The pitch is familiar: time-tracking software is a neutral tool, a way to bill clients accurately or spot workflow bottlenecks. But a growing body of research suggests that many of these platforms do something far beyond measuring hours. They quietly collect worker data — name, email, browsing activity, sometimes location — and share it with third parties most employees have never heard of. Most of what’s documented here comes from a single investigation by researchers at Northeastern University, Vanderbilt University, UC Berkeley, and Columbia Law School, who signed up as employers, deployed nine common monitoring platforms, and captured everything those platforms transmitted to outside companies. What they found raises questions that go well beyond productivity.
The data you didn’t know was leaving your company
The investigation looked at nine platforms: Apploye, Deputy, Desklog, Hubstaff, Monitask, Buddy Punch, Time Doctor 2, Vericlock, and When I Work. Every single one directly shared identifying worker information — first name, last name, email, company — with third parties. In total, the researchers logged 121 unique instances of worker data being sent to companies including Facebook, Google, Microsoft, and AppLovin. That’s not a leak. That’s routine infrastructure. The data flows through analytics services, advertising networks, and cloud telemetry systems that are embedded in the software’s code, often without any clear disclosure to the person being tracked.
Beyond names and emails, nine platforms also transmitted online activity data — IP addresses, device identifiers, web pages visited — to 145 unique third-party domains. Some of those domains are familiar: facebook.com, linkedin.com, bing.com, google.com, googletagmanager.com, stripe.com, yandex.com. Others less so. The result is a digital trail that extends far beyond the employer’s control, and far beyond what most workers would reasonably expect when they clock in.
This isn’t a hypothetical risk. The researchers documented that a third of the platforms have features that can track a worker’s precise location at any time, even when the app is running in the background or the employee has clocked out. Three of the nine can require motion sensor data — accelerometer or gyroscope — just to clock in. The full report, published through Columbia Law School’s Center for Law and the Economy, calls for urgent policy action: banning the sale or sharing of worker data, prohibiting unlimited data retention, and barring collection of sensitive information.
Who’s getting your keystrokes and location (without asking)
The privacy concerns don’t stop at third-party data sharing. Many employee monitoring applications, or EMAs, operate in what’s called “invisible mode” — running in the background without the employee’s knowledge. A survey of managers and employers in Canada, published in the Canadian Review of Sociology, found that the most frequently used tools include apps like Kickidler, Spyera, Flexispy, and Teramind, all of which collect data using at least two highly invasive features: video surveillance and keystroke logging.
The same survey, conducted by University of Waterloo researchers, reported that 87.1% of managers were at least somewhat concerned about the negative impact of these tools on employee trust. Yet 51.7% continued using them anyway. When asked if they would be more likely to adopt an app without invasive features like keystroke logging and video surveillance, 70.7% said yes. That gap — between what managers worry about and what they actually deploy — suggests many organizations aren’t asking hard questions about the tools they choose.
It’s one thing to know your employer tracks billable hours. It’s another to wonder whether a random screenshot or a keystroke log is being fed into an advertising system or a data broker’s database. That feeling — of being watched by people you never agreed to share data with — is exactly what the research is documenting.
The Los Angeles Times reported on the experience of pharmacist Lannie Duong, whose employer tracked the length of every phone call and patient appointment. Performance evaluations questioned her pace. She described feeling unrelenting pressure, not trusted, and ultimately went on medical leave. Her employment was terminated after that leave. In another case reported by the Times, a college administrator read student papers uploaded to a learning management system — along with a professor’s comments on that work — and used the professor’s casual tone to question their teaching. The professor’s contract was not renewed. Neither case involves time-tracking software specifically, but both illustrate the broader culture of workplace surveillance that monitoring tools enable.
The productivity-accuracy trade-off that nobody talks about
There’s a reason employers reach for these tools. Inaccurate retroactive timesheets cost the U.S. economy an estimated $7.4 billion daily in lost professional services productivity, according to Harvard Business Review research. Workers who track time weekly achieve only about 47% accuracy. So the argument for automated tracking has real weight — especially for small firms where revenue leakage from unbilled hours can erode profitability.
But the same research that justifies tracking also reveals a tension: when employees understand how monitoring data is used and perceive it as fair, performance improves and trust holds steady. That’s a finding from the Journal of Business and Psychology, cited in a Handdy blog piece that summarizes the industry debate. The problem is that many implementations skip the fairness part entirely. They roll out tracking without explaining what data leaves the company, how long it’s kept, or whether it’s shared with third parties. That’s where the hidden data trail becomes a trust bomb.
If your employer introduced time-tracking software during the remote-work boom without a clear policy on data retention and third-party sharing, it’s likely the tool is sending more data outward than anyone reviewed. The default settings on many platforms enable analytics and marketing integrations.
What the law says (and doesn’t say) about workplace surveillance
Legal protections for workers against digital surveillance are patchy. New York, Connecticut, Delaware, and Maine now require employers to notify workers if they’re being monitored. Maine goes further, prohibiting visual monitoring in employees’ homes or personal vehicles unless the job duties require it — a telehealth nurse needs a camera, but a productivity webcam pointed at a desk almost certainly doesn’t qualify. These state laws are steps forward, but they only address notification, not the scope of data collection or sharing.
Ontario’s Bill 88, passed in April 2022, was the first notification law for electronic monitoring in Canada. But as legal scholars have noted, notification alone does little to protect privacy or well-being. The report from the Vanderbilt-led investigation urges enforcement agencies to examine whether current monitoring practices violate the Fair Credit Reporting Act or state Unfair and Deceptive Acts and Practices statutes. That’s a signal that regulators are beginning to look at the data trail, not just the presence of a tracking tool.
Under the GDPR, employers need explicit consent and clearly defined data retention policies for monitoring tools. But many U.S.-based platforms operate globally, and the enforcement gap is wide. Industry guidance suggests that companies using these tools may face tougher compliance obligations as regulators in Europe and elsewhere tighten rules on cross-border data transfers.
What you can actually do about it
The most practical step is to treat any work-issued device as a monitored environment. Don’t use it for medical searches, private messages, or anything you wouldn’t want a third party to see. That’s tedious — switching between phones for personal tasks — but it’s the simplest way to limit exposure.
If you’re comfortable raising the issue at work, approach it with curiosity rather than accusation. You might ask your manager or IT department: “I’ve been reading about how some time-tracking tools share data with outside companies. Do we know what our platform sends out and to whom?” The IT team often activates features without deep review of the privacy settings. A question like that can prompt a conversation that benefits everyone.
The researchers also recommend coordinating with a union if you have one. Without a union, you can still ask about data retention policies and whether the organization has done a privacy audit. The essential privacy steps we’ve covered before — like auditing your home network and securing personal devices — become even more important when you know your work machine is potentially broadcasting data to dozens of third parties.
- Check what monitoring software is installed on your work device — look for processes running in the background, or ask IT directly.
- Review your employer’s privacy policy for any mention of data sharing with third parties.
- If you use a time-tracking app on your personal phone, check its permissions and disable location access when not clocked in.
- Keep personal browsing and sensitive conversations on a personal device, not the work machine.
There’s a larger question here about what kind of workplace we’re building. The tools themselves aren’t inherently malicious — a transparent time tracker used for project scoping, with data visible first to the employee and kept in-house, can actually protect workers from unrealistic deadlines and unfair workloads. But the default configuration of many platforms is the opposite: opaque, data-hungry, and connected to an advertising ecosystem that has nothing to do with productivity.
Knowing that trail exists is the first step. The next is deciding whether to ask questions, push for policy changes, or simply guard your personal information more carefully. None of those options are perfect, but they’re better than assuming the software only does what it says on the tin.
Most of the documented evidence in this article comes from a single research collaboration — the investigation by Vanderbilt Policy Accelerator, Northeastern University, UC Berkeley, and Columbia Law School — and from reporting by the Los Angeles Times and The Conversation. The picture they paint is consistent: the hidden data trail is real, it’s widespread, and it’s largely invisible to the people generating the data. That doesn’t mean every time-tracking tool is a privacy violation, but it does mean we should stop pretending they’re just punch clocks.