Useful or Potential Spyware? Microsoft's Recall Feature Draws Regulatory Scrutiny

UPDATE 6/13: Microsoft is delaying the Recall launch and limiting it to the Windows Insider Program for now. Windows 11 Copilot+ PCs will ship without Recall when they launch June 18.

Original Story:
A new Microsoft feature that can remember everything you do on your PC is attracting regulatory scrutiny in the UK over concerns it’ll be abused to violate users' privacy. 

At a pre-Build press event on Monday, Microsoft introduced Recall, a feature coming to Copilot+ PCs running Windows 11. The system will "take images of your active screen every few seconds" and save them locally on your PC in an encrypted format. This includes screenshots of your passwords or financial information that could appear on your PC, as Microsoft's FAQ says.

Redmond is marketing the feature as a convenient way to pull up old files, emails, or web pages you’ve lost track of or closed. But Recall's surveillance potential is also drawing concern from the UK's Information Commissioner's Office (ICO), which handles data-protection issues. 

"We are making inquiries with Microsoft to understand the safeguards in place to protect user privacy," the ICO said in a statement on Wednesday. "Industry must consider data protection from the outset and rigorously assess and mitigate risks to people's rights and freedoms before bringing products to market."

Constant Surveillance or More of the Same?

Numerous privacy and security experts, along with Elon Musk, have already voiced concerns about Recall. "This is called constant surveillance, monitoring, and tracking and it will eventually be used to influence and control the masses,” argues AI researcher and Mozilla fellow Abeba Birhane.

This Tweet is currently unavailable. It might be loading or has been removed.

The Recall announcement also comes a few weeks after Microsoft pledged to prioritize security first "when designing any product or service."

In its defense, Microsoft says Recall only stores data locally on the user’s PC, not in the cloud. In addition, users can turn the feature off or toggle privacy controls to prevent certain apps from being snapshotted. Still, David Ruiz, Senior Privacy Advocate at Malwarebytes, says the Recall feature will become an enticing target for hackers to try and abuse. 

"Recall also requires people to extend their trust far beyond Microsoft with this data, as Recall’s most sensitive snippets of information can still be retrieved by someone else using the same device," Ruiz added. "That could be a curious family member, a device thief, or an abusive spouse. Here, device security becomes even more crucial—a worrying proposal in a world where countless people reuse weak passcodes."

Recommended by Our Editors

Copilot+ PCs Have Great Potential But Will Businesses Care?

Everything We Saw at Microsoft's AI Event: Copilot+ PCs, Recall, Surface, More

Dangerous? Signal Blasts Google Effort to Use AI to Scan for Scam Phone Calls

On the other hand, Christopher Budd, Director at cybersecurity provider Sophos X-Ops, says Recall is no different from other backup and restore services. As a result, Microsoft will need to find the right balance between control and usability. 

"This all comes down to the importance of the key privacy principles of adequate notice and consent: providing clear information about what’s being gathered and what’s being done with it, and the opportunity to say clearly 'Yes' or 'No,'" he tells PCMag.   

In the meantime, Microsoft says it’s still gathering user feedback for Recall, which is in a preview testing phase.