Workplace digital surveillance, which surged during the pandemic, appears to have expanded far beyond monitoring productivity. A new investigation by researchers at Vanderbilt University, Northeastern University, and UC Berkeley reveals that the apps employers use to track staff—commonly known as 'bossware'—are sharing sensitive data with outside tech companies and advertising brokers.
Data Leakage by the Numbers
Researchers tested nine widely used monitoring platforms, including Hubstaff, Deputy, and Time Doctor 2. The results were startling: they logged 121 instances where these platforms sent identifying worker data, such as names and email addresses, to companies including Facebook (Meta), Google, Microsoft, and the ad-tech firm AppLovin.
Furthermore, the nine apps sent activity data—including IP addresses, device information, and browsing history—to 145 third-party domains, among them the Russian search engine Yandex. A third of the platforms could track a worker’s precise location even when the app was running in the background or the employee was off the clock.
Human Cost and 'Digital Dossiers'
Wilneida Negrón, director of research at the nonprofit Coworker, notes that AI now enables employers to create extensive 'dossiers' used to punish workers or predict behavior. "Oftentimes, the workers with the least amount of power in the labor markets tend to be testing grounds for some of the more intrusive forms of data collection," Negrón said.
The investigation highlights cases such as a pharmacist whose employer tracked the exact duration of patient appointments, pressuring her to spend less time on care. In another instance, a college instructor discovered administrators were reading private comments she exchanged with students regarding sensitive topics like family trauma through learning management software.
Legal Landscape and Protection
While some U.S. states, such as New York and Maine, require employers to notify workers of monitoring, many jurisdictions lack such requirements. Experts advise employees never to use work devices for personal matters and to consult IT departments about which tracking features are activated in the software they use daily.
