Workplace surveillance: employee monitoring, news

What is employee monitoring and employee monitoring software

Employee monitoring is the use of software, cameras and sensors to track employees’ activity, location and performance, and employee monitoring software is the program that does it on work devices. Critics call it bossware. Tools in the 2026 stories log keystrokes and mouse movements, track browsers, messaging and meeting apps, photograph remote workers by webcam, read the content of calls, emails and messages, and report location from a phone. According to reporting, nearly 70% of firms with more than 500 employees already used monitoring systems in 2022. In Europe the data falls under the GDPR, and breaches can be penalised as described in GDPR fines.

Is employee monitoring software legal

Mostly yes, but the limits depend on where the employer and worker are. An OECD study of more than 6,000 firms in six countries found that US employers use sanctioning software far more than European ones: 67% against 4% in France, Germany, Italy and Spain combined and 1% in Japan. US firms track work speed at 72% and message content at 55%; European firms at 15% and 6%. Researchers attribute the gap to law, not technology: EU rules require informing and consulting worker representatives before rollout, while US labor law requires bargaining only in narrower circumstances.

Some US states, including New York, Connecticut, Delaware and Maine, require employers to notify workers about monitoring, but the rules leave gaps. In Canada, workers in Ontario have few defences: the federal privacy law PIPEDA does not cover provincially regulated employers, and since October 2022 firms with at least 25 employees must have a written monitoring policy. It requires disclosure only, with no right to object.

What Polish law allows

Polish law allows video and email monitoring only when it is necessary for set purposes and workers are told in advance. From the consolidated Labour Code of 2026, checked on 10 October 2026:

• Video monitoring (Article 22²). Allowed if necessary for employee safety, protection of property, production control or keeping confidential information secret. It excludes union premises, and also sanitary rooms, changing rooms, canteens and smoking rooms unless strictly necessary and not harmful to dignity. Footage is kept for up to 3 months, longer only if it is evidence in proceedings, then destroyed.
• Notice. Purposes, scope and method are set in a collective agreement, work regulations or a notice. Employees are told at least 2 weeks before launch, and since 27 January 2026 also before they start work, on paper or electronically. Monitored areas are marked at least a day before.
• Email and other monitoring (Article 22³). Checking a work email account is allowed when necessary to organise work and use work tools properly, and must not breach the secrecy of correspondence. The same notice rules apply, and paragraph 4 extends them to other forms of monitoring necessary for the same purposes.

The text of these articles does not name keystroke logging or webcam photos. GDPR information duties apply alongside (Article 22² paragraph 10).

What data does employee monitoring software collect and share

It collects identifying data, online activity, IP addresses, device data and location, and some of it goes to third parties. Researchers from Vanderbilt University, Northeastern University and UC Berkeley deployed nine popular platforms, including Hubstaff, Deputy and Time Doctor 2. Every platform sent names and email addresses to outside companies (121 documented cases), and data went to 145 third-party domains, including Facebook and the Russian search engine Yandex.

A third of the platforms could track a worker’s precise location in the background or off the clock, and three required access to a phone’s motion sensors just to clock in. It is the same mechanism covered under online tracking.

Keystroke logging and AI training: Meta and TD Bank

In 2026 companies tried to collect keystrokes and mouse movements as AI training data, then pulled back after protests and a leak. Meta paused its Model Capability Initiative, which logged the keystrokes and mouse movements of most US employees: a screenshot showed private conversations, performance data and transcriptions readable across the company, and a security notice put the exposure at data from 45,000 Hive tables. Employees could not opt out on company laptops, and a petition gathered 1,600 signatures.

In July, Meta’s CTO Andrew Bosworth confirmed that a researcher had moved sensitive data to an internal location where it should not be, with no outside intrusion. Meta also expanded opt-outs because the data was too uniform for AI training. The logging stays dormant, and Meta has not decided what to do with the data already collected. Toronto-Dominion Bank backed off collecting keystrokes for AI after pushback but kept WorkiQ, which tracks browsers, messaging and meeting apps. See Meta.

Webcam photos every three minutes: the New Jersey lawsuit

A New Jersey lawsuit alleges a remote worker was fired for refusing an AI tool that would photograph her about every three minutes. Glennis Von Sander-Timinski sued Sutherland Healthcare Solutions: the Sentinel AI tool would take about 160 photos a day. She had worked remotely since 2018 with positive reviews. She feared the pressure would trigger a lupus flare-up, and her doctor asked for less frequent or intermittent monitoring.

The company gave her three options: accept the monitoring, report to an office about six hours away each day, or be dismissed. She was dismissed on 8 September. Her lawyers accuse the company of failing to provide the reasonable accommodation New Jersey law requires. These are allegations in a complaint, not a ruling.

What are surveillance wages

Surveillance wages are pay set from a worker’s personal data to find the lowest amount they will accept. An audit of 500 labor-management AI companies by UC Irvine law professor Veena Dubal and Wilneida Negrón, published in August 2025, named Intuit, Salesforce, Colgate-Palmolive, Amwell and Healthcare Services Group among customers of vendors whose tools enable the practice. It does not claim all of them engage in it, and Colgate-Palmolive and Intuit denied using such tools. Systems can draw on signs of financial distress, such as payday loans, and on public social media profiles for union sympathies or pregnancy. Colorado’s proposed Prohibit Surveillance Data to Set Prices and Wages Act would ban using intimate data for algorithmic pay.

What it means for you

• Ask your employer what employee data it collects, and keep sensitive personal matters off work devices. Experts gave that advice in reporting on the monitoring-app study.
• In Poland, check the work regulations or notice: purposes, scope and method of monitoring must be set there, and you must be told at least 2 weeks ahead.
• With remote work and webcam tools, ask for the legal basis. Articles 22² and 22³ do not name such tools.
• If you work for a US employer in New York, Connecticut, Delaware or Maine, the employer must notify you about monitoring.

Still open: what Meta will do with the data it already collected, how the New Jersey court rules on the accommodation claim, and whether Colorado bans surveillance-based pay.