We demand that you not collect employee “computer-use” data for the purposes of training AI Models.
Recently, leadership announced in a limited audience group (MSL Infra FYI) that a program called "MCI" (Model Capability Initiative) would be rolling out. For context this program collects computer inputs such as mouse movements, click locations and keystrokes, as well as screen content.
When employees asked what privacy reviews were conducted, including any "people data reviews" (which are required for processing employee data), no completed privacy reviews were provided. The outlined privacy mitigations were vague, and leadership’s confidence in them appeared limited - evidenced by the selective opt-out afforded to executives.
We are speaking up - because it’s expected of us and, more importantly, because it is the right thing to do.
The importance of our work means we must commit to holding ourselves to a high standard. This is why I expect everyone at Meta - leaders, managers, individual contributors - to follow our code of conduct, advocate for others to do the same, and feel empowered to speak up if you need help or have questions.
Mark Zuckerberg (Founder, Chairman and Chief Executive Officer) in reference to Meta’s Code of Conduct
We are calling for a clear commitment that employees (FTEs, CWs and Interns), must not have their "computer use data" - also referred to as human-computer interaction data - collected for the purposes of training AI models. This includes, but is not limited to:
- Keystrokes
- Mouse movements and usage patterns
- Screen interactions
- Device interaction habits
- Navigation and behavioral patterns
- Screen content
Collecting and repurposing this kind of data raises serious concerns around privacy, consent, and trust in the workplace.
These fears are not unwarranted given that in the past user passwords being stored in plain text, led to
four breaches of the General Data Protection Regulation (GDPR) and a hefty €91m (£75m) fine by the Irish
Data Protection Commission (DPC) in 2024. (Facebook parent company fined €91m over password
storage
, BBC, 27 Sept. 2024)
Even more recently, in March 2026, an AI agent gave an employee the wrong instructions which were then
followed and resulted in sensitive user data being exposed. (Meta AI agent’s instruction causes
large sensitive data leak to employees
,
The Guardian, 20 Mar. 2026)
Due to the nature of how this data collection works, it is inevitable that sensitive data such as SSNs, protected health information, and other personally identifiable or confidential information will be collected and stored.
Collecting this data introduces both security and regulatory risks for Meta, including the potential for breaches and unauthorized disclosure. Employee data is protected under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), which grant employees specific rights. These include the right to know what personal data is being collected and how it is used, the right to request deletion or correction of that data, and the right to limit its use.
In the most recent earnings call, Mark Zuckerberg stated:
People will be more important in the future, not less. Meta believes in empowering individuals.
According to Meta’s Code of Content, Meta is dedicated to empowering and protecting people by "Building AI Responsibly". Meta’s mission is to help ensure that AI at Meta benefits people and society by ensuring that Meta’s machine learning (ML) and AI systems are designed and used responsibly and meet legal and regulatory obligations.
We collectively believe that empowering individuals and communities through building responsible AI includes respecting their boundaries and privacy. Any approach to AI that relies on intrusive, coercive, non-consensual data collection contradicts that principle.
It should not be the norm that companies of any size are permitted to exploit their employees by nonconsensually extracting their data for the purposes of AI training. AI meant to serve and empower people cannot do so while disregarding or disrespecting the consent of the people it claims to serve.