Meta Employee Surveillance Program Raises GDPR Concerns in the EU

Meta Platforms acknowledged that its controversial employee surveillance program captures data from workers outside the US. This has resulted in raising legal questions in Europe.

The company’s Model Capability Initiative (MCI) was introduced last month as a tool to record how US-based employees interact with their work computers by tracking mouse movements, clicks, and navigation patterns across more than 200 apps and websites. The goal of MCI is to use the employee-generated data to train AI agents capable of performing coding and white-collar tasks. Meta told staff the program is confined to US devices and stated safeguards are in place to protect sensitive information.

Meta acknowledged in a question-and-answer document provided to employees that MCI will capture the contents of any emails or direct messages sent to US personnel, regardless of the sender’s ⁠location. Meta spokesperson Dave Arnold said that the company notified non-US employees the tool was running on the machines of US-based colleagues they might correspond with, describing the step as one of transparency.

“We’ve been clear that this tool is for US-based personnel only, and in the interest of transparency, we notified non-US employees that it was deployed on the computers of US colleagues they may email or chat with in the normal course of business,” a Meta representative said. “We carefully considered and mitigated potential privacy risks in both the development and deployment of this tool, and we are committed to complying with applicable laws and regulations.” 

The disclosure introduces new regulatory exposure in Europe, where technology companies are already fighting a series of heated legal battles over data collection. Under the GDPR rules, companies must establish a clear legal basis for processing personal data, disclose what is being collected, and satisfy strict conditions around sensitive categories of information.