UK watchdog investigates Microsoft's Recall over privacy concerns

Microsoft wants your next PC to remember everything you do, but privacy regulators are not thrilled about it.

The tech giant recently unveiled Recall for its upcoming Copilot+ PCs. The feature works by quietly taking snapshots of your laptop screen every few seconds, running AI across the text and images, and building a searchable timeline of your entire digital life.

Now, the UK's data privacy watchdog has stepped into the room. The Information Commissioner’s Office (ICO) announced it is officially making enquiries with Microsoft over the tool, demanding to know what safeguards are actually in place.

A timeline that captures everything

Microsoft pitches Recall as an optional, privacy-first tool. The company notes that all snapshots are encrypted and stored locally on the device, meaning Microsoft cannot access them, and a hacker would need physical access and your login credentials to see anything. Users can also exclude specific websites, and private browsing sessions in Microsoft Edge are left alone.

However, cybersecurity and privacy experts quickly labeled the feature a potential "privacy nightmare." Daniel Tozer, a data privacy expert at Keystone Law, even compared the system to an episode of Netflix’s Black Mirror.

The biggest sticking point is that Microsoft confirmed Recall will not filter or blur sensitive information like passwords, bank account details, addresses, or health records from the screenshots. If it appeared on your screen, Recall captured it.

Jen Caltrider, who leads a privacy team at Mozilla, pointed out that anyone with your device password could suddenly browse your deepest secrets. She warned that she wouldn't do anything on a Recall-enabled computer that she wouldn't do in front of a busload of strangers.

Why it matters

Trading ultimate convenience for round-the-clock surveillance is a steep price. For everyday users and professionals dealing with confidential data, having an unfiltered, unmoderated paper trail of every password and personal inquiry stored on disk turns any lost or shared laptop into a massive vulnerability. We think most people should keep this feature firmly switched off until proper data redaction exists.

For the tech industry, Microsoft is desperate to prove why customers must buy into the new Copilot+ PC category. Local processing was supposed to soothe privacy fears, but Recall shows that keeping data on-device is not a get-out-of-jail-free card. The ICO's swift inquiry signals that regulators will not let companies bypass privacy laws simply by framing background recording as a local AI feature.

Ultimately, Microsoft’s execution feels surprisingly clumsy. Leveraging local neural processing to make past work searchable is a smart concept, but failing to automatically scrub passwords and sensitive financial screens is a glaring blind spot. When an AI feature feels more like pre-installed spyware than a personal assistant, user trust evaporates before the hardware even hits the shelves.