Study Finds Nine Employee Monitoring Apps Sent Worker Data to Facebook, Google and Russia's Yandex

Researchers at Vanderbilt University, Northeastern University and the University of California at Berkeley set up shop as fake employers. They deployed nine widely used employee monitoring platforms, including Hubstaff, Deputy and Time Doctor 2. Then they logged back in as workers to see exactly what data left the building.

Every single one of the nine platforms sent identifying worker data, including names and email addresses, to outside companies. The researchers documented 121 separate instances of this happening, involving Facebook, Google, Microsoft and the ad-tech firm AppLovin, according to Fortune, which first reported the findings.

The nine apps also sent workers' online activity, including IP addresses, device information and browsing data, to 145 third-party domains. One of those domains belonged to Yandex, the Russian search engine, Fortune reported. A third of the platforms tested could pinpoint a worker's precise location even when the app was running in the background or the employee was off the clock. Three of the nine apps demanded access to a phone's motion sensors just so an employee could clock in for a shift.

None of this was clearly disclosed to the workers being monitored, according to the investigation.

Why This Software Exists in the First Place

Employer monitoring tools spread fast during the coronavirus pandemic, when millions of people started working from home and companies wanted proof the work was getting done. The tools never went away once offices reopened.

Wilneida Negrón, director of research and policy at Coworker, a nonprofit that helps workers organize, told the Associated Press that AI and data science now let employers build extensive "dossiers" on workers. Those dossiers, she said, can be used to punish employees or try to predict their behavior.

"Oftentimes, the workers with the least amount of power in the labor markets tend to be testing grounds for some of the more intrusive forms of data collection," Negrón said.

Pharmacist Lannie Duong, who worked at a medical clinic treating patients with diabetes, hypertension and heart disease, said her employer tracked the length of her phone calls and appointments down to the minute. Management then questioned her in performance reviews for spending too much time with patients, according to the Associated Press and Daily Mail.

"Everything was counted. How many minutes you're on the phone. The minutiae of it was ridiculous," Duong said. She described the pressure as leaving her feeling "not trusted, not appreciated, almost completely hopeless."

Other examples cited in the reporting include college administrators reading an adjunct professor's written comments on student essays, and warehouse scanners clocking how fast workers inspected items on a conveyor belt.

The Fair Case for Monitoring, and Where It Breaks Down

Employers have a legitimate interest in knowing whether remote or hourly workers are actually doing their jobs. Nobody's arguing a company can't track whether a warehouse employee is hitting quota, or whether a remote worker is logged in during business hours. That's basic accountability, and it's the employer's equipment and network in most cases.

The problem here isn't that monitoring exists. It's that the data collected for a legitimate business purpose, tracking task completion, is apparently being funneled to Facebook, Google, and a Russian search engine without workers being told. That's not accountability. That's a data pipeline nobody signed up for, running through software billed as a productivity tool.

Fortune's reporting, syndicated in part by ua.news, laid out the mechanics of the data transfers clearly. None of the three sources reviewed here cite a response from Hubstaff, Deputy, Time Doctor or the other platforms named in the study, and no U.S. regulator has announced an investigation into the findings as of this writing.

Data privacy experts quoted by the Associated Press advise workers to avoid using work-issued devices for personal or medical matters, and to check whether monitoring features are quietly switched on in everyday tools like Microsoft Office and Zoom.

There's no federal law requiring employers to disclose exactly what employee monitoring software collects or where that data goes after it leaves the app. A handful of states, including New York and Connecticut, require some form of notice to employees before electronic monitoring begins, but none of the three source reports here identify a state or federal law these nine platforms may have violated. Until Congress or a regulator like the FTC decides workplace surveillance data deserves the same scrutiny as consumer data, the burden falls on individual workers to figure out what their employer's software is actually doing behind the login screen.