Microsoft delays Recall feature for third time over security concerns
Microsoft postponed the preview release of its Recall AI feature for Copilot+ PCs to December 2024, marking the third delay since the tool's announcement in May 2024. The postponement comes after security experts and privacy advocates raised concerns about the feature's access to user data and potential vulnerabilities.
What happened
Microsoft announced its Recall feature in May 2024 as a way to give computers a photographic memory by taking screenshots of user activity to improve search. After security experts and insiders raised concerns, the company delayed release from June to October, then to the following couple of months.
The feature was delayed a third time in October 2024, with Microsoft stating that Recall would not enter preview for Windows Insiders until December. Brandon LeBlanc, senior product manager of Windows, said the company was taking additional time to refine the experience to deliver a secure and trusted experience.
Reported impact
Security experts and privacy advocates expressed concerns about Recall's high degree of access to a computer's systems and data, particularly regarding how easily accessible the feature's database could be if a system were hacked.
After initial feedback, Microsoft made Recall an opt-in feature and later allowed users to fully uninstall it, whereas it had initially been set as default. The company added security measures including database encryption, Windows Hello authentication, anti-hammering, and rate limiting protections.
Index analysis
The repeated delays suggest that implementing privacy and security protections for a feature with broad system access is challenging. The feature's design, which logs extensive computing activity, raised concerns about potential unauthorized access if security measures were compromised.
Governance controls
Microsoft repositioned Recall as an opt-in feature requiring explicit user permission and added the ability for users to fully uninstall the tool. The company implemented technical protections including database encryption and Windows Hello authentication requirements to access logged data.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.