Most workplace monitoring is generally legal with proper notice — federal law is permissive — but many states have moved aggressively in the last five years to add notice requirements, restrict biometric collection, and protect off-duty activity. Employer monitoring has expanded dramatically with remote work, productivity tracking software, video conferencing, and biometric tools, and the legal landscape varies enormously by state: a monitoring practice generally legal in Texas may be treated as unlawful in California or Illinois, so your state's law is usually the deciding factor. The specifics depend heavily on your situation, and these rules and figures continue to change.
What does federal law say?
Several federal statutes set the floor here. How they apply depends on your situation, and the rules below can change:
- Electronic Communications Privacy Act (ECPA): The ECPA generally permits employer monitoring of company-owned communications systems (email, messaging, work phones), but it generally prohibits intercepting communications without consent or a business justification.
- Stored Communications Act: The SCA generally limits access to stored electronic communications without consent.
- Wiretap Act: Under the federal Wiretap Act (18 U.S.C. § 2511), interception of oral, wire, or electronic communications is generally prohibited without consent of at least one party — the federal rule is one-party consent, though many states require all parties to consent (see below).
- NLRA: The NLRB generally treats surveillance of union organizing or protected concerted activity as unlawful.
How does this vary by state?
State law varies a great deal here, and these rules continue to change — your state may differ:
- Two-party consent recording states: In CA, CT, FL, IL, MA, MD, MT, NH, PA, and WA, the law generally requires all parties to a recorded conversation to consent. Employer recording of phone calls without notice may be treated as a violation of state wiretap laws.
- Biometric Information Privacy Acts: Illinois (BIPA — strong; private right of action), Texas, Washington, and others generally regulate collection of fingerprints, retinal scans, voiceprints, and face geometry. BIPA in particular has triggered substantial class action liability.
- Off-duty conduct protections: NY, CA, CO, ND, and others generally prohibit adverse action based on lawful off-duty activities (with exceptions that vary by state).
- Social media login laws: Many states generally prohibit employers from demanding social media credentials.
- GPS and location tracking: Some states generally require notice and consent for GPS tracking of employee vehicles.
- Productivity monitoring notice: NY (effective 2022), Connecticut, and Delaware generally require notice for electronic monitoring of employees.
What can your employer legally monitor?
Work email and messaging:
- Generally permitted on company systems with notice.
- Off-platform messaging (personal email, personal devices) is generally treated as protected from monitoring.
- A "business justification" can extend reach, but generally cannot reach personal communications on company systems without proper notice and consent.
Video surveillance:
- Generally permitted in most workplace common areas with notice.
- Bathroom, locker room, and similar areas are generally prohibited.
- Some states generally require posted notice; some generally require specific written notice to employees.
Audio recording:
- In two-party consent states, the law generally requires consent of all parties.
- Open-call recording (call center quality monitoring) usually involves customer notice ("This call may be recorded for quality assurance").
- Recording of internal employee conversations without consent is generally prohibited in two-party consent states.
Keystroke and screen monitoring:
- Generally permitted on company-owned equipment with notice.
- Specific state laws (NY, CT) generally require advance written notice.
- Aggressive monitoring (every keystroke, screenshot every N minutes) can create privacy claims if it captures personal information not relevant to the work.
Productivity software:
- Tools like Hubstaff, Time Doctor, and Teramind are generally permitted with notice in most jurisdictions.
- Capturing personal information (banking, health, personal communications) can create privacy claims.
- Random screenshots have raised concerns under several state laws.
Biometric data:
- Illinois BIPA generally requires written notice, written consent, and a written retention policy before collection of biometric identifiers, and provides a private right of action with statutory damages.
- Class actions have produced significant settlements against employers using fingerprint time clocks or facial recognition without compliance.
GPS and location:
- Many states generally permit tracking on company vehicles with notice.
- Tracking off-duty location or personal vehicles is generally prohibited.
How do you evaluate workplace monitoring, step by step?
1. Many people start with the employer's monitoring notices and policies
Most employers provide notices through onboarding documents, employee handbooks, or computer login banners. A common first step is to identify what is disclosed.
2. People often look for monitoring occurring beyond the disclosed scope
It often helps to compare the disclosed monitoring to your observable experience. Surveillance beyond the disclosed scope may run up against state notice requirements, depending on your state.
3. Many people check their state's specific protections
Two-party consent? Biometric notice? Off-duty conduct? GPS notice? Each generally adds a separate compliance requirement, and which apply depends on where you work.
4. Many people document the monitoring practice
Many people keep screenshots, communications about monitoring, and a record of requirements imposed (fingerprint clock-in, mandatory screen-recording, etc.).
Scripts people sometimes use
To request the monitoring notice:
"I'd like to request a copy of any electronic monitoring notice or policy applicable to my role, including: (a) what systems are monitored, (b) what data is collected, (c) how long data is retained, (d) any biometric identifiers collected, and (e) the legal basis under [state law]."
To raise a BIPA concern:
"I'm a resident of Illinois. Before consenting to biometric collection [fingerprint, facial scan, voiceprint], I'd like to confirm: (a) written notice describing the purpose and duration of collection, (b) a written retention schedule, and (c) my written consent. Could you provide the BIPA-compliant documentation?"
To raise a two-party consent recording concern:
"I'm aware that [state] is a two-party consent state for recorded conversations. I'd like to confirm whether internal meetings are being recorded, and if so, that all participants have given consent. If recording is occurring without consent, I'd ask that the practice be reviewed for compliance."
What should you document?
- The employer's monitoring policies and notices
- The specific monitoring practices observed or experienced
- Any biometric data collection (fingerprint, face, voice)
- Any GPS or location tracking
- Any keystroke or screen monitoring
- Any audio recording of conversations
- The state where you work and the state law that applies
When should you escalate?
When someone suspects unlawful monitoring, common avenues people pursue include:
- For potential BIPA issues (Illinois), many people consult an employment attorney who handles BIPA matters. Class actions have produced significant settlements, and individual claims are also possible.
- Filing a complaint with the state attorney general for state-law violations.
- Filing an NLRB charge, since the NLRB generally treats surveillance of protected concerted activity or union organizing as unlawful.
- Filing a complaint with the FTC for deceptive monitoring practices that depart materially from disclosed policies.
- For potential wiretap issues, many people consult an attorney about civil claims and possible criminal referral.
Monitoring law is complex and varies dramatically by state. The general trend has been toward more notice requirements and more substantive protections — especially for biometric data and off-duty activity. Many monitoring practices that seemed routine five years ago may now be actionable, though whether any of this applies depends on your specific situation and state.
Official sources
- Cornell Law School, Legal Information Institute — 18 U.S.C. § 2511 (Wiretap Act — interception of wire, oral, or electronic communications)
- National Labor Relations Board — Employee Rights Under the NLRA (protected concerted activity)