Waking your MacBook from sleep or viewing your lock screen in macOS can sometimes reveal an unsettling privacy warning: an icon resembling overlapping squares or a recording camera accompanied by the text “Your screen is being observed”. This alert also appears inside the macOS Control Centre and Menu Bar, prompting immediate concerns that your computer has been hacked or infected by spyware.
In almost all cases, this notification is not malware. macOS displays this mandatory privacy banner whenever an active application or system extension is utilising Apple’s ScreenCaptureKit or CoreGraphics APIs to read pixels from your display. Common legitimate culprits include external monitor docks (such as DisplayLink), video conferencing tools (Zoom, Microsoft Teams, Discord), screen brightness utilities, or local screen recording software. This guide details how to identify which application is observing your screen and safely revoke or manage its access.
Method 1: Identify the Observing Application via Menu Bar and Control Centre
Modern versions of macOS (Sequoia, Sonoma, and Ventura) make it easy to see precisely which software process is capturing video frames.
- Log into your Mac using your password or Touch ID.
- Look at the top-right corner of your screen in the Menu Bar. Locate the Screen Recording icon (two overlapping rounded rectangles or a circular camera icon).
- Click on the icon to open the privacy drop-down menu.
- macOS will explicitly state: “[Application Name] is capturing your screen”.
- If the application is a communication tool you are actively using (such as Discord or Teams during a presentation), the banner will automatically disappear the moment you stop sharing your screen or end the call.
Method 2: Revoke Screen Recording Permissions in System Settings
If an application you are not actively using continues to hold an open capture session in the background, you can revoke its system privileges.
- Click the Apple menu in the top-left corner and select System Settings.
- In the left sidebar, click Privacy & Security.
- Scroll down the right pane and click Screen & System Audio Recording (or Screen Recording).
- Review the list of apps that have received permission to capture your display.
- Locate apps that do not require constant capture access (e.g. utilities you only use occasionally) and toggle their switches to Off.
- macOS will prompt you to quit the application to apply the change; click Quit & Reopen or Quit Now.
- Lock your Mac (press Control + Command + Q) to confirm that the “Your screen is being observed” banner is gone.
Method 3: Address DisplayLink External Monitor Drivers
If you connect your MacBook to external monitors using a USB hub or docking station powered by DisplayLink technology, the DisplayLink Manager app must continuously capture the screen buffer to output video over standard USB.
- Because USB-A and standard USB-C ports without native Thunderbolt Alt-Mode cannot transmit raw GPU video signals, DisplayLink software compresses screen frames in user space and sends them to the dock.
- macOS treats this virtual display process as a screen recording, triggering the persistent “Your screen is being observed” banner.
- If you use DisplayLink docks, this alert is completely normal and benign. The software is only transmitting pixels to your physical monitors, not uploading data externally.
- If you upgrade to native Thunderbolt 3/4 or USB4 monitors that support DisplayPort Alternate Mode, you can uninstall DisplayLink Manager, eliminating the banner permanently.
Method 4: Disable Remote Management and Screen Sharing
If your Mac is managed by an enterprise IT department or you previously enabled local remote desktop features, network screen sharing may be active.
- Open System Settings > General > Sharing.
- Check the status of Screen Sharing and Remote Management.
- If either setting is toggled on and you do not require incoming remote desktop connections from other computers, toggle both switches to Off.
- This immediately severs any inbound viewing sessions and clears the lock screen notification.
Screen Observation Causes and Solutions Reference
Use the reference guide below to evaluate common apps that trigger the macOS screen observation alert:
| Application Type | Examples | Why It Triggers Alert | Recommended Action |
|---|---|---|---|
| External Display Docks | DisplayLink Manager, InstantView | Compresses desktop video frames over USB | Safe to ignore; required for multi-monitor USB docks |
| Video Conferencing | Zoom, Microsoft Teams, Google Meet | Screen sharing or meeting capture active | Stop screen sharing in meeting toolbar |
| Screen Color / Calibration | f.lux, BetterDisplay, Lunar | Reads framebuffer to apply brightness curves | Keep enabled or switch to native macOS Night Shift |
| Remote Access Services | TeamViewer, AnyDesk, Apple Remote Desktop | Inbound remote viewing session connected | Quit remote software when not in use |
Maintaining Screen Privacy in macOS
Apple introduced the mandatory “Your screen is being observed” banner as a critical security safeguard to ensure users are never recorded without their knowledge. Auditing your Privacy & Security > Screen Recording permissions every few months ensures that abandoned software utilities do not retain unnecessary background visibility into your personal desktop activities.