Despite assurances, Windows 11's Recall still captures a lot of sensitive data

After spending six months improving Recall after its initially disastrous launch, Microsoft returned its flagship AI feature to Windows Insiders for testing in the latest preview builds. Although the company has addressed much criticism about the feature, some concerns remain, especially when it comes to Microsoft's claims about capturing sensitive data (plus other known issues like ignoring the list of filtered websites).

Tom's Hardware experimented with Recall and its capability to filter out confidential information like credit card numbers, social security numbers, personal information, and other sensitive data. In some cases, Recall successfully detected and filtered out what it should not snapshot. However, many times, it ignored all clues and captured everything without any filters.

For example, Recall captured a credit card number in Windows Notepad and a fully filled loan application in the Edge browser. The same happened with a simple HTML page with fields for credit card information like number, CVC, expiration date, etc. Despite the obvious clues, Recall ignored its filters and captured everything as is.

Still, not everything is that bad. Recall managed to detect sensitive information on e-commerce websites and capture them without any personal information.

Before you grab a pitchfork, it is worth reminding that Recall is currently in public preview, and Microsoft explicitly stated that filters might not work 100%:

We’ll continue to improve this functionality, and if you find sensitive information that should be filtered out, for your context, language, or geography, please let us know through Feedback Hub.

In addition, Windows 11 encrypts all your snapshots, and they are only accessible after you authenticate with Windows Hello. Microsoft also promises that snapshots never leave your device, and turning off Recall purges everything immediately. Despite the reassurances, the reality shows that Copilot+ PC owners should probably think twice before embracing Recall.

Although Recall is now available (in preview) for more devices, including AMD and Intel-powered ones, it is probably a good idea for many to stay away from it and let Microsoft take its time to polish the experience and make it more reliable. With that said, it remains a big question whether Microsoft can regain user trust after all the drama that happened this year.