The arrival of Windows Recall has sparked debate: a feature capable of periodically saving screenshots of what appears on the screen to enable natural language searches. While it promises productivity, many have concerns about the privacy and security implications , especially on shared computers or in regulated environments.
In this guide, we've gathered the best information from the most reliable sources to explain what it is, how to limit it as much as possible, disable it, or even uninstall it, and what alternatives exist so you don't have to sacrifice convenience. Here you'll see how to take control, from basic settings to advanced techniques for preventing screenshots in sensitive apps.
How Windows Recall Works
Windows Recall is a feature of Copilot+ PCs that takes screenshots of the screen every few seconds when it detects changes and saves them locally. From these images, Windows creates a semantic index so you can search by words, visual cues, or context . The experience includes a timeline, previews, and a button to return to the content you previously viewed (relaunch).
In addition to general search, Microsoft describes an interaction layer over the content called Screenray. This layer recognizes on-screen elements and extracts useful information that can then be reused within the application itself. Furthermore, the UserActivity API facilitates deep linking, allowing users to pick up tasks exactly where they left off, integrating apps, documents, and web pages.
The company assures that everything is processed and stored on the device, encrypted, and that data is not uploaded to the cloud by default. With the changes announced following criticism, Recall is now optional and is only activated if the user explicitly enables it via Windows Hello . Automatic filters have also been introduced to try to protect sensitive data such as passwords or card numbers, and access controls have been strengthened.
Meanwhile, voices within the cybersecurity community have warned of risks: snapshots could contain extremely private information (banking, messages, work data), and malware with privileges or an attacker with access to the computer could attempt to extract that data from the local database . This tension between productivity and privacy explains the public reaction and why Microsoft has adjusted the design and deployment.
Windows Recall: Requirements and limitations
To use Recall, you need a Copilot+ device with a powerful NPU. Microsoft has indicated that the device requires AI capabilities comparable to the new generation (in practice, the 40 TOPS of the Snapdragon X Elite/Plus NPUs are the benchmark at launch), which excludes most previous PCs. Current Intel and AMD processors with lower-performing NPUs were not designed for this sustained workload.
Regarding software, an updated version of Windows is required. According to the most recent documentation, the April 2025 Preview Non-Security Update or later is needed . Users with Copilot+ PCs can choose to enable the option to get new features early in Windows Update and then check for updates to receive the required build. In some scenarios, parts of the feature are delivered via separate packages.
There are known limitations: Microsoft notes that, for now, Arm64EC in emulation mode is not supported. Furthermore, the company announced that Recall would first go through the Windows Insider channel before being widely deployed to devices with Copilot+, delaying the general release to incorporate security improvements and default controls.
It's important to distinguish between the requirements for standard Copilot and those for Copilot+ with Recall. Some guides mention minimum requirements such as an 8th-generation Intel Core i5 or Ryzen 5 3000 CPU, 16 GB of RAM, a 512 GB SSD, TPM 2.0, and a DirectX 12 compatible GPU; these references refer to the general Copilot experience , but Recall is more demanding and targets newer PCs with advanced NPUs. Always check the fine print of the build and hardware specifications.
Activate Windows Recall
If you choose to enable this feature in Settings > Privacy & security > Recall & snapshots, Windows will automatically save screenshots of what you see on your screen as it changes. You can search using natural terms (for example, a chart or an email you vaguely remember) and explore the timeline to jump to previous sessions of apps, documents, or websites.
When you find what you're looking for, you'll see a thumbnail with a relaunch button to return to that content within the corresponding app. In compatible apps, screen segmentation and image recognition help detect key elements like text, shapes, or icons, and the relaunch action makes it easier to reopen the context.
Windows applications can integrate with Recall in two ways: by enabling semantic searches of viewed content or by providing deep links to the UserActivity API to resume tasks. This integration speeds up workflows where you need to pick up a document or conversation without remembering the exact point.
Microsoft documents that there are keyboard shortcuts for navigating the experience, opening search, or managing snapshots. Consult Windows Help for the updated list of shortcuts , as it may vary depending on the build and Insider channel.
Finally, remember that there are exceptions by design: private browsing sessions are not captured in Microsoft Edge , and exclusions can be set per application or website to prevent sensitive areas from being recorded.
How to adjust Windows Recall to suit our needs
From the same Settings page (Privacy and security > Recall and snapshots) you can adjust its behavior. These are practical options to minimize exposure while still maintaining some functionality:
- Pause or resume Taking snapshots temporarily when working with confidential information.
- Exclude specific apps or sites so that nothing is saved every time they are in the foreground.
- Limit storage and review the snapshots to delete what you no longer need.
In scenarios where an application needs to prevent anyone (not even the system itself) from taking screenshots, developers can use SetWindowDisplayAffinity with the value WDA_MONITOR. With this affinity, the content is only displayed on the monitor and appears empty if someone tries to capture it.This includes Recall. Browsers with InPrivate mode should follow their specific guide to block capture.
If you want to go further in reducing your footprint: disable the startup loading of processes related to Recall in Task Manager (Startup tab), restart your computer after the changes , and get into the habit of checking after each major Windows update that the state is still as you left it.
In corporate environments, there is a policy to control whether Windows saves snapshots and analyzes user activity: DisableAIDataAnalysis . This policy can be enforced through Windows client management tools, allowing IT to align Recall with the organization's compliance requirements.
Adjustments via CMD and PowerShell
There are also useful command-line methods for scripting or large-scale deployments. With DISM, you can enable or disable the feature when it's available as an optional component. run DISM /Online /Enable-Feature /FeatureName:"Recall" to install it, or DISM /Online /Disable-Feature /FeatureName:"Recall" to deactivate it.
If you prefer PowerShell, the equivalent commands are: Enable-WindowsOptionalFeature -Online -FeatureName "Recall" y Disable-WindowsOptionalFeature -Online -FeatureName "Recall". Please note that Microsoft has been adjusting availability and behavior.Therefore, in some builds, complete removal may not be allowed, and only deactivation will be permitted.
To check if your PC has it, open the Start menu and type Recall. If it appears in the results, it's installed ; if it doesn't, your computer is probably not part of the rollout or doesn't meet the requirements for Copilot+ or the Insider channel.
Disk Space
A common concern is disk usage. Microsoft has indicated that around three months of snapshots could take up approximately 25 GB, a significant amount that should be monitored if you're using smaller drives. You can learn how to limit disk space usage . In Settings, you can adjust the limits and delete blocks of content to free up space.
Technically, the captures and metadata are stored on the device, encrypted and protected by the TPM keys and associated with your Windows Hello identity. This means that the security layer relies on hardware and user authentication , and that Recall data is not shared with other accounts on the device or with Microsoft without explicit action.
On devices with a secure core and Microsoft Pluton security processor, default protection is more robust. Windows also offers Windows Hello's Enhanced Sign-in Security (ESS) feature to strengthen login. The better the device's security foundation, the smaller the attack surface for Recall data.
For administrators, there are specific sections in Windows client management: storage allocation ( for example, redirecting folders in Windows ), user-controlled settings, known limitations, and supported browsers. Plan policies and quotas aligned with your organization's risk profile , especially if you manage laptops outside the corporate network.
Privacy and protection
Although Recall's current design has been strengthened following criticism, concerns remain. Privacy groups and security professionals emphasize that turning the screen into a continuous log increases the chances of data breaches , both through unauthorized access to the device and through malware that searches local databases.
In sectors subject to strict regulations (healthcare, legal, finance), this type of visual record-keeping can clash with internal data protection policies. The exposure is not only technical, but also legal and reputational . That's why many recommend disabling or severely limiting the function, at least until each organization assesses the risks and implements compensatory controls.
Another issue is trust: even though the storage is local, Windows is proprietary software and not publicly auditable at the source code level. Critics argue that this normalizes unnecessary surveillance for tasks that could be handled with other, less intrusive features.
Meanwhile, proof-of-concept attacks have been reported demonstrating how valuable a Recall database would be to an attacker. The best defense remains prevention: disable, exclude, encrypt, and minimize what you don't need to keep.
If you like the idea of ​​quickly finding what you did yesterday, for example using Recent Files in Windows 11 , but don't want a perpetual desktop camera, there are options. One is to use local solutions that index documents, emails, and notes without capturing the screen, leveraging semantic search on your own data and masking sensitive information where appropriate.
In the professional sphere, specialized teams can develop custom applications with local AI and granular visibility controls, respecting data minimization and corporate policies . This approach balances usability and compliance without sacrificing privacy.
For IT, having software inventory and telemetry helps monitor sensitive functions. Asset management platforms allow you to see Windows versions, feature status, and patch compliance, making it easier to decide where to disable or block recall and verify that policies are being applied correctly.
For administrators and developers: fine-tuned Recall control
Administrators have several levers at their disposal. In addition to the DisableAIDataAnalysis policy , they can review storage allocation, predefined app and site exclusions, and activation status per user. Keep in mind that the feature is now opt-in and requires Windows Hello to be enabled, which reduces accidental activation in large fleets.
In browsers, private browsing modes are respected and filters can be added. In internal apps, consider integrating UserActivity to resume tasks without relying on screenshots, and apply SetWindowDisplayAffinity (WDA_MONITOR) to screens displaying highly sensitive data . This prevents screenshots by both standard software and the Recall function itself.
Document a clear procedure: disable by default, allow only under exceptions with risk assessment , and periodically audit which policies and exclusions remain in effect after Windows updates. Supplement this with user training: what is logged, how to delete it, and when to pause it.
The community also reminds users that this is not a general technical support forum and directs them to the appropriate channels for resolving PC issues. For questions about Recall configuration, please use the official documentation and the corporate channels established by your organization.
The balance between instantly retrieving context and protecting your digital life requires conscious choices. With the current options—manipulating it with authentication, exclusions, filters, encryption, and the ability to uninstall it in certain builds— you can tailor Windows Recall to your risk tolerance or forgo it altogether without sacrificing productivity by adopting alternatives focused on local indexing, security best practices, and, where appropriate, custom development that prioritizes privacy by design.
