Inside Meta’s MCI: How Employee Keystroke Tracking Sparked a Privacy Revolt

In April 2026, Meta installed tracking software on US employee work laptops that logged far more than the company initially let on. The initiative, internally called the Model Capability Initiative (MCI), was designed to harvest real-world computer interactions — keystrokes, mouse clicks, scrolls, and screenshots — to train AI agents that could one day perform those same office tasks autonomously . What followed was a months-long internal crisis that exposed sharp tensions between Meta’s aggressive AI ambitions and its own workforce’s privacy, culminating in rare public concessions from leadership.

What MCI actually collected — and where

MCI wasn’t a lightweight telemetry tool. According to a list Meta shared with staff, the software monitored activity across more than 200 applications and websites . The roster included core workplace tools like Gmail, GChat, Google, LinkedIn, GitHub, Slack, Wikipedia, and VSCode, along with Meta’s own internal AI assistant, Metamate .

The data it captured was granular: mouse movement paths, click locations, keystroke sequences, and periodic screen captures, all to teach AI models how humans navigate software interfaces . Meta insisted the program was not about measuring productivity or evaluating individual performance, but about building AI agents that can execute everyday digital tasks .

The backlash: no opt-out, no exceptions

When the tool was announced, the foremost question inside the company was how to decline participation. The answer from CTO Andrew Bosworth was unambiguous: “There is no option to opt out of this on your work provided laptop.” The response, posted on an internal thread, was met with a flood of crying, shocked, and angry-face emoji reactions from employees .

Dissent quickly took multiple forms:

• Petition and protest flyers: More than 1,000 employees signed an internal petition demanding the program be stopped, and some posted physical flyers in Meta’s offices .
• Viral parody video: Software engineer David Frenk produced a satirical video targeting MCI. It spread widely inside the company and on external platforms like Blind .
• Union organizing: UK-based staff escalated their privacy objections into a formal union organizing drive with the United Tech and Allied Workers .

Privacy and security red flags

GDPR collision course

Internal documents reviewed by Reuters showed that MCI’s reach was wider than Meta’s public statements suggested. In an internal FAQ, the company acknowledged that if a US-based employee with the tool enabled exchanged emails or chat messages with a colleague outside the US — including in the EU — that entire conversation was captured . Because Meta dissociated the data from employee identities, the company stated it could not individually search or delete the records — a direct conflict with GDPR rights around access, rectification, and erasure .

Privacy advocates warned this could violate the GDPR’s purpose limitation principle. Kleanthi Sardeli, a legal expert at the Vienna-based advocacy group NOYB, told Reuters that “taking an employee’s chat and ingesting it into an AI model is incompatible with the initial purpose of work communication” .

Unencrypted storage and security tool integration

The security posture of the collected data added another layer of concern. Reports indicated that MCI data was stored in an unencrypted format and was integrated directly with Meta’s existing data security software, raising fears about potential exposure or misuse if the data were ever accessed by unauthorized parties . Employees also complained about a noticeable surge in data traffic on their machines while the tool was running .

The concessions Meta actually made

The sustained internal pressure produced a shift, though a limited one. On June 2, 2026, a memo from Stephane Kasriel, a vice president in Meta’s Superintelligence Labs unit, announced that the company was scaling back the program in response to staff concerns .

The concrete concessions were:

• A pause control that allowed employees to halt data collection for up to 30 minutes at a time.
• A commitment to reduce the scope of what the tool tracked.

Critically, the company did not reverse the no-opt-out policy. Full exemption from MCI remained unavailable for employees using company-issued devices .

The layoff context: “training their own replacements”

The surveillance rollout did not happen in a vacuum. It landed inside a company undergoing the largest AI-driven workforce restructuring in its history:

• 8,000 employees laid off (roughly 10% of the global workforce), with termination emails arriving as early as 4 AM on May 20, 2026 .
• 7,000 employees forcibly reassigned to AI-focused teams .
• 6,000 open positions closed, meaning roughly 20% of Meta’s approximately 78,000-strong workforce was affected .

For many inside Meta, the sequence felt dystopian: workers were being required to generate the very training data that would teach AI agents to perform their jobs, even as thousands of their colleagues were being let go. The internal narrative — that employees were being forced to train their own replacements — was captured bluntly in coverage by TechTimes and other outlets tracking the controversy .

The MCI saga became a case study in how the race to build autonomous AI agents can collide with labor relations and privacy law, forcing even the largest tech companies to make concessions — but not yet full reversals.