Microsoft has once again moved to address persistent privacy concerns surrounding its Windows Recall feature by introducing a new “Recall Safe Mode” in the November 2025 security update. This optional restricted mode, available on Copilot+ PCs running Windows 11 versions 24H2 and 25H2, significantly tightens the feature’s operations in direct response to ongoing criticism from users, security researchers, and privacy advocates who argue that even the revamped Recall—fully launched earlier this year—still poses unacceptable risks.
Recall Safe Mode activates through Settings > Privacy & security > Recall & snapshots > Advanced settings and applies a series of aggressive safeguards by default. Snapshots are now limited to a seven-day retention period instead of the standard three months, with automatic deletion thereafter. The system employs more robust sensitive-content filtering, drawing on enhanced Microsoft Purview technology to block passwords, credit card details, national IDs, and other personal information more reliably than before. When the device is idle or in battery saver mode, background snapshotting stops completely. Users must use Windows Hello biometric methods—face or fingerprint—to log in each time they access the Recall timeline, which means they can’t use a PIN to view their history. A new audible audit log also lets users review exactly when snapshots were captured and what, if any, filtering occurred.
The introduction of Safe Mode comes at a time when there is a lot of new interest in it. Although Microsoft rolled out a heavily revised Recall to the general public in April after nearly a year of delays, testing, opt-in requirements, on-device encryption, and initial sensitive-information filters, reports persisted of the tool occasionally capturing passwords, encrypted chat contents, or other private data. Privacy organizations highlighted risks in scenarios involving domestic abuse or regulatory compliance, while security experts continued to warn that the mere existence of a local screenshot database creates an attractive target for malware or insiders with physical access.
In an accompanying blog post, Windows vice president Pavan Davuluri acknowledged the feedback, stating that while Recall processes everything locally and never transmits data to Microsoft, the company recognizes that “trust is earned through choices that put user comfort first.” He positioned Safe Mode as the recommended setting for consumer devices, preserving core functionality for those who find the timeline useful while offering peace of mind to cautious users. Full unrestricted mode remains available for power users or enterprises willing to accept broader retention and looser controls.
Reaction to the update has been cautiously positive in some quarters. Security researcher Kevin Beaumont, who has closely tracked Recall since its troubled 2024 preview, described Safe Mode as “meaningful progress on the margins” but maintained that the underlying concept of an always-on visual history still carries inherent danger. Privacy watchdogs praised the shorter retention and mandatory biometrics yet renewed calls for Safe Mode to become the outright default—or for Recall to remain entirely optional and uninstallable without workarounds.
The November 2025 Patch Tuesday update (KB5044284) sends Recall Safe Mode right away to devices that can use it through Windows Update. For many people who own a Copilot+ PC and either turned off or never turned on Recall after it came out in the spring, the new mode may finally give them a middle ground: a less intrusive way to try out AI-powered memory without feeling like they’re always being watched. It’s not clear if this latest concession will completely fix Recall’s reputation or just put off more controversy, but it shows how hard it is for Microsoft to balance ambitious on-device AI innovation with the fact that people are more aware of privacy issues these days.
