Keystroke Logging, Screenshots and Webcam Monitoring: The Proportionality Question

These three sit at the top of the intrusion scale and near the bottom of the usefulness scale. That combination is unusual, and it is the reason to treat them separately from monitoring in general.

For further product context on employee PC activity tracking, consult further details.

Proportionality and privacy-risk analysis can be structured with the NIST Privacy Framework.

General information, not legal advice. See employee monitoring: what is lawful for the notice and consent position.

What each actually captures

Keystroke logging. Every key pressed. Depending on configuration, that includes passwords typed into personal accounts, private messages, medical searches, banking, and anything a person types in a moment of frustration and deletes.

Products vary in whether they capture content or only counts. Establish which you are buying, because the two are entirely different propositions and marketing frequently blurs them.

Screenshots. Periodic or triggered captures. Whatever is on screen — including a personal email tab, a message from a family member, a health portal, or a colleague's screen visible in a video call.

Webcam capture. Periodic photographs of the person at their desk, which in remote work means photographs of their home, and sometimes of other people in it.

What they cannot tell you

The intrusion would be easier to justify if the information were valuable. It generally is not.

None of them measures output. A screenshot shows a document open. It does not show whether the document is good, whether the thinking behind it was sound, or whether the person spent the previous hour solving the problem in their head.

Keystroke counts measure typing. Writing code is not typing. Reviewing a contract is not typing. The most valuable hour of a knowledge worker's week may involve almost no keys pressed.

All are gameable, trivially and cheaply, and once they are a target they will be gamed. See productivity surveillance.

They capture what nobody wanted. Personal information, third-party information, and — where a screenshot includes a colleague's shared screen — data from systems the monitored employee was not even accessing.

The specific risks

Passwords and credentials. A keystroke logger capturing content is capturing credentials, including for systems and accounts the employer has no relationship with. That is a security liability, not only a privacy one — you now hold something you cannot safely store.

Regulated and sensitive data. Health information, financial data, legal communications, and information about third parties, captured incidentally and stored in a monitoring system that was not designed to hold it.

Discovery. Everything captured is potentially producible in litigation — including material that undermines your own position. See when monitoring data is used in a termination.

Access rights. Where employees can request the personal data an employer holds about them, extensive capture creates a correspondingly extensive disclosure obligation.

Notice statutes and consent. Screen and keystroke monitoring falls squarely within the notice requirements in the states that have them. Webcam capture and any audio raise additional questions.

Personal devices. On hardware the employer does not own, these are the least defensible options available. See monitoring on personal devices.

The proportionality test

Before enabling any of the three, answer all four:

1. What specific question does this answer that a less intrusive method cannot?

Not "visibility." A question. If output tells you whether work is being done, screenshots do not tell you more — they tell you something else that nobody asked.

2. What decision will be made differently because of this data?

If you cannot name one, you are collecting because the feature exists.

3. Is there a less intrusive way to answer the same question?

Almost always yes. Defined deliverables, delivery tracking, weekly conversation, application-level access logs.

4. Could we explain this, in detail, to the person being monitored and to their family?

If the honest answer is that you would rather they did not know the specifics, that is the answer to the whole question.

Where they are defensible

Narrow, and worth naming precisely:

Regulatory supervision where content review is mandated — certain financial services communications, for instance. Scoped to the regulated channels, not to the whole device.

A specific documented investigation, time-limited, narrowly scoped, with legal advice, on defined grounds.

Security incident response, targeted and time-bound.

Environments with a genuine and specific security requirement, where the scope is defined by that requirement.

What these share: a defined trigger, a defined scope, a defined end, and a purpose that is not "checking whether people are working hard enough."

If you deploy them anyway

Disclose precisely. Not "systems usage may be monitored." What is captured, how often, who sees it, how long it is kept. See writing a monitoring policy.

Turn off content capture unless a specific requirement demands it. Counts without content answer most legitimate questions at a fraction of the risk.

Exclude non-work applications and periods where technically possible.

Restrict access tightly, and log every access.

Set a short retention period and enforce it.

Never use it for individual performance evaluation. This is the commitment that determines whether the workforce can live with it.

Review whether anyone looks at it. Organisations routinely enable screenshot capture, review it for a fortnight, and never open it again — having paid the trust cost in full for a benefit nobody collected.

The recommendation

For the overwhelming majority of employers, the honest recommendation is not to use any of the three.

They do not answer the question that motivates buying them, they create security and disclosure liabilities that did not previously exist, they are the most likely of all monitoring practices to become a public story, and the people most willing to tolerate them are the people with the fewest alternatives.

If the underlying question is whether work is getting done, the answer is available for free. See measuring knowledge work without measuring keystrokes.