# 9 Workplace Monitoring Apps All Share Your Data. Here's Which Ones — and What Gets Sent. > A joint study from Columbia Law School, Northeastern, Vanderbilt, and UC Berkeley tested nine widely-used 'bossware' platforms — Hubstaff, Time Doctor 2, Deputy, and six others — and found all of them share worker names, emails, and employer info with Facebook, Google, Microsoft, and Yandex. Here's exactly what gets sent, where it goes, and what professionals can do today. **Author:** [Alex Lowe](https://theaicareerlab.com/about) — Founder, The AI Career Lab **Published:** 2026-08-23 **Canonical URL:** https://theaicareerlab.com/blog/bossware-workplace-monitoring-data-2026 **Category:** industry-news **Tags:** data privacy, workplace monitoring, bossware, Hubstaff, Time Doctor, Deputy, worker privacy, AI tools, industry news, 2026 ---If your employer uses software to track your work time or productivity, there is a good chance that software is also quietly forwarding your name, email address, employer name, and browsing activity to Facebook, Google, and — in some cases — Yandex, the Russian search engine. That is the central finding of a joint investigation by researchers from Columbia Law School, Northeastern University, Vanderbilt University, and UC Berkeley, published in May 2026 and receiving wide attention this week after Fortune's deep-dive coverage. ## What the researchers tested The study examined nine workplace monitoring platforms that millions of workers use daily to clock in, log hours, and document their activity: - Apploye - Buddy Punch - Deputy - Desklog - Hubstaff - Monitask - Time Doctor 2 - Vericlock - When I Work These are not obscure tools. Hubstaff and Time Doctor 2 are among the most-used remote-work trackers. Deputy is deployed by major retailers including Ace Hardware, Ben & Jerry's, CVS Pharmacy, and Dunkin'. ## What they found Every single one of the nine platforms shared identifying worker information with outside companies. The researchers documented **121 unique instances of data being shared** with companies including Facebook (Meta), Google, Microsoft, and the ad-tech firm AppLovin. The platforms collectively transmitted data to **145 distinct third-party domains** — a list that includes yandex.com, the dominant Russian search engine and ad network. Shared data included: - **Names and email addresses** — identifiers that tie tracking data to a real person - **Employer name** — allowing ad companies to build accurate professional profiles - **IP addresses and device identifiers** — enabling cross-site tracking - **Browsing history** — URLs visited and when - **Unique tracking IDs** — persistent identifiers that follow you across sites Beyond data sharing, **one-third of the apps tracked workers' precise GPS location continuously** — even when running in the background and even when employees were off the clock. Three of the nine apps required access to workers' phone motion sensors simply to clock in. ## Why Yandex matters Yandex is Russia's largest technology company. It operates a digital advertising network whose SDKs are embedded in many apps, often without the app maker's customers knowing — similar to the way Google Analytics or Facebook Pixel gets bundled into third-party software. The presence of Yandex as a data recipient in employer monitoring software is notable because Yandex operates under Russian law, which can compel companies to share data with state security agencies. The researchers did not allege deliberate data sales to Russian authorities — but they flagged Yandex's presence as warranting specific regulatory attention. ## What this means if you use AI tools at work Two things connect this directly to professionals using Claude, ChatGPT, or Gemini at work. **First, AI tools on company devices are visible to monitoring software.** Most bossware logs URLs visited, active applications, and — in some configurations — screenshots or keystrokes. If you run Claude.ai, ChatGPT, or Gemini in a browser on a company laptop, that monitoring software may record your sessions, including what you type. That data then flows, through the monitoring platform, to the third parties documented in this study. **Second, the monitoring tools themselves now use AI.** Hubstaff uses AI to generate productivity summaries and flag "low activity" periods. Time Doctor 2 includes AI screenshot analysis that classifies whether captured screens show work-relevant content. When worker activity data flows to 145 third-party domains, some of it may enter the machine learning pipelines those companies use to train future AI systems — with no meaningful disclosure to the workers who generated it. ## What the law currently requires Most states have no specific law governing employee monitoring. But four states impose notification requirements: - **Connecticut, Delaware, and New York** require employers to notify employees in writing before electronic monitoring begins. Delaware and New York require written acknowledgment from employees; Connecticut and New York require visible workplace posters. - **Maine** went further with a new law effective **July 14, 2026**. It imposes disclosure requirements, sets substantive limits on certain monitoring practices, and explicitly gives employees the **right to refuse monitoring software on their personal devices**. If you work in one of these four states and were never informed about monitoring, ask HR. That may be an employer compliance issue. ## What you can do now The researchers recommend legislative action: bans on data sharing, caps on data retention, and disclosure requirements at the federal level. That will take time. In the meantime: 1. **Ask IT what's installed.** You can ask what monitoring tools run on your work devices and which features are enabled. Some features — like location tracking — can be toggled off by administrators. 2. **Keep personal accounts on personal devices.** Banking, personal email, and personal AI tool sessions belong on hardware you own, not your employer's. 3. **Know your state.** Connecticut, Delaware, New York, and Maine have notification requirements. If you're in one of these states and were never told about monitoring, your employer may have a compliance gap. 4. **Read your onboarding documents.** Most monitoring practices are disclosed in employment contracts, acceptable-use policies, or onboarding paperwork. Find out exactly what you agreed to. 5. **Be careful with what you type into work-device AI tools.** If your employer uses any of the nine platforms above, assume your AI sessions on company hardware may be logged — and may be flowing to ad networks. Sensitive client data, proprietary code, and personal information belong in sessions on personal devices with verified privacy settings. The researchers describe current worker privacy protections as "insufficient" and have called on the FTC to examine whether these practices violate consumer protection law. No federal enforcement action has been announced as of August 23, 2026. --- ## Sources - [Fortune: "Your boss's monitoring app didn't just watch you — it shared your data to Facebook and a Russian search engine"](https://fortune.com/2026/08/23/bossware-data-shared-facebook-yandex-workers/) — August 23, 2026 - [Northeastern University: "Worker data is ending up with third parties, Northeastern study finds"](https://news.northeastern.edu/2026/05/21/employee-monitoring-software/) — May 21, 2026 - [Vanderbilt Law School: "Research Shows Bossware Is Spying on Workers and Sharing Their Data"](https://law.vanderbilt.edu/research-shows-bossware-spying-on-workers-and-sharing-their-data/) — May 2026 - [UC Berkeley Center for Consumer Law & Economic Justice: "New Research Investigation Shows 'Bossware' Is Spying on Workers and Sharing Their Data"](https://consumerlaw.berkeley.edu/news/new-research-investigation-shows-%E2%80%98bossware%E2%80%99-spying-workers-and-sharing-their-data/) — May 2026 - [Littler: "Maine Joins Three Northeastern States in Regulating Workplace Electronic Monitoring"](https://www.littler.com/news-analysis/asap/maine-joins-three-northeastern-states-regulating-workplace-electronic-monitoring) — 2026 - [Fisher Phillips: "Maine Sets New Restrictions on Workplace Monitoring and Surveillance"](https://www.fisherphillips.com/en/insights/insights/maine-sets-new-restrictions-on-workplace-monitoring-and-surveillance) — 2026 ## Frequently asked questions ### Which workplace monitoring apps were found sharing employee data? The researchers tested nine platforms: Apploye, Buddy Punch, Deputy, Desklog, Hubstaff, Monitask, Time Doctor 2, Vericlock, and When I Work. Every single one shared worker names, email addresses, and employer information with outside companies. These are widely-used tools — Deputy is used by Ace Hardware, Ben & Jerry's, CVS Pharmacy, and Dunkin'; Hubstaff and Time Doctor 2 are among the most popular remote-work trackers. ### What data do these monitoring apps share, and with whom? The study documented 121 unique instances of worker data shared with companies including Facebook (Meta), Google, Microsoft, and the ad-tech firm AppLovin. The platforms collectively transmitted data to 145 distinct third-party domains — including yandex.com, the Russian search engine. Shared data included: names and email addresses, employer names, IP addresses and device identifiers, browsing history and URLs visited, and unique tracking IDs that can be linked across sites. ### Why is Yandex receiving my workplace data? Yandex, Russia's largest search engine, also operates a digital advertising network that many apps integrate without their customers knowing. Monitoring platforms appear to have embedded Yandex analytics or ad SDKs as components — the same way many apps include Google Analytics or Facebook Pixel. This isn't necessarily an intentional data sale to a Russian company, but Yandex operates under Russian law, which can compel companies to share data with security agencies. The researchers flagged this as a concern warranting regulatory scrutiny. ### Do these apps track my location even when I'm off the clock? One-third of the nine apps studied track precise GPS location continuously — including when the app runs in the background and when employees are off the clock. Three of the nine required access to workers' phone motion sensors simply to clock in, even when location tracking was not an obvious part of the app's function. ### I use AI tools like Claude or ChatGPT on my work laptop. Does bossware see that? Likely yes, if your employer runs one of these monitoring tools. Most bossware records URLs visited, app usage, and (in some cases) screenshots or keystrokes. Your Claude.ai or ChatGPT sessions — including what you type — may be visible to your employer's monitoring dashboard and, through that software, to the third parties identified in this study. If your work involves sensitive client data, this is worth knowing before you paste it into any AI tool on a company device. ### What can I do if my employer uses one of these monitoring apps? First, ask IT what monitoring tools are installed — you have a right to know. Second, keep personal accounts (banking, personal email, personal AI tools) on personal devices, never company hardware. Third, check your state's laws: Connecticut, Delaware, and New York require employers to notify employees in writing before monitoring; Maine's law (effective July 14, 2026) goes further, imposing disclosure requirements, substantive limits on monitoring practices, and giving employees the right to refuse monitoring software on their personal devices. If you work in one of these states and were never notified, ask HR about your employer's disclosure policy. ### Is it legal for these apps to share my data like this? That question is currently being examined by regulators. The researchers call on federal agencies to investigate whether these practices violate the Fair Credit Reporting Act or the FTC's authority over Unfair and Deceptive Acts & Practices. As of August 2026, no enforcement action has been announced. Employment contracts typically authorize broad monitoring — if you signed an acceptable-use policy or monitoring disclosure at onboarding, that likely covers much of this. But sharing with third-party ad networks may go beyond what those disclosures contemplate. ### Are these monitoring tools using AI? Many now do. Hubstaff uses AI to generate productivity summaries and flag low-activity periods. Time Doctor 2 includes AI screenshot analysis that attempts to classify whether captured screens show work-related content. When worker data flows to the 145 third-party domains identified in the study, it may also enter machine learning pipelines that train future AI systems — meaning your work activity can become training data for AI models, with no meaningful disclosure to you. --- *Canonical version: https://theaicareerlab.com/blog/bossware-workplace-monitoring-data-2026* *This document is the Markdown companion served for AI crawlers and answer engines. See the canonical URL for the rendered version with navigation, related content, and interactive elements.*