Recall got the headlines. That’s understandable — an AI tool that takes a screenshot of your screen every few seconds, processes the text and images, and stores all of it in a searchable local database is an easy story to tell. The outrage was fast and the concerns were legitimate.
But Recall is one feature on a class of devices that now ships with a suite of AI capabilities, and the broader picture has attracted considerably less attention. Copilot+ PCs — Microsoft’s certification tier for AI-capable Windows hardware — include several other features that interact with your personal data in ways most buyers haven’t thought through.
What Copilot+ Actually Means
A Copilot+ PC is a device certified to meet Microsoft’s minimum hardware requirements for running AI workloads locally. The defining requirement is an integrated Neural Processing Unit capable of at least 40 TOPS (tera operations per second). In practice, this means devices with Qualcomm Snapdragon X, AMD Ryzen AI, or Intel Core Ultra 2 processors.
The hardware certification doesn’t tell you much about privacy. What matters is which software features are enabled on these devices by default, what data they collect, and where that data goes.
Microsoft’s messaging emphasizes local processing — the NPU handles AI tasks on-device, and the company has been careful to distinguish Copilot+ features from cloud-dependent Copilot services. The distinction is real, but the picture is more nuanced than “everything stays on your device.”
Recall: The Known Problem
Starting with the feature that’s already been scrutinized: Recall takes periodic screenshots of your screen, runs OCR to extract text from those screenshots, and stores everything in a local encrypted database. You can search this database using natural language — “that email from my landlord last month” or “the recipe with saffron.”
Microsoft has made several changes since the initial backlash. Recall is now opt-in rather than on by default. The database is encrypted at rest. Access requires biometric authentication through Windows Hello. Sensitive content filters attempt to exclude credit card numbers, passwords, and some categories of personal information from capture.
Despite these improvements, security researchers have continued to identify problems. The database, while encrypted, must be decrypted whenever the feature is active — which means it’s accessible to any process running as the user during that window. Third-party software, browser extensions, and other applications running under your user account may be able to access Recall data during active sessions.
The privacy baseline for Recall is that your screen content — including documents, messages, web browsing, financial data, and images — is being continuously processed and indexed, even if the index stays local. Whether that trade-off is acceptable depends on your threat model and how much you trust the security of your specific device.
Live Captions with Translation: What It Captures
Live Captions is one of the more useful Copilot+ features for practical purposes. It transcribes audio playing from any source — a video, a call, a podcast — into real-time captions in the corner of your screen. The translation feature extends this to convert audio from over 40 languages into English text.
The privacy question here is about what’s being processed and where. Microsoft states that Live Captions processing occurs on-device using the NPU. Audio is captured by the feature, processed locally, and the resulting text is displayed — it’s not sent to Microsoft’s servers.
What this means in practice: if you use Live Captions during a video call, the audio of that call is being processed by the feature. The captions aren’t uploaded, but the audio capture itself means the feature has access to conversation content. For calls that involve confidential business discussions, legal consultations, or medical conversations, the question of which processes on your device can access that audio stream is worth considering.
The more significant concern is that Live Captions can capture audio from any source, including other applications. A meeting recorded through a third-party tool might simultaneously be captured by Live Captions, creating a local text record that persists after the meeting application’s own data has been cleared.
Cocreator and Image Generation
Cocreator is a feature in the Windows Paint application that allows you to generate or modify images using AI. You can draw a rough sketch and have the AI complete it, or describe an image and have it generated.
Unlike most Cocreator features, image generation requires a connection to Microsoft’s cloud servers — the local NPU doesn’t run the image generation model. This means that when you use Cocreator, your prompts and any images you submit for editing are sent to Microsoft’s infrastructure.
For most users, this is a low-stakes concern. Generating an image of a landscape or editing a casual photo involves no sensitive personal content. But if you’re using Cocreator to work with documents that include private images — redacting personal information from photos, editing screenshots of sensitive material — those images are being transmitted to Microsoft’s cloud during processing.
The terms that govern this processing are Microsoft’s general content policies, which permit Microsoft to use content submitted to AI services for service improvement under some conditions. The specific handling of Cocreator content is worth reviewing if you plan to submit sensitive images.
Power Automate and AI Actions
Windows 11 on Copilot+ devices integrates more deeply with Power Automate, Microsoft’s automation platform. AI Actions allows you to describe tasks in natural language — “whenever I receive an email from this domain, save the attachment to this folder” — and have Windows set up the automation.
The privacy dimension here is significant. Automation features that involve reading your email, accessing your files, monitoring your calendar, or interacting with web services on your behalf require broad access to your data. The natural-language interface makes these automations easy to set up without necessarily thinking through what data the automation is touching.
Power Automate workflows can run across Microsoft 365 services and third-party connectors. When a workflow runs, it may transmit data between services — from your inbox to a shared folder, from a form submission to a database — according to the logic you defined. Reviewing what each workflow accesses is more complicated than the interface makes it appear.
The Click-to-Do Feature
Click-to-Do is a feature that lets you select content on your screen — text, an image, a web address — and take contextual actions on it. Right-clicking on a product image might offer to search for it visually; selecting text might offer to copy, translate, or send it to Copilot.
The data involved here depends on what you select. For image-based searches, the selected image content is submitted to a search service. For text-based actions that route through Copilot, the selected text is sent to Microsoft’s servers.
The concern is less about any single use of Click-to-Do and more about the habit it encourages: treating screen content as something you can freely submit to cloud services without thinking about what the content is. Highlighted text from a legal document, a medical result visible on screen, a message from a financial institution — these are all candidates for accidental submission via a feature that makes cloud submission feel as casual as copying to the clipboard.
What You Can Actually Disable
The practical question for anyone with a Copilot+ PC is which features to turn off and how.
Recall can be disabled in Settings > Privacy & Security > Recall & Snapshots. On devices where it shipped off by default following the initial controversy, you may never need to turn it off. On older devices where it was enabled, disabling it stops new captures and lets you delete the existing snapshot database.
Live Captions is off unless you activate it. It doesn’t run continuously in the background. You can leave it available for accessibility use cases without concern that it’s capturing audio when you haven’t invoked it.
Cocreator in Paint requires you to opt in to cloud processing the first time you use the generative features. If you use Paint only for local image editing, you can avoid the cloud-connected features entirely.
Power Automate integrations are governed by which workflows you’ve set up. Reviewing and disabling workflows that touch sensitive data sources is straightforward in the Power Automate interface.
Click-to-Do can be disabled in Settings > Accessibility > Click-to-Do, or invoked only when needed rather than left active.
The key point about all of these features is that “local NPU” doesn’t automatically mean “private.” Local processing means the computation happens on your device, but the feature may still transmit inputs, outputs, or metadata through Microsoft services depending on what you’re doing.
The Broader Pattern
Copilot+ PCs represent a direction rather than an endpoint. Microsoft has announced that the Windows AI agent architecture being built on these devices will expand to more hardware over time. The features available today are an early version of a platform that’s expected to deepen its integration with your files, applications, and communication tools.
The privacy decisions being made now — which features ship on by default, what data can be accessed by which services, how transparency about data flows is communicated to users — will become more consequential as the capability expands.
For anyone buying a Copilot+ PC in the near term, the purchase decision should include a review of which AI features you plan to use, which you’ll disable, and how you’ll keep sensitive data — personal files, confidential communications, financial and medical records — appropriately separated from the features that touch screen content.
Keeping Sensitive Files Away from AI-Adjacent Features
One practical mitigation is keeping your most sensitive files in storage that’s explicitly separated from the applications and features most likely to interact with them. A private storage location for personal documents, health records, and sensitive correspondence — one that isn’t indexed by Windows Search, doesn’t appear in Recall’s capture scope, and isn’t accessible to workflow automations — reduces the surface area meaningfully.
This is true regardless of which AI features you use. Files that live in broadly accessible locations accumulate risk as each new feature that touches the filesystem gains potential access. Intentional compartmentalization isn’t paranoia; it’s the appropriate response to a computing environment where AI features have become the default, not the exception.
The hardware that makes Copilot+ useful is the same hardware that makes it possible to run these features efficiently. What that hardware is doing for you at any moment depends entirely on which features you’ve reviewed, enabled, and actually chosen.