A friend of a colleague recently found out her employer had been recording her screen every six minutes for the better part of a year. She works in accounts. Not exactly a high-security role. Nobody told her. She found out because IT sent a company-wide email about a software update and accidentally included the monitoring tool’s name in the changelog. Oops.
That story probably isn’t unusual anymore. Something like 74% of organizations reportedly use some form of “bossware” now, and the tools have gotten a lot sharper than the old clock-in, clock-out stuff. We’re talking behavioral modeling, AI-scored productivity dashboards, even emotion detection in some cases. The regulation around all of it? Lagging badly. Almost comically so.
Workers in competitive job markets, your San Joses and Austins and Seattles, are starting to bring monitoring complaints into employment disputes alongside the usual wrongful termination and retaliation claims. People seeking legal representation for employees have started asking pointed questions about what data their employer collected and who saw it. It’s becoming a thing.
The Keystroke Problem
Old-school keystroke logging was blunt. Count the clicks, compare to a number, done. What’s running now is different. These tools build behavioral profiles over weeks. They learn your patterns, your rhythms, the gap between when you open a document and when you start typing. Then they flag deviations.
Which… fine, maybe that catches a genuine insider threat once in a while. But it also catches someone who had a migraine, or spent an hour on a difficult phone call with a client, or just stared at a problem for twenty minutes before writing anything. Context doesn’t really exist for these systems.
And here’s what bugs people who actually work in cybersecurity tools and network scanning. Some of the same infrastructure built to protect companies from external threats is being quietly redirected inward, toward employees. The boundary between threat detection and staff surveillance got blurry a while ago. Nobody drew a line.
Facial Recognition Is… a Lot
Some companies scan faces to confirm identity at login. Others try to read emotional states from expressions during meetings. That second one feels like science fiction that skipped peer review, honestly. The confidence levels on emotion-detection AI are not great. They’re especially not great across different ethnicities and skin tones, which is where it goes from “questionable tech” to “potential discrimination lawsuit” pretty fast.
The EEOC held a public hearing specifically about this, examining how AI tools used for workplace decisions can violate civil rights laws when they produce uneven outcomes for protected groups. Facial recognition that works worse on darker skin? That’s a textbook adverse impact problem.
But then the federal government yanked several of its own AI guidance documents off agency websites in early 2025. Colorado and Illinois have stepped in with state-level rules. Everywhere else is mostly a shrug. Your rights depend a lot on geography right now, which has always been true of employment law in America but feels more absurd when the technology is universal and the protections are not.
Algorithms That Score Your Workday
This one doesn’t get enough attention. Monitoring isn’t just watching. It’s deciding. AI systems in warehouses and logistics operations track workers to the second, auto-generate performance flags, and feed directly into termination pipelines. Some office workers get scored daily on “engagement metrics” they’ve never seen and can’t appeal.
Researchers at UC Berkeley’s Labor Center have documented how workers currently have almost no right to know what data is being gathered on them or challenge how it’s being used. Low-wage workers, women, and people of color absorb a disproportionate share of the impact. Not surprising. But the speed at which algorithmic management entrenches those patterns is new.
There’s something genuinely strange about being scored by a system you can’t see. Like getting a grade on an exam nobody showed you.
Consent That Isn’t Really Consent
Most monitoring gets authorized through a paragraph in an onboarding packet that nobody reads carefully at 9am on day one while they’re also trying to remember which floor the bathroom is on. Legally that counts as consent in most jurisdictions. Practically it’s meaningless.
Proposed federal legislation like the Stop Spying Bosses Act tried to set limits, blocking surveillance of off-duty activity and monitoring aimed at disrupting union organizing. It didn’t pass. State-level bills keep popping up, but the pattern so far is introduce, debate, stall.
Anyway. The gap between what the tools can do and what the law addresses keeps widening. For a lot of people that just means hoping their employer uses this stuff responsibly, which… is a strategy, sure. Not a particularly reassuring one.
