Meta captures employee keystroke and mouse data for AI training
Meta deployed software on US employee work computers to record keystrokes, mouse movements, and screenshots across hundreds of websites to train AI agents, without offering employees an option to opt out. The programme raised concerns about workplace privacy, informed consent, and worker surveillance, though European employees were exempted due to GDPR restrictions.
What happened
Meta deployed software on U.S.-based employees' work computers called the Model Capability Initiative (MCI) to record every keystroke, mouse movement, click, and periodic screenshots across hundreds of websites and apps, including Google, LinkedIn, GitHub, Slack, and Gmail, without offering an opt-out.
Internal documentation indicated MCI would capture the contents of emails and direct messages sent to US employees, regardless of where the sender was located. European employees are exempt because GDPR does not allow such surveillance.
Reported impact
Several employees expressed concern that enhanced tracking could enable micromanagement at a time of job uncertainty, with multiple Meta employees describing MCI as dystopian.
The programme was disclosed via an internal memo rather than through any formal consent process, and employees were given no meaningful choice about participation.
Index analysis
The case exposes a critical gap in US employment and data protection law. Under US federal law, there is currently no statutory limit on workplace keystroke surveillance on employer-owned devices, while European privacy law prohibits recording employees' keystrokes without consent.
Specific logging to train AI models represents a step-change in scope from pandemic-era remote work monitoring tools, raising questions about consent, transparency and governance for data collected from employees.
Governance controls
Meta stated the project was necessary because AI agents designed to handle computer tasks need real examples of how people actually work. The programme's legal basis relied on a gap in US federal law that does not restrict keystroke surveillance on employer-owned devices.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.