You unlocked your Mac and a message appeared near the menu-bar clock or in Control Center: "Your screen is being observed." It is an unsettling thing to read. Is someone watching you right now? Is it a virus? Is your employer spying? The short answer: this message is macOS being honest with you, and in the large majority of cases it is caused by something ordinary that you can identify and turn off in under a minute.
Here is exactly what that message means, how to tell a harmless cause from one worth worrying about, and the step-by-step way to find and stop whatever is doing the observing.
What "Your screen is being observed" actually means
macOS shows this notice whenever an app or service currently has access to your screen contents in real time. Apple added it as a privacy safeguard: if anything can see your screen, the system tells you so. The message does not mean you have been hacked, and by itself it does not prove a person is watching. It only means a screen-observation capability is active right now.
The four things that trigger it, from most to least common:
- Screen sharing or remote control. Someone connected to your Mac with Screen Sharing, or you left it enabled. This is the number-one cause. See our guide on how screen sharing works on a Mac to understand the difference between someone observing and someone controlling.
- Screen recording. A screen-capture or video app (QuickTime, OBS, Zoom sharing your screen, a recorder you forgot to quit) is capturing what you see.
- Screen mirroring / AirPlay. Your Mac is mirroring to a TV, Apple TV, or another display.
- Remote management (MDM). On a work- or school-owned Mac, an administrator has enrolled it in device management that permits remote observation. This is the cause most people actually worry about, and we cover how to check for it below.
Should you worry? A 30-second triage
Work through these in order. Most people find the answer at step 1 or 2.
- Did you start something? If you just began an AirPlay/mirroring session, a Zoom/Teams screen share, or a recording, that is your cause. The message will clear when you stop it.
- Whose Mac is this? If it is a laptop your employer or school gave you, remote management is expected and the observation notice can appear during legitimate IT support or policy checks. Personal Macs are almost never observed unless you enabled sharing.
- Is it constant or occasional? A one-off during a video call is normal. A message that is always present the moment you log in points to Screen Sharing left on, a recorder running at login, or an MDM profile — all identifiable below.
Genuine spyware is rare on Mac and usually does not politely announce itself through Apple’s own privacy indicator — the indicator is the system protecting you, not the attacker. That said, if you bought a used Mac and cannot account for the message, do the full checklist; a Mac configured by a previous owner can carry leftover profiles.
How to find exactly what is observing your screen
1. Open Control Center
Click the Control Center icon (the two toggles) in the top-right menu bar. If your screen is being observed, you will see a purple screen-mirroring/observation indicator. Click it — macOS often names the app or device doing the observing right there. That single click solves a lot of cases.
2. Quit the obvious apps
Look for and quit anything that captures the screen: Zoom, Microsoft Teams, Google Meet (in a browser), QuickTime Player, OBS, Loom, CleanShot, or any remote-support tool (TeamViewer, AnyDesk, Chrome Remote Desktop). If the message disappears when you quit one, you found it.
3. Turn off Screen Sharing and Remote Management
Go to System Settings > General > Sharing. Check that Screen Sharing and Remote Management are switched off (unless you deliberately use them). On a personal Mac, both should normally be off.
4. Stop AirPlay / mirroring
If you are mirroring to a TV or Apple TV, open Control Center > Screen Mirroring and turn it off.
5. Check Screen Recording permissions
Go to System Settings > Privacy & Security > Screen & System Audio Recording. This lists every app you have allowed to record the screen. If you see something you do not recognize or no longer use, toggle it off. This is the master list of what can observe your screen.
6. Check for a management profile (the MDM question)
Go to System Settings > General > Device Management (or Profiles). If this section is empty or absent, your Mac is not under MDM and no employer or school is observing it. If a profile is listed on a personal Mac you bought used, that is a leftover you will want removed — often the cleanest fix is a full erase and reinstall, which we walk through in how to factory reset a MacBook.
Related indicators people confuse with this one
Apple uses several small privacy signals, and it is easy to mix them up:
- A purple screen indicator or the "being observed" text = your screen is being seen (this article).
- An orange dot = your microphone is active. We explain that one in what the orange microphone dot means.
- A green dot = your camera is active.
If you want to limit what apps and other users can do on the Mac in the first place, Screen Time and its parental controls let you set app limits and restrictions.
Buying or selling a used Mac? Start from a clean slate
The safest way to be certain no leftover profile, sharing setting, or recorder is watching is to start from a Mac that was properly reset and inspected. Every Mac we sell is wiped, reinstalled, and checked before it ships, with a real warranty behind it — browse current Apple clearance deals if you want a machine you can trust from day one. Selling yours? Erase it first so the next owner never sees a mystery observation notice from your old settings.
Frequently asked questions
Does "Your screen is being observed" mean I have a virus?
Almost never. The message is macOS reporting that some app or service currently has screen access — usually screen sharing, a recorder, AirPlay mirroring, or work MDM. Real spyware avoids Apple’s privacy indicators rather than triggering them. Work the checklist above and you will typically find an ordinary cause.
Can my employer see my screen without me knowing?
On a company-owned, MDM-enrolled Mac, an administrator can have remote-observation rights, and this notice is one of the moments it can appear. Check System Settings > General > Device Management to see whether a management profile exists. On a personal Mac with no profile listed, no employer is observing you.
How do I make the message go away?
Stop whatever is observing: quit screen-recording or video-call apps, turn off Screen Sharing and Remote Management in Sharing settings, stop AirPlay mirroring, and remove any screen-recording permission or management profile you do not want. When nothing is observing, the message clears on its own.
I bought a used MacBook and this keeps appearing. What should I do?
A used Mac can carry a previous owner’s sharing settings or a leftover management profile. Check Device Management for a profile, review Screen Recording permissions, and if anything looks off, do a clean erase and macOS reinstall so you start fully in control.