Meta and Google Are Feeding on Your Boss's Surveillance Data

A landmark study exposes how bossware doesn't just report to management — it quietly fuels the ad-tech industrial complex.

Written by OutOfToken AI

June 4, 2026 · 4 min read · Synthesized from reporting by The Verge Policy · How this works

AI Likely Accurate · 8/10

Hundreds of thousands of employers installed workplace monitoring software to watch their workers. What those employers likely didn't advertise in the employee handbook: the same apps are piping worker data — names, email addresses, browsing histories — straight to Meta, Google, and data brokers. A new study led by a former Federal Trade Commission chief technologist has put hard numbers to a privacy crisis hiding in plain sight inside corporate IT stacks.

The Research: Nine Apps, Zero Clean Records

The investigation was conducted by Stephanie Nguyen, senior fellow at Columbia Law School's Center for Law and the Economy, who previously served as the FTC's chief technologist under chair Lina Khan. Nguyen's team scrutinized nine commercially deployed bossware platforms — tools marketed to employers for tracking productivity, logging keystrokes, capturing screenshots, and monitoring web activity. The finding was unambiguous: every single one of the nine services transmitted some form of employee data to third-party entities. Recipients identified in the study included Facebook's parent company Meta, Google, and various data brokers whose business model is explicitly the aggregation and resale of personal information.

What's Flowing — and Where It Ends Up

The data categories implicated range from the mundane to the deeply sensitive. At the softer end: names and corporate email addresses, the kind of identifiers that seem innocuous until they're cross-referenced with behavioral profiles. At the harder end: web browsing histories captured during work hours, which can reveal health concerns, financial stress, union research, or job-hunting activity. Once that data touches a platform like Meta or lands in a data broker's warehouse, it becomes raw material for targeted advertising, risk scoring, and profiling pipelines that the employee has no visibility into and almost certainly never consented to. The employment relationship creates a structural power imbalance that makes meaningful consent close to fiction — workers rarely negotiate over which third parties their employer's HR tech vendor is allowed to call home to.

"Every single one of the nine bossware platforms tested shared employee data with external third parties — including Meta, Google, and data brokers."

Industry Pushback and the Limits of 'Trusted Partners'

At least one of the implicated platforms pushed back on the characterization. Ciaran Hale, chief technology officer at Deputy, a workforce management tool included in the review, issued a statement asserting that the company's third-party relationships are confined to 'trusted operational and infrastructure providers that support the delivery, security, and reliability' of its services. That framing — standard boilerplate in the SaaS industry — doesn't directly address whether those providers include advertising platforms or data brokers, nor does it clarify what contractual restrictions, if any, govern downstream use of the data once it leaves Deputy's environment. The gap between vendor assurances and demonstrable data flows is precisely what studies like Nguyen's are designed to measure.

With the FTC under new leadership and federal privacy legislation still stalled in Congress, the regulatory pressure that might force bossware vendors to restructure their third-party data relationships remains uncertain. What is certain is that the surveillance economy has found a particularly captive audience in the American workforce — people who, by economic necessity, cannot simply opt out of the tools their employers mandate. Nguyen's research arrives at a moment when the definition of workplace privacy is being litigated not just in courts, but in the architecture of enterprise software. The question now is whether policymakers move faster than the data already has.

Editorial Note

The Verge is a credible technology publication with established fact-checking standards. The claim references a specific research study led by a named researcher (Stephanie Nguyen) with verifiable credentials at Columbia Law School and prior FTC role under Lina Khan, which can be independently verified. Employee monitoring software sharing data with advertisers is a documented phenomenon that aligns with known privacy concerns in the sector, though the specific scope of all nine services examined would require reviewing the original study.

Claim Tracker

AI-assessed

VerifiedStephanie Nguyen is a senior fellow at Columbia Law School's Center for Law and the Economy and former FTC chief technologist under Lina Khan

Nguyen's credentials are documented in public records and Columbia Law School directory

UnverifiedAll nine workplace monitoring services examined in the study transmitted employee data to third-party entities

The full study methodology and complete findings are not detailed in this summary; verification requires access to the complete research publication

UnverifiedRecipients of shared employee data included Meta, Google, and data brokers

Specific companies identified need confirmation from the original study; the article cuts off mid-sentence making full verification impossible

UnverifiedHundreds of thousands of workplaces use workplace monitoring software

The exact figure and data source for this claim are not provided in the excerpt

VerifiedWorkplace monitoring tools capture keystrokes, screenshots, and monitor web activity

These are well-documented capabilities of commercially available bossware products

Ask AI about this story

// discussion