Why manager screen viewing should always require consent — and how we built it that way

DeskTrust Connect includes a feature called manager-initiated screen viewing. A manager can request to see an employee\'s screen live — like TeamViewer, but scoped to their organization. It\'s the feature that most obviously overlaps with an existing product category (TeamViewer, LogMeIn, etc.).

In every one of those existing products, silent screen viewing is possible. Sometimes it\'s the default. That\'s a design choice, and it\'s not the choice we made.

The problem with silent viewing

Silent viewing is easy to build: you install an agent, the agent has permission to capture the screen, done. It\'s legal in many jurisdictions when there\'s a written policy the employee signed. It works.

The problems are downstream:

1. Every session is a legal risk. The written policy was signed years ago. The manager didn\'t re-check with counsel. The employee is in California now, not Texas. Two-party consent statutes vary by state, and by country.
2. Every session is a trust wound. Even employees who\'ve technically consented via policy don\'t like the idea of being watched without knowing. Once they find out, the relationship is different.
3. Every session is unfalsifiable. If a manager did the wrong thing, the employee has no way to say "I never agreed to that." If a manager did the right thing, the manager has no way to prove "I only did the thing they said was okay." Silent viewing makes both cases indefensible.

What we built instead

Four hard rules for every manager-initiated screen-view session in Connect:

1. The employee must actively approve every session. A modal takes over their browser. They click Approve. They pick which screen or window to share. There\'s no "remember this decision" toggle. There\'s no "auto-approve for admins in this group" setting. Every session is a fresh consent event.
2. The employee always sees they\'re being viewed. A persistent red pill floats in the top-right corner of their screen for the entire session. It shows the manager\'s name, the elapsed time, and a giant STOP button. It cannot be closed while the session is active.
3. The employee can end the session at any time. The STOP button is the same size and prominence as the approval button. One click, session\'s over. On the server side the mediasoup Router closes; on the manager\'s side the CallScreen exits.
4. Every request writes an immutable audit row. Approved, denied, expired, cancelled, revoked mid-session — all of them. With actor, target, jurisdiction, timing, IP. Never updated, never deleted. If a regulator or a lawyer asks what happened, the evidence is there.

The consent text

The disclosure shown to the employee at approval time varies by jurisdiction. US 2-party-consent states get stricter language emphasizing recording and revocation. GDPR-covered EU sees GDPR-specific consent framing. GCC customers see a variant appropriate to their local labor practice. ANZ + default categories fill out the rest.

The base text ships as a defensible default. Every customer\'s legal team should review and (if needed) replace it before enabling the feature in production. We flag this loudly in the docs and in the settings page itself.

What this costs us as a product

Silent viewing would have been half the code. Fewer modals, fewer server-side gates, no jurisdiction-detection code, no audit-log requirements. Faster to demo. Easier to sell to a certain kind of buyer who wants unrestricted oversight.

We think that buyer is asking for the wrong feature. What they actually need — evidence of what happened, confidence they weren\'t liable, ability to help employees quickly — is exactly what consent-first delivers. It just requires the employee\'s participation, which is a feature, not a bug.

What about the base DeskTrust product?

DeskTrust\'s core screenshot and activity capture is always-on, unattended. That\'s a different product category with different disclosures — employees consent at hire time and via monitoring policies. Connect\'s manager-view is opt-in per session, in real time. Two different tools for two different jobs. The one on the same server as your monitoring dashboard.

We wanted to be clear about that difference. Now we hope customers are too.