Most workplace monitoring is generally legal with proper notice — federal law is permissive — but many states have moved aggressively in the last five years to add notice requirements, restrict biometric collection, and protect off-duty activity. Employer monitoring has expanded dramatically with remote work, productivity tracking software, video conferencing, and biometric tools, and the legal landscape varies enormously by state: a monitoring practice generally legal in Texas may be treated as unlawful in California or Illinois, so your state's law is usually the deciding factor. The specifics depend heavily on your situation, and these rules and figures continue to change.
What does federal law say?
Federal law is generally permissive about workplace monitoring and sets a floor rather than a ceiling. The Electronic Communications Privacy Act generally permits an employer to monitor its own communications systems — company email, messaging, work phones — while generally prohibiting the interception of communications without consent or a business justification. The Stored Communications Act generally limits access to stored electronic communications without consent. The federal Wiretap Act (18 U.S.C. § 2511) generally prohibits intercepting oral, wire or electronic communications unless at least one party consents, which is why the federal rule is described as one-party consent, though many states require every party to agree. The NLRB generally treats surveillance of union organizing or other protected concerted activity as unlawful regardless of the technology involved. How these apply depends on your situation, and the rules can change.
Several federal statutes set the floor here. How they apply depends on your situation, and the rules below can change:
- Electronic Communications Privacy Act (ECPA): The ECPA generally permits employer monitoring of company-owned communications systems (email, messaging, work phones), but it generally prohibits intercepting communications without consent or a business justification.
- Stored Communications Act: The SCA generally limits access to stored electronic communications without consent.
- Wiretap Act: Under the federal Wiretap Act (18 U.S.C. § 2511), interception of oral, wire, or electronic communications is generally prohibited without consent of at least one party — the federal rule is one-party consent, though many states require all parties to consent (see below).
- NLRA: The NLRB generally treats surveillance of union organizing or protected concerted activity as unlawful.
How does this vary by state?
State law is where most of the real limits on monitoring live, and it is usually the deciding factor. A group of states — California, Connecticut, Florida, Illinois, Massachusetts, Maryland, Montana, New Hampshire, Pennsylvania and Washington — generally require every party to a recorded conversation to consent, so recording without notice may run into the state wiretap law. Illinois, Texas, Washington and others regulate biometric collection such as fingerprints, retinal scans, voiceprints and face geometry, with the Illinois statute generally the strongest. New York, California, Colorado, North Dakota and others generally protect lawful off-duty activity from adverse action, with exceptions that vary. Many states generally bar employers from demanding social media credentials, some require notice and consent for GPS tracking, and New York, Connecticut and Delaware generally require notice of electronic monitoring. A practice that is routine in one state may be treated very differently a border away.
State law varies a great deal here, and these rules continue to change — your state may differ:
- Two-party consent recording states: In CA, CT, FL, IL, MA, MD, MT, NH, PA, and WA, the law generally requires all parties to a recorded conversation to consent. Employer recording of phone calls without notice may be treated as a violation of state wiretap laws.
- Biometric Information Privacy Acts: Illinois (BIPA — strong; private right of action), Texas, Washington, and others generally regulate collection of fingerprints, retinal scans, voiceprints, and face geometry. BIPA in particular has triggered substantial class action liability.
- Off-duty conduct protections: NY, CA, CO, ND, and others generally prohibit adverse action based on lawful off-duty activities (with exceptions that vary by state).
- Social media login laws: Many states generally prohibit employers from demanding social media credentials.
- GPS and location tracking: Some states generally require notice and consent for GPS tracking of employee vehicles.
- Productivity monitoring notice: NY (effective 2022), Connecticut, and Delaware generally require notice for electronic monitoring of employees.
What can your employer legally monitor?
On company-owned systems and equipment, most monitoring is generally permitted with proper notice, and the limits tend to appear where the monitoring reaches personal life or crosses a specific state statute. Work email, messaging, keystrokes and screens generally sit inside what an employer can watch on its own systems, while personal email and personal devices are generally treated as outside it. Video surveillance is generally permitted in common areas with notice and generally prohibited in bathrooms and locker rooms. Audio recording turns on the consent rule in your state. Biometric collection is the most tightly regulated category, and Illinois in particular generally requires written notice, written consent and a written retention policy first. GPS tracking is generally permitted on company vehicles with notice, and generally not on personal vehicles or off-duty movement. The details by category:
Work email and messaging:
- Generally permitted on company systems with notice.
- Off-platform messaging (personal email, personal devices) is generally treated as protected from monitoring.
- A "business justification" can extend reach, but generally cannot reach personal communications on company systems without proper notice and consent.
Video surveillance:
- Generally permitted in most workplace common areas with notice.
- Bathroom, locker room, and similar areas are generally prohibited.
- Some states generally require posted notice; some generally require specific written notice to employees.
Audio recording:
- In two-party consent states, the law generally requires consent of all parties.
- Open-call recording (call center quality monitoring) usually involves customer notice ("This call may be recorded for quality assurance").
- Recording of internal employee conversations without consent is generally prohibited in two-party consent states.
Keystroke and screen monitoring:
- Generally permitted on company-owned equipment with notice.
- Specific state laws (NY, CT) generally require advance written notice.
- Aggressive monitoring (every keystroke, screenshot every N minutes) can create privacy claims if it captures personal information not relevant to the work.
Productivity software:
- Tools like Hubstaff, Time Doctor, and Teramind are generally permitted with notice in most jurisdictions.
- Capturing personal information (banking, health, personal communications) can create privacy claims.
- Random screenshots have raised concerns under several state laws.
Biometric data:
- Illinois BIPA generally requires written notice, written consent, and a written retention policy before collection of biometric identifiers, and provides a private right of action with statutory damages.
- Class actions have produced significant settlements against employers using fingerprint time clocks or facial recognition without compliance.
GPS and location:
- Many states generally permit tracking on company vehicles with notice.
- Tracking off-duty location or personal vehicles is generally prohibited.
How do you evaluate workplace monitoring, step by step?
Working out whether monitoring at your job is within bounds generally means comparing three things: what the employer has disclosed, what you can actually observe, and what your state requires. The disclosed part usually sits in onboarding documents, the employee handbook, or the banner that appears at computer login, so a common first step is simply to collect those and read what they claim to cover. The observable part is what you notice day to day — a fingerprint clock-in, a screen recorder, a call being recorded, a tracker on a vehicle. Monitoring that goes past the disclosed scope may run up against state notice requirements, depending on where you work. The state part is a short checklist: consent rules for recording, biometric notice, off-duty conduct protections, GPS notice, electronic-monitoring notice. Each one generally adds its own requirement, and which of them apply depends on where you work.
1. Many people start with the employer's monitoring notices and policies
Most employers provide notices through onboarding documents, employee handbooks, or computer login banners. A common first step is to identify what is disclosed.
2. People often look for monitoring occurring beyond the disclosed scope
It often helps to compare the disclosed monitoring to your observable experience. Surveillance beyond the disclosed scope may run up against state notice requirements, depending on your state.
3. Many people check their state's specific protections
Two-party consent? Biometric notice? Off-duty conduct? GPS notice? Each generally adds a separate compliance requirement, and which apply depends on where you work.
4. Many people document the monitoring practice
Many people keep screenshots, communications about monitoring, and a record of requirements imposed (fingerprint clock-in, mandatory screen-recording, etc.).
What can you say to raise a monitoring concern?
These are the sentences people use to ask what is being collected rather than to accuse anyone of anything. The first simply requests the monitoring notice that many states already require, which turns an assumption into a document. The second asks for the written notice, retention schedule and consent that biometric collection generally calls for in Illinois before a fingerprint or face scan is taken. The third asks whether internal meetings are being recorded in a state that generally requires everyone to consent. None of them commits you to filing anything, to refusing a work requirement, or to accusing an employer of breaking the law — each one asks for the paperwork the practice would already need. Your own state and role go in the bracketed parts, and the request usually goes to HR rather than to a manager. Versions some people adapt:
To request the monitoring notice:
"I'd like to request a copy of any electronic monitoring notice or policy applicable to my role, including: (a) what systems are monitored, (b) what data is collected, (c) how long data is retained, (d) any biometric identifiers collected, and (e) the legal basis under [state law]."
To raise a BIPA concern:
"I'm a resident of Illinois. Before consenting to biometric collection [fingerprint, facial scan, voiceprint], I'd like to confirm: (a) written notice describing the purpose and duration of collection, (b) a written retention schedule, and (c) my written consent. Could you provide the BIPA-compliant documentation?"
To raise a two-party consent recording concern:
"I'm aware that [state] is a two-party consent state for recorded conversations. I'd like to confirm whether internal meetings are being recorded, and if so, that all participants have given consent. If recording is occurring without consent, I'd ask that the practice be reviewed for compliance."
What should you document?
The useful record here is the gap between what was disclosed and what is actually happening. That generally starts with the employer's monitoring policies and notices — the handbook page, the login banner, the onboarding acknowledgment — and then the specific practices you observe or experience alongside them. It helps to note the categories separately, because different statutes attach to different categories: biometric collection such as a fingerprint, face or voice scan; GPS or location tracking; keystroke or screen monitoring; and audio recording of conversations. The last item people write down is the plainest one, and the one that decides most questions: the state where you work, and therefore the state law that applies. Monitoring that is routine in one state may be treated very differently in another, so the location is not a footnote. What people commonly keep:
- The employer's monitoring policies and notices
- The specific monitoring practices observed or experienced
- Any biometric data collection (fingerprint, face, voice)
- Any GPS or location tracking
- Any keystroke or screen monitoring
- Any audio recording of conversations
- The state where you work and the state law that applies
When should you escalate?
Escalation generally comes up when the monitoring appears to go past what the state allows or past what the employer disclosed. Which route people take depends on the category. Biometric questions in Illinois usually go to an employment attorney who handles those matters, since both class actions and individual claims are possible. State-law violations more broadly are often raised with the state attorney general. Surveillance of union organizing or other protected concerted activity generally goes to the NLRB, which treats it as unlawful. Monitoring that departs materially from the policy the employer published is sometimes raised with the FTC as a deceptive practice. Suspected wiretap issues usually go to an attorney. The general trend has been toward more notice requirements and more protection, especially for biometric data and off-duty activity. Your state may differ.
When someone suspects unlawful monitoring, common avenues people pursue include:
- For potential BIPA issues (Illinois), many people consult an employment attorney who handles BIPA matters. Class actions have produced significant settlements, and individual claims are also possible.
- Filing a complaint with the state attorney general for state-law violations.
- Filing an NLRB charge, since the NLRB generally treats surveillance of protected concerted activity or union organizing as unlawful.
- Filing a complaint with the FTC for deceptive monitoring practices that depart materially from disclosed policies.
- For potential wiretap issues, many people consult an attorney about civil claims and possible criminal referral.
Monitoring law is complex and varies dramatically by state. The general trend has been toward more notice requirements and more substantive protections — especially for biometric data and off-duty activity. Many monitoring practices that seemed routine five years ago may now be actionable, though whether any of this applies depends on your specific situation and state.
Official sources
- Cornell Law School, Legal Information Institute — 18 U.S.C. § 2511 (Wiretap Act — interception of wire, oral, or electronic communications)
- National Labor Relations Board — Employee Rights Under the NLRA (protected concerted activity)