, Live Captions, Cocreator, and Restyle Image and Image Creator within Photos are now all available for Copilot+ PCs that include Qualcomm Snapdragon CPUs as well as PCs with qualifying processors from AMD and Intel. A few features -- Click to Do, Live Captions, and Voice Access -- are available for Copilot+ PCs running on Snapdragon, but support for AMD and Intel chips isn't quite available. For Microsoft, the release of these AI-powered features are cause for celebration, finally delivering on promises of an AI-powered world that the company first made a year ago. But in the weeks and months since Microsoft first announced Recall, a darker side of its potential has emerged. Now, Recall and its saved snapshots provide a record of information that could be used against you. Fortunately, Microsoft hasn't shied away from allowing you to remove Recall altogether, deleting these saved records entirely. It's also important to put Recall in perspective. Now, by default, Recall is opt-in, which means that you'll have to explicitly enable it. But even if you want to use Recall, it's only available to Copilot+ PCs, which are a tiny subset of the available PCs on the market. Just because Recall is available doesn't mean that your PC will necessarily receive it. Even the most "modern" PCs, such as Intel's Core Ultra 200 series (Arrow Lake) don't have the necessary NPU power to run Recall. Microsoft first announced Recall at a May 2024 event at its headquarters in Redmond, Wash., where the company debuted several upcoming Windows features to complement its newly announced Copilot+ PCs. Recall was designed as a sort of search assistant: As you went about your day-to-day business, Recall would periodically take and store "snapshots" of your PC, which its optical-character recognition AI could "read." (At the time, Recall wasn't designed to be opt-in.) Essentially, Recall could search your PC for a piece of information without knowing the app in which it was captured, or when it was stored. In concept, Recall's premise appealed to me. Privacy experts disagreed, big time. Instead of serving as a useful tool, Recall could store snapshots of information that weren't necessarily secure, opening them up to hackers and whoever else gained access to your PC. Meanwhile, others were concerned with the vast amounts of storage needed to store all of that information. Cowed, Microsoft pulled Recall from the original Copilot+ launch and promised to perform more testing. Recall would debut in October, Microsoft said then. In September, Microsoft began making the changes that users had asked for: making Recall opt-in, and even uninstallable after a user had decided to enable it. But it was delayed yet again. I went hands-on with Recall in early December, but by then my stance had changed -- I found Recall to be a useful tool, but by then government attitudes toward privacy and free speech had begun changing. Also at that time, Microsoft opened up Recall to Copilot+ PCs using AMD and Intel processors, paving the way for a final test run before releasing it. Recall will be shipped as a feature of new Copilot+ PCs, though you should be able to opt in during the original setup process. When I tested Recall, I had to manually download a new Windows builds and then manually launch the Recall app, which then stepped me through its setup process. Finally, I had to specifically choose to enable Recall and store snapshots. Even after doing so, the Windows 11 Settings menu included a toggle switch that allowed me to turn off the ability to save Recall snapshots entirely, or exclude specific applications. (It still does.) Related: What are Copilot+ PCs? Explained Even with all of these safeguards, I don't trust Recall. That's not to say I distrust Microsoft's implementation of it -- Recall is protected by Windows Hello, which is both a secure and convenient way of locking down information on your PC. It's the convenience of Hello that worries me. I can imagine a scenario in which I'm directed to unlock my PC via Windows Hello, which would give someone access to my documents and email -- even as a journalist, whose legal protections should safeguard that correspondence. I have major concerns about Hello also unlocking a searchable database of everything I've done on that PC for the last few months using Windows Hello. No, I don't have anything to hide, but I also don't want anyone poring through anything I consider private. You shouldn't, either. It's my recommendation, then, that you don't let Recall on to your system. If your PC is managed by a corporation or school, Microsoft says that Recall won't be on it. Otherwise, Recall "is available by default," Microsoft says on its Recall support page. ("An IT admin can't, on their own, enable saving snapshots on devices that are managed by an organization or school," Microsoft says. "IT admins can only give you the option to enable snapshots.") Recall can be turned on and off via the optional Windows features. To access them, type "Turn Windows features on or off" within the Windows search bar. That will bring up a list of optional features that can be turned off or on depending on whether the appropriate box is checked. Microsoft shouldn't enable Recall without telling you, as per my earlier test. But if you're simply not sure, you can double check by running down the list of optional features and seeing if Recall is installed. (If it is, the box marked "Recall" will be checked.) To uninstall Recall, you can simply uncheck the "Recall" box. Recall will be uninstalled and your PC will be rebooted, so be careful to save your work. As Microsoft removes Recall, it will delete your stored snapshots, too. You can re-enable Recall by checking the box at a future time, though doing so won't restore the deleted snapshots. Recall is an optional feature; the other new AI features arriving on your Copilot PC are not. On the other hand, something like Photos' new Restyle Image doesn't offer anywhere near the privacy concerns that the other applications do. If you've followed our coverage, you'll know that I was in favor of Recall from the beginning. But upon further reflection and changing world events I've become uncomfortable with the threat that Recall poses to our privacy. Remove it immediately.

Microsoft's controversial Recall feature arrives on Copilot+ PCs, here's what you should know

Do you want an AI taking snapshots of what you're doing on your computer? Last year at Microsoft's Build event, the company unveiled a new feature for its Microsoft Copilot+ PCs called Recall. This AI feature would automatically take snapshots of what you're doing on your computer to create an easily searchable timeline to find something like a browser tab from a month ago or an image you saved last week. This feature, however, raised a lot of concerns regarding users' privacy, as the AI would technically be spying on everything you do on your computer. This led to Microsoft pausing the rollout of Recall to make some changes, including letting it be an opt-in feature for Windows 11 devices. Almost a year later, Microsoft is finally rolling out the Recall feature to all Copilot+ PCs, according to a new Windows blog. "Recall retrieves your digital memory, allowing you to retrace your steps in seconds to quickly and securely find and get back to an app, website, image or document," Microsoft wrote in the blog. "Simply scroll through your timeline or describe the content you remember. With Recall on Copilot+ PCs it can take up to 70% less time to find and reengage with your PowerPoint presentation - just use your own words, no digging required." Microsoft did reiterate that Recall is an opt-in experience, and that there is a set of privacy controls to filter content and customize what is saved on the timeline. The company says there are also additional security features such as data encryption, the Windows Hello sign-in, and isolation in Recall to make sure a user's data is safe. Along with Recall, Microsoft also offered details on two other AI features for Copilot+ PCs. Windows Search has been improved upon. Instead of having to provide the exact wording of what you're looking for, search will now understand what you're looking for based on more natural words or phrases you would use. An example would be doing a search by describing a picture based on what was in the actual picture instead of the filename of the picture. There's also a new Click to Do feature that will integrate different Windows tools to cut down on the back and forth you would have to do. Using a prompt such as hitting the Windows button and clicking with the mouse, certain tools can be made available to you. Let's say you're on a website and there's an image you want to screenshot. Instead of having to open up the Snipping Tool, the Click to Do feature will do it for you. Recall, the improved Windows Search and Click to Do will be available on Copilot+ PCs starting in April in the Windows non-security preview update. The features will then gradually roll out starting in May.

Microsoft's AI Secretly Copying All Your Private Messages

Microsoft is finally relaunching "Recall," its AI-powered feature that records almost everything you do on your computer by constantly taking screenshots in the background. The tool is rolling out exclusively to Copilot+ PCs, a line of Windows 11 computers built with specific hardware optimized for AI tasks. And if it sounds like a privacy nightmare, your suspicions are not unfounded. Originally launched last May, Microsoft quickly withdrew Recall after facing widespread backlash, one of the reasons being that security researchers found that Recall's screenshots were stored in an unencrypted database, making it a sitting duck for hackers who'd be able to see potentially anything you'd done on your computer if they broke into it. Since that disastrous debut, the feature has been tested out of the spotlight through Microsoft's Insider program. Huge risks were still being flagged even as it was being revamped. In December, an investigation by Tom's Hardware found that Recall frequently captured sensitive information in its screenshots, including credit card numbers and Social Security numbers -- even though its "filter sensitive information" setting was supposed to prevent that from happening. For this latest release, Microsoft has tinkered with a few things to make Recall safer. For one, the screenshot database, though easily accessible, is now encrypted. You now have to opt in to having your screenshots saved, when before you had to opt out. You also have the ability to pause Recall on demand. These are good updates, but they won't change the fact that Recall is an inherently invasive tool. And as Ars Technica notes, it also poses a huge risk not just to the users with Recall on their machines, but to anyone they interact with, whose messages will be screenshotted and processed by the AI -- without the person on the other end ever knowing it. "That would indiscriminately hoover up all kinds of [a user's] sensitive material, including photos, passwords, medical conditions, and encrypted videos and messages," Ars wrote. This is perhaps its most worrying consequence -- how it can turn any PC into a device that surveils others, forcing you to be even more wary about what you send online, even to friends. "From a technical perspective, all these kind of things are very impressive," warns security researcher Kevin Beaumont in a blog post. "From a privacy perspective, there are landmines everywhere." In his testing, Beaumont found that Recall's filter for sensitive information was still unreliable. And that encrypted screenshot database? It's only protected by a simple four digit PIN. But the most disturbing find was how good Recall was at indexing everything it stored. "I sent a private, self deleting message to somebody with a photo of a famous friend which had never been made public," Beaumont wrote. "Recall captured it, and indexed the photo of the person by name in the database. Had the other person receiving had Recall enabled, the image would have been indexed under that person's name, and been exportable later via the screenshot despite it being a self deleting message." Beaumont's advice is simple, but a sobering indictment of the state of affairs. "I would recommend that if you're talking to somebody about something sensitive who is using a Windows PC, that in the future you check if they have Recall enabled first."

Windows Recall Is Back (but Should You Use It?)

There are still several security and privacy concerns with Windows Recall. Originally launched by Microsoft last July, Windows Recall was swiftly pulled in response to a barrage of security and privacy complaints. Now it's back, with some tweaks to make it more palatable for users -- but there remain plenty of concerns about what happens when it's enabled. If you're new to the story, Recall is an AI-powered feature that acts like a memory for your computer. It regularly snaps and analyzes screenshots of whatever you're doing. It's handy if you want to get back to a document or message you vaguely remember from three weeks ago, while at the same time sounding several alarm bells in terms of having all your past Windows activity stored on your system. I tested an early version of Windows Recall at the end of last year, and found it to be genuinely useful at times -- for those prepared to put up with the security and privacy problems. Back then it was still in a rather unfinished form, with some basic features missing, such as the option to filter snapshots by app. To get Recall today, you need to have a Copilot+ PC, with all the necessary AI processing power: If you have a compatible computer with the latest version of Windows, you'll find the Recall app on the Start menu. It won't be enabled by default; making the feature opt-in is one of the changes Microsoft has made after the wave of criticism directed towards Recall when it was first unveiled. Microsoft has made other changes, too. The data stored by Recall is now more securely encrypted; Windows Hello authentication is required each and every time you want to access it; and sensitive information such as passwords, credit card numbers, and official IDs are filtered out -- though it remains to be seen how effectively that works. Are the changes enough to win back trust for Windows Recall? It's certainly now much harder for someone else to get at the screenshots that Recall stores, but there remain questions about how well they're protected -- not just on your own computer, but on the computers of anyone else you might be communicating with. Security researcher Kevin Beaumont has been digging into the latest version of Recall, and there are still some worrying problems here. The first is that someone else can access your PC and Recall using your computer PIN, if they can guess it or trick you into revealing it: While biometric authentication is required to set Recall up, you can fall back to using a PIN whenever you need to see or search through the screenshots. Now this isn't too different from someone hacking into your phone using your PIN, and you might be confident that no one else will even get hold of your set of digits. However, if they do, Recall gives these unauthorized visitors instant access to everything you've ever done on your PC since you set up the feature. Secondly, Beaumont found that the sensitive data filtering is hit and miss (something I noticed in my own testing too): You can't really rely on it to wipe out details of your credit cards or your medical histories. That's not a huge issue if you're the only one looking at this information, but that's difficult to guarantee. There's another problem here, highlighted by Ars Technica: If someone you know enables Recall, and is syncing photos and chats you've sent them to their computer, all that information then gets snapped and sorted on their PC (think Signal for Windows, for example). Your data is more likely to be exposed, and you've not even had any say in it. It seems as though insisting on biometric authentication every time Recall is accessed is an obvious fix Microsoft could apply here -- making it much harder for someone else to get at your data, whether it's on your PC or the PC of someone you know. It still feels wrong that your emails, photos, or chats might be getting collected together in someone else's Recall library, though. More robust filtering tools would certainly help as well. Windows Recall already lets you exempt certain sites and apps from being screenshotted, but it's a rather clunky system, and better automatic censoring would be welcome. In the meantime, you not only need to decide if you're going to enable Recall, you need to check in with family and friends to see what they're doing as well.