Windows Recall's always-on capture was reworked before release

What Microsoft announced in May 2024

On 20 May 2024, Microsoft's Introducing Copilot+ PCs post described Recall as a feature that lets a user scroll back through anything they have seen or done on their PC, built on what the post calls a personal semantic index stored entirely on the device. Mechanically, this means the operating system takes a screenshot of the active window every few seconds, runs on-device optical character recognition and image analysis over it, and stores the result so a later text or visual search can jump back to that moment. The post set a preview date of 18 June 2024 and described snapshots as staying local to the PC.

What changed after security researchers looked at the design

The announcement drew scrutiny from security researchers who found that the initial implementation stored the semantic index in a form that could be read by another logged-in process without re-authentication, turning a convenience feature into a standing record an attacker with local access could harvest in one pass. Microsoft's update, published 7 June 2024, moved Recall out of the general Copilot+ PC release and into the Windows Insider preview programme first. The post states that Windows Hello enrolment is now required to enable Recall at all, that proof of presence is required to view the timeline, and that snapshots are decrypted only at the moment of authenticated access rather than sitting decrypted on disk.

What an always-on capture still means for a workplace

Even in its revised form, Recall is a feature that, once turned on, captures whatever appears on screen, including content in other people's confidential documents, client data in a browser tab, or a colleague's message visible in a notification. Microsoft's support documentation, as retrieved on 16 September 2026, describes filtering that tries to exclude passwords and payment card numbers and lets a user exclude specific apps, but filtering of this kind is necessarily incomplete against content it was not designed to recognise. The feature's default-off status, adopted after the redesign, shifts the decision to the device owner, not to every other person whose data might land in a snapshot.

• Is Recall, or an equivalent capture feature, on or off on devices your organisation issues, and who decided that?
• What confidential material from other people or organisations could end up in a colleague's local snapshot history?
• How would your data-retention and legal-hold obligations apply to a rolling on-device screenshot archive nobody centrally manages?

Recall's revision is a useful case study in the gap between a feature description and its threat model: the mechanism did not change in scope, but the access controls around it had to catch up before general release.