Microsoft makes Windows Recall ‘opt-in’ after privacy, security backlash

Microsoft will make its Windows Recall feature opt-in by default after criticism by security and privacy experts. 

With Recall, currently in preview, Microsoft wants to let Copilot+ PC users find and retrieve information across any app they’ve accessed. It does so by taking screenshots every few seconds, creating a searchable timeline of everything a user has interacted with on their computer. 

Microsoft Executive Vice President Yusuf Mehdi likened Recall to “photographic memory,” when the feature was unveiled in May.   

However, the ability to record and store all user data that appears on screen — anything from passwords to confidential messages — drew widespread criticism. 

Experts claimed Recall would create a treasure trove of data for hackers, with some comparing it keylogger malware. The UK’s Information Commissioner’s Office, a privacy watchdog, said it had written to Microsoft to “understand the safeguards in place to protect user privacy.”

On Friday, Microsoft announced it would make changes to Recall in response to feedback.  Along with turning off the feature by default, Microsoft said users will have to use Windows Hello biometric authentication to enable Recall. 

A “proof of presence” is also needed to search in Recall or view a timeline. 

In addition, Microsoft will add “just in time” decryption protected by Windows Hello Enhanced Sign-in Security (ESS). This means Recall snapshots will “only be decrypted and accessible when the user authenticates,” Pavan Davuluri, corporate vice president for Windows and Devices, said in a blog post, providing an “an additional layer of protection to Recall data.” 

The changes will be made before the Recall feature becomes available on Copilot+ PCs beginning June 18. 

“The introduction of an opt-in option has now given users more control, allowing them to choose to activate the Recall feature,” said Pareekh Consulting CEO Pareekh Jain,  who expects early adopters will turn on the Recall feature when it launches.  “As more people start trusting this feature and their concerns about misuse are addressed, then the majority may choose to opt-in and benefit from it,” he said.