Modern workplace software can, in principle, capture an extraordinary amount: keystrokes, screenshots, application usage, location, and in some deployments even facial expression during video calls. The technology to monitor almost everything exists and is commercially available. The real question isn't whether that capability exists — it does — but where a company draws the line between legitimate oversight and something that treats employees as subjects of surveillance rather than people doing a job.
The Technology Categories Worth Distinguishing
It's worth separating what's actually being deployed into rough tiers, because the ethical weight differs a lot between them. Basic activity monitoring — tracking whether work is getting done, project completion, hours logged — is the least controversial category, and most people accept some version of it as a normal part of employment. Detailed activity tracking — keystroke logging, continuous screenshots, mouse-movement analysis — is a meaningfully more invasive tier, because it captures the texture of how someone works rather than just whether the work got done, often including things that have nothing to do with job performance. And then there's a smaller but real category of genuinely invasive monitoring — facial-expression or "emotion AI" analysis during meetings, biometric tracking, wellness-app data being used for HR decisions — that raises a different order of concern, because it extends surveillance into internal states and bodily information a job was never supposed to require access to.
The honest observation here is that a lot of monitoring software gets adopted for the middle tier without much scrutiny of whether the second tier's level of detail is actually necessary for the stated goal. A company that wants to know whether remote employees are getting their work done doesn't need a continuous keystroke log to answer that question — outcome-based measurement answers it directly, without capturing everything else a keystroke log incidentally captures along the way.
What the Law Actually Requires
The legal landscape genuinely diverges by jurisdiction in ways worth understanding concretely rather than assuming a uniform standard. In the EU, GDPR requires a lawful basis for monitoring, proportionality between the monitoring method and the actual risk being addressed, and real transparency about what's collected and why — a legal regime that puts the burden on the employer to justify surveillance rather than assuming it's permitted by default. In the US, the default runs the other way in most states, but there are real, specific exceptions worth knowing. New York State has required employers to give written notice before electronically monitoring employee communications since May 2022, with acknowledgment required at hiring and posted notice thereafter. Illinois's Biometric Information Privacy Act requires informed consent before collecting biometric data like fingerprints or facial geometry, and it's been the basis for some of the largest privacy settlements in US history — a real deterrent, not just a statute on paper. Beyond those specific state requirements, most of the US operates on a much thinner baseline of common-law privacy protection, which is exactly why the same monitoring practice can be a straightforward compliance violation in one state and essentially unregulated in another.
The Trust Question Underneath the Technology
The deeper issue isn't really about which specific technology gets deployed — it's about what a company's monitoring choices communicate about how much it trusts the people it hired. Outcome-based management, where a manager cares about deliverables and results rather than activity captured minute to minute, treats an employee as a capable adult who was hired for a reason. Detailed activity surveillance, applied broadly rather than in response to a specific, documented problem, communicates something closer to the opposite — a default assumption of suspicion that most employees will, correctly, read as exactly that.
I'd also flag the asymmetry that's common in how monitoring actually gets applied: heavier surveillance is often directed at lower-wage, more replaceable roles, while leadership faces little to none of the same scrutiny. That's worth noticing on its own, because a monitoring policy that only makes sense as something imposed on other people, and that leadership would object to having applied to themselves, is revealing something about its actual purpose beyond the stated business justification.
A Reasonable Framework for Employers
If I were setting monitoring policy, I'd apply a short set of tests before deploying anything: what specific, documented problem does this solve, and is there a less invasive way to solve it? Is the level of detail proportional to that problem, or does it capture far more than the stated justification requires? Have employees actually been told, clearly, what's monitored and why, rather than having it disclosed only in dense policy language nobody reads? And is the same standard applied consistently across levels of the organization, rather than only downward? A policy that survives all four of those questions honestly is probably defensible. A lot of currently deployed monitoring wouldn't survive the first one.
What Employees Can Actually Do
Knowing what's actually installed on your devices, and what your specific jurisdiction requires by way of notice, is the practical starting point — in states like New York, that notice is a legal requirement, not a courtesy, and you're entitled to ask for it directly. Keeping personal activity on personal devices, off the company network, remains the most reliable practical boundary regardless of what a specific company's policy says, since it removes the question of whether a given activity falls under a monitoring policy at all. And where monitoring data is used to make a consequential decision about you — a performance review, a termination — asking to see the actual data behind that decision, rather than accepting a manager's summary of it, is a reasonable and often underused request.
The technology to monitor nearly everything about how someone works now exists and is cheap to deploy. Whether a given company uses that capability with real restraint, or applies it simply because it's available, tells you something honest about how that company actually thinks about the people who work there — regardless of what the official values statement says.