Employee Monitoring Laws

Monitoring employees on company equipment is broadly lawful in the United States. The complications are not about whether you may, but about notice, audio, biometrics, and the states that have added requirements on top of the federal default.

A product-oriented example of stealth monitoring software is available from Monitask.

Employee-rights context is available through the National Labor Relations Board employee-rights guidance.

This page also corrects one claim that appears in a large number of 2026 compliance guides and is simply wrong.

General information, not legal advice. This area is changing, sources disagree on some points, and the answer depends on your states. Take advice from employment counsel.

The federal default

Under the Electronic Communications Privacy Act, employers may generally monitor systems they own. If the employer provides the computer, it is company property, and monitoring of activity on it — stored documents, downloads, internet usage, active and idle time — is generally permitted.

The two commonly cited bases are the business-use exception and consent. Both are narrower than they sound, and both work better when the employer has a clear written policy that employees have acknowledged.

Federal law does not require notice for monitoring on company devices. Several states do.

The states with a dedicated notice statute

Here the sources genuinely disagree, so it is worth separating what is settled from what is contested.

Undisputed: Connecticut, Delaware and New York each have a statute specifically requiring notice of electronic monitoring.

Connecticut, under Conn. Gen. Stat. 31-48d, requires prior written notice to affected employees describing the types of monitoring, plus a notice posted in a conspicuous place. An exception applies where the employer has reasonable grounds to believe employees are breaking the law. Civil penalties run $500 for the first offence, $1,000 for the second, and $3,000 for each subsequent one.

A 2026 amendment adds a plain-language statement requirement for employees hired on or after October 1, 2026 — worth checking against your onboarding materials now.

Delaware requires prior written notice regarding monitoring of phone transmissions, email and internet access, and uniquely allows employers to choose between two methods: daily notice when the employee accesses employer systems, or one-time written or electronic notice with an acknowledgement from the employee. Penalties are civil, up to $100 per violation.

New York, under SB S2628, requires private employers to give written or electronic notice on hire and to display a notice conspicuously where they monitor telephone calls, email or internet usage. The notice must state that such communications may be monitored at any time and by lawful means.

Contested: Colorado and Texas. Some guides list one or both as a fourth state. One recent analysis states plainly that only three states have a dedicated monitoring-notice statute, that Texas has a notice practice but no such statute, and that the real number is three. Other sources count Colorado as a fourth on the basis of provisions covering AI-driven monitoring tools.

How to handle the disagreement: if you employ in Colorado or Texas, do not resolve it from an article. Ask counsel. In practice the safe course in every state is to give written notice anyway — see below.

Broader privacy laws reach monitoring data

Even without a dedicated monitoring statute, several states' comprehensive privacy laws apply to employee data. California requires a notice at collection under the CCPA for personal data, which includes monitoring data.

The number of states with comprehensive privacy statutes has grown steadily, and employee data is inside the scope in some of them. This is the direction of travel, and it is worth building for.

The correction: California AB 1221 is not law

This matters because it appears in a great many 2026 guides as though it were.

California AB 1221 is not law. The workplace-surveillance bill that many 2026 guides describe as "effective January 2026" died in the legislature on January 31, 2026.

Do not build a policy around it, and be sceptical of any vendor or guide that cites it as a current requirement. Its presence in a compliance article is a reasonable signal that the article was not checked.

That said, similar bills have been introduced repeatedly and will be again. Building a monitoring programme that would survive such a law is not wasted effort — it is just not currently mandatory in California.

Audio is the strictest category

The rules for recording conversations are considerably tighter than the rules for screen or activity monitoring.

Nine states clearly require all-party consent for audio recording, and several more are disputed, so calls and meetings carry tighter rules than screen or activity tracking. Other counts put the figure at eleven states plus DC.

The counts differ because some states' positions are ambiguous or contested. The practical rule: for any call or meeting recording, obtain consent from everyone on the call, every time. It costs a sentence at the start of the call and removes the entire question.

This applies to routine recorded meetings, customer calls, and — increasingly — automated meeting transcription tools, which are frequently switched on without anyone treating them as recording.

Biometrics carry the largest single exposure

Illinois is the highest-risk state for biometrics. Its BIPA law carries $1,000 to $5,000 in damages per violation, and has produced settlements reaching very large figures.

Fingerprint and facial-recognition time clocks are the common trigger. They are convenient, they eliminate buddy-punching, and in Illinois they have produced some of the largest privacy settlements in employment.

If you use biometric timekeeping anywhere, get advice before deployment, not after. Texas and Washington also have biometric statutes, and more states are legislating.

Where monitoring is restricted regardless

Some limits apply almost everywhere:

Break and rest areas. Some states specifically prohibit monitoring in designated break areas.
Changing areas and restrooms. Prohibited essentially everywhere, and in several states by specific statute.
Protected activity. Monitoring that surveils employees discussing pay, working conditions or organising can raise separate legal problems entirely.
Personal devices. Monitoring an employee's own phone or computer is a different and much narrower question than monitoring company equipment. See monitoring on personal devices.
Off-duty activity. Several states restrict employer action based on lawful off-duty conduct.

The position we would take regardless of the law

The minimum legal standard and the sensible standard are not the same, and the gap is where most of the practical damage happens.

Give written notice everywhere, not only in the three states that require it. It costs nothing, it removes the notice question entirely if you later add headcount in a state that requires it, and covert monitoring that becomes known does more damage to a workforce than the monitoring itself.

Monitor for a stated purpose, and only that. "Because the tool collects it" is not a purpose. Data collected without a purpose is data you will have to explain later.

Collect the least that answers the question. If the question is whether work is completed, output answers it. Screenshots do not answer it better; they answer a different question that nobody asked.

Tell people what is collected, who sees it, how long it is kept, and what it will and will not be used for. Especially the last part.

Do not monitor covertly except on specific, documented grounds with legal advice — the narrow circumstances the Connecticut exception contemplates, not as a general practice.

The costs of getting this wrong are not primarily legal. See what productivity surveillance measures and what it costs.

A compliance checklist

[ ] Written monitoring policy, acknowledged by every employee
[ ] Notice meeting the specific requirements of CT, DE and NY where you employ there
[ ] Connecticut plain-language requirement checked against onboarding for hires from October 2026
[ ] Audio recording: all-party consent as standard practice everywhere
[ ] Automated meeting transcription treated as recording
[ ] Biometric timekeeping reviewed by counsel before deployment
[ ] No monitoring in break areas, changing areas or restrooms
[ ] Personal device monitoring addressed separately and narrowly
[ ] Stated purpose, retention period and access list for every data type collected
[ ] Policy reviewed annually — this area is moving

Employee Monitoring: What Is Lawful, and Where Notice Is Required