Argues that the 30-minute window is a compliance artifact forced by labor law, not a privacy feature Meta designed in good faith. Points out that opting out is itself a logged event, so workers can be invisible but not invisibly invisible — the surveillance baseline remains intact regardless of whether the button is pressed.
Acknowledges the 'it's fine' camp has a legitimate point about the baseline: badge readers date to the 1980s, conference-room sensors are a decade old, and Wi-Fi triangulation has quietly logged laptop locations for years. The infrastructure has existed; Meta is just making it visible and addressable.
The novel element isn't any individual sensor but the consolidation of badge, room, desk, and Wi-Fi signals into one identity-linked profile that can be queried and acted on. This crosses a qualitative line from passive infrastructure to active personal tracking, even if no single data source is new.
Reports Meta's stated justification as space utilization and hot-desk optimization, but frames the rollout in the context of post-return-to-office policy. After three years of RTO arguments, large employers want to verify whether people they ordered back are actually at their desks — utilization metrics are a convenient cover for attendance enforcement.
The BBC reports that Meta has begun tracking employees inside its offices — badge swipes, room occupancy, desk presence — and is giving workers a 30-minute opt-out window they can trigger when they don't want to be logged. The story landed on Hacker News at 241 points, which is the developer community's way of saying 'we noticed, and we have opinions.'
The mechanic is straightforward. The default state is tracked. To stop being tracked, you press a button (or its software equivalent), which gives you a 30-minute window of presence-data silence. After that, you're back on the grid. The opt-out itself is, of course, a logged event — the system knows you opted out, when, and for how long. You can be invisible, but not invisibly invisible.
Meta's stated justification is the standard one for this class of system: space utilization, hot-desk optimization, post-RTO occupancy planning. After three years of arguing about return-to-office policies, every large employer wants to know whether the people they ordered back are actually at their desks. The 30-minute opt-out exists not because Meta wanted to design a privacy feature, but because some jurisdiction's works council or labor law forced one into the spec.
The HN thread split predictably. One camp: 'this is fine, it's an office, employers have always known where you are.' The other camp: 'the default matters more than the opt-out, and a logged opt-out is not really an opt-out.' Both are right about different things, which is why the story is interesting rather than just outrageous.
The 'it's fine' camp has a point about the baseline. Badge readers have existed since the 1980s. Conference-room sensors have been standard in new builds for a decade. Wi-Fi triangulation has been quietly logging laptop locations in most large offices since roughly the iPhone era. What's new at Meta isn't the sensors — it's that the sensors have been unified into a single addressable identity model with a user-facing toggle. The toggle is the tell. You only ship a toggle when the underlying system is comprehensive enough that people would object if they understood it.
The 'defaults matter' camp has the stronger technical argument. In any consent system — GDPR cookie banners, app permissions, telemetry prompts — the default determines the outcome for >90% of users. A 30-minute timer that you have to actively trigger, that resets automatically, and that is itself logged, is the surveillance equivalent of a cookie banner with 'Accept All' pre-highlighted. It satisfies the letter of whatever policy required it without changing behavior in aggregate. The data still gets collected from almost everyone, almost always.
There's also a precedent question worth taking seriously. Meta is not a small company experimenting at the edges; it's one of the five firms that defines what 'normal corporate IT' looks like for the rest of the industry. When Meta ships a workplace surveillance model with a 30-minute opt-out, vendors will sell that exact pattern to every Fortune 500 by next quarter. The HR-tech category has been waiting for a credible reference architecture for in-office presence tracking. They just got one.
The wrinkle Meta seems to be missing: engineers, more than any other professional class, build the tools that decide what 'consent' means in software, which makes them unusually allergic to consent theater when it's pointed at them. This is the same demographic that ripped Oracle apart yesterday for pitching AI surveillance as a product category. Asking them to accept it as a workplace condition is going to land badly internally, even if it survives externally.
If you build internal tools at any company over ~500 people, this story is a forcing function. You will, within 12 months, be asked to integrate with, extend, or build on top of a presence-tracking system. The questions to get answered before you write a line of code:
Retention. How long is presence data kept? 'Forever' and '90 days' produce wildly different risk profiles. Forever means the data outlives the policy that justified collecting it, and outlives the executives who promised it wouldn't be misused. Short retention windows are the single most effective privacy control you can ship, and the one most consistently negotiated away in the second sprint.
Granularity of the opt-out log. Logging that someone opted out is sometimes necessary (audit, compliance). Logging *which* 30-minute window they chose, combined with their badge data on either side, lets you reconstruct the gap. If your system records the opt-out as a structured event with timestamps, you've built a tool that punishes people for using the privacy feature you advertised. Consider whether the opt-out should be a count-only metric, not a timestamped one.
Default state on new hires. New employees almost never read the data-collection disclosure on day one. Whatever the default is at onboarding is the default forever, because nobody goes back and changes it. If you're going to ship a toggle, ship it in the off position for the first 30 days, then prompt explicitly.
Access controls on the data itself. Presence data is the kind of dataset that gets requested by every adjacent team — facilities, HR, security, the manager who wants to know why Dave wasn't at his desk Tuesday. The list of roles with query access should be short, written down, and reviewed quarterly. Otherwise, in 18 months, your CTO finds out a middle manager has been running attendance reports against engineers and the resulting Slack thread is a career event.
The 30-minute opt-out is going to become a template, the way GDPR cookie banners became a template — copied widely, implemented minimally, and largely ignored by the people it was supposedly designed to protect. The interesting question isn't whether Meta's specific feature is good or bad; it's whether the next generation of workplace software treats presence data as sensitive by default or as routine telemetry. The architectural choices made in the next 18 months — retention, granularity, defaults, access — will decide whether 'tracked at work' means 'logged for facilities planning' or 'queryable forever by anyone with a JIRA ticket.' The people making those choices are reading this thread. Hopefully they're taking notes on more than just the UX of the timer.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.