Yesterday I wrote about the potential winners and losers in Microsoft’s big push to sell powerful and energy-efficient AI PCs. But, while there was a lot to chew on with the hardware aspects, I failed to mention a major angle to the AI-ification of Windows: privacy.
One of Microsoft’s most eye-catching announcements was that of a feature called Recall, which gives the operating system’s Copilot AI assistant “photographic memory” of what the user does on their PC. This involves taking snapshots of the active screen every few seconds, which are then encrypted and kept on the machine. The aim is to help people remember, for example, which website they found stuff on or which folder they stored stuff in. Microsoft will gradually refine the tool, ultimately allowing users to quickly open the document, website, or email shown in the snapshot.
This could clearly be useful to many people, but some privacy experts have concerns about what Microsoft is doing here—and so do data protection authorities.
The BBC reported today that the U.K. Information Commissioner’s Office has asked Microsoft for information to help it “understand the safeguards in place to protect user privacy.” And the Irish Data Protection Commission, which is Microsoft’s main privacy enforcer in the EU, told me it’s also on the case.
“We too have reached out to Microsoft this morning and are looking for further information,” said the Irish watchdog’s communications chief, Graham Doyle. (There’s no word yet on any regulatory pushback in the U.S.)
Now, there’s clearly a good deal of privacy built into Windows Recall, as Microsoft explained in a statement: “Recall data is only stored locally and not accessed by Microsoft or anyone who does not have device access. The security to protect a user’s Recall data is the same as for anything on the endpoint. With available built-in security and identity features, an attacker would need to get physical access to the device, be able to unlock it and sign-in, and Microsoft already builds in defenses, such as Windows Hello, right into devices.”
Also, per Microsoft’s FAQ on the subject, Recall is designed to avoid taking snapshots of private browsing sessions in the company’s Edge browser, and users will be able to click on a special icon to “make choices about what snapshots Recall collects and stores.”
However, the same page warns that “Recall will not hide information such as passwords or financial account numbers” from those viewing the snapshots. And that’s far from being the only potential pitfall for Microsoft here.
The most immediate issue is whether Recall’s implementation complies with the General Data Protection Regulation (GDPR)—an EU law, but one that’s also still replicated in the legal system of post-Brexit Britain. As Keystone Law partner Daniel Tozer told the BBC, the GDPR means “Microsoft will need a lawful basis to record and re-display the user’s personal information.” And with these snapshots often containing sensitive personal information, that basis may need to involve the user’s active consent.
The big question here is whether Microsoft will be getting that consent in a GDPR-compliant (and ethically sound) way. European regulators have generally maintained that you can’t claim to have received consent in a situation where the user is automatically opted into the processing of their data. And that is what’s happening here.
Although Microsoft insists that people setting up one of the incoming Copilot+ AI PCs will be “informed about Recall and given the option to manage [their] Recall and snapshots preferences”—a spokesperson told me this means “you have the option from the start to opt in or opt out”—the fact remains that not clicking through the Recall settings will automatically authorize the default saving of snapshots.
Then there’s the question of who has access to your computer. Again, keeping everything local comes with clear benefits, but people often share their computers and logins with others, particularly family members. As cybersecurity expert Eva Galperin noted in an X post: “I’ve got some news for Microsoft about how domestic abuse works.”
It’s too early to say that Recall has irredeemable privacy flaws, but Microsoft definitely has to demonstrate that it has answers to all the questions that are rightly being raised, otherwise it may find itself in trouble with both regulators and Windows users.
More news below.
David Meyer
Want to send thoughts or suggestions to Data Sheet? Drop a line here.
NEWSWORTHY
Google threatens media. Google is reportedly threatening to withdraw investment in California nonprofit newsrooms, and even to pause the expansion of its global media-funding program, over a bill passed yesterday by California’s Senate. The bill would tax digital advertising, with the revenue funding tax credits for local news outlets, Axios reports. Google is already mad about another Californian bill that would tax Google and Meta when they link to local news sites, with the proceeds again going to newsrooms.
TikTok layoffs. TikTok is planning to lay off “a large percentage” of people in global user operations, content and marketing, The Information reports. The publication says the whole global user operations team will be disbanded, with those who still have a job being shunted over to trust and safety, marketing, content, and product teams.
Apple supply chain. The government of the Democratic Republic of Congo says it has whistleblower evidence showing Apple is using minerals mined in conflict zones in the country’s east, Reuters reports. Apple has so far not commented on these allegations, but has previously claimed that third-party auditors revealed “no reasonable basis for concluding” there were any links between refiners and smelters in its supply chain and “armed groups in the DRC or an adjoining country.”
ON OUR FEED
“I can't adequately describe how much I loved Gordon and respected what he did for the industry.”
—Former Microsoft CTO Ray Ozzie, mourning the death of computer pioneer Gordon Bell, which was announced yesterday. Bell led engineering at the fabled Digital Equipment Corporation in the early days of the microcomputer, played a pivotal role in Microsoft’s research group in the 1990s, and became a prominent tech historian. He died last week of aspiration pneumonia, at the age of 89.
IN CASE YOU MISSED IT
Tech companies have agreed to an AI ‘kill switch’ to prevent Terminator-style risks, by Dylan Sloan
Microsoft must again contend with OpenAI drama. Will Satya Nadella’s patience wear thin?, by Jeremy Kahn
The race to lead China’s AI sector heats up as ByteDance, Alibaba and Baidu offer their models at rock-bottom prices, by Lionel Lim
Mastercard says it expects new AI software to find compromised credit and debit cards quicker—before they get used by criminals, by the Associated Press
Investors clash over Elon Musk’s $46 billion pay package: ‘The board has yet to ensure that Tesla has a full-time CEO’, by Amanda Gerut
BEFORE YOU GO
Humane exit. Humane, maker of the much-roasted AI Pin, is reportedly looking to sell itself following the critical drubbing that met its device’s launch. According to Bloomberg, the company hopes to get $750 million to $1 billion. Humane was last valued at $850 million, before the Pin—a lapel-worn AI assistant—came out. A rival device called the Rabbit has been similarly savaged over its lack of reliability and unclear purpose, though at $199 it costs a lot less than Humane’s $699 (plus $24 per month to use it) gadget.
