Recall was one of the most polarizing features Microsoft has shipped in years: an AI-powered “photographic memory” for your PC that takes periodic screenshots and lets you search them later in plain language. It’s genuinely useful and genuinely unsettling, often at the same time.
How It Actually Works
Recall periodically captures screenshots, runs on-device OCR and image analysis via the NPU, and stores the extracted text and semantic descriptions in a local, encrypted database — none of it leaves the device or gets sent to Microsoft. You can then search “the spreadsheet I had open last Tuesday” and jump straight back to it.
Legitimate Privacy Concerns
- Anything visible on screen gets captured — passwords typed into non-protected fields, private messages, sensitive documents.
- The local database, while encrypted at rest, becomes a single high-value target if an attacker gains access to a logged-in session.
- Shared or work machines raise questions about what a screenshot history means for compliance and confidentiality.
Managing It
# Check whether Recall is enabled Get-WindowsOptionalFeature -Online -FeatureName "Recall" # Disable it entirely via Group Policy-equivalent registry key Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI" ` -Name "DisableAIDataAnalysis" -Value 1 # Exclude specific apps from ever being captured (per-app privacy setting) # Settings > Privacy & security > Recall & snapshots > Filter sensitive information
Should You Use It?
For a personal device, Recall’s on-device-only design makes it a reasonable trade-off if you find the search functionality genuinely useful. On shared, managed, or compliance-sensitive machines, disabling it by policy is the safer default until organizational data-handling rules explicitly account for it.