Windows 11 Recall is coming back with a very different pitch from the version that drew heavy criticism before release. Microsoft is preparing to reintroduce the feature for Copilot+ PCs, where it can build a searchable record of what a user has done on the computer by saving screenshots and text extracted from them.
The core idea has not changed: Recall is still a local history tool built around snapshots and OCR. What has changed is the way Microsoft is presenting, gating, securing, and testing it before wider availability.
Why Recall became controversial
Recall was controversial because of what it records. When enabled, it builds an extensive database of text and screenshots covering almost everything a user does on a PC. That alone raised concern, but the original problem went further than the existence of the database.
The first version was delayed after a large-scale outcry from security researchers, reporters, and users. According to the source article, the issue was not simply that Recall captured user activity. It was that the feature was rushed, enabled by default, and had major security weaknesses that made the Recall database easy to access for anyone with some form of access to the PC.
The earlier version also did not automatically exclude sensitive information such as bank information or credit card numbers. Users had only limited manual tools for excluding specific apps or websites. That approach clashed with Microsoft’s broader promise to prioritize security over other considerations after several serious and highly public breaches.
What Microsoft has changed
The current version of Windows 11 Recall has gone through a more typical testing path. It is being rolled out to the Windows Insider Release Preview channel after months in more experimental and less-stable channels, rather than arriving outside the normal preview process.
The most visible change is consent. Recall is now off by default. After installing the update, users see a setup screen that describes the feature and offers to turn it on. Even after accepting there, the source article says users must opt in a second time during Recall setup before snapshotting actually begins.
Microsoft has also changed the security model. The new Recall encrypts data at rest so it cannot be accessed by other users on the same PC. It adds automated filters for sensitive information. It also requires frequent reauthentication with Windows Hello whenever a user accesses their Recall database.
Users and IT administrators can remove Recall entirely from Windows. The feature can be uninstalled by unchecking it in the legacy Windows Features control panel, which is also reachable by searching for “turn Windows features on and off.”
How Recall works when enabled
Recall is limited to Copilot+ PCs. The tested systems in the source article included a Snapdragon X Elite version of the Surface Laptop and a couple of Ryzen AI PCs, all with NPUs fast enough to support Copilot+ features.
PCs without the required NPU do not offer Recall or other Copilot+ features by default. That includes every single PC sold before mid-2024 and the vast majority of PCs sold since then. As a result, Recall is not something most current Windows users will see by default.
Once enabled, Recall saves two main kinds of information:
- screenshots of the active area of the screen, excluding the taskbar
- a searchable text database created from those screenshots using OCR
The OCR behavior has limits. Even when multiple apps are visible at once, Recall appears to scrape and store text only from the active, currently focused app. Multi-monitor use works in a similar way: screenshots are taken only from the active display, and OCR is applied only to the active window on that active display.
That design may reduce unnecessary screenshot storage from idle or empty monitors. It also means Recall may miss information that updates passively in windows a user is not actively interacting with.
Controls, filters, and deletion options
Recall’s text index is searchable. Text extracted by OCR can be copied out of Recall and pasted elsewhere. The feature can also offer to open the app or website visible in a saved screenshot.
Users can delete a specific screenshot, or delete all screenshots from specific apps. That matters if a user later decides that an app should be filtered and wants to remove already saved snapshots from it.
Settings provide several controls. Users can see how much storage Recall is using and limit the total storage it may consume. Snapshot retention is normally determined by available storage, but users can also choose an age-based expiration setting. The options range from 30 to 180 days.
Users can delete the entire database or remove recent snapshots from the past hour, past day, past week, or past month. They can also toggle automated sensitive-content filtering, add specific apps and websites to filtering lists, pause Recall from the system tray icon, or turn it off completely in Settings.
Pausing or turning off Recall stops new snapshots from being created. It does not delete snapshots that already exist.
What users should understand before opting in
The new version answers several of the sharpest objections to the original Recall launch. It is opt-in, per-user, removable, encrypted at rest, and tied to Windows Hello authentication. It does not require a Microsoft account, an Internet connection, or cloud-side processing to work.
It does require local disk encryption through Device Encryption or BitLocker. It also requires Windows Hello and either a fingerprint reader or face-scanning camera for setup, although after setup it can be unlocked with a Windows Hello PIN. Windows Hello authentication happens every time the Recall app is opened.
There are still tradeoffs. Recall can generate a couple of hundred megabytes per day of images, depending on usage and filtering. On a Ryzen system with a 1TB SSD, the source article found that Windows allocated 150GB to Recall snapshots by default. Even a smaller 25GB Recall database could store a few months of data.
Filtering also has practical effects. Users can manually exclude apps and websites, and major browsers in private or incognito modes are generally not snapshotted. If a filtered app is on screen, Recall avoids taking desktop screenshots entirely rather than trying to blank out only the filtered area.
That approach reduces the chance of accidental capture, but it may also mean users who often mix filtered and unfiltered apps end up saving less in Recall than expected. The revised feature is therefore less risky than the original design described in the source, but it remains a tool that users should enable only after understanding what it stores, how it is protected, and how to delete it.