Windows Recall Privacy Settings Explained

Windows Recall saves periodic snapshots of your screen on Copilot+ PCs so you can search what you have seen. Microsoft says it is opt-in, processed locally and protected by Windows Hello.

This guide explains where the settings are, how to turn Recall off or delete snapshots, what the filters miss, and what security researchers say. It follows Microsoft's documentation, checked on October 11, 2026.

The short answer

Open Settings, then Privacy & security, then Recall & snapshots. Turn off Save snapshots to stop saving, and delete what is already stored from the same page.

Recall exists only on Copilot+ PCs. If your PC is not one, there is nothing to turn off.

What Windows Recall saves

Recall takes snapshots of your screen periodically, analyzes them on your PC, and lets you search them in natural language. Per Microsoft, Recall records no audio and keeps no continuous video.

Microsoft says Recall skips game video while Game Mode is active, on platforms that support Game Mode.

Microsoft says the search covers things you viewed in apps, websites, images and documents. Anything visible on screen can end up in a snapshot unless a filter applies, which is why the filters below matter.

Which PCs support Recall

Requirement	What Microsoft's documentation says
PC type	A Copilot+ PC meeting Microsoft's Secured-core standard
Hardware	An NPU rated at 40 TOPS, 16 GB of RAM, eight logical processors and 256 GB of storage
Free space	At least 50 GB free to enable Recall, and saving pauses below 25 GB free
Encryption	Device Encryption or BitLocker
Sign-in	Windows Hello Enhanced Sign-in Security, with a face or fingerprint option enabled

Recall is not available on Windows 10. Microsoft's Recall page applies to Windows 11. Microsoft says Recall is optimized for English, Simplified Chinese, French, German, Japanese and Spanish.

A Copilot+ PC is a hardware category. Settings for the Copilot app are separate, and our guide to Microsoft Copilot privacy settings covers them.

How to tell whether your PC has Recall

1. Open Settings, then select Privacy & security.
2. Look for Recall & snapshots in the list.

If you do not see it, your PC likely does not have Recall. Microsoft's pages do not describe this check, so confirm with your PC maker if you are unsure whether it is a Copilot+ PC.

Is Recall on by default?

No. Microsoft says each user must opt in to saving snapshots. If you do not opt in, Recall is off and snapshots are not saved.

Managed devices differ. On commercially managed devices Recall is disabled and removed by default, Microsoft says, and IT cannot switch snapshot saving on for users.

To start using Recall on a PC that offers it, Microsoft says to launch Recall and go through the setup, or turn on Save snapshots under Recall & snapshots.

How to turn off Recall or stop saving snapshots

1. Open Settings, then select Privacy & security.
2. Select Recall & snapshots.
3. Turn off Save snapshots.Off
4. Confirm with Windows Hello if you are asked.

For a temporary stop, use the Recall icon in the system tray and pick pause. With Save snapshots off, that icon does not appear.

Removing Recall completely is possible through Turn Windows features on or off, Microsoft says.

How to delete Recall snapshots and set storage limits

You can delete snapshots at any time from Recall & snapshots. Snapshots get a storage ceiling that Windows chooses and you can adjust. When it is reached, Microsoft says the oldest snapshots are deleted automatically.

You also decide how long snapshots stay on the device.

How to filter apps, websites and sensitive information

Filters for apps and websites are added in Settings, under Privacy & security, then Recall & snapshots. Filter lists are not shared by default, Microsoft says.

Microsoft says Sensitive information filtering helps reduce what is stored. Read that as risk reduction, not a promise that nothing sensitive gets saved.

Where snapshots are stored, and Microsoft's design claims

These points are Microsoft's own statements about how Recall is designed. They describe intent and architecture, not independent verification.

Microsoft states that snapshots and related data stay on your PC, are always encrypted, and are shared with no one: not Microsoft, not third parties, not other users of the PC.

It describes just-in-time decryption that Windows Hello Enhanced Sign-in Security protects. Keys sit behind the TPM and are used only inside a secure area called a VBS Enclave.

Microsoft states that it cannot access or view your snapshots. It also says you must confirm your identity with Windows Hello before Recall opens and before you change its settings.

Recall does fetch website icons and metadata from the internet for its timeline, Microsoft says. Depending on your settings, some diagnostic data may be sent, and our guide to Windows optional diagnostic data covers that.

What independent security research found

In April 2026, researcher Alexander Hagenah released TotalRecall Reloaded, a proof-of-concept tool. By his account, the tool pulls Recall data once the user has authenticated through Windows Hello.

He has said the encryption, the VBS Enclave and the Windows Hello check held up. His finding is that decrypted content reaches a less protected process, where code running as the same user could read it.

As reported by the technology press, Microsoft said the behavior matches Recall's documented design after authentication and did not treat it as a vulnerability.

We did not test this. It is one researcher's proof of concept and Microsoft's reported response, not a confirmed attack on typical users.

Microsoft's own management guide notes that Recall uses general Windows screenshot APIs. In that guide, Microsoft treats screenshots of content you need to keep from leaving as a general security risk.

Whether to turn Recall on

Our view, not Microsoft's: consider leaving Recall off if you handle confidential client or medical data, share your PC, or cannot rely on filters to catch everything you want kept out.

If you use it, add filters for banking, password and messaging apps, keep Sensitive information filtering on, and lower the maximum storage and retention period.

Work and school devices

On managed devices, administrators decide whether Recall is offered at all. Two Windows AI policies cover this, Allow Recall to be enabled and Turn off saving snapshots for Recall.

If the Allow Recall policy blocks it, users cannot turn it on themselves. Even when it is allowed, Microsoft says Recall needs user consent to save snapshots.

Microsoft says the storage policies work only on Enterprise and Education editions. Content in Recall can also be restricted with Microsoft Purview endpoint data loss prevention.

Frequently asked questions

Does Recall capture passwords or financial information?

The filter starts on and helps cut down how often passwords, national ID numbers and card numbers are stored. Microsoft describes it as a reduction, not a removal of every case.

Can Microsoft or my employer see my snapshots?

Microsoft says it cannot access or view them. Employers control whether Recall is available but cannot start saving snapshots. Whether administrators can view snapshots is not stated on the pages we read.

Does Recall work on Windows 10 or a non-Copilot+ PC?

No. Microsoft says Recall is exclusive to Copilot+ PCs, and its Recall page applies to Windows 11.

How do I know whether Recall is saving snapshots?

The system tray Recall icon changes state when snapshots are being saved, paused or filtered. It does not show at all if Save snapshots is off.

A quick checklist

• Check whether your PC is a Copilot+ PC at all.
• Open Settings, then Privacy & security, then Recall & snapshots.
• Turn off Save snapshots if you do not want Recall.
• Add app and website filters, and keep Sensitive information filtering on.
• Limit the storage size and retention period.
• Delete snapshots you do not need.

Up nextWindows 11 activity history: what it stores and how to clear itRecall is one of several records Windows can keep. Our guide to Windows 11 activity history explains another, and what clearing it does and does not remove.→