Skip to content
Submit incident
AII-1000-85047
ReportedReported by fewer than three independent publishers, with no official finding.Supporting sources are pending verification.

Meta's MCI tool tracks US employees' computer activity for AI training

Meta deployed the Model Capability Initiative tool to track U.S. employees' detailed computer activity for AI training, but the tool reportedly collects more data than initially disclosed, including communications with non-U.S. contacts, raising potential GDPR compliance concerns.

April 2026 Β· Meta Β· Privacy and surveillance
April 2026
AII-1000-85047
Quick facts
Organization
Meta (subject)
Category
Privacy and surveillance
Country
United States
Date
April 2026
Drafted by
Raidu Incident Detection

What happened

In April 2026, Meta launched the Model Capability Initiative (MCI), a tool to track U.S. employees' computer usage including mouse movements, clicks, dropdown menu navigation, and data from over 200 apps and websites to train AI agents that perform software tasks.

According to internal documentation reviewed by Reuters, MCI captures the contents of any emails or direct messages sent to U.S. employees regardless of sender location, and tracks code changes, computer sleep and wake cycles, and URLs copied to clipboards.

Reported impact

Meta employees complained that MCI consumed excessive data, causing home internet usage to spike and in some cases depleting a month's quota within days.

A legal expert told Reuters that the tool's collection of data from EU residents may violate the EU's General Data Protection Regulation (GDPR), particularly regarding purpose limitation and whether the data collection qualifies as incidental.

Index analysis

The tool tracks detailed computer interaction data from more than 200 apps and websites accessed by U.S. employees, including communications with non-U.S. colleagues.

Some employees disputed Meta's characterization of the tool, calling the company an 'Employee Data Extraction Factory' and noting that MCI is more extensive than initially disclosed.

Governance controls

Meta stated that safeguards were in place to protect sensitive information and that it 'carefully considered and mitigated potential privacy risks' in development and deployment.

Meta notified non-U.S. employees that MCI was deployed on computers of U.S. colleagues they communicate with, and Meta spokesperson Dave Arnold stated the company is 'committed to complying with applicable laws and regulations.'

Classification

Organization
Meta (subject)
Category
Privacy and surveillance
Industry
Digital security
Country
United States
Harm status
Actual harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Human or fundamental rights
Harmed
Workers
Failure modes
Training data misuse
AI systems
Model Capability Initiative
Regulations
GDPR (cited)

Sources and evidence

Sources not yet published

This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.

How sources are verifiedSuggest a source for this incident