Columbia Law study reveals bossware platforms share employee data with Meta and Google

A comprehensive review led by Stephanie Nguyen, senior fellow at Columbia Law School’s Center for Law and the Economy, has found that all nine workplace monitoring applications examined share employee data with third parties, including major digital advertising platforms such as Meta and Google. The study, which scrutinised software commonly referred to as ‘bossware’, revealed that transmitted information ranged from basic identifiers like names and email addresses to behavioural data including web history and IP addresses.

Nguyen, a former Federal Trade Commission chief technologist, noted the universality of the findings. “The striking piece of this study is that every single platform, nine of nine bossware companies, shared worker data with outside companies,” she told The Verge. “That blew me away.” The recipients of this data included Facebook, Google, and Microsoft, raising concerns about how employee activity is being aggregated by entities primarily focused on digital advertising.

The nine platforms analysed were Apploye, Desklog, Hubstaff, Monitask, Buddy Punch, VeriClock, When I Work, Deputy, and Time Doctor. Collectively, these services serve hundreds of thousands of workplaces, with disclosed customers including Amazon Ring, Ben & Jerry’s, Ticketmaster, Verizon, and Tesla. To determine data flows, researchers created trial accounts for managers and workers, intercepting network traffic with open-source tools to identify what information was being transmitted and to which services.

Deputy’s Chief Technology Officer, Ciaran Hale, disputed the findings, stating that the company’s third-party relationships are limited to trusted operational providers. Hale suggested that researchers conflated standard B2B marketing cookies on the company’s public website with its secure employee application. Nguyen countered that the study tracked the full user experience from logging into deputy.com, confirming that personal information was sent to third parties whenever the application was used, regardless of whether the user was a worker or a manager.

Seven of the nine platforms did not immediately respond to requests for comment. Time Doctor provided information about data sharing via an AI assistant but did not provide a response from a human spokesperson. The report also noted that three of the nine platforms possess the capability to track precise worker location even when the app is running in the background.

The researchers warned that this data sharing could contribute to a “shadow worker reputation economy,” where disparate information is gathered into centralized profiles that follow individuals long after they leave their jobs. This practice allows third parties to make inferences about worker behaviour, such as perceived distraction or intent to leave an employer. The report argues that workers typically lack the ability to meaningfully refuse such surveillance without risking their livelihoods.

In response to these risks, the report proposes regulatory interventions, including bans on sharing worker data with third parties and limits on data retention. Nguyen urged state and federal law enforcers to consider whether such data collection violates existing privacy laws or the Fair Credit Reporting Act, particularly if used to make employment decisions based on inferences about health or fitness derived from movement tracking.