What triggers the message "your screen is being observed" on the login screen
I was able to confirm that OBS Studio does trigger the message even when it is not recording anything. I assume that this is occurs when there is at least one Display Capture Device configured in OBS so that OBS is indeed constantly &quot;observing&quot; the screen.
I did not check whether yet other conditions must be met (e.g. that the source must somehow be active in the current scene). Neither did I check whether the same is true for a Window Capture Device or perhaps even a Browser source, but I guess in many cases pointing to OBS will be enough of an explanation.
I would assume that other apps might trigger the message in similar ways as OBS but I'll leave it to others to identify those apps in separate answers.