Windows 11 ‘Recall’ AI Feature Delayed Over “Privacy Nightmare” Concerns

The first Windows 11 ‘CoPilot+’ laptops to hit the market in the US on June 18 will come without one of Microsoft’s most heavily publicised and derided new AI-powered features. Recall, which was intended to allow users to find information related to anything they were doing on their computer at any point in the past, has been criticised for its potential to expose private data and usage habits. It works by capturing and storing screenshots at short intervals, which are then indexed and searchable using local AI.

When first demonstrated at Microsoft’s CoPilot+ announcement in May, the company said Recall will keep track of anything a user does, including the contents of documents, things searched for or visited on the Web, and even the contents of online conversations. AI-powered search would then let users find information using contextual terms or vague descriptions, and they would be able to see exactly what they were doing at any time in the past. A scrollable “timeline” view would function much like a Web browser’s history list, but with full screenshots of everything you do.

Microsoft did state that all Recall data stays on your PC and nothing is sent to any cloud service. Certain privacy measures were in place at first, including the ability to “pause” Recall when using specific apps. However, observers soon found that Recall would capture passwords, banking information and sensitive private data. More worryingly, data was stored as plain text and could be read by anyone with access to a PC. Malware could easily be designed to steal this information, thus rendering most security tools and practices ineffective.    

Security researcher Kevin Beaumont posted a series of tweets and a detailed blog post showing how it would be trivial for an attacker to search through anyone’s Recall history, and several others raised questions about governments and law enforcement being able to spy on users; how proprietary, legal or medical data could be compromised; and how compliance with international privacy and data security laws might be affected. Analysts have called it “terrifying” and a “privacy nightmare”. 

In response, Microsoft first announced that Recall would not be enabled by default on all CoPilot+ laptops, as was originally planned, and that the database would be encrypted using Windows Hello for authentication. However, it seems that the company has realised that there is more work to be done before releasing this feature, so plans have changed again. The company is taking more time, and Recall will be offered only to those signed up to the Windows Insider testing programme. There is no specific timeline yet on when that will happen, which means the feature has been pulled completely from the CoPilot+ launch.

While this is an embarrassing setback for Microsoft, the decision to withhold Recall from distribution should ultimately help the company address concerns about AI and keep its users safe. It might also have been necessary to assuage the concerns of some government watchdogs, which had already taken notice, and prevent a potential PR disaster. Interestingly, Apple just this week unveiled its Apple Intelligence strategy which puts user privacy and data security at the forefront of all use cases.