Meta halts employee data collection program after security incident

Editorial illustration for: Meta pauses internal mouse-tracking program after security incident exposes employee data

In brief

  • Meta paused Model Capability Initiative on June 22 after security incident exposed employee data internally.
  • Program logged mouse movements, keystrokes, and screen data from US employees for AI model training.
  • No external breach detected, but employees had raised privacy concerns before the incident.

How the program worked

Meta was logging the moment-to-moment computer behavior of US-based employees, not to monitor productivity in the traditional sense, but to generate training data for its AI models. The Model Capability Initiative collected mouse movements, clicks, keystrokes, and occasional screen snapshots — raw material for training systems that would otherwise require licensed data or public datasets. Employees had complained about the resource drain and privacy implications months before the June incident.

In response to those concerns, Meta introduced employee controls in early June. Workers could pause data collection for up to 30 minutes at a time or request full exemption from participation. The controls arrived weeks before the security event that forced the broader pause.

What the investigation found

Meta's own investigation found no evidence of external breaches or unauthorized access by outside parties. Spokesperson Tracy Clayton confirmed that privacy safeguards had been in place and that no indications of improper access by Meta employees were found. The exposure was internal — the data reached a wider set of Meta staff than the program's architecture intended.

Still, the incident has reignited questions about how tech companies source training data. Training competitive AI models requires enormous volumes of high-quality data, and that data is increasingly hard to source without legal or ethical complications. Using employees as a data source sidesteps copyright and licensing issues but does not sidestep workplace privacy law, employee consent frameworks, or questions about worker understanding of participation.

Meta has not announced a timeline for resuming the program or whether it will proceed in its current form.