Microsoft Limits New Windows AI 'Recall' Feature Following Privacy Backlash

Following weeks of criticism, Microsoft announced Friday that it will build tougher limits around the controversial AI-powered “Recall” feature that it unveiled during its annual developer conference in May. Cybersecurity and privacy experts railed against the product, calling it spyware and a potential honeypot for cybercriminals.

In an update, Microsoft said it was changing how Recall functions, giving customers more control over the application. According to Microsoft, Copilot+ PC users will have to opt into using Recall, saying that the service will now be turned off by default.

Additionally, enrollment in Microsoft’s Windows Hello service—the secure, biometric login feature introduced in Windows 10—is required to enable Recall, and decryption of snapshots will now require user authentication.

“Even before making Recall available to customers, we have heard a clear signal that we can make it easier for people to choose to enable Recall on their Copilot+ PC and improve privacy and security safeguards,” Microsoft said in a statement.

 Artificial Intelligence

Microsoft Recall Is Spyware and an Obvious Target, Say Security Experts

When Microsoft announced its new Recall feature during its annual developer conference on Monday, the news made waves beyond the AI industry. Cybersecurity and privacy experts also took notice—and they were concerned. During the presentation, Microsoft said new Copilot-enabled computers will remember and later be able to find anything displayed on screen—including emails, websites, and applications—through AI-indexed snapshots stored on-device. Reaction to the announcement was mixed, prompting s...

A feature of Microsoft’s new line of AI-powered Copilot+ Windows PCs, Recall uses artificial intelligence to take random screenshots of what the user is doing in order to provide a way to retrieve lost or missing data. Concerns that Recall would be able to capture passwords and other sensitive information soon followed.

“We also know the best way to secure information on a PC is to secure the whole PC itself,” Microsoft said.

Microsoft emphasized that Snapshots are stored locally and are not shared, and users will know when Recall is saving a snapshot. Microsoft also noted that Recall does not save snapshots of digital rights-managed content or private browsing in supported web browsers, and customers can also pause, filter, and delete snapshots at any time.

“We are on a journey to build products and experiences that live up to our company mission to empower people and organizations to achieve more, and are driven by the critical importance of maintaining our customers’ privacy, security, and trust,” the firm noted. “As we always do, we will continue to listen to and learn from our customers, including consumers, developers and enterprises, to evolve our experiences in ways that are meaningful to them.”

Edited by Andrew Hayward