1. GDPR Article 6 lists the lawful purposes for processing private data. The only that can apply is "If the data subject has given consent to the processing of his or her personal data" and opt out won't cut it based on previous cases. Microsoft needs to ship Recall default off in the EU and make it strictly opt in. Given it seems like a simple keypress might re-enable it, this doesn't look good so far.

2. Even if Microsoft ships it default off in the EU and makes it strictly opt in, it's not at all clear whether Recall recording said information of EU citizens from chats, emails and everything else on someone else's computer is lawful. Ie.: just because I sent you a message over Whatsapp or Viber doesn't mean I consented to you processing it with Recall.

3. Even if Microsoft manages to clear the GDPR hurdle and -- that's saying something -- the EP and the EC might still take issue with it: it certainly violates the spirit of the GDPR even if not the letter of it and together with the domestic abuse issue they probably will show the EU is not always so slow in legislating.