You’re sitting there, maybe finishing a spreadsheet or just scrolling through some old photos, and you glance up at your lock screen. There it is. A small, persistent, and deeply unsettling message: your screen is being observed macbook.
Your heart skips. Honestly, it’s a terrifying thing to read if you aren't expecting it. It sounds like a hacker is currently watching you type your passwords or that some shadowy IT admin is monitoring your every move from a basement across town. It’s spooky. It feels like a violation. But here is the thing: 99% of the time, it’s just macOS being a little too honest about how its own features work.
I’ve seen people panic and put tape over their cameras or immediately shut down their Wi-Fi. Don't do that yet. Most of the time, this isn't a security breach. It’s a UI quirk that Apple hasn’t quite figured out how to explain to users without scaring the daylights out of them.
What is actually happening when your screen is being observed?
Apple’s security architecture is built on the principle of transparency. If any process—whether it’s a system tool or a third-party app—accesses the "framebuffer" (the stuff being drawn on your display), the OS triggers a warning. It’s a safety net.
The most common culprit? Display mirroring. If you are using AirPlay to send your screen to an Apple TV, or if you have an iPad sitting next to you acting as a second monitor via Sidecar, your Mac is technically "observing" the screen to send that data elsewhere. Because the data is being captured and transmitted, the lock screen throws up the warning. It doesn't distinguish between "I am sending this to your own iPad" and "A hacker is recording your screen." To the system, it's the same action.
Sometimes it’s even simpler. If you use a third-party app to record a quick tutorial, or if you’re sharing your screen on a Zoom call and then you lock your computer without ending the session, that message will stay there. It’s a persistent flag. It stays until the process stops.
The DisplayLink Factor
This is where things get annoying for office workers. Many modern docking stations—especially those used to connect a MacBook to two or three external monitors—use a technology called DisplayLink.
DisplayLink works by using a driver to "scrape" the pixels off your screen and send them over USB. It’s a clever workaround for MacBooks that don't natively support multiple external displays (looking at you, base model M1 and M2 chips). But because this driver is constantly reading the screen data to show it on your monitors, macOS identifies it as a screen recording. You’ll see that your screen is being observed macbook alert every single time you lock your Mac while docked. It’s not a bug. It’s just how the hardware has to function to get around Apple’s display limitations.
How to check who (or what) is watching
If you aren't using a dock or Sidecar, you probably want to know exactly what is triggering the alert. Apple actually provides a way to see this, though it’s tucked away in the menu bar.
Look at the top right of your screen. Do you see two overlapping squares or a small icon that looks like a camera inside a circle? Click it. This is the Control Center. If an app is currently using your microphone or recording your screen, macOS will list it right at the top. It might say something like "DisplayLink Manager is capturing your screen" or "Screen Recording by Zoom."
If you see an app there that you don't recognize, that’s when you should actually worry. But usually, it’s just Chrome, Discord, or a utility you forgot was running in the background.
When you should actually be concerned
I don't want to give you a false sense of security. While 99% of cases are benign, "screen observation" is a primary tactic for malware and spyware.
Remote Access Trojans (RATs) allow attackers to see exactly what you see. If you haven't touched your settings, you aren't using a second monitor, you aren't on a video call, and that message is still there? Yeah, that’s a red flag. Check your Login Items. Go to System Settings > General > Login Items & Extensions. Look for anything weird. If you see a process with a nonsensical name like "com.sys.daemon" or something you never installed, disable it immediately.
Also, look at your Privacy & Security settings. Under the "Screen & System Audio Recording" section, you can see a list of every app that has permission to watch your screen. Go through that list like a bouncer at a club. If an app doesn't need that permission to function, toggle it off. You can always turn it back on later if the app breaks.
Is it your IT department?
If you're using a company-issued MacBook, the answer is "maybe, but probably not in the way you think."
Most corporate Macs are managed via MDM (Mobile Device Management) software like Jamf or Kandji. While these tools give IT a lot of power, they generally don't "observe" your screen in real-time without you knowing. Usually, if an admin wants to see your screen for troubleshooting, macOS will pop up a very explicit request asking for your permission.
However, some "productivity monitoring" software—the kind of stuff people call bossware—can run silently. If your company installed something like Hubstaff or Teramind, those can trigger the "observed" warning. It’s worth checking your installed Profiles in System Settings > Privacy & Security > Profiles. If there’s a management profile there, your privacy expectations should honestly be pretty low.
Getting rid of the message
If the message bothers you and you know it’s just your docking station, there isn't a "magic switch" to hide it. Apple wants it there for security reasons. You can't just opt-out of being notified that your screen is being recorded.
But you can stop the behavior.
- Disconnect from AirPlay or Sidecar.
- Quit screen-sharing apps like TeamViewer or AnyDesk when you're done.
- Unplug your DisplayLink dock.
If you're using a DisplayLink dock and you need those monitors, you just have to learn to live with the message. It’s a trade-off for having that extra screen real estate.
Actionable steps to secure your Mac right now
If you’re still feeling uneasy, do these four things. It takes five minutes.
- Audit Screen Recording Permissions: Go to System Settings > Privacy & Security > Screen & System Audio Recording. Revoke access for everything except the absolute essentials (like your browser for video calls or your docking station software).
- Check for Unknown Profiles: Go to System Settings > Privacy & Security > Profiles (it only shows up if profiles are installed). If you see something you don't recognize and it's a personal Mac, delete it.
- Update macOS: Apple frequently patches "zero-day" vulnerabilities that allow apps to bypass these warnings. Staying on the latest version of Sequoia or Sonoma is your best defense.
- Use a specialized cleaner: Use a tool like KnockKnock (by Objective-See) to see what persistent software is installed on your Mac. It’s a free, expert-level tool that shows you exactly what starts up when your Mac boots. It’s much more thorough than the basic Apple settings menu.
Knowing what’s running on your machine is the difference between being a "user" and being in control. Most of the time, that lock screen message is just a clumsy way of your Mac saying, "Hey, I'm doing that thing you asked me to do with the extra monitor." Don't let it ruin your day, but don't ignore it either. Just verify it.
