Meta's AI training tool for employees may spark new EU privacy concerns

Meta is reportedly collecting detailed software usage data from US employees to train AI systems, a move that could raise GDPR-related concerns in Europe

Meta is reportedly planning to collect detailed records of US employees’ computer usage to train its AI models, a move that could have broader privacy implications. According to a Reuters report, the initiative may draw the company into another privacy dispute in Europe.

 

The tool, called the Model Capability Initiative (MCI), is currently deployed on devices used by US-based employees and is intended to collect data on how people perform tasks across software applications.

 

However, Reuters reported that Meta has acknowledged the system could also capture communications involving employees outside the United States, including those in the European Union, potentially raising questions under the bloc’s strict data protection rules.

 

What is Meta’s AI training initiative about?

According to Reuters, Meta launched the Model Capability Initiative as part of a broader effort to develop AI agents capable of performing software tasks autonomously.

 

The company has reportedly told employees that the system collects information about how people interact with computers, including mouse movements, clicks, menu navigation and workflows across different applications.

 

Reuters reported that the tool tracks activity across more than 200 apps and websites. Meta said the objective is to understand how people use software so future AI agents can learn to perform similar tasks independently.

 

In a statement to Reuters, Meta said the tool is installed only on devices used by US employees and focuses on computer interactions rather than the content displayed on screens. The company added that it had assessed and mitigated privacy risks during the development and deployment of the system.

Who could be affected?

While Meta says the programme is targeted at US employees, Reuters reported that internal company documents suggest the scope may extend beyond them in certain situations.

 

According to an internal FAQ reviewed by Reuters, if a US-based employee with the tool enabled exchanges emails or chat messages with a colleague outside the US, that activity could also be captured by the system.

 

Reuters noted that this means communications involving EU-based employees may be recorded even if those employees are not directly participating in the programme.

 

The report also said Meta informed non-US employees that the tool had been deployed on the devices of their US-based colleagues and that communications exchanged during routine work could be affected.

Why could this create problems in Europe?

Reuters reported that privacy advocates believe the initiative could raise compliance questions under the European Union’s General Data Protection Regulation (GDPR), one of the world’s strictest privacy frameworks.

 

Under GDPR, organisations generally require a clear legal basis to process personal data, must disclose what information is collected and how it will be used, and are subject to strict rules when handling certain categories of information.

 

Privacy experts cited by Reuters argued that communications originally collected for workplace collaboration may not automatically be repurposed for AI training without further justification.

 

According to the report, Meta told employees that data collected through MCI would be dissociated from identifying information and therefore could not be searched or deleted for individual users.

 

Some privacy experts told Reuters that even limited or indirect capture of EU employee data could potentially conflict with GDPR requirements, which grant individuals rights over their personal data.

 

The report noted that Meta has informed Ireland’s Data Protection Commission, its lead regulator in the European Union, that neither EU employee data nor screen recording falls within the primary purpose of the initiative.

Employee concerns emerge

Beyond privacy concerns, Reuters reported that the initiative has also faced internal criticism from some employees.

 

According to the report, some workers claimed the tool consumed unusually large amounts of internet bandwidth, with a few reporting that it used significant portions of their monthly home internet data allowances within a short period.

 

Reuters said Meta declined to provide detailed information about the volume of data being collected.

 

The report also cited employee concerns about the scale of information being gathered. Some workers argued that analysing detailed computer usage patterns could enable Meta to build increasingly sophisticated AI systems capable of replicating aspects of knowledge-based work.

 

Meta disputed some of those characterisations, with a company spokesperson telling Reuters that certain employee claims about the tool’s capabilities were fundamentally inaccurate.

Why this matters

The initiative highlights how technology companies are increasingly seeking large datasets to train AI systems capable of performing complex workplace tasks.

 

Reuters reported that MCI forms part of Meta Chief Executive Officer Mark Zuckerberg’s broader push towards AI agents that can automate software workflows and assist with digital work.

 

At the same time, the report suggests the project could become another test case for how AI development intersects with privacy regulation, particularly in Europe.

 

If regulators determine that communications involving EU employees are being collected or processed in ways that conflict with GDPR requirements, Meta could face additional scrutiny from European authorities.

 

For employees and users more broadly, the development underscores a growing debate across the technology industry about how much behavioural data can be collected to train increasingly capable AI systems, and where privacy regulators may draw the line.