Meta Caught Collecting Keystrokes and Screens from Its Own Employees for AI Training

Over 50 Meta employees just published an open petition calling out a program that records every keystroke, mouse movement, and on-screen pixel they produce - all fed directly into AI model training. The program, called MCI (Model Capability Initiative), was announced in a limited-audience MSL Infra FYI group. Leadership offered no completed privacy reviews, no People Data Review, and only a selective opt-out for executives.

Employees learned about MCI through an internal FYI, not a privacy notice

MCI collects “computer-use data”: keystrokes, click locations, navigation patterns, device interaction habits, and even raw screen content. According to the petition, when employees asked about privacy assessments, Meta had none to show. The claimed mitigations were vague enough that leadership themselves didn’t trust them - hence the executive-only opt-out button.

Meta’s own Code of Conduct, signed by Mark Zuckerberg, says everyone should “follow our code of conduct, advocate for others to do the same, and feel empowered to speak up.” The petitioners are doing exactly that, calling the collection “coercive” and “non-consensual.” They point out that sensitive data - SSNs, protected health information, confidential business documents - will inevitably be captured alongside ordinary work activity.

Past GDPR fines and a recent data leak make this a regulatory landmine

Meta already paid €91 million (£75 million) in 2024 for storing user passwords in plaintext, a GDPR violation. More recently, in March 2026, an AI agent gave an employee bad instructions that led to a large leak of sensitive user data (The Guardian). Collecting this much employee telemetry invites similar exposure: stored keystrokes and screen captures become a juicy target for internal or external attackers.

California law (CCPA/CPRA) gives employees specific rights to know what personal data is collected, how it’s used, and to request deletion. MCI’s apparent lack of transparency puts Meta directly in conflict with those statutes. The petition demands a clear commitment that no employee computer-use data will be used for AI training - and that includes full-time staff, contractors, and interns.

If Meta really believes “people will be more important,” start with consent

Zuckerberg told investors on the last earnings call that “people will be more important in the future, not less.” Meta’s “Building AI Responsibly” page preaches empowerment. You can’t square that with a surveillance program that records everything an employee does on their work machine, offers no real opt-out, and hasn’t passed basic privacy review. The petitioners are right: extracting data under threat of job repercussions isn’t consent - it’s exploitation.

Expect this to escalate. Either Meta issues a formal privacy review and rolls out a real opt-in for all employees, or the DPC and California AG get a new set of talking points.

Source: Petition against Meta's employee training data collection for ML models
Domain: mcipetition.com