Microsoft Copilot+ Recall ‘privacy nightmare’ feature

The UK data watchdog says it is “inquiring with Microsoft” about a new feature that can take screenshots of your laptop screen every few seconds.

Microsoft says that Recall, which will store encrypted photos locally on your computer, is exclusive to its upcoming Copilot+ computers.

But the Information Commissioner’s Office (ICO) says it is contacting Microsoft for more information on the security of the product, which privacy campaigners have called a “privacy nightmare”.

Microsoft says Recall is an “optional experience” and is committed to privacy and security.

According to its websiteusers “can limit which photos Recall collects.”

“Retraction data is only stored locally and is not accessible by Microsoft or anyone who does not have access to the device,” the firm said in a statement.

And it said a would-be hacker would have to gain physical access to your device, unlock it and log in before he could access the saved screenshots.

But an ICO spokesman said firms must “rigorously assess and mitigate risks to people’s rights and freedoms” before bringing any new product to market.

“We are making inquiries with Microsoft to understand the safeguards in place to protect user privacy,” they said.

Recall has the ability to search through all past user activity, including files, photos, emails, and browsing history.

Many devices can already do this – but Recall also takes screenshots every few seconds and searches for them too.

“This could be a privacy nightmare,” said Dr Kris Shrishak, an AI and privacy consultant.

“Just the fact that screenshots will be taken while using the device can have a chilling effect on people.”

says Microsoft it “built privacy into the design of Recall” from the start, and users will have control over what is captured.

For example, users can opt out of capturing certain websites, and private browsing in Microsoft’s Edge browser will not be captured.

“People can avoid visiting certain websites and accessing documents, especially confidential documents, when Microsoft is taking screenshots every few seconds,” Dr Shrishak said.

And Daniel Tozer, data and privacy expert at Keystone Law, said the system reminded him of Netflix’s dystopian show Black Mirror.

“Microsoft will need a lawful basis to record and re-display personal user information,” he said.

“There may be information on the screen that is proprietary or confidential to the user’s employer; will the business be happy for Microsoft to record this?

And he asked how consent would work for people appearing on the screen in a video or photo call.

“Will they be given the choice to accept this? User and access controls will be a key issue that Microsoft will no doubt focus on,” he said.

Meanwhile, Jen Caltrider, who heads a privacy team at Mozilla, suggested the plans meant someone who knew your password could now access your history in more detail.

“[This includes] law enforcement court orders, or even Microsoft if they change their mind to keep all this content local and not use it for targeted advertising or training their online AIs,” she said.

According to Microsoft, Recall will not moderate or remove information from screenshots that contain passwords or financial account information.

“This data can be in pictures that are stored on your device, especially when sites do not follow standard internet protocols such as hiding password input,” Ms Caltrider said.

“I wouldn’t want to use a computer with Recall to do anything I wouldn’t do in front of a busload of strangers.

“That means no more accessing financial accounts, asking for sensitive health information, asking embarrassing questions, or even asking for information about a domestic violence shelter, a reproductive health clinic, or an immigration attorney.”