Is Employee Monitoring Legal? What Employers Can and Cannot Do

Reliable employee tracking software. Clear visibility and insights into how employees work. Even remotely.
Try Monitask free for 10 days

Employee monitoring is legal in all 50 US states and in most other countries, but legality depends on how it is done rather than whether it is done. On company-owned equipment during work hours, with a written policy in place, monitoring is broadly permitted under federal law. Four states require written notice first. Audio recording, biometrics and personal devices each have separate rules, and the EU treats employee consent as unreliable by design.

Those conditions are where most of the confusion sits, and a good deal of it comes from a handful of persistent employee monitoring myths that circulate on both sides of the question.

What is legal, what needs notice, what needs consent

This is general information, not legal advice. Rules vary by state, by contract and by industry. Confirm your own position with counsel.

The federal baseline: what the ECPA allows

The Electronic Communications Privacy Act of 1986 (18 U.S.C. §§ 2510–2522) is the primary federal statute. It prohibits unauthorised interception of electronic communications, then provides two exceptions that cover most workplace monitoring.

The business-purpose exception (18 U.S.C. § 2511(2)(a)(i)) permits monitoring on company-owned equipment and networks where there is a legitimate business reason. Courts read it broadly: in Fraser v. Nationwide Mutual Insurance Co., 352 F.3d 107 (3d Cir. 2003), reviewing stored email on a company server fell within it.

The consent exception (18 U.S.C. § 2511(2)(d)) permits monitoring where at least one party to the communication consents. In practice, a written policy plus continued use of company equipment establishes implied consent.

Two further federal statutes matter: the Stored Communications Act (18 U.S.C. §§ 2701–2712) governs access to stored communications, and the Computer Fraud and Abuse Act (18 U.S.C. § 1030) prohibits unauthorised access to systems.

What the ECPA does not do is pre-empt stricter state law, and it says nothing about biometrics, GPS or AI-driven analysis. Those sit in separate state statutes. For what has changed recently at federal and state level, see our round-up of the latest employee law regulation in the US.

Notice or consent: they are not the same thing

These two words are used interchangeably in most guides, and the difference decides what you actually have to do.

Notice means telling employees that monitoring happens and what it covers. They do not have to agree. They simply have to be informed.

Consent means employees must actively agree before monitoring begins. A signature, a checkbox, a separate form.

The four US states with monitoring statutes require notice, not consent. Consent requirements appear separately, and narrowly: for audio recording in two-party states, and for biometric collection in Illinois and Texas. Washington is often listed beside them, but its statute accepts notice or consent or an opt-out mechanism — the detail is below. Colorado sits alongside those three on biometrics rather than on notice — its HB 24-1058 made biological and neural data “sensitive data” under the Colorado Privacy Act from August 2024.

Outside the US the distinction inverts. Under GDPR, consent is the weaker basis, not the stronger one — covered below.

Which US states require written notice

This is where the published guidance disagrees with itself, so it is worth being precise.

Four states have statutes requiring notice before electronic monitoring begins. Connecticut, Delaware and New York are the long-standing three; Maine is the fourth and the most recent.

Maine’s law goes further than notice. It also bars audiovisual monitoring of an employee’s home, personal vehicle or personal property unless the job genuinely requires it, and bars requiring employees to install tracking applications on their own devices — an employee may decline. It applies to every Maine employer, public and private, regardless of size.

Two dates in that table are reported incorrectly almost everywhere, and both were checked against the legislatures’ own records.

Connecticut’s statute was rewritten three weeks ago. Public Act 26-73 repealed and replaced § 31-48d effective 1 October 2026. The penalty schedule survived unchanged, which is why the change is easy to miss, but the notice content grew: an employer must now disclose the specific locations where monitoring may occur, not merely the types of monitoring, and must give every employee hired on or after that date a separate plain-language statement before they start work listing prohibited activities and activities that may be monitored without notice. Any guide describing Connecticut’s duty as “notice of the types of monitoring” is now describing repealed law.

Maine’s law took effect on 29 July 2026, not 14 July. The 14 July date in circulation is computed from the constitutional adjournment deadline for a second regular session — the third Wednesday in April, plus ninety days. But the session was extended and adjourned on 29 April. The Legislature’s own Legislative Digest, the House end-of-session report and the Maine Department of Labor’s list of labour-law changes all give 29 July. The chapter law carries no effective-date clause of its own, so the default ninety-day rule governs. Worth noting too that LD 61 became law without the Governor’s signature, on 11 January 2026, after being held over the 2025 adjournment — which is why the chapter law is headed 2025 while the statute dates from 2026.

So why do published guides disagree about the fourth state? Because several of them name Colorado instead, citing HB 24-1058 — and that bill is not a monitoring-notice law at all. Its title is Protect Privacy of Biological Data. Signed on 17 April 2024 and in force since 7 August 2024, it adds biological and neural data to the definition of sensitive data under the Colorado Privacy Act. It is a biometric statute, and it belongs in the biometrics column rather than the notice column. A guide that lists Colorado as a notice state has filed a real law under the wrong heading.

And one claim circulating widely is wrong. California’s AB 1221 would have required employers to give workers 30 days’ written notice before introducing a workplace surveillance tool, barred tools using facial, gait or emotion recognition, prohibited inferring protected characteristics such as immigration status or disability, and carried a $500 civil penalty per violation. It did not become law. The bill failed, with its last action recorded on 2 February 2026.

It still appears in several compliance guides as though it had passed. Part of the confusion is that California had two workplace surveillance bills in the same session: AB 1221 and AB 1331, which would have barred monitoring in employee-only areas such as break rooms and during off-duty hours. AB 1331 also failed, on the Senate floor. Neither is law. Build your policy on statutes in force, not on bills that did not pass.

Monitoring law in all 50 states and the District of Columbia

Every row below was read in the statute text on the state’s own code or
legislature site. Where a published survey disagrees with this table, the
disagreement is usually one of three things: a law that changed in 2026, a
comprehensive privacy act that looks relevant but excludes employees, or a
consent rule whose operative element is not consent at all. The notes after the
table cover each case.

What the table is too small to say

Alabama. Statute text read from the Legislature’s bill reprints; the Code of Alabama site serves no text without JavaScript.

Alaska. HB 86 / SB 85 (2025) would have moved Alaska to all-party consent; both died in committee. Current penalty section unread.

Arkansas. Audio confirmed from Acts 2001, No. 1773, which reprints 5-60-120(a): lawful where ‘one (1) of the parties to the communication has given prior consent to such interception and recording’. The last amendment, Act 1087 of 2003, adds only pen-register and stored-communications carve-outs and leaves (a) alone.

California. The CCPA gives a right to LIMIT use of sensitive personal information, not an opt-in consent gate — California is mis-scored in tables headed ‘opt-in’. AB 1221, which would have made California a fifth monitoring-notice state, was NOT enacted: the Assembly’s own Daily Journal for 2 February 2026 records it reported out of Appropriations under Joint Rule 56 and ‘ordered filed with the Chief Clerk’ — the terminal disposition for a two-year bill dying at the house-of-origin deadline.

Colorado. The most employee-specific biometric provision outside Illinois, and almost nobody lists it. Audio confirmed from the Colorado Judicial Branch’s own published jury instructions, which quote 18-9-304(1) as ‘without the consent of at least one of the principal parties thereto’ — the codified text itself sits behind a LexisNexis container.

Connecticut. REWRITTEN EFFECTIVE 1 OCTOBER 2026 — two weeks before this research. Notice must now state the SPECIFIC LOCATIONS monitoring may occur, and every employee hired on or after 1 Oct 2026 gets a separate plain-language written statement before starting work. Every table written before Oct 2026 is stale.

Delaware. Notice is a CHOICE of two mechanisms: daily electronic notice, or a one-time notice the employee acknowledges. Audio: 11 Del. C. 2402(c)(4) protects a participant, but 11 Del. C. 1335(a)(4) criminalises interception ‘without the consent of all parties thereto’. The two sections conflict on their face.

Georgia. Two things here that no survey has right. First, Georgia splits by medium: 16-11-62(2) makes it unlawful ‘through the use of any device, without the consent of all persons observed, to observe, photograph, or record the activities of another which occur in any private place and out of public view’ — with a carve-out for an owner or occupier of real property using a device for security ‘in areas where there is no reasonable expectation of privacy’. So workplace video turns on expectation of privacy, not consent. Second, the widely reported Georgia privacy act does not exist: S.B. 111 carries the caption ‘Georgia Consumer Privacy Protection Act’ and was signed 11 May 2026 as Act 462, but the as-passed text amends only O.C.G.A. 31-8-9.1, the rural hospital tax credit. Georgia keeps a bill’s original caption after a substitute guts it. Confirmed from the Governor’s own signed-bill PDF. 16-11-66(a) and the penalty section 16-11-69 could not be read.

Hawaii. Penalty figures come from the Legislature’s 1999 HRS archive; current pages were unreachable.

Illinois. 820 ILCS 55/10(b)(2) affirmatively preserves an employer’s right to monitor its own equipment, so Illinois is a notice state’s opposite. P.A. 103-0769 (1 Aug 2024) caps recovery at one per person per collection method; the 7th Circuit held it retroactive in April 2026, but NO Illinois state appellate court has ruled, so the question is open in state court.

Indiana. The employment exclusion is verbatim from the enrolled act: a consumer is someone ‘acting only for a personal, family, or household purpose’ and ‘does not include an individual acting in a commercial or employment context’. The audio cell is unread — Indiana serves its code only as a JavaScript app.

Iowa. Iowa is routinely lumped with the opt-in states. Section 715D.4(2) requires only ‘clear notice and an opportunity to opt out’.

Kentucky. The KRS website currently displays the version of the KCDPA taking effect 1 July 2027 (2026 Ky. Acts ch. 118), including a new ‘smart monitor’ consent duty. Anyone reading it today will describe law not yet in force.

Maine. EFFECTIVE 29 JULY 2026, not the 14 July date circulating in law-firm write-ups — that is computed from the constitutional adjournment deadline, but the session ran to 29 April 2026. The Legislative Digest, the House end-of-session report and the Maine DOL’s own labour-law-changes list all say 29 July. The bill became law WITHOUT the Governor’s signature on 11 Jan 2026. Duties: notice before monitoring begins, disclosure to candidates during interview, and WRITTEN NOTICE TO CURRENT EMPLOYEES ONCE A YEAR — the annual re-notice is unique among the four states.

Massachusetts. An openly announced recording is not an ‘interception’ at all, because the definition requires secretly hearing or recording. Monitoring-notice bills have been filed in at least seven consecutive sessions and never passed.

Michigan. MCL 750.539c says ‘without the consent of all parties thereto’. One-party status depends entirely on reading ‘private discourse of others’ in 750.539a(2) to exempt a participant — a Court of Appeals holding federal courts have split on. A flat ‘one-party’ cell for Michigan is not defensible.

Mississippi. The one-party position is established from primary documents but not from the operative sentence. Mississippi has seen a recurring series of bills whose stated object was to CONVERT the state to all-party consent — HB 561 (2003), HB 399 (2004), HB 396 (2005), HB 558 (2021), HB 593 (2024) — and every one died. HB 396’s caption reads ‘TO AUTHORIZE THE INTERCEPTION OR RECORDING OF A COMMUNICATION WHERE THE PERSON IS A PARTY … AND WHERE ALL OF THE PARTIES … HAVE GIVEN PRIOR CONSENT’. All-party had to be created by amendment and never was. Mississippi reprints amended sections with no add/delete markup, so the bill text cannot be read as current law.

Missouri. 542.402.1 reaches WIRE communications; purely in-person conversation is covered only where the device transmits by radio. The usual ‘one-party’ cell is right in outcome, wrong in reason.

Montana. ‘Montana: all-party in person, one-party by phone’ is wrong — the word telephone appears only in a health-care exception. The offence requires a HIDDEN device and recording ‘without the knowledge of all parties’, and a warning cures it: ‘If one person provides the warning, either party may record.’

Nevada. Nevada is the most mis-scored audio cell in the country, and a flat label is wrong either way. NRS 200.620 permits intercepting a WIRE communication only where there is one party’s prior consent AND an emergency making a court order impractical — the conjunction is why one-party consent alone is no defence on a phone call. The Legislative Counsel’s Digest to A.B. 127 (2007) states it plainly: ‘Existing law generally requires two-party consent before a person may record a telephone conversation.’ But NRS 200.650, covering an in-person private conversation recorded with a listening device, prohibits it ‘unless authorized to do so by one of the persons engaging in the conversation’ — one-party.

New Hampshire. The all-party label overstates New Hampshire’s reach over employer monitoring. The prohibition attaches only to an ‘oral communication’, which RSA 570-A:1, II defines as one uttered by a person ‘who has a reasonable expectation that the communication is not subject to interception, under circumstances justifying such expectation’ — an objective screen. And RSA 275:74, IV(b) expressly preserves an employer’s right to ‘Monitor usage of the employer’s electronic equipment and electronic mail’.

New Jersey. New Jersey is often tabled as a monitoring-notice state. It is not — its law covers VEHICLE TRACKING DEVICES only. The Governor’s conditional veto also stripped the criminal penalties, so anyone citing NJ for criminal liability is citing a superseded reprint. Audio confirmed one-party from a New Jersey Superior Court decision quoting 2A:156A-4(d). The prior-approval requirement in the neighbouring subsection (c) attaches to law-enforcement consensual interceptions, not to private parties — secondary summaries collapse the two.

New Mexico. The one-party consent exception at 30-12-1(C)(3) is written only for a person ‘acting under color of law’, so a private employer’s position rests on the consent element inside (B)(3) itself. The definition of a protected message also excludes circumstances where the parties ‘may reasonably expect that the message, communication or report may be overheard or recorded’. Text read from a legislature-hosted bill reprint (2013 SB 127, which tried to move New Mexico to all-party and died) rather than the codified NMSA.

New York. NO employer-size threshold of any kind — a one-employee business with a NY place of business is covered. BOTH mechanisms are mandatory: individual written or electronic notice on hiring that the employee ACKNOWLEDGES, and a conspicuous posting. Unamended since 7 May 2022. The duty is triggered ‘upon hiring’, which on its face says nothing about existing employees — the posting is what does the continuing work.

Oklahoma. Oklahoma’s comprehensive act is new and every pre-2026 survey lists the state as having none. Its operative text sits only on a robots-blocked bill server, so the employment-exclusion question — the one that decides whether it touches employee monitoring — is unresolved. Every comparable act carries the exclusion, but that is inference from the model, not a read of the text. The enforcement and penalty figures come from the Legislature’s own bill summaries, which also disagree with the House press release on the effective date — the engrossed summary says 1 July 2026, the House release says 1 January 2027. Resolve before citing a date.

Oregon. ORS 165.535(1) now defines ‘conversation’ to include ‘a communication occurring through a video conferencing program’ — so Zoom and Teams fall under the all-participants-informed rule, not the one-party telephone rule. For 2026 employee monitoring that is the most consequential Oregon fact, and it is in almost no survey. Note the duty is to INFORM, not to obtain consent.

Pennsylvania. This is the most useful audio cell in the table for an open-plan workplace. 18 Pa. C.S. 5702 defines an oral communication as one ‘uttered by a person possessing an expectation that such communication is not subject to interception under circumstances justifying such expectation’ — so Pennsylvania’s all-party rule bites only where the speaker had an expectation of privacy AND the circumstances justified it. Confirmed verbatim from two independent Pennsylvania court opinions. The all-party label itself rests on 5703’s blanket prohibition plus the chapter structure; the text of the 5704(4) all-parties-consent exception was not read.

Rhode Island. Do NOT state that Rhode Island gives employees a wiretap private right of action: the civil remedy at 12-5.1-13 reaches violations ‘of this chapter’, meaning the court-ordered-interception chapter, not 11-35-21.

South Carolina. The most generous private right of action found in this research. A workplace conversation held with no exhibited expectation of privacy may fall outside ‘oral communication’ entirely.

South Dakota. The statute reaches conversations, not just wire calls, and the chapter’s exemptions are carrier, switchboard, subpoena and court order only — there is no employer or business-use exemption. The only civil-side provisions are immunity for service providers and a good-faith defence.

Tennessee. The TIPA employment exclusion is confirmed from the enforcing Attorney General’s own published Key Terms: a consumer ‘does not include a natural person acting in a commercial or employment context’. The audio cell is unread — capitol.tn.gov is robots-blocked for the whole domain and tncourts.gov puts a browser-validation wall on every opinion PDF. Tennessee is reported one-party under 39-13-601(b)(5).

Texas. Texas runs opposite to every other state here: its DEDICATED statute reaches employee fingerprint and face timeclocks while its COMPREHENSIVE act does not. A table that treats the comprehensive act as the biometric column gets Texas exactly backwards. H.B. 149 (2025) rewrote 503.001 effective 1 Jan 2026, adding AI-training exemptions; the inform-and-consent, retention, $25,000 and AG-only elements survived unchanged.

Utah. UCPA quotes come from enrolled S.B. 227 (2022), not the current code — every le.utah.gov route for Title 13 ch. 61 failed.

Vermont. Vermont is the one state with no private-party recording statute whatsoever, which is a more interesting cell than ‘one-party’. On the privacy act: the enacted vehicle is S.71, not the identically titled H.208, which died in committee — a trap for anyone tracking the wrong bill. The employment exclusion appears twice: 2415a(b)(8)(B) says a consumer ‘does not include an individual acting in a commercial or employment context’, and 2415c(a)(24)(A) separately exempts data handled ‘in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller’. Distinct from the Age-Appropriate Design Code, which takes effect 1 Jan 2027 and covers minors.

Washington. The common description of Washington as ‘BIPA-lite, notice AND consent’ is simply wrong. Audio: gross misdemeanor plus a private action capped at $1,000.

Wisconsin. The Class H figures come from two published Wisconsin Court of Appeals opinions quoting 939.50(3)(h); the statute page itself is robots-blocked. Of the six-year maximum, initial confinement may not exceed three years, the balance being extended supervision.

Wyoming. A felony capped at a $1,000 fine is counterintuitive but is what 7-3-702(f) says — and note the civil floor is $1,000 a day, so the private action is far more dangerous to an employer than the criminal penalty. Damages text read from the 2001 enrolled act that created the section.

Audio recording: where every participant has to agree

Recording a conversation is a separate legal question from monitoring a screen,
and it is the one most often got wrong.

In a one-party consent state the employer counts as a party and can record.
In an all-party state — usually called two-party — every participant must
agree. Ten states require all-party consent on the face of the statute: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, Washington.

The District of Columbia is not among them, although a great many published
guides put it there. D.C. Code § 23-542(b)(3) permits interception “where such
person is a party to the communication or where one of the parties to the
communication has given prior consent”. DC is one-party.

Three more jurisdictions do not fit either label, and the difference is practical
rather than academic:

• Michigan reads as all-party on the page — MCL 750.539c says “without the

consent of all parties thereto” — and is listed everywhere as one-party. That
label depends entirely on a 1982 Court of Appeals reading of “private discourse
of others” in MCL 750.539a(2) as exempting a participant, and federal courts in
Michigan have split on whether it survives. Treat Michigan as unsettled.

• Oregon splits by medium, and the split moved. Telephone and radio are

one-party, but ORS 165.535(1) defines “conversation” to include “a communication
occurring through a video conferencing program” — so Zoom, Teams and Meet sit
with in-person conversation under ORS 165.540(1)(c), which requires that all
participants be “specifically informed”. Note the duty there is to inform, not to
obtain consent: a clear announcement discharges it.

• Vermont has no private-party recording statute at all. Title 13 contains no

wiretap chapter, and 13 V.S.A. § 8108 binds law enforcement only.

Two further traps worth knowing. Massachusetts is counted as all-party, but
its operative element is secrecy rather than consent — an openly announced
recording is not an “interception” under M.G.L. c. 272 § 99(B)(4) at all.
Montana draws no telephone/in-person distinction whatever, requires a hidden
device, and lets a unilateral warning cure the offence: “If one person provides
the warning, either party may record.”

What this means in practice: if your monitoring software has a microphone
feature, it must be off by default for employees in the all-party states, and in
Oregon that now includes video meetings. Screen captures, application tracking,
website logging and keystroke counting do not involve audio interception and are
unaffected anywhere.

Biometrics: why Illinois is the expensive one

Fingerprint clock-ins and facial recognition attendance are the highest-risk monitoring features in the US, and the risk is concentrated in one state.

Illinois’ Biometric Information Privacy Act (740 ILCS 14) requires written informed consent before collecting a biometric identifier, a written retention policy, and secure storage with defined destruction timelines. It carries a private right of action — employees sue directly — with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless one.

In Cothron v. White Castle System, the Illinois Supreme Court held that each individual scan is a separate violation. A 2024 amendment (Public Act 103-0769, in force 1 August 2024) limited a plaintiff to one recovery per person per collection method, and in April 2026 the Seventh Circuit held that the amendment applies retroactively. That holding binds federal courts in the Seventh Circuit; it is a prediction of Illinois law rather than a ruling on it, and no Illinois appellate court has yet decided the question — so retroactivity is settled in federal court and genuinely open in state court. Even with the cap, cumulative BIPA settlements run into the hundreds of millions.

Texas (Bus. & Com. Code ch. 503, known as CUBI) requires an employer to inform the individual and obtain consent before capturing a biometric identifier, and to destroy it within a year of the collection purpose expiring. Penalties run to $25,000 per violation, enforced by the Attorney General rather than by employees. H.B. 149 (2025) rewrote the section effective 1 January 2026 to add AI-training exemptions; the inform-and-consent, retention, $25,000 and AG-only elements survived unchanged.

Washington is weaker than it is usually described, and the difference matters. RCW 19.375.020 bars enrolling a biometric identifier for a commercial purpose “without first providing notice, obtaining consent, or providing a mechanism to prevent the subsequent use” — three alternatives, not three requirements, so notice alone can satisfy it. The statute does not require that consent be written, and it imposes no published-retention duty of the Illinois kind. RCW 19.375.030(2) says the chapter “may be enforced solely by the attorney general”, so employees cannot sue under it.

Illinois is the outlier, and it is the only one of the three where that is true: it is the only state of the three with a private right of action, which is why essentially all biometric litigation risk sits there.

Why two dozen “biometric privacy laws” do not apply to your employees

Most compliance guides now list twenty-odd states as having biometric protections, on the strength of the comprehensive consumer privacy acts passed since 2023. Nearly all of those acts do classify biometric data as sensitive data requiring opt-in consent. Nearly all of them are also irrelevant to employee monitoring, for a reason that sits one definition away from the headline.

These statutes regulate what a controller may do to a consumer, and almost every one of them defines a consumer to exclude “an individual acting in a commercial or employment context.” Virginia, Utah, Montana, Nebraska, Minnesota, Maryland, Texas, Oregon, Rhode Island, New Jersey, Iowa, Kentucky, Indiana, Delaware, Connecticut, Florida, Colorado and Louisiana all carry that exclusion, most of them twice over — once in the definition and again as a standalone HR-data exemption. An employee is not a consumer, so the act does not reach the fingerprint scanner at the door.

California is the exception, and it is the only one. The CCPA’s carve-out for data collected about job applicants, employees, contractors and officers expired on 1 January 2023 and was not renewed, so California employees are consumers for these purposes. Note what that does and does not give them: the CCPA grants a right to limit the use of sensitive personal information, not an opt-in consent gate, so California is mis-scored by any table whose biometric column is headed “opt-in consent.”

Colorado deserves its own line, because it did something no other state has. HB 24-1130, in force since 1 July 2025, added employer-specific provisions to the Colorado Privacy Act — and bars an employer from obtaining consent to retain biometric data used for employee location tracking, or for tracking how much time an employee spends in an application. That is a direct limit on a monitoring feature, not a general privacy duty, and it appears in almost no published survey.

And Texas runs the opposite way to everywhere else. Its comprehensive act excludes employees, but CUBI — the dedicated statute — contains no employment exclusion at all and expressly contemplates employer collection. So a table that treats “comprehensive privacy act” as the biometric column gets Texas exactly backwards.

The practical takeaway: standard monitoring features — screenshots, app tracking, time logging — do not collect biometric identifiers. The exposure appears only when biometric authentication is added to the stack, and then it is concentrated in Illinois, Texas and, for location and application-time tracking specifically, Colorado.

Which state’s law applies to a remote worker

The law of the state where the employee physically works, not where the company is incorporated or headquartered.

A company registered in Delaware with offices in Texas that employs a remote worker in New York must satisfy New York’s notice requirement for that person. For a distributed team, that means as many rule sets as there are states.

Two workable approaches:

1. Highest common denominator. Apply the strictest applicable standard to everyone. Operationally simple, and the core requirements — written notice, acknowledgment, limited scope — are good practice regardless.
2. Configuration by location. Different monitoring levels per state. More precise, more to maintain, and it only works if your software supports per-team configuration.

Most employers should start with the first.

What each monitoring feature actually collects

Legal guides discuss monitoring in the abstract. Purchasing decisions happen at the feature level, so here is the mapping.

The line that recurs across jurisdictions: counting is safer than capturing, and work-hours-only is safer than always-on. Where screenshots are the feature in question, what the tool does before the image leaves the machine matters — our screen monitoring software blurs sensitive content at capture, which is the practical answer to the HIPAA and client-record problem in that row.

Outside the US

Why “just get consent” fails under GDPR

GDPR applies the moment an EU-based employee’s personal data is processed, regardless of where the employer sits.

The common assumption is that a signed consent form settles it. It does not. The European Data Protection Board has repeatedly held that consent rarely works as a lawful basis in employment, because an employee who declines risks disciplinary action or a worse review. Consent given under that pressure is not freely given, and consent that is not freely given is not valid.

Most employers rely instead on legitimate interest under Article 6, balanced against employee privacy rights. That requires the monitoring to be necessary and proportionate to a specific business purpose and no more intrusive than needed. Systematic monitoring usually requires a Data Protection Impact Assessment.

Everything collected — website logs, app usage, email metadata, screen recordings — is personal data under GDPR. Covert monitoring is permitted only in narrow circumstances such as an active investigation into suspected criminal conduct, with strictly limited scope and duration.

Where tools struggle is data minimisation. Continuous keystroke logging, continuous screenshots and full email content go beyond what is necessary to measure productivity, and collecting more than necessary increases both regulatory exposure and breach damage.

Our guide to GDPR requirements for employee monitoring covers the mechanics.

Works councils

In parts of the EU, deployment requires consultation before, not after. In the Netherlands, employers with 50 or more employees need Works Council approval under the Works Councils Act before implementing monitoring, a process that typically runs four to eight weeks. Germany adds consultation requirements on top of baseline GDPR under Article 88 derogations.

This is the requirement most often discovered too late, because it cannot be fixed retroactively.

The EU AI Act

The Act classifies AI used for recruitment, performance evaluation, task allocation, worker monitoring and promotion or termination decisions as high risk.

Two things already apply. Emotion inference from face, voice or other biometric signals in the workplace has been banned since 2 February 2025, along with social scoring. And transparency obligations under Article 50 — informing workers when they are being assessed by an AI system — took effect on 2 August 2026.

High-risk obligations, including risk assessments, human oversight, technical documentation and worker notification before deployment, were rescheduled by the Digital Omnibus package. For standalone systems, which covers most workplace monitoring tools, they now apply from 2 December 2027.

Canada and Australia in brief

Canada is a patchwork. Federally regulated sectors fall under PIPEDA; British Columbia, Alberta and Quebec have their own statutes, with Quebec’s Law 25 the strictest. Ontario requires employers with 25 or more employees to maintain a written electronic monitoring policy — a disclosure obligation, not a restriction on what may be monitored.

Australia sets rules at state level. New South Wales has the most specific framework under the Workplace Surveillance Act 2005: at least fourteen days’ written notice before surveillance begins, an outright prohibition in change rooms and bathrooms, and court authority required for covert surveillance.

What is never legal, anywhere

Short list, and it is worth knowing because it is the same everywhere:

• Monitoring in bathrooms, change rooms and similar facilities
• Monitoring an employee’s off-duty activity on their personal devices
• Covert monitoring without a specific investigative justification
• Using monitoring to interfere with protected activity, including discussing wages and working conditions with colleagues
• AI inference of emotional state at work, in the EU

Covert monitoring is the one of these that gets argued about rather than simply avoided, and the argument is as much an ethical question as a legal one — we have set out our own position in is stealth monitoring ethical.

If you are the employee: what you can ask for

About half the people searching this question are not implementing monitoring. They are on the receiving end of it.

What you are generally entitled to:

• To know whether monitoring happens, in the four notice states and across the EU, UK, Canada and Australia
• To decline monitoring software on a personal device, in most jurisdictions
• To have monitoring confined to work hours and work equipment
• Not to be monitored in bathrooms or change rooms
• Under GDPR, to access the data held about you, correct it, and object to processing

What you are generally not entitled to:

• Privacy on a company device during work hours
• Advance consent, in most US states
• Knowing exactly when a screenshot was taken, unless the tool shows it

Practical step if you suspect undisclosed monitoring: ask HR for the written monitoring policy. Employers in the four notice states, and across the EU, UK, Canada and Australia, are required to have one. The absence of a policy is itself informative. Separately, there are technical signs worth knowing — we cover them in how employees can tell if they are being monitored.

How to build a monitoring program that holds up

Six practices that reduce risk in every jurisdiction covered here. They are general risk reduction, not a compliance checklist or a safe harbour.

1. Give written notice before monitoring starts, everywhere — including where it is not required. It is the single cheapest protection available.
2. Do not rely on consent in the EU or UK. Document a legitimate interest assessment instead.
3. Collect only what the stated purpose needs. Continuous keystroke logging and unrestricted screen recording are hard to defend.
4. Document proportionality for systematic monitoring, even where no assessment is formally required.
5. Avoid emotion and biometric inference features entirely. Banned in the EU, scrutinised increasingly elsewhere.
6. Set retention limits and give employees a route to access or deletion.

Our free company forms and policies section includes templates for the written policy in point one, and our guide to how to monitor employees without being overly intrusive covers the proportionality question in points three and four.

Sources

Legislative records, checked against the legislatures’ own trackers:

• California AB 1221, Workplace surveillance tools — failed, last action 2 February 2026
• California AB 1331, workplace surveillance in employee-only areas — failed on the Senate floor
• Maine LD 61, An Act to Regulate Employer Surveillance to Protect Workers — enacted without the Governor’s signature
• Colorado HB 24-1058, Protect Privacy of Biological Data — signed 17 April 2024, in force 7 August 2024

Statutes, cases and regulator guidance:

• Electronic Communications Privacy Act, 18 U.S.C. §§ 2510–2522
• Stored Communications Act, 18 U.S.C. §§ 2701–2712
• Computer Fraud and Abuse Act, 18 U.S.C. § 1030
• Fraser v. Nationwide Mutual Insurance Co., 352 F.3d 107 (3d Cir. 2003)
• Conn. Gen. Stat. § 31-48d
• Del. Code tit. 19, § 705
• N.Y. Civil Rights Law § 52-c
• 26 MRS § 620-A
• Illinois Biometric Information Privacy Act, 740 ILCS 14
• Cothron v. White Castle System, Illinois Supreme Court
• Texas Capture or Use of Biometric Identifier Act, Bus. & Com. Code ch. 503
• Washington biometric identifiers statute, RCW 19.375
• Regulation (EU) 2016/679, the General Data Protection Regulation
• Regulation (EU) 2024/1689, the EU Artificial Intelligence Act
• European Data Protection Board guidance on data processing at work
• Information Commissioner’s Office, guidance on monitoring workers
• Netherlands Works Councils Act
• New South Wales Workplace Surveillance Act 2005

The remaining entries are cited by title, chapter and section rather than by URL: the state code sites and the court reports move their pages, and a link that breaks is worse than a citation a lawyer can follow.

Legal information and version history

This article is general information about how employee monitoring is regulated. It is not legal advice, it does not cover every jurisdiction, and it does not account for the particular facts of any employer or employee. Reading it does not create a lawyer–client relationship with Monitask.

Law in this area changes often, and several items described here have scheduled commencement dates that may move. Confirm your own position with counsel qualified in the relevant jurisdiction before acting on anything in this article.

Reliable employee tracking software. Clear visibility and insights into how employees work. Even remotely.
Try Monitask free for 10 days