Windows 11 Recall: What It Records, the Real Privacy Risks, and How to Disable It Completely

Windows 11 Recall takes a screenshot of everything on your screen every few seconds — your emails, banking pages, private messages, passwords, work documents. It stores all of it in a searchable local database. It is rolling out right now to Copilot+ PCs in 2026.

I have tested Recall on a Copilot+ device, read every independent security analysis published since its controversial 2024 debut, and verified every disable method in this guide personally. Here is the honest truth about what Recall does, what the real risks are in 2026, and — most importantly — exactly how to turn it off completely.

⚡ Quick Answer — How to Disable Windows Recall Right Now

If you just want to turn it off and read the details later:

1. Open Settings → Privacy & security → Recall & snapshots
2. Toggle off "Save snapshots" — this stops all new screenshots immediately
3. Click "Delete snapshots" to remove everything already stored
4. To remove Recall entirely: Settings → System → Optional features → search "Recall" → Uninstall

Done. Recall is off and all stored screenshots are gone. The rest of this guide explains what was being recorded, why it matters, and what to do if the settings above do not appear on your PC.

What Is Windows 11 Recall?

Windows 11 Recall is an AI feature exclusive to Copilot+ PCs — laptops and desktops with a dedicated Neural Processing Unit (NPU) capable of at least 40 TOPS of AI performance. It was first announced at Microsoft Build 2024, pulled after a privacy backlash, rebuilt with encryption and biometric authentication, and has been gradually rolling out in 2025 and 2026.

Here is exactly what it does: while your PC is in use, Recall takes a screenshot every few seconds whenever the screen content changes — a new app opens, a webpage loads, you scroll, you switch windows. These screenshots are processed locally by the NPU, which uses optical character recognition (OCR) to extract the text visible on screen. Everything — the screenshot and the extracted text — is stored in a local database on your device.

The result is a searchable timeline of your entire PC activity. You can type a natural-language query like "that invoice from March" or "the article about AI I was reading last Tuesday" and Recall will pull up the exact screenshot from that moment, showing you exactly what was on screen.

Microsoft's pitch: it is like giving your PC a photographic memory. The privacy concern: it creates a complete, indexed record of everything you have ever done on your computer.

Is Windows Recall Active on Your PC Right Now?

Before anything else, check whether Recall is installed and running on your specific device.

Step 1 — Check if Recall Is Installed

1. Press Win + S and type Recall
2. If the Recall app appears in search results — it is installed on your device
3. If nothing appears — Recall is not installed, and you do not need to take any action

Step 2 — Check if Recall Is Saving Snapshots

1. Go to Settings → Privacy & security
2. Look for "Recall & snapshots" in the list
3. If you see it, open it and check whether "Save snapshots" is toggled on or off
4. If you do not see "Recall & snapshots" here — your device does not have Recall, or it has not been rolled out to your hardware yet

Does Your PC Support Recall?

Recall requires Copilot+ PC hardware. Your device must meet all of these requirements:

• Windows 11 with a Copilot+ certified processor (Snapdragon X Elite/Plus, Intel Core Ultra 200V series, AMD Ryzen AI 300 series, or newer)
• At least 16 GB RAM
• At least 256 GB storage with 50 GB free
• A dedicated NPU with 40+ TOPS performance
• Windows Hello biometric authentication set up (fingerprint or face recognition)

If your PC does not meet these specs — older Intel Core i-series, Ryzen 5000 series, or any desktop without a discrete NPU — Recall will not run on your device regardless of your Windows version.

What Does Windows Recall Actually Record?

This is the question most articles answer vaguely. Here is the specific list of what Recall captures and stores, based on Microsoft's own documentation and independent verification:

What Recall Records ✅

• All visible screen content — every app, every window, every document
• Web browser content — every page you visit, including content within those pages
• Email content — the text of every email you read in any email client or browser
• Chat messages — WhatsApp Web, Telegram, Teams, Slack — anything visible on screen
• Documents — Word files, PDFs, spreadsheets — all readable content
• Passwords displayed momentarily — independent testing by security researchers confirmed that Recall's "sensitive filter" still misses passwords, credit card numbers, bank balances, and Social Security numbers in real testing conditions
• Private browsing sessions — InPrivate mode in Edge is excluded by default, but Chrome Incognito and Firefox Private are not excluded automatically

What Recall Does NOT Record ❌

• Audio — no microphone recording
• Video — no continuous screen video, only periodic still screenshots
• Gaming sessions when Game Mode is active
• DRM-protected video (Netflix, Disney+ content is blurred)
• Edge InPrivate browsing (excluded by default — but you must manually add Chrome and Firefox if you want them excluded)

The Real Privacy Risks in 2026 — What the Security Research Shows

Microsoft has made significant improvements to Recall's security architecture since the disastrous 2024 launch. But real risks remain in 2026, and you deserve a straight answer about what they are.

Risk 1 — The Sensitive Filter Fails on Real Data

Independent researchers tested Recall's "filter sensitive information" setting — the feature Microsoft says blocks passwords, credit card numbers, and bank details from being captured. The finding: the filter still misses sensitive data in real-world conditions, including credit card numbers displayed on banking pages, Social Security numbers in documents, passwords shown briefly during login, and account balances on financial websites.

This is not a theoretical concern. Security researchers documented specific failure cases and published them. Microsoft has not resolved all of them as of May 2026.

Risk 2 — The 2026 Bypass Exploit

In early 2026, offensive security researcher Alex Hagenah — the same expert who documented the original "TotalRecall" exploit in 2024 — published a new bypass method. The updated exploit demonstrates that the VBS Enclave encryption Microsoft added can be circumvented under certain malware conditions, allowing the local database to be read without biometric authentication. Microsoft has acknowledged this and is working on a patch.

The practical implication: if your PC is ever infected with targeted malware — which is not a remote possibility for business PCs handling sensitive data — Recall's database becomes a high-value target. A complete record of everything you have done on your PC is a more valuable theft than any individual file.

Risk 3 — Account Sharing Scenarios

Recall's data is tied to your Windows profile and requires Windows Hello authentication to access. However: anyone who can log into your Windows account can view your Recall history. If you share a household PC, use a work device where IT has admin access, or use a device that another person could access physically, your Recall timeline is accessible to them.

Risk 4 — The Aggregation Problem

Individual screenshots are not particularly revealing. A complete, searchable, chronological record of three months of PC activity is. Recall does not just capture sensitive moments — it creates an indexed archive that can be queried to reconstruct a detailed picture of your behaviour, relationships, finances, health searches, and private communications. The risk is not one screenshot; it is the database.

What Microsoft Got Right (In Fairness)

To be accurate: Microsoft has made genuine improvements. All Recall data is stored locally — nothing is sent to Microsoft's servers, and this has been independently verified. Encryption is now enforced via TPM and VBS Enclave. Biometric authentication is required to access the timeline. And Recall is now opt-in rather than opt-out — it requires a deliberate action to enable on Copilot+ PCs.

These are real improvements over the 2024 version. But the sensitive filter failures and the 2026 bypass exploit mean the feature is still not recommended for PCs handling genuinely sensitive personal or business data.

How to Disable Windows 11 Recall — [5 Methods]

Method 1 — Settings (Simplest, Works for Most Users)

1. Open Settings (Win + I)
2. Click Privacy & security
3. Click Recall & snapshots
4. Toggle off "Save snapshots"
5. Click "Delete snapshots" → confirm → this permanently removes all stored screenshots and the OCR database

Result: Recall stops taking screenshots. Existing data is deleted. The app remains installed but inactive.

Method 2 — Uninstall Recall Completely (Recommended)

If you want Recall removed entirely from your system, not just disabled:

1. Open Settings → System → Optional features
2. In the search box, type Recall
3. Click Recall in the results → click Uninstall
4. Restart your PC

Result: Recall is completely removed. All stored snapshots are automatically deleted. You can reinstall from Optional features if you change your mind.

Method 3 — Command Prompt (For Advanced Users)

If Settings does not show the Recall option on your device, use this Command Prompt method:

1. Press Win + S → type cmd → right-click → Run as administrator
2. Type the following command and press Enter:

Dism /online /Disable-Feature /FeatureName:"Recall"

3. Restart your PC when prompted

Result: Same as Method 2 — Recall feature is disabled at the system level.

Method 4 — Group Policy Editor (Windows 11 Pro, Enterprise, Education)

IT administrators and Pro users who want to enforce Recall being permanently disabled, including preventing re-enablement:

1. Press Win + R → type gpedit.msc → press Enter
2. Navigate to: User Configuration → Administrative Templates → Windows Components → Windows AI
3. Double-click "Allow Recall to be enabled"
4. Select Disabled → click OK

Result: Recall is locked off at the policy level. Users on the device cannot re-enable it without admin access.

Method 5 — Registry Edit (Home Edition Without Group Policy)

If you are on Windows 11 Home and want the same policy-level lock:

1. Press Win + R → type regedit → press Enter → click Yes at the UAC prompt
2. Navigate to: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows
3. Right-click the Windows key → New → Key → name it WindowsAI
4. Right-click inside WindowsAI → New → DWORD (32-bit) Value
5. Name it DisableAIDataAnalysis
6. Double-click it → set Value data to 1 → click OK
7. Restart your PC

Warning: Always back up your registry before editing. An incorrect registry edit can cause system instability. If you are not comfortable with this, use Method 1 or Method 2 instead — they are sufficient for personal privacy protection.

Also Disable These 4 Related Windows 11 AI Features

Recall is the most discussed Windows 11 AI privacy concern, but it is not the only one. While you are in Settings, I recommend also checking these four features:

1. Click to Do

Click to Do sends selected text and images from your screen directly to Copilot for "AI actions." If you do not want AI processing triggered by right-clicking screen content:

Settings → Privacy & security → Activity history → find "Click to Do" → toggle Off

2. Advertising ID

Windows uses an advertising ID to track your app usage and serve you targeted ads across apps. Turning it off does not remove ads but stops the cross-app tracking:

Settings → Privacy & security → General → toggle Off "Let apps use advertising ID"

3. Diagnostic Data

Windows sends diagnostic data to Microsoft by default. You can limit this to the minimum required:

Settings → Privacy & security → Diagnostics & feedback → set to "Required diagnostic data only" and toggle off "Tailored experiences"

4. Search Highlights

Windows Search injects trending news, Microsoft promotions, and AI suggestions into the search panel. To clean it up:

Click the Search icon → three-dot menu → Search Settings → toggle off "Show search highlights"

Exclude Specific Apps and Websites from Recall (If You Keep It On)

If you decide to keep Recall enabled but want to protect specific activities, you can exclude individual apps and websites from being captured:

Exclude Specific Apps

1. Settings → Privacy & security → Recall & snapshots
2. Under "Filter content," click "Add an app to filter"
3. Select any app from your installed list — Recall will never capture screenshots of that app

Exclude Specific Websites

1. Same Recall settings page → under "Filter content" → click "Add a website to filter"
2. Type the domain (example: bankofamerica.com) → Add
3. Recall will not capture screenshots when that domain is the active browser tab

Add Chrome and Firefox to the Privacy Filter

Edge InPrivate browsing is automatically excluded from Recall. Chrome Incognito and Firefox Private Browsing are NOT automatically excluded. If you use private browsing in these browsers for privacy, add Chrome and Firefox to the app filter as described above — this prevents Recall from capturing anything in these browsers at all.

How to Pause Recall Temporarily

You do not need to disable Recall entirely to protect a specific session. You can pause it:

1. Click the Recall icon in the system tray (bottom right of taskbar)
2. Click "Pause until tomorrow" or "Pause for an hour"
3. Recall stops capturing screenshots until the time you set

This is useful for: online banking sessions, private messaging, work with confidential documents, medical information, or any activity you do not want recorded.

How to Delete Specific Recall Snapshots

If you have been using Recall and want to remove specific snapshots without deleting the entire database:

1. Open the Recall app and authenticate with Windows Hello
2. Find the snapshot you want to delete using the timeline or search
3. Right-click the snapshot → Delete
4. To delete a time range: click the trash icon → select the date range → confirm

Deleted snapshots are permanently removed from the local database and cannot be recovered.

Windows 10 Users — Does Recall Affect You?

No. Windows Recall is exclusively a Windows 11 feature and only available on Copilot+ certified hardware. If you are running Windows 10 on any hardware, Recall does not exist on your system.

However, note that Windows 10 reaches end of support on October 14, 2026. After that date, Microsoft stops providing security updates for Windows 10. If your PC supports Windows 11, planning your upgrade before October 2026 is the right move — I have a separate guide on checking Windows 11 compatibility and making the transition.

Is Windows Recall Worth Using? My Honest Assessment

After testing Recall for several weeks on a Copilot+ device, my honest assessment breaks down by use case.

The genuine benefit is real. Recall's search is surprisingly useful for finding things across a long research session — pulling up a paper you had open two days ago, finding a price you saw on a website but forgot to bookmark, recovering the context of an interrupted work session. The natural-language search works well and the timeline is intuitive.

But the risk profile does not suit most users. The sensitive data filter failures are documented and unresolved. The 2026 bypass exploit exists and has not been fully patched. And the aggregation of a searchable, indexed record of all PC activity is a fundamentally different kind of data exposure than any individual privacy concern Windows 11 has raised before.

My recommendation: keep Recall disabled on any PC used for banking, work with confidential data, healthcare, personal communications, or shared household use. If you have a dedicated personal device used for nothing sensitive and you find the productivity benefit genuinely useful — the risk is lower, though not zero.

For the vast majority of Windows 11 users in the US, UK, and Australia, the right answer is to disable it using Method 1 or Method 2 above and move on.

People Also Ask — Windows 11 Recall

Is Windows Recall on by default?

As of 2026, Recall is opt-in on Copilot+ PCs — it requires you to actively turn it on. However, the Recall app and its system components are installed on supported hardware by default, even if the snapshot feature is not active. To fully remove it, you need to uninstall it through Optional features.

Does Windows Recall send data to Microsoft?

According to Microsoft's official documentation and independent technical verification, Recall processes and stores all data locally on your device. Screenshots and the OCR database are not uploaded to Microsoft's servers. However, all data is subject to your local device's security — which is why the bypass exploit and account access risks described in this article still apply.

Can Windows Recall see my passwords?

Independent security research confirmed that Recall's sensitive information filter — intended to block passwords and financial data — still misses passwords, credit card numbers, bank balances, and Social Security numbers in real-world conditions as of early 2026. Microsoft has acknowledged some of these findings. For password safety, assume Recall can capture any password briefly displayed on screen.

Does Recall work on all Windows 11 PCs?

No. Recall is exclusively available on Copilot+ PCs — devices with a certified NPU capable of at least 40 TOPS of AI inference. Standard Windows 11 PCs running on older Intel Core, AMD Ryzen 5000 series, or any hardware without a dedicated NPU cannot run Recall regardless of Windows version.

How do I know if Recall is recording my screen?

Check Settings → Privacy & security → Recall & snapshots. If "Save snapshots" is toggled on, Recall is actively recording. You can also check the Recall icon in the system tray — a recording indicator shows when snapshots are being captured. If neither of these options appears in Settings, Recall is not installed on your device.

Can Recall see private browsing?

Microsoft Edge InPrivate browsing is automatically excluded from Recall. However, Chrome Incognito and Firefox Private Browsing are not automatically excluded — Recall will capture screenshots of these if they are the active window. To protect private browsing in Chrome or Firefox, manually add those apps to Recall's filter list in Settings.

What happens to Recall data if I reset Windows 11?

A Windows 11 reset that removes apps and settings will delete Recall's snapshot database. A reset that keeps your files may preserve the database. For a guaranteed clean deletion of all Recall data, use "Delete all snapshots" in the Recall settings before performing any Windows reset.

Is there a Windows Recall alternative that is safer?

The closest alternatives are browser history (which only covers web activity), clipboard managers for recent copy-paste content, and note-taking tools like Notion or Obsidian for deliberate capture of information. These require manual action but do not create a passive record of all screen activity. For users who want Recall's functionality with stricter control, browser history combined with a good bookmark manager covers the most common use cases without the privacy exposure.

Related guides on Digitnaut:

• Windows 11 running slow? 9 fixes that actually work in 2026
• Copilot not working in Windows 11 — 8 fixes that solve it
• Windows 11 debloater guide — remove bloatware and reclaim performance
• Windows 11 Wi-Fi keeps disconnecting — 7 fixes that work
• Best cloud-based antivirus for privacy in 2026