The interesting design question isn't "can we collect this" — it's "what do we lose by not collecting it."                                                                                
                 
  I run a small web tool. Early on I considered session recording, heatmaps, keystroke timing. Every one of those would have made the product slightly better to optimize. I didn't add any of them. Not because of regulation, but because I didn't want to be in the business of explaining to users what I was doing with their cursor path.                                             
                                                            

Meta is in a different position — these are employees, not customers, and the stated goal is AI training. But the logic is the same: once you've decided the data is useful, the collection feels justified. The question is who gets to decide "useful to whom."

The part that bothers me most isn't the mouse movements. It's that there's no symmetry employees can't see what Meta does with their cursor data the same way Meta can see what the employee's cursor does.