Digital exhaust, or data exhaust, is the information you generate as you interact digitally. We’ve typically thought of this in terms of tracking cookies and the like, but it is so much more. For instance, think about all of the telemetry data which observability platforms like Azure Application Insights, DataDog, Dynatrace, and others capture. We’re able to see session data, even the user journey through our systems, all the way to back-end servers and data stores. This is great, useful information which can make our products better. Digital exhaust is also any data we enter. For instance, Facebook/Meta released a study back in 2013 about “self-censorship,” which was research tracking posts we started but didn’t actually post on the platform.

With the pandemic, enterprise systems gained a lot more instrumentation. Again, this instrumentation is valuable. It can tell the leadership in an organization what the real processes are. There was a write-up back in 2021 in Forbes discussing how valuable this data was to an organization. But as I was researching this topic for an ISACA article, I began to think about what kind of controls and safeguards are needed to protect employees and other workers. Take Microsoft Teams, for instance. There’s significant telemetry captured, especially around meetings and collaboration. The question, though, is what are organizations doing with this data? Are they using it to improve or punish?

The reality is that the laws, especially in the United States, don’t provide much in the way of protection for enterprise users. An article was published on February 24, 2025, on the MIT Technology Review titled, “Your boss is watching” and it’s a great article detailing the concerns, some specific cases where data wasn’t used properly, and the current state of legislation here in the United States.

With hybrid and remote work having become prevalent, the justification is that employers need to monitor their employees and they need tools to cover the new working arrangements. This bothers me greatly because busy is not the same as effective. In fact, it isn’t unusual for busy to cause ineffectiveness. Busyness prevents “deep work,” which is what almost every knowledge worker needs to be engaged in to be most effective. If I’m in deep work mode, I’m probably not generating a lot of telemetry. Planning, strategy, architecture, and design all require deep work. If enterprise digital exhaust is used incorrectly, the organization will end up penalizing those who focus on deep work, which will have negative impact to the organization.