Your Screen is Being Observed on Mac, Fix
Several users have said that they see a warning message saying “your screen is being observed” on the Mac. It seems that this message may appear on Mac’s Lock screen, the screen you see before logging into the Mac. You may also see an “overlapping squares” icon in the Apple status Menu Bar. This icon looks like two rectangles on top of each other in the top-right corner of your Mac’s screen. And once this icon is clicked, the same message appears when your Mac is unlocked.
Several users have further said that this message scared them into thinking that their Mac is being tracked or hacked. There can be several reasons why you may see this. But it is highly likely that there is nothing that you need to worry about. For example, you have not been hacked or you do not have malware. This article explains why you’ve received a notification that your screen is being observed and how you can stop it.
- How To Prevent Viruses And Other Malware On Your Mac
- Mac: Your System Is Infected With (3) Viruses, Fix
Why does the “screen is being observed” message appear and how can you fix it?
There are a few scenarios in which your computer may display this:
1. Are you recording the screen on your Mac?
If you are recording your Mac’s screen, this message will be displayed on the Lock Screen. Your screen recording will continue when you lock your Mac or put your screen to sleep in macOS. And this message will be displayed indicating your screen is being recorded.
This happens to me a lot too. I often start screen recording, then I forget about it and I remember my screen is being recorded when I see this message. When I stop screen recording, this message disappears. There are multiple ways to record the screen. The built-in options include:
- You can use the Screenshot toolbar.
- You can use QuickTime Player
To end the recording, click the stop recording icon (the little square stop button in the upper right corner) in the menu bar. Or alternatively, you may press Command-Control-Esc (Escape).
In other words, check to see if a screen recording is occurring. Simple press Command-Control-Esc to end it.
There are multiple ways to record on your Mac:
- How to Record Voice Memos & Audio on your Mac
- How to Record Video in iMovie on Mac
- How To Record Audio On Your Mac
- How To Screenshot (Print Screen) And Record Screen On Your Mac
- How To Record Your Face and Screen On Your Mac
2. Are you sharing your screen?
You can share your screen remotely or locally. If your screen is being shared, then this message will be displayed. If you are not sure, you may want to check your settings. Go to Apple menu > System Preferences, and then click Sharing. If you want to turn off screen sharing, follow the steps below:
- Open System Preferences, click Sharing.
- Ensure that the Remote Management checkbox is deselected.
- Ensure that the Screen Sharing checkbox is deselected.
3. Are you using AirPlay?
If you are using AirPlay to stream video or mirror your Mac’s screen to your Apple TV or AirPlay 2-compatible smart TV. If this is the case, once you stop the mirroring, this message will disappear. Here is how you can do this:
- You can click the AirPlay icon (which looks like a computer monitor) in the menu bar, then choose Turn AirPlay Off.
- Or alternatively, you can go to System Preferences > Displays and select Off from the AirPlay Display drop-down menu.
See also: AirPlay Not Working?
4. Third party apps
Some third-party apps may cause this issue. Some apps may require you to permit “Screen Recording” in order to function properly. For example, a popular app called DisplayLink needs this permissions. You can check your screen recording permissions by using the Privacy pane of Security & Privacy preferences. Here is how:
- On your Mac, open System Preferences and click Security & Privacy.
- Select Screen Recording (scroll the left column down). And then you can see a list of apps that are permitted to record the contents of the screen. If you want, you can prevent an app from recording your screen by deselecting it.
- If you are not sure about an app, you may want to contact its developer.
My circumstances are that Display Link Manager is needed, as Klas said, for my Dell dock to enable my external monitors via the USC-C connector if I have the name right. If I turn off the permission in preferences>privacy it turns off the signal to the monitors. So I infer that “observe” means “has full access to the video signal” (so that the monitors can work). What a classic user-hostile behavior, in the name of full transparency, we get a threatening and genuinely scary behavior (not just a message)… and the message provides no direct trace-back to the offending software or its manufacturer.
Thanks for compiling the advice above. I had this problem – suddenly got the message saying that my screen was observed (in Swedish: “Skärmen övervakas”). Following the tips above did not solve the problem though. After many hours of trying to figure out why, the problem turned out to be the DisplayLink software mentioned in your fourth scenario. But deselecting the app or even deleting it from the list of apps allowed to record the contents of the screen in the System preferences was not enough – I still kept getting the warning message.
Solution: I uninstalled the DisplayLink software entirely and got rid of the warning message. I can still use several displays via HDMI (and probably via DisplayPort, mini-DisplayPort, DVI). I believe DisplayLink is only needed for connecting displays via USB.
I teach remotely from WV at Bristol CC in MA. At least 5 times within the last 2 months, I have had a similar issue. Using Chrome – ZOOM – screen sharing PADLET -sharing videos, I have received this message: Your screen is being observed. Underneath this message, there is a password box. I do not enter my password. There is a box with X for cancel. Nothing happens when I click on cancel. No keys work. I cannot turn off the computer using the power button. I have to unplug from power strip. Wait. Restart. This happens from 10:30 to 11:00 consistently when I am teaching. I do not recall the specific dates except for June 1, yesterday. This happened at 10:44 and 11:44 a.m. I have communicated with BCC IT, and my husband who is a computer software engineer has been searching for a solution.