A Northeastern University study analyzed 9 employee monitoring platforms and found that identifiable data and information about workers’ online activity were being shared with third-party companies. Understand what the study revealed and why privacy needs to be part of the process when choosing monitoring software.

Monitoring employee activity is no longer a practice restricted to large corporations.

With the growth of remote work, hybrid work, and distributed teams, monitoring software has become increasingly used by companies that need to better understand how corporate computers are being used, identify periods of inactivity, track accessed applications and websites, and make data-driven decisions.

But there is one question many companies still don't ask before hiring one of these tools:

Where does the data collected about my employees go?

A study published by Northeastern University in May 2026 brought this discussion to the center of the debate.

The researchers analyzed nine employee monitoring platforms and investigated not only what information was collected, but also with whom that data was shared.

And the results deserve attention.
 

What did the Northeastern University study investigate?

The study analyzed nine platforms used for employee monitoring and workforce management:

• Apploye
• Deputy
• Desklong
• Hubstaff
• Monitask
• Buddy Punch
• Time Doctor 2
• VeriClock
• When I Work

The researchers created administrator and employee accounts on the platforms and used applications for computers and mobile devices.

To analyze the platforms’ behavior, they used HTTP Toolkit, a tool that allows researchers to intercept and analyze internet traffic generated by applications.

The goal was to understand what happened to the information after it was collected by the software.

And that was precisely where one of the most important findings emerged.
 

The 9 platforms shared workers’ personal data

According to the study, all nine platforms analyzed shared workers’ personal information with third-party technology and advertising companies.

The identifiable data included:

• First and last name;
• Email address;
• The company where the worker is employed.

According to Northeastern University, this information was shared with major technology companies, including Facebook, Google, and Microsoft, as well as mobile advertising companies such as AppLovin.

This does not, by itself, mean that every employee monitoring platform is unsafe or that all data sharing is illegal.

The point raised by the study is different:

Companies need to know exactly what data is being collected and who may receive it.

This transparency should be one of the first questions asked before hiring any monitoring tool.

Employees’ online activity was also shared

The study found another point that is even more relevant for companies concerned about privacy.

The nine platforms analyzed also shared information related to workers’ online activity.

The data identified included:

• IP addresses;
• Device information;
• Visits to web pages;
• Data related to online activity.

According to the researchers, this information was sent to more than 145 domains, including Facebook, Google, LinkedIn, and Yandex.
 

Imagine the difference between two solutions.

In the first, a company hires a tool to understand how much time its team spends on certain applications and websites.

In the second, in addition to this information reaching the manager, certain data about the worker’s activity may also circulate through a network of third parties.

It is precisely this difference that needs to be understood before choosing a monitoring solution.

1 in 3 platforms analyzed had precise location-tracking features

The study also identified another point of concern.

According to the researchers, one-third of the platforms analyzed had features capable of tracking workers’ precise location, including when the application was running in the background.

This type of feature can represent a significant change in the nature of monitoring.

The company moves beyond simply monitoring the use of a corporate computer and potentially gains a much broader view of a person’s movements.

Therefore, before hiring a platform, it is not enough to ask:

“What does it monitor?”

It is also necessary to ask:

“What can it monitor?”

And, most importantly:

“What happens to this information afterward?”

Is employee monitoring the same as surveillance?

It shouldn’t be.

There is an important difference between analyzing information necessary for management and trying to track every detail of an employee’s digital life.

A company may need to know:

• Which applications are used during working hours;
• Which websites are accessed;
• How much time is spent on certain activities;
• When periods of inactivity occur;
• Which times have higher or lower activity levels;
• How corporate computers are being used.

But that does not mean the company needs to record everything an employee does.

Monitoring does not have to mean invading privacy.

The real challenge is finding the balance between management visibility and employee privacy.

What should a company ask before hiring monitoring software?

The Northeastern University study leaves an important lesson for managers, HR professionals, and IT teams:

do not choose a monitoring tool based solely on the number of features it offers.
 

Before hiring one, ask questions such as:

1. What data is collected?

Ask for a clear list of the data processed by the platform.

Do not settle for a generic description such as “we monitor productivity.”

Ask specifically:

• Does it capture screenshots?
• Does it record keystrokes?
• Does it record audio?
• Does it track location?
• Does it record message content?
• Does it collect personal data?
• Does it record IP addresses?
• Does it record websites and applications?

2. Who is this data sent to?

This may be one of the most important questions.

Check whether the data remains restricted to the contracting company or whether it can be shared with:

• Infrastructure providers;
• Analytics companies;
• Technology partners;
• Advertising platforms;
• Other third parties.

It is also important to understand under what circumstances such sharing may occur.

3. Does the tool capture content or just activity?

There is a huge difference between recording:

“The employee used Microsoft Outlook for 40 minutes.”

and recording:

“What the employee wrote in Outlook during those 40 minutes.”

For many companies, the first type of information is already enough to generate management insights.

In that case, collecting the content may represent an unnecessary invasion of privacy.

4. Is there transparency with employees?

A monitoring policy needs to be clear.

Employees should know that monitoring exists, what data is processed, and the purpose of the collection, always taking applicable legal obligations into consideration.

Technology should not be used as a “black box” within the company.
 

How does Monitoo approach privacy?

This is precisely where Monitoo takes a different approach.

Monitoo’s goal is to provide information for productivity analysis without needing to capture the personal content of what an employee is doing on the computer.

According to Monitoo’s Privacy Policy, the platform does not collect sensitive data or directly identifiable civil data, such as CPF, RG, driver’s license, address, personal email, or banking information.

The platform works with technical and operational information, such as:

• Operating system username;
• Machine IP address;
• Login, logoff, and screen-lock times;
• Names and access times for files, websites, and applications;
• Productivity data automatically generated based on criteria defined by the client.

These data are linked to the monitored corporate device and do not include personal information entered on websites, emails, or messages.

In addition, Monitoo does not use features such as screenshot capture, keystroke logging, or recording private conversations to perform its productivity analysis.

Does Monitoo share employee data with third parties?

Monitoo’s Privacy Policy establishes that data is not shared with third parties, except in specific situations, such as:

• With the contracting company, which acts as the data controller;
• To comply with legal, judicial, or regulatory obligations;
• With technology infrastructure providers, such as cloud services, under contract and with appropriate protection measures.
   

This creates an important difference in approach:

the goal of monitoring is not to turn employee activity into a product for third parties.

The focus is to provide the contracting company with technical information that can help with management, productivity, information security, and compliance with internal policies.

Responsible monitoring starts with minimal data collection

The discussion raised by Northeastern University should not lead companies to abandon monitoring.

It should lead them to make better choices about what to monitor.

The question should not be:

“How can I monitor everything?”

But rather:

“What is the minimum amount of information I need to make a better decision?”

This principle helps create a healthier relationship between technology, management, and privacy.

Because a good monitoring tool does not need to know everything about an employee.

It needs to provide the right data to answer the right questions.
 

The future of monitoring is more transparency, not more surveillance

The Northeastern University study shows that there is a question that can no longer be ignored:

when a company monitors its employees, who else is receiving this information?

Monitoring can help companies identify bottlenecks, understand the use of corporate computers, reduce inactivity, and make more data-driven decisions.

But this needs to happen with transparency.

Monitoring should not mean surveillance.

And productivity should not require employees to give up their privacy.

It is possible to pursue efficiency without turning a work computer into a permanent window into an employee’s digital life.

Want to monitor productivity without invading your team’s privacy?
 

Meet Monitoo.

A productivity analysis platform designed to help companies better understand the use of corporate computers, identify periods of inactivity, analyze websites and applications used, and turn data into actionable information for management.

No screenshots.

No keystroke logging.

No recording of private conversations.

No collection of sensitive data such as CPF, personal documents, address, personal email, or banking information.

Because better monitoring does not mean monitoring more.

It means monitoring with purpose, transparency, and responsibility.

👉 Discover Monitoo and learn how to analyze your team’s productivity while respecting employee privacy.

Discover Monitoo

Research source

Northeastern University — Workplace Monitoring Study