“Your screen is being observed” Mac Message

This message means that an app has permission to "see" the contents of your screen and is currently exercising that privilege. (It need not be recording of the screen per se. )

Of the built-in apps, this is typically the built-in Screen Capture feature has been unknowingly triggered to record your screen (Shift-Cmd-5).

Of the 3rd-party apps, it would be one or more of the apps in Apple Menu > System Preferences… > Security & Privacy > Screen Recording

Hi Kurt, I'm completely new to Mac. I was also having the same issue on my new personal MacBook Pro just now and it really sketched me out. How do I find out and also revoke which apps or software on my end are trying to access my screen? Is there a centralized hub for this and where is it located, if you wouldn't mind helping me out? Again, completely new to Mac OS.

Try checking the icons in your top menu bar to see if a screen recording is happening. I saw the same message a few hours after triggering a screen recording with CMD + Shift + 5. I was able to close the recording, and the message on the Lock Screen disappeared.

From one online forum:

Person 1: Seems to be tied to applications having screen recording permission. I revoked it from my display link manager and the message was gone. When I re-enabled the permission the message returned

Person 2: Ah thanks dude, it was that :)

Person 2: It was my DisplayLink as well. Freaked me out ... what an ominous message!

The thing is I use a DisplayLink adapter to enable a 3rd external monitor for my 13" MacBook Pro - it's always connected at my desk. The problem with this persistent error for something I do want, is that if something I don't want to record my screen tries to, I might not notice the difference.

From this, I would guess the message is from the OS, letting you know an app being loaded at startup is monitoring screen activity. You would need to find out what it is (or more than one) and disable it/them.

Also, check the System Preferences under Sharing. Screen Sharing may be on. If so, turn it off.

I have the same issue but here are my added details. I only see this message when the screen is locked. I only see this message when I'm screen sharing or Apple playing my content onto my Samsung TV. I cannot produce the message by screen sharing with other products, only my tv. I don't care that much but I kinda do care. Not the best feeling thinking your being watched but it's not like I'm interesting. I don';t even like monitoring my MacBook when I'm on it. I have a feeling this is an issue with my tv IF and only IF this isn't some kind of mistake on my MacBook software. If one advises that it may be my tv, please advise at to what I might do. Thanks a bunch in advance.

Thanks craigfay. I stepped away and when I returned to the lock screen, I saw the unnerving message "your screen is being observed." Your advice was perfect in my situation, as that was indeed the case for me—I had turned on screen recording and then forgotten to turn it off.

The OS or any apps written by Apple included with it will not produce such errors. Such as, a simple full screen shot keyboard command of Command+Shift+3 will produce no error even though it is obviously accessing the screen. The luxury of being able to declare yourself safe.

This means you need to find out what third party software you've installed is causing the message to appear.

Are you seeing this as soon as you turn your Mac on, or when you're trying to use a specific app? If the former, it may be the drivers for a Wacom, or other brand of tablet. As an example, the Wacom drivers in Big Sur have just the one entry that needs to be declared "safe" by you in System Preferences > Security & Privacy under the Privacy tab. There are more of them for Wacom in Catalina.

Another way to check is to see what startup daemons have been added by third party software you've installed. These entries exist as one method to cause an app to load as the Mac starts up. Entries in the .plist files point to the app, or sub-app buried within an app. Whichever they are, the OS acts on and loads them at startup.

There are three locations. If you double click the main drive icon on your desktop, the first two are in the Library folder next to Applications, System and Users.

/Library/LaunchAgents

/Library/LaunchDaemons

The last is in your user account. The tilde ~ means your account. Not the main Library folder.

~/Library/LaunchAgents

I have these in Catalina:

/Library/LaunchAgents

com.adobe.AdobeCreativeCloud.plist

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

com.adobe.ccxprocess.plist

com.adobe.GC.AGM.plist

com.adobe.GC.Invoker-1.0.plist

com.microsoft.update.agent.plist

com.wacom.DataStoreMgr.plist

com.wacom.IOManager.plist

com.wacom.wacomtablet.plist

com.xrite.device.softwareupdate.plist

com.xrite.i1Profiler.tray.plist

/Library/LaunchDaemons

com.adobe.acc.installer.v2.plist

com.adobe.agsservice.plist

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.aladdin.aksusbd.plist

com.aladdin.hasplmd.plist

com.bombich.ccchelper.plist

com.charlessoft.pacifist.helper.plist

com.empiatech.cmio.DPA.plist

com.github.IngmarStein.Monolingual.Helper.plist

com.microsoft.autoupdate.helper.plist

com.microsoft.office.licensingV2.helper.plist

com.prosofteng.DRInstaller.plist

com.quark.quarkupdate.quhelper.plist

com.quark.QXPHelper.plist

com.twocanoes.WincloneHelper.plist

com.wacom.displayhelper.plist

com.wacom.UpdateHelper.plist

com.xrite.device.xrdd.plist

com.xrite.device.xrdd.restart.plist

~/Library/LaunchAgents

com.adobe.GC.Invoker-1.0.plist

com.linotype.FontFolderProtector.plist

As you can see, there can be quite a few. The only ones I have that would have anything to do with screen access would be for the Wacom tablet. The rest launch services and helpers that need to be active for each third party app listed to run when launched. A lot of them are just services that check in the background for updates for each respective app.

Since we can't see your system, this is decent info to give you an idea where to start looking.

That person was referring to a third party app. It was just an example of something that wants control of the screen.

I got a similar message just today when I wanted to pick up a color with the eye dropper in Muse. Had to go into the System Preferences to allow Muse access to a simple color pick.

You need to check what software on your end is trying to access the screen.

It simply means that you have a third party app that is getting permission to use screen. You can find it listed in

System Preference -> Security and Privacy -> Privacy Tab -> Screen Recording option.

uncheck what is not needed and go from there.

After finding out what this msg meant, i moved on. Since i liked sharing my screen with another external screen.

I have a 3rd Monitor using a hub with DisplayLink. The DisplayLink software needs Screen Recording permission to function. According to DisplayLink's website: "requires the user to permit "Screen Recording" in order for DisplayLink devices to work properly. The message is generated by the OS and the screen is not actually being recorded by DisplayLink. Approving it enables the DisplayLink driver to access the pixels it needs to render a mirrored or extended screens, and send the pixels over USB from your computer to the DisplayLink display. It does not send any data or pixels back to DisplayLink."

If you don't use DisplayLink then look in System Preferences, Security & Privacy then Screen Recording and see if any apps are listed. If so, revoke screen recording to see if the message goes away.

Used the built-in Screenshot app today for the first time to do a screen save. Noticed the message when I logged in again. Read the messages. Clicked on the icon at the top of the screen and the message disappeared. Spooky, though.

A search brought me here and, with the help of answers above, I figured out that in my case the culprit was an app called Yoink (which allows files and other things to be "put on a shelf" at the side of the screen to facilitate drag-and-drop operations). Always pleased to find helpful people listing good solutions: thanks!

ltracz wrote:

I don't want this screen is being observed. I don't understand why the recording. How do I stop it?

Reboot through Safe Mode, and see if the message persists.

If the message persists, change your Mac password, and disable screen sharing in System Preferences > Sharing, and don’t offer to share your desktop via iMessages or other conferencing tools.

I got this message when using VSCode i accidentally started recording my screen with an extension called “Chronicler”. Once i stopped the recording the message disappeared. I then deleted the 3 hour video. 🤷🏽‍♀️