Monitoring Remote Workers on Personal Devices

Monitoring company equipment is broadly permitted. Monitoring an employee's own device is a different question with a different answer, and the difference is frequently missed — particularly where a remote or hybrid workforce grew faster than the equipment budget.

Monitask provides a product-oriented overview of employee PC activity tracking.

Privacy and security practices can be checked against the FTC privacy and security guidance.

General information, not legal advice. This area involves state privacy law, wiretap statutes and employment law together. Take advice before deploying anything on personal devices.

Why it is different

On company equipment, the employer owns the device, the accounts and the data, and the business-use position is strong.

On a personal device, none of that is true. The device belongs to the employee. It contains their personal communications, their family's data, their medical information, their photographs, and the activity of everyone else in the household who uses it.

Consequences:

Consent is doing more work. With no ownership argument, the employer relies almost entirely on consent — and consent obtained as a condition of employment is weaker than consent freely given. Some jurisdictions scrutinise it accordingly.

Third parties have not consented. A spouse, a housemate, a child using the same laptop has agreed to nothing. Capturing their communications can raise wiretap and privacy issues entirely separate from the employment relationship.

Off-duty activity is captured. Monitoring software installed on a personal device usually does not stop at 5pm. Several states restrict employer action based on lawful off-duty conduct, and capturing that activity creates a record you did not want.

The data is harder to contain. Personal photographs and messages in a corporate monitoring system are a data protection problem, a discovery problem, and an incident waiting to be reported.

What is generally reasonable

Container and workspace approaches. Mobile device management applied only to a work profile, or a virtual desktop the employee logs into. The employer monitors the container; the device outside it is untouched.

This is the answer to most personal-device situations, and it is technically mature.

Company accounts, not the device. Monitoring email, files and applications inside company systems, accessed from any device. You are monitoring your own systems, not the employee's hardware.

Security controls scoped to work data. Encryption of the work container, remote wipe of the container only, access controls.

What is not

Full-device monitoring software. Screenshots of the whole screen, keystroke logging, browsing history across all activity, webcam access. On a personal device this captures the employee's private life and other people's.

Location tracking outside working hours. Difficult to justify on a device the employee carries constantly.

Remote wipe of the entire device. Destroying an employee's personal photographs to protect a spreadsheet is a foreseeable dispute and an avoidable one.

Anything undisclosed. Covert monitoring on a device the employer does not own is the highest-risk version of an already risky practice.

The BYOD policy

If employees use personal devices for work, the arrangement needs writing down before it starts.

What is monitored, precisely, and — equally important — what is not.

Where the boundary is. Container only, or whole device. Say it in terms an employee understands.

What happens on separation. Container wiped, personal data untouched, and how that is verified.

Who pays. Several states require reimbursement of necessary business expenses, which can include a share of a personal phone bill where the phone is required for work. Check your states — this is a live source of claims independent of monitoring.

Support boundaries. What IT will and will not do to a personal device.

A right to decline. If an employee does not want work software on their own device, the employer should provide equipment. Requiring personal-device use as a condition, then monitoring it, is the least defensible position available.

The timekeeping angle

Personal-device monitoring is sometimes proposed as a solution to remote timekeeping. It is not.

Activity monitoring records activity, not hours worked. It will not produce a compliant record, it will not capture the message answered at 10pm, and it does not satisfy any recordkeeping obligation.

A timekeeping problem is solved by making recording easy and expected. See timekeeping for remote and hybrid staff.

The practical recommendation

Provide equipment. A laptop costs less than one dispute, and it resolves the entire category of question. Employers who monitor personal devices are almost always doing so because equipment was not budgeted, and the saving is smaller than it looks.

Where personal devices must be used, use a container. Monitor the work profile and nothing else.

Where you must monitor more, get advice first, document the necessity, scope it as narrowly as possible, and disclose it fully.

Never install full-device monitoring on hardware you do not own. There is almost no business case that survives the legal and human cost.

The question to test it against

Would you be comfortable explaining this arrangement, in detail, to the employee's family?

Their data is in it too, and they never agreed to anything. If the answer is no, the arrangement is wrong regardless of what the consent form says.