Meta suspended its employee computer-usage tracking program on June 22, 2026, after a data security incident exposed sensitive employee information, Reuters reported. The pause capped months of escalating internal opposition that had already forced the company to make concessions once before.

The program, launched in April 2026, collected mouse movements and keystroke data from employee work machines to feed AI training models, Reuters reported. Meta's rationale was clear: behavioral data from actual users is increasingly hard to find, and employees already on company hardware represent a readily available source of interaction patterns—exactly what large language models need to improve. The company framed participation as consensual.

Employees saw it differently. By May 2026, more than 1,600 staff members had signed a petition opposing the program, and an in-person protest had taken place, Reuters reported. The timing mattered: the protest occurred roughly a week before Meta announced 10% workforce layoffs. Employees facing potential job loss while being monitored for productivity-adjacent behavior had little reason to trust that the program was research rather than surveillance. Their skepticism deepened the company's credibility problem.

Meta's first move, in early June, was to add pause and exemption options—a modification that quieted nothing, Reuters reported. When the security breach exposed data the program had collected, the company had exhausted its room to maneuver. A full suspension followed.

Regulatory law narrows the runway

Employee resistance was only half the problem. Meta's plan to collect behavioral data from staff in Europe collided with EU data protection law, specifically GDPR requirements that workplace surveillance must meet strict tests of necessity and proportionality, Reuters reported in late May. European regulators treat employee monitoring as a high-risk form of data processing. Keystroke logging—capturing both the content and timing of typed input—falls at the most invasive end of that scale.

This constraint applies beyond Meta. Tech companies across the industry are trying to source AI training data from internal behavioral signals, where consent and data ownership are murkier than with publicly available content. GDPR's restrictions on automated processing and its employee-protection provisions are not written specifically for AI use cases, yet they apply with full force. Any organization operating in Europe that wants to pursue Meta's strategy faces the same regulatory hurdle.

The pause leaves the future unresolved

A pause is not a cancellation. Meta has not announced the program is dead—only that it is investigating the security incident before deciding what comes next. The breach was the immediate trigger, but it does not settle the deeper policy question: whether the program, once repaired or redesigned, could legally or practically resume.

The 1,600-person petition signals real internal discontent but does not bind Meta's hand. The company has previously absorbed employee opposition on return-to-office mandates and performance management changes and moved forward anyway. The sturdier constraint may be regulatory pressure. A formal inquiry from European data protection authorities could force any redesigned version to be substantially narrower in scope to pass review.

Broader context matters here. The tech industry faces a genuine problem: synthetic data and licensed datasets each have limitations; behavioral data from real users remains genuinely valuable for training AI models. Yet Meta's experience suggests that capturing it at large scale inside a company—where employees have job security concerns, collective organizing potential, and legal protections—presents obstacles that even a company with Meta's technical sophistication cannot easily overcome.

The program's ultimate fate hinges on three unknowns: what Meta's security review reveals, how regulators respond, and whether leadership decides the value of the data justifies the ongoing internal friction. None of these questions have answers yet.