A petition circulating among Meta employees, now publicly accessible at mcipetition.com, demands that the company halt a program called the Model Capability Initiative (MCI), which reportedly collects granular human-computer interaction data from employees for the purpose of training AI models. The signatories, numbering several hundred and spanning roles from software engineers and research scientists to product designers, UX researchers, and operations staff, are raising objections that touch on workplace privacy law, informed consent, and the internal consistency of Meta's own stated AI ethics commitments.
The petition deserves careful technical and ethical scrutiny, not merely as a labour relations story, but as a signal of a broader unresolved tension in how frontier AI labs source behavioural training data.
What MCI Appears to Collect and Why It Matters
According to the petition, MCI captures mouse movements and click locations, keystroke sequences, screen content, navigation patterns, and broader device interaction habits. This is, in technical terms, a continuous behavioural telemetry stream. The research community sometimes refers to this class of data as computer use traces or desktop interaction logs, and it has attracted significant attention as a training signal for agent-oriented models.
The motivation is not obscure. Models such as Anthropic's Claude Computer Use and OpenAI's Operator demonstrate that grounding an agent in realistic human desktop behaviour substantially improves task completion on GUI-driven workflows. Training such models requires large corpora of authentic interaction sequences, and synthetic generation of those sequences is non-trivial because the distribution of real human hesitation, error correction, and contextual navigation is difficult to replicate procedurally. Employee machines, operating on internal tooling and proprietary workflows, represent an exceptionally high-fidelity source of exactly this kind of data.
The problem is that this fidelity cuts both ways. Any continuous screen capture and keystroke logger will inevitably sweep up credentials, session tokens, internal API keys, personally identifiable information, protected health information, and confidential business data. The petition explicitly names Social Security Numbers and PHI as foreseeable collateral captures. This is not a theoretical concern. It is a near-certainty given the diversity of tasks Meta employees perform across HR systems, legal tooling, medical benefit portals, and internal communications.
The Consent and Regulatory Dimension
The petition invokes both the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), which were extended to cover employees following the expiration of the workforce exemption in January 2023. Under this framework, employees have the right to know what categories of personal data are collected, the purposes for which that data is processed, and the right to request deletion or correction. Crucially, the CPRA also introduced a right to limit the use of sensitive personal information, a category that almost certainly encompasses keystroke logs and screen content given the inevitable co-mingling with financial and health data.
The petition also references Meta's 2024 GDPR fine of €91 million imposed by the Irish Data Protection Commission for storing user passwords in plaintext, citing it as evidence of a pattern of inadequate data handling practices. This is a reasonable contextual point, though it should be noted that the legal frameworks differ: the GDPR fine concerned user data processed under Article 5(1)(f) security obligations, whereas MCI concerns employee data processed under a different lawful basis. The underlying concern about institutional data hygiene is nevertheless legitimate.
Perhaps more structurally significant is the petition's observation that when employees asked whether the required internal people data reviews had been completed, no completed reviews were provided. Meta's own internal policies apparently require such reviews before processing employee data. The selective opt-out afforded to executives, noted in the petition, is particularly telling. If the program's privacy mitigations were genuinely adequate, there would be no principled basis for differential treatment by seniority.
The Broader Research Context: Behavioural Data as a Training Resource
It is worth situating MCI within the wider research trajectory around computer use agents. The 2023 and 2024 literature on GUI agents, including work on WebArena, OSWorld, and ScreenSpot, consistently identifies the scarcity of authentic, diverse interaction traces as a primary bottleneck. Existing public datasets are either too narrow in domain coverage, too small in scale, or too synthetic in character to support robust generalisation across the heterogeneous software environments that real users navigate.
Corporate deployment contexts are particularly attractive from a data collection standpoint because they expose agents to enterprise software, internal tooling, and complex multi-step workflows that consumer-facing datasets do not capture. A company of Meta's scale, with employees spanning infrastructure engineering, legal, marketing, and research, would generate interaction traces across an unusually broad application surface.
This explains the strategic logic of MCI. It does not, however, resolve the ethical and legal questions. The research community has grappled with analogous tensions in other data collection contexts: the use of scraped web data, the collection of conversational logs from deployed chatbots, and the mining of code repositories. In each case, the core issue is the same: the interests of the data subject and the interests of the model trainer are not automatically aligned, and consent mechanisms that exist primarily on paper do not constitute genuine informed consent.
Internal Dissent as a Governance Signal
What makes this petition analytically interesting beyond its immediate subject matter is what it reveals about the internal governance structures of large AI companies. The signatories include not only individual contributors but engineering managers, research scientists, associate general counsel, and at least one Senior Director. This is not a fringe protest. It represents a cross-functional, multi-seniority expression of concern from people who understand both the technical architecture of what is being collected and the institutional context in which it is being collected.
The petition's invocation of Zuckerberg's own public statements about empowering individuals and building AI responsibly is rhetorically sharp, but it also points to a genuine structural problem. When a company's stated values around responsible AI and employee empowerment are invoked by employees to resist a company program, it suggests that the values articulation and the operational decision-making pipelines are not well integrated. This is a governance failure before it is an ethics failure.
Several specific concerns from the petition merit highlighting:
- No completed people data reviews were provided when employees asked, despite internal policy apparently requiring them before employee data processing begins.
- Privacy mitigations described to employees were characterised as vague, with leadership appearing uncertain about their adequacy.
- Executives were given a selective opt-out that was not extended to the broader workforce, implying an asymmetric risk assessment.
- The March 2026 incident in which a Meta AI agent gave an employee incorrect instructions that led to a sensitive data leak is cited as recent evidence that the company's AI systems do not yet operate at the reliability threshold that would justify expanded data collection mandates.
What a Responsible Data Collection Framework Would Look Like
It is worth being precise about what a defensible version of this kind of program might require, because the objection is not necessarily that behavioural data is useless for AI training. The objection is that the collection as described lacks adequate consent architecture, data minimisation controls, and oversight mechanisms.
A responsible framework would need, at minimum, the following properties. First, genuine opt-in consent rather than opt-out defaults, with no professional consequences for non-participation. Second, technical controls ensuring that sensitive data categories (credentials, PHI, financial data) are filtered at the point of capture rather than post-hoc, since post-hoc filtering of a continuous screen capture stream is both technically unreliable and legally insufficient. Third, completed and published internal privacy reviews before deployment, not after concerns are raised. Fourth, an independent audit mechanism with access to the collected data and the training pipeline. Fifth, clear data retention and deletion policies with employee-accessible tooling to exercise deletion rights under CPRA.
None of these requirements are technically infeasible. They are organisationally expensive and would reduce the volume and diversity of collectible data. That is precisely the point. The cost of responsible data collection should be borne by the organisation that benefits from the resulting model capabilities, not externalised onto employees who did not meaningfully consent to serving as a training corpus.
Conclusion
The MCI petition is a concrete instantiation of a problem that the AI research community has discussed abstractly for years: the gap between stated commitments to responsible AI development and the operational pressures that drive data acquisition decisions. The petition's signatories are not opposed to AI development. Many of them are building the systems in question. They are asking for the same standards of consent and transparency that the company publicly advocates for when discussing AI's relationship to society at large.
Whether Meta responds substantively or dismisses the petition as a minority concern will be instructive. The trajectory of computer use agent research means that similar programs will be proposed at other companies. How this case resolves will shape the norms around employee behavioural data collection across the industry. The technical capability to collect this data has outpaced the institutional frameworks for deciding when and how it is appropriate to do so. Closing that gap is not a purely legal or HR problem. It is a systems design problem, and it requires the same rigour that these engineers apply to everything else they build.