I recently learned (the hard way) that my company is accessing my browser history on my work computer. That's fine and all, and comes as no surprise, really. However, I recently got hit with a warning about some of the sites I've visited. I'm not perfect, and have probably been on some websites during work that haven't been the best, but none have been what they claim I visited.
I will admit that I did visit the sites they claimed - but not with my company-issued hardware and not at work. So this kind of threw me for a loop - how does my company know all of the websites I've visited, even from my personal devices?
So after some research and digging, I'm 99% certain they know this because at some point, I logged into Google Chrome at work, and it's syncing my data (including browsing history) between every device I'm logged in on. Then a process on my work computer periodically scans my browsing history and sees some restricted websites, so then I get the hammer.
To be honest, I wasn't aware I was logged in on Chrome or that it synced my browser history. Of course, I know now that had I not been logged in on Chrome, none of this would be a problem. If I had known what was happening I would have logged out of Chrome.
My question is - is this legal/ethical? I feel like I'm justified in challenging the warning from HR. But, I'm unsure about their process in the first place...can they scan my browsing history, even when it includes stuff from my personal devices? Or are they justified in the practice, on the grounds that I don't have to be logged in to Chrome, and don't have to sync my data?
Edit
Okay, it's legal from them to peruse my browsing history, no matter what. And it was unwise, albeit legitimate, to be logged in to Chrome. But, are they justified in giving me the formal warning when I, in fact, broke no company policies? And can I challenge it? This is something that is going in my personnel file that I would rather not be there at all.
On a side note, when they query for my browsing history, it is possible to tell what device a page was viewed on across synced devices. Whether they are using that or not, I don't know (I guess not).
Edit 2 for some more information
The company and I both are located in Texas, USA. All internet traffic goes through a firewall/proxy while on the internal network, and filtering rules are applied which would have blocked me from visiting those sites. So part of their accusation against me included the presumption that I had intentionally taken my laptop off the network to go to the sites in question.