Meta is piloting the Model Capability Initiative (MCI) to track detailed employee computer usage, including mouse movements, clicks, and navigation across more than 200 apps and websites, with the aim of training autonomous AI agents.

The program is marketed as limited to U.S. devices with safeguards, but internal documents and reports show it now also captures data from international users and cross-border communications, raising cross-border processing and GDPR concerns.

Initial descriptions claimed the tool would affect only U.S. employees and protect sensitive information, yet multiple internal notes indicate non-U.S. data and collateral data from global interactions can be collected.

While the rollout targets U.S. staff, observers warn about regional implications, including South Africa’s POPIA framework which imposes safeguards when employee data could be used for AI training.

Critics warn that this real-time monitoring resembles gig-work surveillance and could erode trust, as scholars and privacy experts question consent and the balance of productivity gains.

Reuters and privacy advocates are cited to present a balanced view of potential legal and ethical challenges surrounding MCI.

Meta says data will be used solely for AI training and not performance reviews, but concerns persist about real-time monitoring and future data use.

The project reportedly collects communications such as emails and messages in addition to mouse and click data, amplifying privacy concerns.

An internal post detailing these concerns has been removed from company message boards, signaling sensitivity around the issue.

The broader tech landscape shows major firms racing to build AI agents that operate across enterprise tools, creating a potential data advantage for companies with large internal workforces.

Meta claims MCI is bandwidth-light on home networks, but employees have alleged significant usage that could burden personal connections.

Meta’s FAQ acknowledges cross-border data risks, noting conversations involving non-U.S. colleagues could be captured if a U.S.-based user is enabled.