Meta suspended its company-wide employee computer-usage tracking program on June 22, 2026, citing a data security incident that exposed sensitive employee data, Reuters reported. The pause followed months of escalating internal resistance that had already forced the company to modify the program once before.

The program, announced in April 2026, was designed to harvest mouse movements and keystroke data from employees' work machines for use as AI training data, Reuters reported at the time. Meta positioned it as a way to generate proprietary behavioral data at scale — an increasingly scarce input in the generative AI race. The logic was straightforward: employees already working on company hardware represent a captive, consented (in Meta's framing) source of interaction data.

Staff disagreed sharply. By May 2026, employees had organized an in-person protest against the tracking software — notably, about a week before the company announced planned 10% workforce layoffs, Reuters reported. The timing intensified distrust: workers being tracked for their productivity-adjacent behavior while facing imminent headcount cuts had obvious reasons to view the program as surveillance first and research second. More than 1,600 employees eventually signed a petition opposing the program, Business Insider reported.

Meta's initial response in early June was to add pause and exemption options — a partial concession, not a withdrawal, Reuters noted. That modification did not contain the pushback. When the security incident emerged, exposing employee data collected by the program, the company had little room left to maneuver. A full pause followed.

Regulatory exposure compounds internal pressure

The internal fracture ran alongside a separate compliance problem. Meta's plan to collect granular behavioral data from employees in Europe put it on a collision course with EU data protection law, specifically the requirements under GDPR that workplace surveillance meet high thresholds of necessity and proportionality, Reuters reported in late May. European data protection authorities have historically treated employee monitoring as a high-risk processing activity. Keystroke logging — capturing the literal content and cadence of typed input — sits at the more invasive end of that spectrum.

The EU angle matters beyond Meta. Across the tech sector, the push to source AI training data from internal behavioral signals — where consent and ownership are murkier than with publicly scraped content — is running into the same regulatory architecture. GDPR's restrictions on automated processing and its employment-context provisions are not tailored specifically to AI, but they apply with force. Any company operating in Europe that wants to replicate Meta's approach faces the same compliance calculus.

What the pause leaves open

A pause is not a cancellation. Meta has not said the program is dead, only that it is examining data security issues before deciding next steps. The security incident that triggered the pause was the proximate cause; it does not resolve the underlying policy questions about whether the program, fixed or redesigned, could resume.

The 1,600-signature petition is a meaningful signal of internal sentiment but not a veto. Meta has demonstrated in prior workforce episodes — return-to-office mandates, performance management overhauls — a willingness to absorb employee dissatisfaction and proceed. The more durable constraint may be regulatory. If European data protection authorities open a formal inquiry, the scope of any redesigned program would need to be substantially narrower to survive scrutiny.

For the AI training data market more broadly, the episode is a data point in an argument that has no clean resolution yet. Synthetic data, licensed datasets, and publicly available text corpora each carry their own limitations; proprietary behavioral data from internal users is genuinely attractive as a training signal. But as Meta's experience suggests, capturing it at scale inside a corporation — with employees who have job security concerns, union-adjacent organizing capacity, and regulatory protections — is not straightforwardly achievable, even for the company that built the infrastructure to track billions of external users.

The program's fate now depends on what Meta's security review finds, how regulators respond, and whether leadership judges the data value worth the continued friction. None of those questions are settled.