The UK ICO is “making enquiries with Microsoft” over the company's Recall feature, which some privacy campaigners have called a potential “privacy nightmare”
The UK data watchdog says it is “making enquiries with Microsoft” over a new feature that can take screenshots of your laptop every few seconds.
BBCImran Rahman-Jones
Context & Ripple Effects
The ICO inquiry arrived as concerns centered on Recall's ability to retain a detailed record of activity. Days later, related coverage examined the feature's default recording period of up to three months, underscoring why screenshot-based AI features drew unusually acute privacy scrutiny.
Microsoft subsequently shifted Recall toward safeguards including opt-in activation, encryption, and Windows Hello access controls in its first major Recall privacy redesign, then later added an uninstall option in its further Recall overhaul. The inquiry is therefore an early pressure point in the feature's redesign arc.
First-order effects
Microsoft must account to the UK privacy regulator for how Recall captures, stores, and exposes users' screen activity, putting the feature's launch design under immediate scrutiny.
UK users and enterprise buyers face greater uncertainty over Recall's privacy posture while the ICO gathers information, raising the importance of clear controls and security protections.
Second-order effects
The scrutiny increases the commercial value of privacy-preserving defaults—such as explicit consent, local protection, and access authentication—for Microsoft and other vendors building activity-aware AI features.
Microsoft's later move to make Recall opt-in and encrypt its index shows how regulatory and public concern can turn product architecture into a launch requirement rather than a post-release refinement.
Third-order effects
If this pattern persists, regulators will increasingly assess AI features by their data-collection and retention mechanics, not just by their stated user benefits.
The ICO's later criticism of Google's fingerprinting plans suggests a broader UK focus on digital tracking practices; AI interfaces that create persistent behavioral records may face the same governance lens.
The trend: Consumer AI features are moving toward privacy-by-design requirements as regulators scrutinize how continuously collected personal data is retained and accessed.
Would you let these Copilot+ Windows PCs into your business? History tells us that cyber criminals will find a way to breach security and access this Recall data. It has to be decrypted for the user to access it. And we all know that users accounts never get compromised. What…
THIS is the company that wants to record literally everything you ever do on your computer. (Report is re an attack last year.) If you don't think Microsoft Recall, local or no, will be one of the biggest cybertargets in history, you aren't paying attention. [image]
From Microsoft's own FAQ: “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers.”
For everyone who needs to see this: @Microsoft Recall in Copilot+ is entirely on device - it does not send your usage data to any servers. This is part of why they needed the @Snapdragon NPU silicon, to process searches against this index while maintaining battery life.
“...a would-be hacker would need to gain physical access to your device, unlock it and sign in before they could access saved screenshots.” I've got some news for Microsoft about how domestic abuse works. https://www.bbc.com/...
Microsoft's AI Recall explained: ➡️ Takes screenshots of everything you do in Windows 11 and uses local small language model to help you search through it ➡️ Stores screenshots locally. You adjust how long they are stored for and how much drive space to dedicate ➡️ Runs [video]