Meta's AI spy tool is capturing EU employee data: Here’s why

Meta's internal tool for harvesting employee computer behaviour to train its AI models is ingesting data from more than 200 apps and websites, and internal documents seen by Reuters confirm it is pulling in communications from non-US workers in the process.

Introduced just last month under the name Model Capability Initiative (MCI), it was sold to Meta employees as a way of tracking how people use computers, everything from mouse movements and clicks to navigating through menus to create AI agents that could carry out software tasks autonomously.

However, according to reports published to Reuters after independent review of logs created using existing data security software, it appeared that MCI was simply added on top of that software.

This meant that it was able to track changes to code and sleep/wake cycles of computers, as well as clipboard contents and the websites visited. In one report an employee said the information would allow the creation of "a complete behavioural model of how a knowledge worker does their job".

Its own FAQ document confirmed the opposite for anyone communicating with those employees. "If a US-based colleague has the tool enabled while GChatting or emailing with someone outside the US, that activity would be captured," the document states.

Kleanthi Sardeli, a legal expert at privacy group NOYB, said the core problem is one of purpose. Data gathered during normal work communication cannot simply be redirected into AI training without a fresh legal basis.

"Taking an employee's chat and ingesting it into an AI model is incompatible with that initial purpose," she told Reuters. Meta has informed its lead EU regulator, the Irish Data Protection Commission, that EU employee data capture falls outside MCI's primary purpose, though the DPC offered no further comment.