Lauren Feiner | The Verge

The bill that would let Jimmy Kimmel sue Brendan Carr is here

2026-06-12T05:55:49-04:00

Under a new bipartisan bill, Americans could sue for damages if a government official illegally tries to coerce a social media, AI, or broadcasting company to remove their post — regardless of whether the platform actually does it.

Senate Commerce Committee Chair Ted Cruz (R-TX) and Sen. Ron Wyden (D-OR) introduced the JAWBONE Act on Thursday, which, in addition to letting individuals sue for these kinds of damages, would create new transparency requirements for government communications with social media, AI, and broadcast companies.

That could empower someone like Jimmy Kimmel to sue Federal Communications Commission Chair Brendan Carr, who threatened TV stations’ broadcast licenses after the comedian made a joke Carr disliked in the aftermath of Charlie Kirk’s killing. (Carr has denied the comments were threats.) It could also empower lesser-known social media users whose posts about medical misinformation or criticism of Kirk were removed or targeted, if they believe it was due to government coercion.

Cruz first teased the bill in the aftermath of Carr’s comments about Kimmel, which the senator characterized as “right out of Goodfellas.” But he’s said he’s worked on the bill since before that incident and has repeatedly criticized Biden administration officials’ messages to social media companies about medical misinformation during the pandemic, which became the subject of a Supreme Court case. (The Supreme Court determined plaintiffs had no grounds to bring the lawsuit, and its ruling found a lack of clear evidence that platforms were moderating based on government coercion.)

The bipartisan sponsorship and a pool of supporters that includes the American Civil Liberties Union (ACLU), Foundation for Individual Rights and Expression (FIRE), and Knight First Amendment Institute at Columbia University, could lend credence to the bill. Cruz and Wyden’s statements each point fingers at the opposite party’s administration for allegedly engaging in the actions they seek to crack down on. “The Biden administration weaponized the Cybersecurity and Infrastructure Security Agency to pressure Big Tech into ‘canceling’ Americans who spoke out against vaccine mandates and election fraud,” Cruz charged. “The most blatant example is Trump threatening cable companies because he doesn’t like their late-night shows, but jawboning isn’t partisan, and it isn’t new,” Wyden said. If passed, the bill could make such incidents the subject of costly legal battles, on top of bitter political fights.

Apple’s new parental controls are for keeping Apple out of trouble

2026-06-08T17:48:08-04:00

When Apple put child safety front and center at WWDC on Monday, its stated goal was helping parents fine-tune their kids’ online experiences and avoid excessive screen time. But amid a global debate over internet regulation, its latest updates also looked like a defensive move in a brewing fight against Meta and other app developers.

Apple announced an expanded toolkit for parents through its child accounts at WWDC, including a greater ability to customize kids’ allotted screen time and the ability to block gory or violent images in messages before kids see them. Raja Bose, Apple’s director of trust, safety, and values product marketing, touted some of the ways Apple believes it can be useful for kids to have access to devices. “On one hand, there’s so many benefits to your child having their own device,” Bose said. “You rest easier since you can stay in touch, know where they are, and provide them with great apps that can help them learn and grow.” But he then acknowledged the risks of unfettered access to the internet before kids are ready.

The company emphasized a few key principles in its presentation of the new child safety features: that parents should be the ones to decide what their kids have access to, that Apple’s recommendations will be shaped by expert research that balances risks and benefits of technology for kids, and that some harmful things on the internet are outside its own control. “While Apple’s powerful controls help parents manage which apps their child can access, and when, it’s developers who play an important role in ensuring kids are getting age-appropriate experiences within apps,” Ann Thai, Apple’s senior director of marketplace platforms and technologies, said during the presentations.

“It’s developers who play an important role in ensuring kids are getting age-appropriate experiences within apps”

The last point sounded like a message not just to Apple customers, but for politicians and regulators debating who should be responsible for keeping kids off certain parts of the internet. As policymakers have grown increasingly enthusiastic about age-gating, Meta and other app and website developers have been forced to roll out age-checking systems in some countries, including the UK, Australia, and parts of the US. In turn, they’ve backed proposals that would put the onus on app stores to verify users’ ages instead, then send signals about those ages to app developers.

Apple has vehemently fought these bills. CEO Tim Cook reportedly called the governor of Texas in an unsuccessful bid to stop him from signing an app store-level age verification rule and visited Capitol Hill to lobby against similar legislation the company has warned could negatively impact user privacy. The Apple and Google-backed group Chamber of Progress has backed proposals like the Parents Over Platforms Act, which would not require strict age verification of users’ accounts, and places some added responsibility on developers like Meta.

Apple has complied with age verification rules when necessary — it began requiring information like a credit card or government ID to create a new Apple account in Texas earlier this month. And its WWDC presentation followed a long tradition of companies attempting to demonstrate they can protect kids without regulation, something Meta has also done. But it put a particular emphasis on the need for developers to pitch in.

“We believe every app has that same responsibility”

“Many apps already offer parental controls to help shield kids from content they shouldn’t see,” Thai said. “We believe every app has that same responsibility.” Thai touted the company’s APIs that developers can use to allow for parent approvals within apps and protect kids from being exposed to nudity. (Even as Apple executives made these announcements inside Apple Park, protesters outside its visitors center were demanding the company remove apps that use AI to virtually undress users, including X’s Grok.)

Apple executives emphasized that they’re following the guidance of medical experts, including through the American Academy of Pediatrics’ Family Media Plan, which promotes a nuanced approach to media consumption, rather than strict screen time limits. Apple similarly wants to avoid dictating from above how much screen time kids should have. During the event, Apple’s VP of health, Sumbul Ahmad Desai, said that “every child is unique, and parents are in the best position to decide what works for their family.” It’s positioning its products as the best way for parents to enforce those decisions — but not a silver bullet for making the whole internet safe.

New York lawmakers pass one-year ban on new data centers

2026-06-05T12:48:45-04:00

The New York State legislature passed a one-year moratorium on new large data centers, the first statewide ban of its kind if Democratic Governor Kathy Hochul signs it into law.

Lawmakers behind the bill say it’s meant to give policymakers time to understand the impact of large data centers on the environment and energy prices. It directs the state’s environmental agency to create an impact report assessing the amount of electricity, water, and land that data centers use, and the pollution they create. It also requires companies planning to build large data centers — defined as having a peak demand of at least 20 megawatts — to hold and fund a public hearing at least three months before it’s able to gain approval for the project. Hochul has not said whether she will sign the bill, and has until December to decide whether to sign or veto it, according to Bloomberg Government.

It requires companies planning to build large data centers to hold and fund a public hearing

Surveys show that most Americans oppose the idea of data centers in their communities, and heated public meetings across the country have shown it to be a galvanizing issue across the political spectrum. Earlier this year, Maine’s legislature passed a bill that would have banned new data centers until late 2027, but Democratic Governor Janet Mills vetoed it because it failed to include an exemption to a previously planned project, according to The New York Times. The New York Independent System Operator, a nonpartisan entity tasked with maintaining electric grid reliability, has said it’s currently reviewing 24 data center proposals totaling over 9,000 megawatts, according to News10 ABC, and a proposed 180 megawatt project in Albany has drawn concerns from residents.

The New York bill is a shorter moratorium than the three-year proposal that was previously introduced, according to Politico. But even the one year pause has garnered pushback from industry groups. Stacey Sikes, acting president and CEO of business group the Long Island Association, told Politico the moratorium would “overall be damaging to the state’s economy, because having a blanket moratorium instead of looking at it at a case by case basis would not allow the state to move forward on a data center project that would actually be helpful to our economy.”

Hochul spokesperson Kristin Devoe told The Verge, “The Governor will review the bill.”

Update, June 5th: Added comment from Governor Hochul’s spokesperson.

AI has a water problem — Google thinks it has a fix

2026-06-03T12:08:53-04:00

In the face of widespread backlash to the AI data center buildout throughout the US, Google is touting its efforts to minimize the environmental impact by actually increasing water for local communities.

The company laid out five commitments around water use in a new blog post published Wednesday, including a goal to replenish more water than it uses at its data centers by 2030. Google also said it will invest in local water infrastructure, identify alternative water sources to power its facilities, and be transparent about its water use overall.

“We’re just one of dozens of players in the space,” Google’s global head of infrastructure and sustainability Ben Townsend told The Verge in an interview. “We think it’s really important to sort of put a blueprint out there that communities can reference, so if somebody else comes and says, ‘we’d like to build a data center there,’ a community can say, ‘well, here are five different things that really put the community and the watershed first. Are you doing these? Are you doing one of them? All of them? None of them? And if not, why?’”

The commitments come amid growing opposition to the rapid data center buildout helping to power the extensive energy needs of AI. Google parent company Alphabet recently said it wants to raise $80 billion from stock sales to fund its buildout for the technology. A recent Gallup poll found that more than 70 percent of Americans oppose the idea of a data center being built in their area. Half of the respondents cited data centers’ impact on environmental resources as a motivator behind their opposition, including 18 percent who cited excess water use as an issue.

A recent Gallup poll found that more than 70 percent of Americans oppose the idea of a data center being built in their area

AI data centers require vast amounts of water for cooling, with a recent study finding that the technology used as much water annually as people drink from water bottles worldwide. Google’s prior estimates of its own water use for AI have been misleading, according to some researchers, who say they omit indirect water usage. The widespread resource concerns have driven a wave of commitments across the industry to limit water usage and prevent data centers from driving up consumer energy prices.

But Google’s Townsend defended the company’s record thus far. “To the best of our ability, we are accounting for the offsite water footprint,” Townsend said, “and I think we’ve made significant progress in reducing or eliminating the water footprint of that supply chain through our waterless renewable energy investments.”

In the blog post, Google’s vice president of global infrastructure Bikash Koley says water usage at data centers can lower overall energy use. “In many places, water cooling can reduce data center energy use by approximately 10% compared to air cooling,” Koley writes. “The aggregate water consumption of data centers is small — U.S. data centers use less than 1% of the water that Americans use on their lawns annually — but we are focused on protecting local water resources in all aspects of our data center operations.”

Koley says Google will be able to replenish more water than it consumes in the next four years by investing in projects that improve things like irrigation and infrastructure. It promises to keep reporting its annual water use and look for alternative sources like reclaimed wastewater, as it’s done in one Georgia county. The company also announced $17 million to support new water stewardship projects across seven states.

Those who worry about data centers sucking up all their water have valid concerns, Townsend said, though he says they might use less water than people think. “It would be a real disservice to the space to say there’s only misconceptions out there. That’s not true,” Townsend said. But, he added, the data center sector doesn’t use as much water as people might think, and now is the time to invest to make sure “that data center water use doesn’t become a problem.”

Trump signs executive order to review AI models before they’re released

2026-06-02T14:33:42-04:00

President Donald Trump signed an executive order Tuesday creating a “voluntary framework” for AI companies to share their frontier models with the federal government before they’re released “to promote secure innovation and strengthen the cybersecurity of critical infrastructure.”

The order says the US AI industry has succeeded in part “because we refuse to stifle this innovation with overly burdensome regulation,” but that it also recognizes new AI capabilities come with security risks. Accordingly, it directs several federal agencies to come up with a framework to “assess the advanced cyber capabilities of AI models” before they’re released to the public. Companies would have the discretion of whether to share their models with the government pre-release, but could get certain confidentiality protections if they choose to do so. It also requires the federal government to prepare cyber defenses for AI, especially for critical infrastructure.

The order comes after Trump postponed at the last minute signing a previously planned executive order that he worried could “get in the way” of competing with China. While the earlier version would have allowed AI companies to voluntarily share their models 14 to 90 days before release, according to The New York Times, the current version asks companies to share their models up to 30 days before public release. Google, Microsoft, and xAI agreed last month to allow pre-release review by the Commerce Department’s Center for AI Standards and Innovation (CAISI).

OpenAI and Anthropic had already agreed to share their models with CAISI back in 2024 under President Joe Biden as part of Biden’s push for AI safety guardrails. But until recently, the Trump administration downplayed safety concerns and took a hands-off approach under former White House AI czar David Sacks. The order signed Tuesday explicitly says it shouldn’t be taken as a form of mandatory licensing or preclearance. Still, it reflects some willingness of the Trump administration to employ oversight of AI companies.

“The White House is officially Mythos-pilled”

One factor in this shift may be Anthropic’s limited April rollout of its powerful Mythos model, which the company said had flagged “thousands of high-severity vulnerabilities, including some in every major operating system and web browser.” Mythos also seemed to create an opening to thaw tensions between Anthropic and the administration, following its legal battle with the Pentagon over its use of AI for autonomous lethal weapons and mass surveillance.

The newly signed order has so far garnered praise even from groups that have advocated against restrictions on state AI laws. “The White House is officially Mythos-pilled,” Americans for Responsible Innovation President Brad Carson said in a statement, adding that the order shows the Trump administration is taking AI vulnerabilities seriously. Alliance for Secure AI CEO Brendan Steinhauser said his group is “pleased to see that the Trump administration is taking the risks of these models seriously,” and both Steinhauser and Carson urged Congress to codify mandatory protections.

Microsoft could be the next Big Tech antitrust target

2026-06-01T09:23:39-04:00

Over the past several years, Microsoft has largely managed to withstand populist calls to break up Big Tech while peers faced sweeping lawsuits. But a probe by the Federal Trade Commission suggests that grace period could be nearing an end.

Earlier this year, Bloomberg outlined the contents of civil investigative demands (CIDs) — similar to a subpoena — the FTC sent to at least half a dozen companies that compete with Microsoft. New details obtained by The Verge further reveal the FTC’s interests, suggesting the agency is particularly concerned with potentially exclusionary behavior around Microsoft’s Azure cloud services, as well as its role in the AI industry.

There’s no guarantee the investigation — which began under the Biden administration in 2024 and continued under President Donald Trump — will end in a legal complaint. After further investigative steps, FTC staff will choose whether to recommend filing one, and the agency’s two commissioners will take a vote. Should they approve a lawsuit, however, Microsoft may find itself back in a hot seat it occupied more than two decades ago, when a court found it had an illegal PC operating system monopoly.

The Verge obtained previously unreported information about the letters from an industry source who reviewed them and was granted anonymity to speak on nonpublic information. The Verge further verified the document. The questions show the FTC gathering information on industry practices and competitive stumbling blocks, asking about Microsoft’s business agreements, licensing arrangements, and interoperability of its products. The documents generally span more than 15 pages and over 15 questions, often with extensive sub-parts.

Do you have information about government investigations into Microsoft and Big Tech? Reach out securely and anonymously with tips from a non-work device to Lauren Feiner via Signal at laurenfeiner.64.

The CIDs say the goal of the FTC probe is to determine if Microsoft has used unfair methods of competition in its cloud, software products, and related services in violation of the FTC Act, the source says. The FTC did not respond to a request for comment. Microsoft spokesperson Alex Haurek says that the company is “cooperating fully with the FTC and believe our practices promote competition while delivering the innovative products our customers expect.”

Customers have complained — often anonymously for fear of retaliation — that Microsoft’s 2019 changes to its licensing terms made it significantly more costly to run Windows software on infrastructure outside of Microsoft’s Azure cloud. In 2023, Google responded to a broad FTC inquiry about business practices in the cloud computing industry by accusing Microsoft of using dominance in other areas to “give their own cloud products an unearned advantage” and lock in consumers. Microsoft insists there’s plenty of competition in the cloud sector, and Haurek pointed to Google as “a clear example of that dynamic—growing 63% year over year and competing head-to-head with other major providers including AWS, the largest cloud provider.”

Microsoft’s growth in cloud computing has helped push its valuation to historic highs

Shortly before the investigation was reported, a 2024 ProPublica investigation found that Microsoft used similar leveraging to gain a foothold across US government agencies after installing free cybersecurity upgrades that came with products that specifically ran on Azure, which would be strenuous to switch away from later on. (Government contracts and cybersecurity were not among the CID topics disclosed to The Verge, and Haurek says Microsoft responded to the government’s security requests at the time and that agencies were “free to engage with other vendors.”)

Microsoft’s growth in cloud computing has helped push its valuation to historic highs, and its investments in the space have positioned it to be prepared for the massive computing requirements of AI. Cloud growth has also buoyed revenue while hardware including Xbox experienced declines.

This kind of information gathering tends to occur at the earlier stages of an investigation, according to George Washington University law professor and former FTC Chair William Kovacic. The two-member, all-Republican commission could choose to end it quietly without bringing a complaint, with no minority party commissioners to object or publicize the choice.

The FTC asks specifically about Microsoft’s impact on competition

Some of the CID questions seem aimed at understanding the cloud industry, including questions about company organizational charts, business and marketing plans, and product roadmaps. It asks the companies to detail plans for bundling multiple features and products, as well as pricing, discounting, and profitability. Other questions appear to probe how challenging it is to break into a market that Microsoft operates in, asking about the costs and barriers to entry involved in entering or expanding into these markets. The FTC asks specifically about Microsoft’s impact on competition, soliciting documents that speak to the impact of Microsoft’s policies or market position as well as details about overall industry bundling and interoperability practices, including at Microsoft.

The agency asks some similar questions about competition around AI products, including competing for customers against businesses that combine extra features or services with an AI or software product like Microsoft 365.

The questions suggest the agency is trying to determine which key market players to watch and how important tactics like bundling are, Kovacic says. The references to AI could suggest that the FTC considers it a potential part of an illegal tying arrangement or an important competitive advantage.

The US isn’t the only country that’s been probing this issue. The European Commission, UK Competition and Markets Authority, and Japan Fair Trade Commission have been investigating Microsoft’s cloud services within the last year. Haurek says Microsoft is “committed to working quickly and constructively with the CMA” on its review and is also cooperating with the investigations in Europe and in Japan, where the cloud sector “has never been more dynamic and competitive.”

As a $3 trillion company, it’s “almost inevitable” for Microsoft to become a target of third-party antitrust complaints, Kovacic says. In the US, Microsoft has already faced a government challenge of its Activision Blizzard acquisition, but ultimately prevailed, and has yet to face a true recent breakup threat like Google, Meta, Amazon, and Apple.

So far, Microsoft has been largely absent from the calls to break up Big Tech reverberating through political campaigns and the halls of Congress. The company’s business-focused offerings have helped it dodge child safety and moderation fights that can create political enemies. Kovacic also credits Microsoft’s adaptation after its earlier monopolization case, saying it’s generally regarded in the industry as “having the best compliance program” and “the best approach to dealing with the regulators.”

A case against Microsoft could impact the AI industry as a handful of companies are vying for market share

In a landmark 1998 complaint, the Department of Justice accused Microsoft of illegally tying its dominant Windows operating system to its Internet Explorer browser, boxing out competitors. While a court ruled against Microsoft, the government ultimately settled, allowing it to avoid a breakup. Still, the case is often credited as reining in Microsoft and allowing then-nascent firms like Google to flourish.

A case against Microsoft could impact the AI industry as a handful of companies are vying for market share. Even when tech companies prevail, antitrust suits can require years of litigation and put internal business operations under a microscope. Though none so far have resulted in a breakup, Apple and Google are both under court orders that restrict anticompetitive business practices. Apple and Amazon’s trials have yet to take place.

Kovacic says it’s really the totality of tech antitrust cases that could tip the scales. “The direction of the entire information services sector is going to depend on the resolution of this very large number of pending cases and investigations involving Big Tech,” he says.

Google appeals search monopoly ruling, says it won business ‘fair and square’

2026-05-22T13:05:46-04:00

Google officially filed its appeal of the federal ruling deeming it an illegal search monopolist, arguing the decision “crashed” through legal guardrails. “Google just prevailed in the marketplace fair and square,” it writes in its legal filing.

Google had already said it would appeal the ruling, which includes both the August 2024 decision about its illegal monopolization and the September 2025 remedies decision that ordered it to share some search data with competitors. The appeal brief filed Friday gives more insight into how the company plans to fight Judge Amit Mehta’s ruling.

“We are asking the court to overturn this flawed decision – partners and users have many options and choose Google because it provides the best, most helpful results,” Google VP of regulatory affairs Lee-Anne Mulholland said in a statement.

“Google just prevailed in the marketplace fair and square”

Google argues that Mehta erred in finding that its search distribution agreements with browser and device makers were anticompetitive. Instead, it argues, other market players simply preferred its services over rivals’. Mehta also “egregiously exceeded” his judicial discretion in the remedies he ordered, according to Google, which included the “extraordinary step of ordering Google to boost its competitors through data-transfer and syndication.” The company also takes issue with how the remedies require data sharing with generative AI players that it says “could not have been affected by Google’s conduct because they did not even exist during the relevant period, and that are already succeeding as wildly as any technology in human history without any need to free-ride on Google’s success.”

The US and a coalition of states that sued alongside it are also appealing the same decision, arguing that Mehta should have gone further in his remedies decision. Mehta declined to grant the government its biggest asks, including a sale of Google’s Chrome browser, which it argues is a key distribution platform for search offerings. The government argued that a broad sweep of changes was necessary to resolve Google’s harms to competition.

About five years since the initial case was filed, it’s now up to a federal appeals court in DC to determine what should happen next. From there, the case could eventually go all the way up to the Supreme Court.

States ask judge to break up Live Nation-Ticketmaster

2026-05-22T09:39:42-04:00

A federal judge is officially being tasked with deciding whether to break up Live Nation-Ticketmaster.

More than 30 states are asking Judge Arun Subramanian to order a sale of the ticketing giant, a “sufficient number” of large amphitheaters, and limit its ability to tie access to its remaining amps to the use of its promotions services. In April, a jury found that the company is an illegal monopolist, after more than a month of trial. The initial remedies proposal doesn’t include a further breakup of some other parts of Live Nation’s business that California Attorney General Rob Bonta told The Verge and other outlets earlier this week they were considering, but the states say they reserve the right to make additional requests as they learn more.

It’s unclear exactly how far Subramanian will be willing to go in ordering remedies, but the requests go far beyond what the Department of Justice got in its settlement with the company one week into trial. That deal included a promise to offload some exclusive booking arrangements at over a dozen amphitheaters, but not a sale of the venues themselves.

The states are also asking for remedies that address specific allegations that came up at trial, like barring retaliation or conditioning the ability for a venue to receive a concert on which ticketing platform they use. They also ask for a range of monetary relief, including paying back overcharges on ticketing fees.

“The jury verdict in this case cannot support a request for divesting Ticketmaster from Live Nation,” Live Nation executive vice president of corporate and regulatory affairs Dan Wall said in a statement. “The States’ request for a breakup is performative and political.” The company has promised to fight the verdict.

Updated, May 22nd: Added statement from Live Nation.

One of Meta’s big legal reckonings just ended in a settlement

2026-05-22T07:47:06-04:00

After back-to-back losses in trials grappling with its impact on teens’ mental health, Meta just settled what was supposed to be its next legal battle with Kentucky’s Breathitt County School District. Google’s YouTube, Snap, and TikTok all recently settled similar claims brought by the school district, which was seeking payment from the companies to cover the cost of combatting social media-related mental health harms.

The trial had been set to begin in June as the first bellwether trial of the federal multidistrict litigation (MDL) cases, which include claims from school districts, state attorneys general, and individuals against the social media platforms. It’s similar to the group of cases making their way through a California state court in Los Angeles, where the first bellwether case in that group was recently held. The idea is that trying a sampling of cases before juries will inform settlement negotiations for the broader bucket of remaining cases.

The terms of the settlement with Breathitt County School District were not disclosed, but plaintiffs’ attorneys Lexi Hazam, Previn Warren, Chris Seeger, and Ronald Johnson said in a statement, “our focus remains on pursuing justice for the remaining 1,200 school districts who have filed cases.”

“We’ve resolved this case amicably and remain focused on our longstanding work to build protections like Teen Accounts that help teens stay safe online, while giving parents simple controls to support their families,” Meta spokesperson Andy Stone said in a statement. YouTube spokesperson José Castañeda said the school district’s claims against the company were “amicably resolved and our focus remains on building age-appropriate products and parental controls that deliver on that promise.” Snap spokesperson Monique Bellamy similarly said they were “pleased” to resolve the case “in an amicable manner.” TikTok did not immediately respond to requests for comment.

The next case on deck dealing with social media addiction and youth mental health claims is expected to begin in the Los Angeles state court in July. The next federal bellwether case is slated for January.

Meta and Google get data from the app your boss uses to track you

2026-05-26T11:19:48-04:00

Hundreds of thousands of workplaces use software to monitor employees. Now, a new study has found that many of these tools share data not just with employers, but with digital advertising platforms and data brokers as well.

The review was led by Stephanie Nguyen, senior fellow at Columbia Law School’s Center for Law and the Economy and former Federal Trade Commission chief technologist under Lina Khan. It examined nine workplace monitoring (or “bossware”) services and found that all of them shared some information with third-party platforms. The data ranged from names and email addresses to web history, and recipients included Facebook, Google, and Microsoft.

“The striking piece of this study is that every single platform, nine of nine bossware companies, shared worker data with outside companies. Every single one,” Nguyen told The Verge in an interview. “That blew me away.”

Seven of the nine platforms — Apploye, Desklog, Hubstaﬀ, Monitask, Buddy Punch, VeriClock, and When I Work — did not immediately respond to The Verge’s requests for comment. Ciaran Hale, chief technology officer at another one of the platforms, Deputy, said in a statement that the company’s “third-party relationships are limited to trusted operational and infrastructure providers that support the delivery, security, and reliability of our platform.” Hale added that Deputy has rigorous privacy controls and that the researchers “appear to have conflated standard B2B marketing cookies found on our public-facing corporate website (such as advertising analytics) with our secure employee application.” In a statement, Nguyen responded, “We looked at the full experience a worker would have from the moment they visit deputy.com and hit ‘Log In.’ What we found is that personal information, including names, emails, and company names, is being sent to third parties whenever anyone uses the application, whether they’re a worker or a boss.”

The ninth, Time Doctor, provided information about data sharing via an AI assistant but not a response from a human spokesperson until after publication. “Time Doctor does not share employee monitoring data — including activity records, screenshots, or web usage — with advertising platforms or data brokers,” spokesperson Laura Ramsay said in a statement. “Like most SaaS companies, we use standard marketing tools including Meta for advertising and remarketing. The third parties identified in the study are documented sub-processors or standard marketing tools, consistent with our privacy policy. No data collected through Time Doctor’s monitoring features is shared with any of these providers.” The nine platforms’ customers collectively include Amazon Ring, Ben & Jerry’s, Ticketmaster, Verizon, and Tesla, according to their own disclosures. Together, the report says, they say they serve “hundreds of thousands of workplaces across dozens of sectors.”

“Every single platform, nine of nine bossware companies, shared worker data with outside companies”

To figure out where workers’ data was going, the researchers reviewed publicly accessible information like terms of service and privacy policies, and made trial accounts across the nine platforms for both managers and workers. They intercepted the network traffic with an open-source tool used to see what they were transmitting and to which other services. They found that the tools shared data including workers’ names, emails, and companies, as well as information about workers’ online activities, including their IP addresses and webpages they visited. Three of the nine platforms analyzed have the ability to track workers’ precise location, even when the app is running in the background, the review found.

Bossware poses risks even without third-party sharing. Data could be used to make decisions that are potentially discriminatory or to make incorrect assumptions — for example, the researchers say, inaccurately inferring details about a worker’s health and fitness by tracking their movement.

Sending that information to third parties creates more potential for abuse. The researchers point to “data append” services, for instance, that can gather disparate information on a person into a centralized profile — including theoretically anonymized material. Adding workplace details to the mix, they warn, could help create a “shadow ‘worker reputation economy’” that follows people long after they leave their jobs. It could even help third parties like advertisers make inferences about how distracted they’re perceived to be or if they’re looking to leave their current employer.

“Workers typically lack the ability to meaningfully refuse surveillance”

The US still doesn’t have a national comprehensive data privacy law for consumers, but workers can be particularly vulnerable. Even if they’re broadly aware the systems are tracking them, they may not understand the extent of the surveillance, nor where the information is going. They may also not be able to avoid them. “Workers typically lack the ability to meaningfully refuse surveillance, to switch employers, or to stop using an employer-issued surveillance platform without risking their jobs and livelihoods,” the report says.

They propose a “bright-line” solution to this problem: banning worker data from being shared or sold to third parties; prohibiting the collection of sensitive data on workers, including off-hours location monitoring; and limiting how long bossware companies can retain information. They urge state and federal law enforcers to consider whether certain worker data collection and disclosure might violate existing state privacy laws or unfair practices laws when it’s used in ways workers wouldn’t reasonably expect. They suggest it could also violate the Fair Credit Reporting Act, if it’s used to make employment decisions.

“The incentives are there for workplaces to try and gather, sell, resell that data,” Nguyen said. “What actually happens, and following that trail, is part of what we want to continue exploring.”

Update, May 26th: Added statement from Time Doctor spokesperson.