Study: All Nine Bossware Platforms Tested Shared Worker Data With Third Parties Including Facebook and Google

Workplace monitoring software shares far more about employees than most employers or workers realize, according to a study by researchers at Northeastern University’s Khoury College, Vanderbilt Law School’s Policy Accelerator, UC Berkeley’s Center for Consumer Law and Economic Justice and Columbia Law School. Fortune highlighted the findings on Sunday.

How the Researchers Tested It

The team signed up as an employer, deployed nine widely used monitoring platforms for workers and then logged in as an employee to capture everything the apps and websites sent to outside parties, according to the researchers’ release. The platforms were Apploye, Deputy, Desklog, Hubstaff, Monitask, Buddy Punch, Time Doctor 2, Vericlock and When I Work. The research group included technologists and former staff of the Federal Trade Commission and the Consumer Financial Protection Bureau.

What They Found

• Identifying data shared: All nine platforms sent workers’ first and last names, email addresses and employer names directly to third parties. The researchers logged 121 unique instances involving companies including Facebook, Google, Microsoft and the ad platform AppLovin.
• Online activity shared: The apps sent IP addresses, device information, pages visited and unique identifiers to 145 third-party domains, including facebook.com, linkedin.com, bing.com, google.com, stripe.com and yandex.com.
• Location tracking: A third of the platforms can track a worker’s precise location at any time, including when the app runs in the background and potentially after the worker clocks out. Three of the nine can require access to motion sensor data to clock in.

The researchers said much of this sharing is not clearly disclosed and in some cases may contradict the platforms’ own privacy policies. “There is enormous potential for harm—not just as it relates to privacy writ large, but also specifically in the context of maintaining current and future employment,” said David Choffnes, a professor at Northeastern’s Khoury College.

The report recommends banning the sale or sharing of worker data, limiting how long it can be kept and barring collection of sensitive employee information. It also asks enforcement agencies to examine whether current practices violate laws such as the Fair Credit Reporting Act. Fortune noted that New York, Connecticut, Delaware and Maine already require employers to tell workers when they are monitored.

What IT and HR Leaders Should Check

Most of this sharing comes from analytics and advertising code embedded in the platforms’ apps and web dashboards, not from features employers deliberately switch on. Companies that license monitoring tools should ask vendors for a full list of third-party SDKs and trackers, review which location and sensor features are enabled by default and confirm that data flows match what employees have been told. A tool bought to measure productivity can otherwise create a privacy and compliance problem the employer never intended.