Meta tracking employee keystrokes to train AI is probably legal. Experts say that doesn’t make it ethical

Employees at Meta Platforms may soon feel like they’re spilling TMI to their employer’s MCI.

The parent company of Facebook, Instagram, and WhatsApp is installing new software—reportedly dubbed Model Capability Initiative (MCI)—on its employees’ computers and workstations that will, among other things, track and capture mouse movements and keystrokes in an effort to train AI models, Reuters first reported on Tuesday. 

It’s all part of a broader effort to develop autonomous AI agents that can perform specific work tasks.

A Meta spokesperson confirmed that the company was, indeed, pushing forward with the measure.

“If we’re building agents to help people complete everyday tasks using computers, our models need real examples of how people actually use them—things like mouse movements, clicking buttons, and navigating dropdown menus,” the spokesperson tells Fast Company. “To help, we’re launching an internal tool that will capture these kinds of inputs on certain applications to help us train our models.”

Regarding privacy concerns, Meta added, “There are safeguards in place to protect sensitive content, and the data is not used for any other purpose.”

Meta has laid off hundreds of employees this year, and there are rumors swirling that more are to come. It could lay off thousands, largely to offset increased AI costs, and to make room for AI agents to take on some of the work originally done by humans. 

It wouldn’t be unprecedented: A couple of months ago, Jack Dorsey’s fintech company, Block Inc, cited AI efficiencies as it laid off 40% of its workforce.

How low can morale go?

Understandably, many Meta workers are likely feeling uneasy, both about the prospect of losing their jobs, and the fact that the company will be tracking every granular move they make on their computers.

Unfortunately, experts say there isn’t much they can do about it.

“In the U.S., Meta’s approach is largely permissible, but it sits in a legally sensitive zone,” says Natalie Bidnick Andreas, an assistant professor of instruction in the Department of Communication Studies at the University of Texas. “Federal law offers very little in the way of employee‑privacy protections, so there’s no nationwide rule that clearly prohibits keystroke or mouse‑movement monitoring on company devices.”

Such practices tend to fit within legal boundaries provided they are limited to a company’s own hardware and work accounts, Andreas adds, although some states might have stricter regulations in place.

“State‑level rules add some complexity,” Andreas says, “since a few states require employers to notify workers about electronic monitoring, while newer privacy laws expand personal‑data rights but still focus more on consumers than employees.” 

Laws need to catch up

While there are stronger laws concerning keystroke logging and screen capture in places like the European Union, existing law in the United States is “inadequate for the AI era,” says Dario Maestro, legal director of the Surveillance Technology Oversight Project, an advocacy and legal services group that fights against the growing use of surveillance technology. 

Existing “statutes were designed to stop bosses from eavesdropping on phone calls and reading private emails, not to stop companies from turning every click into training data,” Maestro says. “Workers have almost no federal right to refuse, and ‘consent’ obtained under threat of termination isn’t consent at all.”

“Closing that gap will require state legislatures to treat AI training as a distinct use—one that demands separate, revocable consent and bars repurposing employee data beyond what was originally disclosed,” Maestro adds.

“Employees cannot meaningfully refuse”

On an ethical level, Andreas says “the concerns run much deeper,” and she echoes Maestro in saying that workers aren’t truly able to consent to the activity. 

“Employees cannot meaningfully refuse when their employer decides to log keystrokes, so any notion of consent is largely symbolic,” she says. “Even if Meta frames the program as contributing to AI development, workers know that opting out could be interpreted as non‑compliance.”

Derek Leben, an associate teaching professor of ethics at the Tepper School of Business at Carnegie Mellon University, says that Meta isn’t alone, either. 

“This is something that a lot of companies are experimenting with, and by experimenting, I mean they are moving forward with it and seeing what kinds of pushback they’re getting from employees, unions, the media, and the public,” Leben says.

He adds that there is, and has been, plenty of discussion and debate as to where the ethical line is in terms of employers respecting the privacy of employees when they’re on the job—if that line does exist.

What it really boils down to is whether employers are “treating their employees like human beings with dignity,” Leben says. Absent of that, workers may feel like they’re “being treated like children,” and that tracking their computers is “not being respectful.”

Meta’s practices are likely to be replicated by other companies as workplaces grapple with new privacy expectations in the age of AI.

“This kind of monitoring also normalizes a level of surveillance that has historically been directed at gig workers and warehouse employees, extending it into knowledge worker roles and reshaping expectations about professional work,” says Andreas. “It further blurs the line between doing one’s job and training one’s replacement.”