Monitoring apps send worker data to Facebook, Google
A new report examined nine workplace-monitoring platforms and found they frequently transmit employee data to third parties.
“This investigation suggests that some workplace monitoring applications are sharing workers’ personally identifiable information and online activities in ways that are not clearly disclosed to workers and, in some cases, may even contradict the companies’ own privacy policies,” wrote the researchers, who are affiliated with Columbia Law School’s Center for Law and the Economy and Northeastern University’s Khoury College.
What platforms get employee data?
All nine platforms shared workers’ identifying data with third parties, resulting in 121 unique instances of data sharing involving companies including Facebook, Google and Microsoft. The same platforms transmitted workers’ online-activity data to 145 unique third-party domains. Three of the nine platforms included features that could track a worker’s precise location while the app ran in the background.
Some monitoring platforms shared workers’ email addresses with as many as six third parties, including Microsoft, , Intercom, ProfitWell, Segment.io and ZoomInfo. Because email addresses can be linked to other personal information, the researchers warned that this type of sharing can make it easier to build detailed profiles of workers without their knowledge.
Findings uncover concerns
The findings raise questions about whether workers receive meaningful notice. Only two of the nine platform providers named specific third parties in their privacy policies, and even those two disclosures covered just a fraction of what the researchers noted they observed.
The sharing was not limited to nonmanagerial workers. Of the 121 unique data-sharing instances, 76 involved managerial accounts, meaning managers using the systems were also subject to the same third-party data flows.
The data flows were more extensive when workers accessed the tools through a web browser. Researchers recorded 104 data-sharing cases in browser testing, compared with 39 through mobile apps, although some third parties appeared in both environments.
External factors to consider
At an April House Education and Workforce Committee hearing covered by HR Executive, Sara Steffens, worker power director at We Build Progress, pointed to the spread of workplace-monitoring technologies and argued that AI can make surveillance faster, cheaper and harder for workers to detect. Separately, an ExpressVPN study of 1,500 U.S.-based employers and 1,500 employees, cited by HR Executive, found that 74% of companies use online monitoring tools; 62% use web-browsing logs and 59% conduct real-time screen tracking.
Meta’s recent experience illustrates the gap between stated safeguards and operational reality. The company paused an AI training program that collected keystrokes, mouse movements and screen content from U.S. employees after reports that sensitive information collected from employee computers was accessible to other Meta employees. Meta said it had designed privacy safeguards into the program and paused it while investigating.
States are already acting, according to HR Executive’s research. Maine’s L.D. 61, enacted in January, defines workplace surveillance broadly enough to include AI-driven keystroke monitoring, productivity or activity scoring and biometric monitoring. It requires employers to notify job applicants during the interview process and provide annual written notice to affected employees.
“In the workplace, the harms of pervasive surveillance are even more acute than in the consumer context—and the protections thinner,” wrote the authors of the study. “Workers typically lack the ability to meaningfully refuse surveillance, to easily switch employers or to stop using an employer-issued surveillance platform without risking their jobs and livelihoods.”
