Microsoft Copilot+ Recall ‘privacy nightmare’ feature

Britain’s data watchdog says it is “inquiring with Microsoft” about a new feature that can take screenshots of your laptop every few seconds.

Microsoft says that Recall, which will store encrypted recordings locally on your computer, is exclusive to its upcoming Copilot+ computers.

But the Information Commissioner’s Office (ICO) says it is contacting Microsoft for more information about the security of the product, which privacy campaigners have called a potential “privacy nightmare”.

Microsoft says Recall is an “enhanced experience” and is dedicated to privacy and security.

“Revocation data is only stored locally and is not accessed by Microsoft or anyone who does not have access to the device,” the company said in a statement.

And it said that a would-be hacker would need to gain physical access to your device, unlock it and log in before they can access the saved screenshots.

But an ICO spokesman said companies must “rigorously assess and mitigate the risks to people’s rights and freedoms” before bringing any new products to market.

“We are inquiring with Microsoft to understand safeguards to protect user privacy,” they said.

Recall has the ability to search all of a user’s past activity, including files, photos, email, and browsing history.

Many devices can already do this – but Recall also takes screenshots every few seconds and searches them.

“This could be a privacy nightmare,” said Dr. Kris Shrishak, an AI and privacy consultant.

“The mere fact that screenshots will be taken while using the device could have a chilling effect on people.”

Microsoft says it “built privacy into Recall’s design” from the start, and users will have control over what’s recorded.

For example, users can turn off the recording of certain web pages, and private browsing on Microsoft’s Edge browser will not be recorded.

“People might avoid visiting certain websites and accessing documents, especially confidential documents, when Microsoft takes screenshots every few seconds,” Dr Shrishak said.

And Daniel Tozer, a data and privacy specialist at Keystone Law, said the system reminded him of the dystopian Netflix program Black Mirror.

“Microsoft will need a legal basis for recording and re-displaying users’ personal data,” he said.

“There may be information on the screen that is proprietary or confidential to the user’s employer; will the company be happy for Microsoft to record that?

And he asked how consent would work for people appearing on screen in a video call or photo.

“Are they going to be given a choice as to whether they agree to it? User and access controls will be a key issue that Microsoft will no doubt focus on,” he said.

Meanwhile, Jen Caltrider, who heads the privacy team at Mozilla, suggests the plans mean someone who knows your password can now access your history in greater detail.

“[This includes] law enforcement court orders, or even from Microsoft if they change their mind to keep all this content local and not use it for targeted advertising or training of their AI down the road,” she said.

According to Microsoft, Recall will not moderate or remove information from screenshots that contain passwords or financial account information.

“I wouldn’t want to use a computer running Recall to do something I wouldn’t do in front of a bus full of strangers,” Ms Caltrider said.

“That means no more logging into financial accounts, looking up sensitive health information, asking awkward questions, or even asking for information about a domestic violence shelter, reproductive health clinic or immigration attorney.”