New Windows 11 "Recall" Feature Sparks Privacy Concerns

Microsoft's new AI feature for Windows 11, called Recall, which is designed to "recall" user activities on compatible PCs, has triggered privacy alarms following its Monday reveal at an AI event.

The Recall feature captures screenshots of the active window every few seconds to create a searchable library of a user’s activities for up to three months. For now, it’s only available on Copilot+ PCs running Snapdragon X ARM processors, with plans to expand to Intel and AMD-powered devices.

Despite fears, Microsoft seems heavily invested in the feature, stating that “Recall is a key part of what makes Copilot+ PCs special.” It has reassured potential users that it “built privacy into Recall’s design from the ground up.”

Among its assurances is that users can control what snapshots Recall collects and when. A filter feature allows users to choose which browsers or applications should not be captured by Recall. Additionally, users can pause snapshots as well as clear or delete some or all snapshot storage from their devices.

By default, Recall will not create browser window screenshots when using Microsoft Edge’s InPrivate mode. However, Microsoft has not confirmed whether this also applies to other browsers’ privacy modes. This same exemption is supposed to apply to all supported “materials” under rights management (DRM) protection.

Furthermore, BleepingComputer reports that Microsoft told them that “data for Recall will only be available locally and not be stored in the cloud,” reiterating that the "data is not accessed by Microsoft." Among other assurances made by Microsoft is that the data will be stored in encrypted form and will not be used in training any AI models.

Despite Microsoft’s reassurances, members of the global privacy and cybersecurity communities are raising major concerns.

For example, the Information Commissioner's Office (ICO) released a statement in direct response to Microsoft’s Recall announcement. “We expect organisations to be transparent with users about how their data is being used and only process personal data to the extent that it is necessary to achieve a specific purpose.” The organization ended its statement by announcing that it was “making enquiries with Microsoft to understand the safeguards in place to protect user privacy.”

With cybersecurity incidents on the rise, Microsoft will have to take significant steps to convince consumers of the safety of a feature like Recall. Just in September of last year, the company revealed that it had mistakenly leaked 38 TB of company data. Earlier this year, Russian hackers even managed to breach top Microsoft leaders’ emails.