“Your screen is being observed” Mac Message

The OS or any apps written by Apple included with it will not produce such errors. Such as, a simple full screen shot keyboard command of Command+Shift+3 will produce no error even though it is obviously accessing the screen. The luxury of being able to declare yourself safe.

This means you need to find out what third party software you've installed is causing the message to appear.

Are you seeing this as soon as you turn your Mac on, or when you're trying to use a specific app? If the former, it may be the drivers for a Wacom, or other brand of tablet. As an example, the Wacom drivers in Big Sur have just the one entry that needs to be declared "safe" by you in System Preferences > Security & Privacy under the Privacy tab. There are more of them for Wacom in Catalina.

Another way to check is to see what startup daemons have been added by third party software you've installed. These entries exist as one method to cause an app to load as the Mac starts up. Entries in the .plist files point to the app, or sub-app buried within an app. Whichever they are, the OS acts on and loads them at startup.

There are three locations. If you double click the main drive icon on your desktop, the first two are in the Library folder next to Applications, System and Users.

/Library/LaunchAgents

/Library/LaunchDaemons

The last is in your user account. The tilde ~ means your account. Not the main Library folder.

~/Library/LaunchAgents

I have these in Catalina:

/Library/LaunchAgents

com.adobe.AdobeCreativeCloud.plist

com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d.plist

com.adobe.ccxprocess.plist

com.adobe.GC.AGM.plist

com.adobe.GC.Invoker-1.0.plist

com.microsoft.update.agent.plist

com.wacom.DataStoreMgr.plist

com.wacom.IOManager.plist

com.wacom.wacomtablet.plist

com.xrite.device.softwareupdate.plist

com.xrite.i1Profiler.tray.plist

/Library/LaunchDaemons

com.adobe.acc.installer.v2.plist

com.adobe.agsservice.plist

com.adobe.ARMDC.Communicator.plist

com.adobe.ARMDC.SMJobBlessHelper.plist

com.aladdin.aksusbd.plist

com.aladdin.hasplmd.plist

com.bombich.ccchelper.plist

com.charlessoft.pacifist.helper.plist

com.empiatech.cmio.DPA.plist

com.github.IngmarStein.Monolingual.Helper.plist

com.microsoft.autoupdate.helper.plist

com.microsoft.office.licensingV2.helper.plist

com.prosofteng.DRInstaller.plist

com.quark.quarkupdate.quhelper.plist

com.quark.QXPHelper.plist

com.twocanoes.WincloneHelper.plist

com.wacom.displayhelper.plist

com.wacom.UpdateHelper.plist

com.xrite.device.xrdd.plist

com.xrite.device.xrdd.restart.plist

~/Library/LaunchAgents

com.adobe.GC.Invoker-1.0.plist

com.linotype.FontFolderProtector.plist

As you can see, there can be quite a few. The only ones I have that would have anything to do with screen access would be for the Wacom tablet. The rest launch services and helpers that need to be active for each third party app listed to run when launched. A lot of them are just services that check in the background for updates for each respective app.

Since we can't see your system, this is decent info to give you an idea where to start looking.

From one online forum:

Person 1: Seems to be tied to applications having screen recording permission. I revoked it from my display link manager and the message was gone. When I re-enabled the permission the message returned

Person 2: Ah thanks dude, it was that :)

Person 2: It was my DisplayLink as well. Freaked me out ... what an ominous message!

The thing is I use a DisplayLink adapter to enable a 3rd external monitor for my 13" MacBook Pro - it's always connected at my desk. The problem with this persistent error for something I do want, is that if something I don't want to record my screen tries to, I might not notice the difference.

From this, I would guess the message is from the OS, letting you know an app being loaded at startup is monitoring screen activity. You would need to find out what it is (or more than one) and disable it/them.

Also, check the System Preferences under Sharing. Screen Sharing may be on. If so, turn it off.

Try checking the icons in your top menu bar to see if a screen recording is happening. I saw the same message a few hours after triggering a screen recording with CMD + Shift + 5. I was able to close the recording, and the message on the Lock Screen disappeared.

I have a 3rd Monitor using a hub with DisplayLink. The DisplayLink software needs Screen Recording permission to function. According to DisplayLink's website: "requires the user to permit "Screen Recording" in order for DisplayLink devices to work properly. The message is generated by the OS and the screen is not actually being recorded by DisplayLink. Approving it enables the DisplayLink driver to access the pixels it needs to render a mirrored or extended screens, and send the pixels over USB from your computer to the DisplayLink display. It does not send any data or pixels back to DisplayLink."

If you don't use DisplayLink then look in System Preferences, Security & Privacy then Screen Recording and see if any apps are listed. If so, revoke screen recording to see if the message goes away.

This message means that an app has permission to "see" the contents of your screen and is currently exercising that privilege. (It need not be recording of the screen per se. )

Of the built-in apps, this is typically the built-in Screen Capture feature has been unknowingly triggered to record your screen (Shift-Cmd-5).

Of the 3rd-party apps, it would be one or more of the apps in Apple Menu > System Preferences… > Security & Privacy > Screen Recording

It simply means that you have a third party app that is getting permission to use screen. You can find it listed in

System Preference -> Security and Privacy -> Privacy Tab -> Screen Recording option.

uncheck what is not needed and go from there.

After finding out what this msg meant, i moved on. Since i liked sharing my screen with another external screen.

ltracz wrote:

I don't want this screen is being observed. I don't understand why the recording. How do I stop it?

Reboot through Safe Mode, and see if the message persists.

If the message persists, change your Mac password, and disable screen sharing in System Preferences > Sharing, and don’t offer to share your desktop via iMessages or other conferencing tools.

I also got this message while using AirPlay to use my Apple TV as a separate display (not mirroring). When I disconnected AirPlay the message on the lock screen went away.

A couple of teachers at my school reported this error, and it turns out it was caused by the Screencastify Chrome Browser extension.

I force quit Google Chrome and the issue resolved! Thank you :) Happy to know what was causing it.

That is a scam. Please download and use Malwarebytes and it should be removed. Also please read Avoid phishing emails, fake 'virus' alerts, phony support calls, and other scams

I got this message when using VSCode i accidentally started recording my screen with an extension called “Chronicler”. Once i stopped the recording the message disappeared. I then deleted the 3 hour video. 🤷🏽‍♀️

Usually, if your screen is being observed without your consent or knowledge, the best way to handle that is to restart the Mac.

I noticed when I’m mirroring my screen, it says that…. When I’m not mirroring or sharing my screen it goes away. It may just be that and not necessarily someone watching your screen….