An employee monitoring policy is a written document that tells employees what the employer monitors, why, where, how long the data is kept and who can see it. Four states — New York, Delaware, Connecticut and Maine — require notice before monitoring begins, each by a different mechanism, and two of those four laws changed during 2026. The template below is free to copy in three formats, and the sections marked with brackets are the ones you replace.
> This is not legal advice. This page describes what the cited statutes require and provides a general template. It does not account for your industry, your states of operation, your collective bargaining agreements or any employee located outside the United States. Have counsel review the policy before you issue it. Statutes were checked against primary sources on 22 October 2026.
What is an employee monitoring policy?
An employee monitoring policy is the document that converts a monitoring practice into a disclosed one. It names the tools in use, the data they collect, the business purpose for each, the retention period, the people with access and the route an employee takes to ask a question or raise an objection.
The policy serves two separate functions, and conflating them is the most common drafting error. The first is legal: in several states, written notice is a statutory precondition to monitoring at all. The second is operational: a workforce that knows what is measured and why behaves differently from one that suspects it is being watched but cannot confirm it. The first function sets a floor. The second determines whether the monitoring programme survives its first year.
Which states require written notice?
Four states impose a notice duty on employers who monitor employees. The duty is not the same in any two of them, and a single policy document satisfies all four only if it is drafted to the strictest of them.
Most published comparisons list three. Maine’s 26 M.R.S. § 620-A took effect on 29 July 2026 and is routinely missing — which matters, because it is the only one of the four that requires a notice to be repeated every year.
| New York | Delaware | Connecticut | Maine | |
|---|---|---|---|---|
| Statute | N.Y. Civil Rights Law § 52-c | 19 Del. C. § 705 | Conn. Gen. Stat. § 31-48d | 26 M.R.S. § 620-A |
| In force | 7 May 2022 | In force | Rewritten by Public Act 26-73, effective 1 October 2026 | 29 July 2026 |
| Who is covered | Any employer with a place of business in New York. The State and its political subdivisions are expressly excluded — the only one of the four that leaves government employers out. | Any employer with a place of business in Delaware, and the State of Delaware or any agency or political subdivision of it | Any person, firm or corporation with employees, including the state and any political subdivision of it | “Any private or public employer, including the State and political subdivisions of the State” |
| Activity covered | Telephone conversations or transmissions, email or transmissions, and internet access or usage, by any electronic device or system — and nothing else. Video surveillance, keystroke logging divorced from email or internet, and location tracking all sit outside the section. | Telephone conversations or transmissions, email or transmissions, and internet access or usage | Collection of information on the employer’s premises about employees’ activities or communications by any means other than direct observation. Security collection in common areas held out for public use is excluded. | “Employer surveillance”: monitoring of an employee through the use of an electronic device or system, including but not limited to a computer, telephone, wire or radio or an electromagnetic, photoelectronic or photo-optical system |
| Notice mechanism | Written or electronic notice upon hiring, which the employee acknowledges in writing or electronically, and a conspicuous posting. Both are mandatory, not alternatives. | Either electronic notice each day the employee accesses employer-provided email or internet, or a one-time written or electronic notice the employee acknowledges in writing or electronically. A choice, not both — and the acknowledgement attaches only to the one-time option. | Prior written notice to all affected employees, stating the types of monitoring that may occur and the specific locations on the premises where it may occur. Employees hired on or after 1 October 2026 also receive a plain-language written statement before starting work. | Three separate duties: notice before monitoring begins; disclosure to a prospective employee during the interview; and written notice at least once per calendar year to all current employees. |
| Posting | Required, in addition to the individual notice | Not specified | Posting in a conspicuous place readily available for viewing constitutes notice — and from 1 October 2026 the posting must be in the identified locations | Not required by the statute. The Maine Department of Labor publishes a poster, but posting does not satisfy the annual written-notice duty. |
| Required content | The types of monitoring that may occur | Not specified in detail | Types of monitoring, and the specific premises locations | Only that the employer engages in employer surveillance. The statute prescribes no further content. |
| Penalty | A maximum civil penalty of $500 for the first offence, $1,000 for the second and $3,000 for the third and each subsequent | A fixed $100 civil penalty for each violation — not a maximum — with no tier and no stated cap (§ 705(c)) | A maximum civil penalty of $500 for the first offence, $1,000 for the second and $3,000 for the third and each subsequent | Not less than $100 and not more than $500 for each violation |
| Who enforces | Attorney General only; no private right of action | “A civil penalty claim may be filed in any court of competent jurisdiction”: the statute names no plaintiff. § 705(d) makes the remedy expressly non-exclusive. | Labor Commissioner, after a contested-case hearing under §§ 4-176e to 4-184; no private right of action | Maine Department of Labor, “within existing resources using strategic enforcement”. The section creates no private right of action and excludes none. |
| Exceptions | Processes managing the type or volume of incoming or outgoing email, voicemail or internet usage, not targeted at monitoring or intercepting a particular individual, and performed solely for system maintenance or protection | § 705(e): processes designed to manage the type or volume of email, voicemail or internet usage, not targeted at a particular individual, and performed solely for system maintenance or protection. A law-enforcement carve-out sits in the closing text of (b). | Monitoring without prior notice where the employer has reasonable grounds to believe employees are engaged in conduct violating the law, violating the legal rights of the employer or other employees, or creating a hostile work environment, and where monitoring may produce evidence of it. Criminal investigations are separately carved out. | Surveillance cameras used for security or safety purposes, and GPS or other safety devices on vehicles owned by the employer but operated by the employee. There is no system-maintenance exception and no misconduct-investigation exception. |
Four differences that decide whether one document can serve all four
Does posting discharge the notice duty? Connecticut: yes — “such posting shall constitute such prior written notice”. New York: no — the employer “shall also post”, on top of the acknowledged individual notice. Delaware and Maine do not provide for posting at all.
Are government employers covered? Connecticut, Delaware and Maine: yes, expressly. New York: no — the State and its political subdivisions are excluded by definition.
Is the penalty a cap or a fixed amount? New York and Connecticut set maxima on a three-step scale. Delaware sets a fixed $100 for each violation with no cap. Maine sets a range of $100 to $500 for each violation.
Is there a system-maintenance exception? New York and Delaware: yes, in near-identical words — New York borrowed Delaware’s. Connecticut: no, but its definition excludes security collection in public common areas. Maine: no system-maintenance exception at all, and no misconduct-investigation exception either.
Two states are routinely added to lists like this and do not belong. New Jersey’s statute its statute covers vehicle tracking devices only. California AB 1221 would have made it the fifth and was not enacted — it was reported out of Assembly Appropriations under Joint Rule 56 and ordered filed with the Chief Clerk on 2 February 2026.
What does Maine require, and why is it usually missed?
Maine’s section is headed employer surveillance, not electronic monitoring — the phrase “electronic monitoring” does not appear in it at all. That is not a cosmetic difference. The other three statutes are keyed to the kind of communication: telephone, email, internet. Maine is keyed to the device or system, which makes its scope substantially wider.
The definition covers monitoring of an employee “through the use of an electronic device or system”, with a non-exhaustive list that names a computer, telephone, wire or radio and electromagnetic, photoelectronic or photo-optical systems. Two carve-outs sit inside the definition: surveillance cameras used for security or safety, and GPS or other safety devices on vehicles the employer owns. Note how narrow the second is — tracking an employee’s own vehicle, or tracking the person through a phone, is not carved out.
The section imposes 5 obligations, in 9 subsections. Three are notices:
| Cite | Duty | What it requires |
|---|---|---|
| § 620-A(2) | Notice before monitoring begins | “An employer may not use employer surveillance unless the employer notifies the employee before beginning the use of employer surveillance.” The statute does not say the notice must be written, and requires no acknowledgement. It is framed as a ban on monitoring rather than as a notice duty: monitoring without prior notice is itself the violation. |
| § 620-A(5) | Disclosure to candidates at interview | An employer using employer surveillance must inform a prospective employee during the employment interview process that it does so. No form is specified and no acknowledgement is required. |
| § 620-A(5) | Written notice once per calendar year | Written notice at least once per calendar year to all current employees — not only those being monitored. Calendar-year, not anniversary: an employer that notifies in December 2026 and again in January 2028 has missed 2027. This duty is unique among the four states. |
Two are prohibitions, and these are the ones no notice can cure:
§ 620-A(3) — Audiovisual monitoring of the employee’s own spaces. An employer may not use audiovisual monitoring in an employee’s residence or personal vehicle or on the employee’s property, unless the monitoring is required by the employer for the duties of the job. Consent does not cure it and neither does notice — the test is job-duty necessity. A camera-on rule for remote staff in Maine has to meet that test.
§ 620-A(4) — The right to refuse an app on a personal device. An employee may decline a request to install data collection or transmission applications on their personal electronic devices for the purposes of employer surveillance. A BYOD policy that makes an agent install mandatory is non-compliant on its face; the policy needs a documented route to decline and a work-device alternative.
There is no system-maintenance exception in Maine and no misconduct-investigation exception — both of which the other statutes have in one form or another. There is no employee-count threshold, and public employers are expressly covered.
On penalties, the surveillance fine is the smaller exposure. 26 M.R.S. § 620-A carries Not less than $100 and not more than $500 for each violation, enforced by the Department of Labor “within existing resources using strategic enforcement”. But 26 M.R.S. § 620, which applies across the chapter, makes it a civil violation to penalise someone for exercising a right protected by it, at not less than $500 nor more than $1,000 for each violation — and the department of labor and the attorney general may file a civil action. That section also says it “may not be construed to limit or restrict the rights of an individual to seek other available remedies in a separate legal action”, so the familiar line that Maine creates no private right of action is true of § 620-A and misleading as a summary.
One thing Maine does not do, which most write-ups imply it does. Maine prescribes no notice content beyond the fact that the employer engages in employer surveillance. A checklist of types, purposes, locations and retention is good practice, and it is borrowed from New York and Connecticut — it is not a Maine requirement.
What changed in 2026?
Connecticut, from 1 October 2026
Connecticut changed § 31-48d through Public Act 26-73 (Substitute Senate Bill No. 472), signed on 4 June 2026 and effective 1 October 2026. Public Act 26-73 reads “Section 31-48d of the general statutes is repealed and the following is substituted in lieu thereof” — Connecticut’s standard formula for an amendment. It restates the whole section and changes only subsection (b).
| Requirement | Before 1 Oct 2026 | From 1 Oct 2026 |
|---|---|---|
| Content of notice | The types of monitoring that may occur | The types of monitoring and the specific locations on the premises where it may occur |
| Where notices are posted | A conspicuous place readily available for viewing | A conspicuous place, including in the identified locations |
| New hires | Covered by the general prior-notice duty | Employees hired on or after 1 Oct 2026 receive a plain-language written statement before starting work, describing the prohibited activities that may be monitored without prior notice |
| Location-disclosure exceptions | — | New subdivision (b)(3): airport premises, and reasonable grounds to monitor for security or employee safety |
| Penalties | $500 / $1,000 / $3,000 maxima | Unchanged |
Four points of precision, each of which is easy to get wrong:
- The new (b)(3) exceptions excuse the disclosure of locations only. They do not excuse the types-of-monitoring notice, and they do not excuse the posting.
- The misconduct exception at (b)(2) is unchanged, as is the criminal-investigation carve-out at (d).
- The new-hire statement is a narrow document. Its subject is the (b)(2) misconduct exception — which activities are prohibited and may be monitored without prior notice — not monitoring in general. It is owed only to employees hired on or after 1 October 2026, and posting does not satisfy it.
- The definition of electronic monitoring in subsection (a) was not touched. This matters because some commentary says the Act extends Connecticut’s rule to AI-based monitoring. It does not: the enrolled text contains no occurrence of “artificial intelligence”, “AI”, “automated” or “algorithm”. What is true, and was equally true in 2025, is that the definition was technology-neutral before the 2026 act and is unchanged by it, so an AI-driven tool collecting information on the premises was already covered.
Maine, from 29 July 2026
Maine’s § 620-A is covered above. On the date: became law without the Governor’s signature on 11 January 2026, and it took effect on 29 July 2026. A number of published alerts give 14 July 2026, which is computed from the constitutional adjournment deadline plus ninety days. The session actually ran to 29 April 2026. The Legislature’s own digest and the Department of Labor’s list of new labour laws both give 29 July.
Which federal and international rules apply?
Federal law in the United States does not impose a general monitoring-notice duty on private employers. It restricts interception instead, and the restriction has consent-shaped exceptions that a disclosed policy is designed to satisfy.
| Framework | Citation | What it bears on |
|---|---|---|
| Electronic Communications Privacy Act — Wiretap Act | 18 U.S.C. § 2511 | Prohibits intentional interception of wire, oral or electronic communications. § 2511(2)(d) makes interception lawful for a person not acting under colour of law where one party has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act in violation of the Constitution or the laws of the United States or of any State. |
| Stored Communications Act | 18 U.S.C. § 2701 et seq. | Governs access to communications held in electronic storage, including an employer’s access to stored messages. |
| GDPR — lawful basis | Regulation (EU) 2016/679, Art. 6(1)(f) | Monitoring of employees in the EU or EEA usually relies on legitimate interests, which requires a documented balancing test. The ground is not available to public authorities processing in performance of their tasks. |
| GDPR — information duty | Art. 13 | Where the data is collected from the employee, they must be told the purposes, the legal basis, the retention period and their rights, before processing. Art. 14 covers data obtained from elsewhere. |
| GDPR — impact assessment | Art. 35 | Systematic monitoring at scale generally requires a data protection impact assessment. |
| CCPA as amended by the CPRA | Cal. Civ. Code § 1798.100(a) | California employees are covered data subjects: a business that controls the collection of personal information must inform them at or before the point of collection. |
A policy that relies on consent as its federal basis should not then describe monitoring as a condition of employment in terms that make the consent meaningless. The two statements sit in tension, and where an employee is also covered by GDPR, consent extracted from a subordinate is generally not a sound lawful basis in the first place. For EU-based staff, legitimate interests under Art. 6(1)(f) with a recorded balancing test is the usual route. An internet usage policy and a data protection policy usually sit alongside this one and should not contradict it.
On US state privacy law, one point saves a lot of reading. California is the only state whose comprehensive privacy act reaches employees, because its HR carve-out expired on 1 January 2023. Every other such act defines the protected individual to exclude someone acting in an employment context, so those acts do not touch employee monitoring.
What must the policy contain?
| Section | What it must answer | Why it is there |
|---|---|---|
| Purpose | Why the employer monitors | Purpose limitation under GDPR Art. 6(1)(f); also the first question employees ask |
| Scope | Who is covered, which devices, which networks | Determines whether contractors and personal devices are in or out |
| Definitions | What “monitoring”, “employer systems” and “working hours” mean here | Prevents the policy covering more than intended |
| Types of monitoring | Each tool and the data it collects | N.Y. § 52-c and Conn. § 31-48d both require the types to be stated |
| Locations | Where on the premises monitoring occurs | Required in Connecticut from 1 Oct 2026 |
| What is not monitored | The explicit exclusions | The single highest-value section for adoption; see below |
| Personal use | Whether it is permitted and what happens to it | Sets the expectation of privacy |
| Personal devices | Whether BYOD is monitored, and the right to refuse | Maine § 620-A(4) gives employees the right to decline an app on a personal device |
| Personal spaces | Homes, personal vehicles, personal property | Maine § 620-A(3) bans audiovisual monitoring there unless the job requires it |
| Data handling | Who can access, how long it is kept, how it is secured | GDPR Art. 13; also the question that decides employee trust |
| Monitoring without prior notice | The narrow circumstances | Conn. § 31-48d(b)(2) and (d) |
| Employee rights | How to ask, object or correct | Required under GDPR Art. 13 |
| Review and re-notice | When the policy is reissued | Maine § 620-A(5) requires written notice to all current employees once per calendar year |
| Acknowledgement | Signature and date | The compliance record in New York and Delaware |
A computer use policy, an acceptable use policy and an AI tool usage policy commonly sit beside this one. Keep the definitions consistent across all of them; a reader who finds two definitions of “Company systems” stops trusting both documents.
What should you say you do not monitor?
Most policies list what is monitored and stop. The exclusions do more work, because an undefined boundary is read by employees at its widest.
| Commonly excluded | Typical wording |
|---|---|
| Personal devices on personal networks | Not monitored at any time |
| Activity outside scheduled working hours | Not monitored, except on employer-owned devices for security logging |
| Content of personal communications | Not read, even where sent through employer systems |
| Webcam and microphone | Not activated remotely or covertly |
| Keystroke content | Not recorded; keystroke counts, if collected, are stated separately |
| Precise location of an employee off duty | Not collected |
| Protected activity | Not monitored for the purpose of identifying union or other legally protected activity |
| Health, financial and other special-category data | Not collected through monitoring tools |
Each line in this list is a commitment, so it has to match the tool configuration. A policy that promises webcam capture is disabled while the software permits it is worse than one that is silent — it converts a configuration question into a credibility question. Check what your monitoring software actually collects before you promise what it does not.
Does a signature make monitoring lawful?
No. An employee’s signature on the acknowledgement page records that the policy was delivered and read. It is the compliance evidence that N.Y. § 52-c and 19 Del. C. § 705 ask for, and both statutes describe it in those terms — acknowledgement, in writing or electronically. Connecticut and Maine do not ask for an acknowledgement at all.
Legal consent is a separate question with a separate test. Under the federal Wiretap Act, 18 U.S.C. § 2511(2)(d), one-party consent makes interception lawful for someone not acting under colour of law — but not where the interception is for the purpose of committing a criminal or tortious act. Under GDPR, consent must be freely given, which an employment relationship rarely supports. The practical consequence is that a signature closes the notice requirement and does not, by itself, authorise anything the underlying law prohibits.
Keep the two apart in the document. One acknowledgement block for receipt of the policy; where separate consent is genuinely required for a specific processing activity, a separate, revocable consent record for that activity.
How do you adapt the template?
- Replace every bracketed placeholder. There are 18 tracked fields; a policy issued with
[COMPANY NAME]still in it undermines every other section. - List only the tools actually deployed. Delete the rest; aspirational monitoring is still disclosed monitoring.
- State the real retention period, matched to what the systems are configured to do.
- Name the roles with access, not individuals.
- Add the specific premises locations if you operate in Connecticut, and post the notice in them.
- Decide the personal-device position explicitly, and keep the right to decline an app install — it is required in Maine and is sound practice everywhere.
- Check any camera-on rule for remote staff against Maine § 620-A(3): notice does not cure it, only job-duty necessity does.
- Add the plain-language pre-start statement for Connecticut hires from 1 October 2026.
- Diary the annual written re-notice for Maine, on the calendar year, and put the interview disclosure into the hiring script.
- Have counsel review it against every state and country where you have employees.
- Issue it with an acknowledgement, retain the acknowledgements, and give new hires theirs at hiring.
- Post it where the relevant statutes require posting, and diary the next review.
What are the common mistakes?
| Mistake | Consequence |
|---|---|
| Covering three states instead of four | Maine’s § 620-A has been in force since 29 July 2026 |
| Issuing to existing staff only | New York ties notice to hiring; new hires need theirs at that point |
| Issuing once and never again | Maine requires written notice to all current employees every calendar year |
| Saying nothing to candidates | Maine requires the disclosure during the interview process |
| One notice, multiple states | A single document works only if drafted to the strictest applicable standard |
| Describing types but not locations | Non-compliant in Connecticut from 1 Oct 2026 |
| Requiring an app on a personal device | Maine § 620-A(4) lets the employee decline |
| A camera-on rule for home workers | Maine § 620-A(3) bans it unless the job requires it, and consent does not cure it |
| Treating the signature as consent | Covered above; conflates two separate tests |
| Promising exclusions the software does not enforce | A credibility failure and a potential misrepresentation |
| No retention period | Leaves GDPR Art. 13 unanswered and the data indefinitely held |
| No review date | Two of the four statutes changed during 2026 |
| No internal route to raise a concern | Objections leave the building instead of reaching HR |
Monitask shows employees the same activity data their manager sees, and lets you turn individual tracking features off per team — so the exclusions in your policy can match what the software actually does. Screenshots can be seen at [time tracking with screenshots](/blog/employee-monitoring-software-with-screenshots/).
See how monitoring works in Monitask
Employee monitoring policy template
Copy the text below and replace the bracketed fields. Delete any section describing monitoring you do not conduct. The same template is available as a PDF, a Word document and a Markdown file — the Markdown pastes straight into Notion or Google Docs with the headings intact.
1. Introduction
1.1 Purpose
[COMPANY NAME] (“the Company”) uses certain monitoring tools on Company-provided systems and devices. This policy explains what is monitored, why, what data is collected, how long it is retained, who may access it and what rights employees have. It applies from [EFFECTIVE DATE].
1.2 Scope
This policy applies to all employees, and to [CONTRACTORS / TEMPORARY STAFF / INTERNS — delete as applicable], who use Company-provided devices, accounts, networks or software. It applies to [LIST: Company laptops and desktops, Company email accounts, Company network, Company-issued mobile devices].
This policy does not apply to personal devices operating on personal networks, except where an employee voluntarily enrols a personal device in a Company programme under section 5.
1.3 Definitions
Monitoring means the automated or manual collection of data about the use of Company systems, as described in section 2.
Company systems means [DEVICES, ACCOUNTS, NETWORKS AND APPLICATIONS provided or paid for by the Company].
Working hours means [THE EMPLOYEE’S SCHEDULED HOURS as recorded in [SYSTEM]].
2. Monitoring we conduct
2.1 Types of monitoring
The Company conducts the following types of monitoring:
| What | Data collected | Business purpose |
|---|---|---|
| [Time tracking] | [Start and stop times, hours by project] | [Payroll, client billing, project costing] |
| [Application and website activity] | [Names of applications and sites used during working hours] | [Security, productivity measurement] |
| [Screenshots] | [Periodic screen captures at [INTERVAL] during working hours] | [Verification of billable work] |
| [Email and network security scanning] | [Metadata, attachment scanning for malware] | [Information security] |
| [Physical premises] | [CCTV in the locations listed in 2.2] | [Security of premises and staff] |
2.2 Locations
On-premises monitoring takes place in the following locations: [LIST SPECIFIC LOCATIONS].
Connecticut requires the notice to identify these locations and to be posted in them. List rooms and areas, not “all premises”.
2.3 What we do not monitor
The Company does not:
- Monitor personal devices on personal networks;
- Activate webcams or microphones remotely or covertly;
- Record the content of keystrokes;
- Read the content of communications identified as personal;
- Collect the location of employees outside working hours;
- Monitor for the purpose of identifying union activity or other legally protected activity;
- Collect health, financial or other special-category personal data through monitoring tools;
- Monitor [ADD ANY FURTHER EXCLUSIONS].
Every line above is a commitment. Delete any the Company’s tools do not actually enforce.
3. Purpose of monitoring
Monitoring is conducted only for the purposes stated in section 2.1. Data collected for one purpose is not used for another without a documented review by [ROLE] and, where required, notice to affected employees.
4. Personal use and expectation of privacy
Limited personal use of Company systems is [PERMITTED / NOT PERMITTED]. Where personal use is permitted, employees should be aware that activity on Company systems is subject to the monitoring described in section 2.
Employees who send personal communications through Company systems may mark them [PERSONAL] in the subject line or equivalent field. The Company will not read the content of communications so marked, except where section 8 applies.
5. Personal devices and personal spaces
5.1 Personal devices
[OPTION A: The Company does not monitor personal devices and does not permit Company data on them.]
[OPTION B: Employees may access Company [EMAIL / APPLICATIONS] from personal devices. In that case the Company collects [SPECIFY] and can [SPECIFY: remotely remove Company data]. The Company does not access personal files, photographs, messages or location data on personal devices.]
An employee may decline to install any Company monitoring or data collection application on a personal device. An employee who declines will be offered a Company-provided device for the work concerned, and declining will not affect their employment in any way. Requests and refusals are recorded by [ROLE].
Required in Maine by 26 M.R.S. § 620-A(4). Sound practice everywhere, because a mandatory install on a personal device is the single most contested line in a monitoring policy.
5.2 Homes, personal vehicles and personal property
The Company does not use audiovisual monitoring — camera or microphone — in an employee’s home, in an employee’s personal vehicle or on an employee’s property.
[WHERE A ROLE GENUINELY REQUIRES IT: The sole exception is [ROLE / TASK], where audiovisual monitoring is required for the duties of the job. The requirement, and the reason for it, are recorded in the role description and reviewed at each policy review.]
Maine bans this outright at 26 M.R.S. § 620-A(3) unless the monitoring is required for the duties of the job. Notice does not cure it and neither does consent, so a camera-on rule for remote staff has to meet the job-duty test or be dropped.
6. Data collected, access and retention
Access. Monitoring data is accessible to [ROLES ONLY, e.g. the employee’s direct manager, HR, the IT security team].
Employee access. Employees may request a copy of monitoring data relating to them by contacting [CONTACT]. [WHERE THE TOOLING SUPPORTS IT: employees can view their own activity data at any time in [SYSTEM].]
Retention. Monitoring data is retained for [RETENTION PERIOD] and then deleted, except where a longer period is required by law or by an active investigation or legal hold.
Third parties. Monitoring data is processed by [NAME SOFTWARE VENDORS]. It is not sold, and is not shared with any other third party except [AS REQUIRED BY LAW / SPECIFY].
7. Data security and breach notification
Monitoring data is stored [SPECIFY: encrypted at rest, access-logged] and is protected by the controls set out in [INFORMATION SECURITY POLICY]. If monitoring data is subject to a personal data breach, the Company will notify affected employees and any required authority in accordance with [APPLICABLE LAW] and [BREACH RESPONSE POLICY].
8. Monitoring without prior notice
In narrowly defined circumstances, the Company may monitor without the prior notice described in this policy — specifically, where the Company has reasonable grounds to believe that an employee is engaged in conduct that violates the law, violates the legal rights of the Company or of its employees, or creates a hostile work environment, and where monitoring may produce evidence of that conduct. Such monitoring requires the prior written approval of [ROLE], is limited to what is necessary, and is documented.
This section also does not limit the Company’s obligations in connection with a criminal investigation.
[FOR EMPLOYEES HIRED IN CONNECTICUT ON OR AFTER 1 OCTOBER 2026: the Company provides a separate plain-language written statement before the start of work, describing the prohibited activities that may be monitored without prior notice.]
9. Employee rights, questions and concerns
Employees may:
- Ask what data is collected about them and request a copy;
- Ask for inaccurate data to be corrected;
- Raise a concern or object to a specific monitoring practice;
- [EXERCISE ANY FURTHER RIGHTS available under applicable law, including under Regulation (EU) 2016/679 where applicable].
Questions and concerns go to [CONTACT — NAME, ROLE, EMAIL]. The Company will respond within [NUMBER] working days. Raising a concern under this policy will not result in retaliation.
10. Policy review and re-notice
This policy is reviewed every [SIX / TWELVE] months and whenever the Company changes its monitoring tools or a relevant law changes. Last reviewed: [DATE]. Next review: [DATE].
Annual notice. The Company gives written notice to every current employee, at least once each calendar year, that it conducts the monitoring described in this policy. The notice for [CALENDAR YEAR] is sent in [MONTH] by [ROLE], and the dispatch is recorded.
Required in Maine by 26 M.R.S. § 620-A(5), which is owed to all current employees rather than only to those being monitored. It runs on the calendar year, so a notice sent in December and the next in January of the year after next misses a year entirely.
At interview. Candidates are told during the interview process that the Company conducts monitoring. [ROLE] includes the statement in the interview script and in the job posting.
Required in Maine by 26 M.R.S. § 620-A(5). The statute asks only that the candidate be informed and does not require a written record — keep one anyway, because the employer carries the compliance burden.
11. Acknowledgement
I confirm that I have received and read the [COMPANY NAME] Employee Monitoring Policy dated [DATE], and that I have had the opportunity to ask questions about it.
| Employee name | ______________________________ |
| Signature | ______________________________ |
| Date | ______________________________ |
This acknowledgement records receipt of the policy. It is not a consent to any processing for which separate consent is required.
Sources
- New York — N.Y. Civil Rights Law § 52-c
- Delaware — 19 Del. C. § 705
- Connecticut — Conn. Gen. Stat. § 31-48d
- Maine — 26 M.R.S. § 620-A
- Maine — 26 M.R.S. § 620, retaliation
- Connecticut Public Act 26-73 (Substitute Senate Bill No. 472)
- Electronic Communications Privacy Act, 18 U.S.C. § 2511
- California Consumer Privacy Act as amended, Cal. Civ. Code § 1798.100
- Regulation (EU) 2016/679 (GDPR), Articles 6(1)(f), 13 and 35
FAQ
When do I have to give the notice?
New York requires it upon hiring, acknowledged in writing or electronically, plus a posting. Connecticut requires prior written notice to all affected employees, which a conspicuous posting satisfies. Delaware allows either a daily electronic notice or a single acknowledged notice. Maine requires notice before monitoring begins, a disclosure to candidates during the interview, and written notice to all current employees at least once per calendar year.
Is posting a notice on the wall enough?
In Connecticut, yes — “such posting shall constitute such prior written notice”, and from 1 October 2026 the posting must also be in the specific locations named in the notice. In New York, no: the employer “shall also post”, on top of the acknowledged individual notice. Delaware and Maine do not provide for posting at all, and in Maine a posting does not discharge the annual written notice.
What are the penalties?
New York and Connecticut both set **maxima** on a three-step scale: $500 for a first offence, $1,000 for a second, $3,000 for a third and each subsequent — enforced by the Attorney General and the Labor Commissioner respectively. Delaware sets a **fixed** $100 for each violation, with no tier and no cap, and § 705(d) makes the remedy non-exclusive. Maine sets $100 to $500 for each violation, enforced by the Department of Labor; separately, 26 M.R.S. § 620 makes retaliation a civil violation at $500 to $1,000 per violation, enforceable by the Department of Labor and the Attorney General.
What changed in Connecticut in October 2026?
Public Act 26-73, signed 4 June 2026 and effective 1 October 2026, requires the notice to identify the specific premises locations where monitoring may occur and to be posted in those locations. Employees hired on or after that date must also receive a plain-language written statement before starting work, describing the prohibited activities that may be monitored without prior notice. New exceptions at (b)(3) cover airport premises and reasonable security or employee-safety grounds, and they excuse only the location disclosure. Penalties are unchanged.
Does Connecticut's 2026 Act cover AI monitoring tools?
The Act says nothing about it. The enrolled text of Public Act 26-73 contains no occurrence of “artificial intelligence”, “AI”, “automated” or “algorithm”, and it does not amend the definition of electronic monitoring in subsection (a). What is true is that the definition was technology-neutral before the 2026 act and is unchanged by it, so an AI-driven tool collecting information on the premises was already covered — which was equally true before the 2026 Act.
What does Maine require that the other states do not?
Three things. A written notice to **all** current employees at least once per calendar year, not just at hiring. A disclosure to candidates during the interview process. And two prohibitions that no notice cures: § 620-A(3) bans audiovisual monitoring in an employee’s home, personal vehicle or on their property unless the job requires it, and § 620-A(4) lets an employee decline to install a data-collection app on a personal device.
Can I monitor without telling employees first?
Conn. Gen. Stat. § 31-48d(b)(2) permits monitoring without prior notice where the employer has reasonable grounds to believe an employee is engaged in conduct that violates the law, violates legal rights of the employer or its employees, or creates a hostile work environment, and where the monitoring may produce evidence of that conduct. Subsection (d) addresses criminal investigations. These are narrow exceptions, not a general route around notice — and Maine has no equivalent exception at all.
Does an employee signature make monitoring lawful?
No. The signature records that the policy was delivered and read, which is the acknowledgement New York and Delaware ask for. Whether a particular monitoring practice is lawful is decided by the underlying statutes. Under GDPR, consent from an employee is rarely a sound lawful basis because of the imbalance in the relationship; legitimate interests under Art. 6(1)(f), with a documented balancing test, is the usual basis for monitoring EU-based staff.
Can I monitor personal devices?
Only within what the employee has agreed to and what applicable law permits, and the policy has to say which it is. In Maine an employee may decline to install a monitoring or data-collection app on a personal device, so a mandatory install is non-compliant on its face. Most employers limit monitoring on a personal device to Company data and applications on it, and state explicitly that personal files, messages, photographs and location data are not accessed.
How long can I keep monitoring data?
No single period applies across the board. GDPR Art. 13 requires the retention period to be stated in advance, and the period has to be justifiable against the purpose. Set it to what the business purpose actually needs, configure the tooling to delete on that schedule, and state the figure in section 6 of the policy rather than leaving it open.
How often should the policy be reviewed?
Every six to twelve months, and whenever a monitoring tool or an applicable law changes. Two of the four state statutes changed during 2026, so a policy drafted earlier in the year for a Connecticut or Maine workforce is already out of date. Maine separately requires the notice itself to be reissued to every current employee each calendar year, which is a different obligation from reviewing the document.
