Microsoft Copilot+ Recall: who should disable it, and how

Microsoft's updated Recall feature, designed to continuously capture screenshots and analyze their content, has been met with cybersecurity concerns despite enhancements like encryption and user permission requirements. While Microsoft has addressed some criticisms, vulnerabilities remain, including the potential for unauthorized access via PINs, unreliable filtering of sensitive data, and privacy violations related to messaging application content. Experts recommend that individuals handling confidential data, engaging in video conferencing, or concerned about privacy should disable or remove Recall due to these ongoing risks.

Analysis

Microsoft's (MSFT) updated "Recall" feature for Copilot+ PCs, reportedly rolled out widely in May 2025 following an initial April 2025 preview, continues to face significant cybersecurity and privacy concerns despite several enhancements designed to address initial criticisms. Microsoft implemented user-permission requirements during initial setup without manipulative UI, mandated BitLocker disk encryption and Windows Hello biometric authentication for initial launch, and enabled hardware-based TPM encryption for Recall's database. Additional reported improvements include per-user enablement, the option to uninstall Recall completely, no requirement for a Microsoft account or internet connection for local data processing, and mandatory Windows Hello authentication for each use of Recall search. However, the article highlights persistent vulnerabilities, such as the ability to bypass initial biometric authentication for subsequent access or re-activation using only a Windows PIN, which is susceptible to compromise. Furthermore, the sensitive data filtering mechanism is described as unreliable, with testers reporting instances where confidential data from private browsing windows (especially in less common browsers), remote desktop sessions (e.g., AnyDesk), payment forms, or password managers slipped through and was logged. Critically, the feature meticulously logs user interactions within messaging and collaboration tools like Zoom, Teams, WhatsApp, and Signal, potentially overriding their privacy settings and capturing supposedly ephemeral content like self-destructing messages or one-time view media if displayed on screen. These logged data stores pose risks from unauthorized physical access via compromised PINs or remote exploitation of Windows vulnerabilities. The article also notes performance degradation, with Recall consuming significant memory and NPU resources (up to 80% NPU load), and accelerating battery drain, even on high-performance PCs. The overall sentiment towards MSFT regarding this feature is negative (-0.4), reflecting these ongoing concerns.

Key Decisions for Investors

• Investors in Microsoft (MSFT) should closely monitor public and regulatory responses to the Recall feature, as the persistent privacy and security concerns could impact user trust, adoption of Copilot+ PCs, and potentially lead to increased scrutiny or calls for stronger data protection safeguards.
• The challenges highlighted with Recall underscore the operational and reputational risks associated with deploying advanced AI features that handle sensitive user data; this serves as a cautionary signal for investments in companies heavily reliant on AI-driven personal data collection for their product strategy.
• Consider the potential for heightened cybersecurity risks and associated costs for Microsoft if vulnerabilities in Recall are exploited, and assess the company's ongoing commitment and effectiveness in addressing these issues transparently to maintain user confidence and mitigate potential financial repercussions.