The remote work era made employee monitoring software easier to justify. What began as a way to watch people working from home is now being normalized on office floors, too. Right on cue, a new Northeastern University study suggests the data collected through these tools is also being shared with major third parties, including Google, Facebook, and Microsoft.
David Choffnes, a professor at Northeastern’s Khoury College of Computer Sciences and one of the study’s co-authors, said the research shows how little privacy protection workers have in the workplace. He also noted that the issue is not just data collection by employers, but the fact that this data is being shared outside the company.
The researchers tested nine “bossware” platforms, including Apploye, Deputy, Desklong, Hubstaff, Monitask, Buddy Punch, Time Doctor 2, Vericlock, and When I Work. These tools let employers track activity through keystrokes, mouse clicks, location, device information, and web visits.
What did the researchers find?
Northeastern found that all nine platforms shared workers’ personal details, including names, email addresses, and employer information, with tech and advertising companies. Employee activity data was also sent to more than 145 domains, including Google, Facebook, LinkedIn, Yandex, and AppLovin.
A third of the apps also offered precise location tracking, even when running in the background. Choffnes warned that this turns monitoring software into something that can follow workers beyond their desks.
What this broadly means is that employee data may not stay between the worker, the employer, and the monitoring app. It can move into a much wider third-party tracking network, often without employees having much control over where it goes or how it is used.
Worker data is becoming AI fuel
What makes these findings more concerning is the recent trend of AI companies collecting human behavior data as training material. Meta has reportedly faced internal backlash over software that records employee computer activity to train AI agents, as the company recently cut about 10% of its workforce.
In India, reports have also highlighted workers wearing cameras or filming everyday physical tasks for AI and robotics training. While these cases are different from bossware data sharing, they point to the same issue of tech companies collecting human data related to work, homes, and daily routines.
The Northeastern report does not say this data was sent out for AI training. It may simply be feeding the same advertising and analytics machinery that already follows people online. That said, detailed worker tracking is already becoming common practice. At this rate, how long before workers are asked to train the systems meant to replace them?