Hundreds of thousands of workplaces use software to monitor employees. Now, a new study has found that many of these tools share data not just with employers, but with digital advertising platforms and data brokers as well.

The review was led by Stephanie Nguyen, senior fellow at Columbia Law School’s Center for Law and the Economy and former Federal Trade Commission chief technologist under Lina Khan. It examined nine workplace monitoring (or “bossware”) services and found that all of them shared some information with third-party platforms. The data ranged from names and email addresses to web history, and recipients included Facebook, Google, and Microsoft.

“The striking piece of this study is that every single platform, nine of nine bossware companies, shared worker data with outside companies. Every single one,” Nguyen told The Verge in an interview. “That blew me away.”

Seven of the nine platforms — Apploye, Desklog, Hubstaff, Monitask, Buddy Punch, VeriClock, and When I Work — did not immediately respond to The Verge’s requests for comment. Ciaran Hale, chief technology officer at another one of the platforms, Deputy, said in a statement that the company’s “third-party relationships are limited to trusted operational and infrastructure providers that support the delivery, security, and reliability of our platform.” Hale added that Deputy has rigorous privacy controls and that the researchers “appear to have conflated standard B2B marketing cookies found on our public-facing corporate website (such as advertising analytics) with our secure employee application.” In a statement, Nguyen responded, “We looked at the full experience a worker would have from the moment they visit deputy.com and hit ‘Log In.’ What we found is that personal information, including names, emails, and company names, is being sent to third parties whenever anyone uses the application, whether they’re a worker or a boss.”

The ninth, Time Doctor, provided information about data sharing via an AI assistant but not a response from a human spokesperson. The nine platforms’ customers collectively include Amazon Ring, Ben & Jerry’s, Ticketmaster, Verizon, and Tesla, according to their own disclosures. Together, the report says, they say they serve “hundreds of thousands of workplaces across dozens of sectors.”

To figure out where workers’ data was going, the researchers reviewed publicly accessible information like terms of service and privacy policies, and made trial accounts across the nine platforms for both managers and workers. They intercepted the network traffic with an open-source tool used to see what they were transmitting and to which other services. They found that the tools shared data including workers’ names, emails, and companies, as well as information about workers’ online activities, including their IP addresses and webpages they visited. Three of the nine platforms analyzed have the ability to track workers’ precise location, even when the app is running in the background, the review found.

Bossware poses risks even without third-party sharing. Data could be used to make decisions that are potentially discriminatory or to make incorrect assumptions — for example, the researchers say, inaccurately inferring details about a worker’s health and fitness by tracking their movement.

Sending that information to third parties creates more potential for abuse. The researchers point to “data append” services, for instance, that can gather disparate information on a person into a centralized profile — including theoretically anonymized material. Adding workplace details to the mix, they warn, could help create a “shadow ‘worker reputation economy’” that follows people long after they leave their jobs. It could even help third parties like advertisers make inferences about how distracted they’re perceived to be or if they’re looking to leave their current employer.

The US still doesn’t have a national comprehensive data privacy law for consumers, but workers can be particularly vulnerable. Even if they’re broadly aware the systems are tracking them, they may not understand the extent of the surveillance, nor where the information is going. They may also not be able to avoid them. “Workers typically lack the ability to meaningfully refuse surveillance, to switch employers, or to stop using an employer-issued surveillance platform without risking their jobs and livelihoods,” the report says.

They propose a “bright-line” solution to this problem: banning worker data from being shared or sold to third parties; prohibiting the collection of sensitive data on workers, including off-hours location monitoring; and limiting how long bossware companies can retain information. They urge state and federal law enforcers to consider whether certain worker data collection and disclosure might violate existing state privacy laws or unfair practices laws when it’s used in ways workers wouldn’t reasonably expect. They suggest it could also violate the Fair Credit Reporting Act, if it’s used to make employment decisions.

“The incentives are there for workplaces to try and gather, sell, resell that data,” Nguyen said. “What actually happens, and following that trail, is part of what we want to continue exploring.”