Meta's employee tracking tool sparks fresh EU privacy concerns over AI training data

Meta is facing potential new regulatory complications in the European Union after its internal employee monitoring tool — designed to train artificial intelligence agents — was found to be collecting data beyond the scope the company had initially described, including activity involving workers based outside the United States.

What the tool does

As reported by Reuters, the tool, known as the Model Capability Initiative (MCI), was introduced to staff last month as part of chief executive Mark Zuckerberg's broader strategy to transform company operations through the use of AI agents.

Meta told employees the tool was designed to capture how people use computers — recording mouse movements, clicks, and navigation through dropdown menus — to build AI agents capable of performing everyday software tasks autonomously.

According to a list shared with staff, the MCI is pulling in data from more than 200 apps and websites. Meta said the initiative would affect only US-based employees and that safeguards were in place to protect sensitive information.

Unexpected data consumption

Since its launch, however, many Meta employees have reported that the MCI is consuming considerably more data than anticipated.

In some cases, the tool reportedly used up an entire month's home internet quota within just a few days, prompting complaints from affected workers.

Non-US data captured in the process

The more significant concern, from a regulatory standpoint, relates to the tool's reach beyond US borders.

Documents reviewed by Reuters reveal that data belonging to non-US employees can be captured when they communicate with US-based colleagues who have the MCI enabled.

Meta's own FAQ document on the initiative addressed this directly. In response to the question — "I'm based outside the U.S. Will my conversations or data be captured if I'm communicating with a U.S.-based colleague who has the tool enabled?" — the company stated: "If a U.S.-based colleague has the tool enabled while gchatting or emailing with someone outside the U.S., that activity would be captured."

EU regulatory exposure

These findings could deepen Meta's regulatory difficulties in the European Union, where the Facebook and Instagram owner is already engaged in a series of legal disputes over data collection and usage practices.

Whilst US workers have limited legal protections against employer surveillance, companies operating under the EU's General Data Protection Regulation (GDPR) are bound by considerably stricter obligations.

These include the requirement to establish a lawful basis for processing personal data, to clearly disclose what is being collected, and to meet specific conditions when handling especially sensitive categories of information such as health data.

The MCI now represents a fresh complication for a project that sits at the heart of Zuckerberg's ambition to reshape Meta around AI — and one that could draw the company into yet another European privacy dispute.