Monitoring apps share data with hundreds of third parties — security gap

For security teams, the headline is not that employers monitor workers — it's that monitoring vendors resell the resulting data to hundreds of unnamed third parties. Every work-issued laptop camera, geolocation feed, and productivity log becomes a potential data-exfiltration point, and the academic finding turns a vendor-management question into an incident-response liability.

The Associated Press's August 20, 2026, report assembles a pattern of intrusions that cuts across sectors and shows workplace surveillance has hardened from a pandemic-era stopgap into permanent infrastructure of behavioral tracking. College administrators read an adjunct professor's comments on students' personal essays. Managers instructed a pharmacist to spend less time with patients after software measured the number and length of her appointments. Scanners on a warehouse conveyor belt monitored workers' pace to enforce inspection of hundreds of items per hour. These are not isolated anecdotes; they illustrate a structural shift in how labor is managed and how little of that shift is visible to the workers being watched.

“

The most consequential finding for privacy law and data security comes from an investigation by Vanderbilt University, Northeastern University, and the University of California at Berkeley.

The mechanism is the convergence of two forces. First, the COVID-19 pandemic normalized remote-monitoring software as millions of employees moved home, and employers retained those tools long after the emergency receded. Second, advances in artificial intelligence and data science transformed raw telemetry into what Wilneida Negrón, director of research and policy at the labor-advocacy nonprofit Coworker, calls 'dossiers' — comprehensive behavioral data sets that can be used to discipline workers or attempt to predict their future behavior. Negrón's framing is pointed: 'the workers with the least amount of power in the labor markets tend to be testing grounds for some of the more intrusive forms of data collection.' The examples in the report bear this out, clustering in adjunct academia, clinical pharmacy, and warehouse logistics — roles defined by contingent contracts, high turnover, and limited bargaining power.

The most consequential finding for privacy law and data security comes from an investigation by Vanderbilt University, Northeastern University, and the University of California at Berkeley. It found that some of the most common workplace monitoring programs share names, email addresses, and other personal worker data with hundreds of outside data brokers and technology companies, frequently without clearly disclosing the practice. Because these programs are marketed as productivity and security tools, their data-sharing behavior has largely escaped the scrutiny applied to consumer apps. This transforms a workplace-relations dispute into a data-governance crisis: the employer is not merely observing the worker but quietly exporting the worker's identity into a commercial data ecosystem the worker cannot audit, correct, or opt out of. For employers, the exposure extends beyond labor law into state privacy statutes, biometric restrictions, and common-law claims. For workers, the surveillance now runs far past the shift boundary and far past the employer-employee relationship itself.