Electronic surveillance laws in the United States are a layered system: the federal Wiretap Act (18 U.S.C. §§ 2510–2522) governs real-time interception of calls, emails, and other electronic communications; the Electronic Communications Privacy Act and its Stored Communications Act cover data held by providers; the Foreign Intelligence Surveillance Act handles national-security monitoring; and a separate statute regulates pen registers and metadata collection. Consent rules decide when private recording is legal, and workplace exceptions give employers wide latitude when they give clear notice. Unauthorized interception carries up to five years in prison and civil damages starting at $10,000.
What the Wiretap Act Prohibits
The Wiretap Act bars intercepting phone calls, voice-over-internet conversations, emails in transit, and other electronic communications without authorization. It applies to government agents and private individuals alike, so a neighbor can violate it as easily as a federal agent can. The statute also prohibits manufacturing or distributing devices designed primarily for covert eavesdropping.1Office of the Law Revision Counsel. 18 USC Chapter 119 – Wire and Electronic Communications Interception and Interception of Oral Communications
Evidence obtained through an illegal wiretap cannot be used. The exclusionary rule under the Act keeps intercepted communications out of any trial, hearing, or government proceeding when the interception violated the statute.2Office of the Law Revision Counsel. 18 USC 2515 – Prohibition of Use as Evidence of Intercepted Wire or Oral Communications
When the Government Can Intercept Communications
Court-Ordered Wiretaps
For a criminal investigation, law enforcement needs what is sometimes called a “super warrant.” The application must show probable cause that a specific felony listed in the statute is being committed, that the interception will capture communications about that crime, and that normal investigative techniques have already failed or would be too dangerous to attempt. The order has to identify the specific communications and the people targeted.3Office of the Law Revision Counsel. 18 USC 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications
Emergency Interceptions
The Wiretap Act creates a narrow emergency exception for three situations: immediate danger of death or serious physical injury, conspiracies threatening national security, and organized crime activity. A specially designated officer who reasonably determines that one of these emergencies exists can authorize interception without a prior court order. An application for a court order must then be filed within 48 hours. If the court denies approval, the interception stops immediately and any communications captured are treated as illegally obtained.3Office of the Law Revision Counsel. 18 USC 2518 – Procedure for Interception of Wire, Oral, or Electronic Communications
Foreign Intelligence Surveillance
Surveillance aimed at gathering foreign intelligence runs under FISA, not the Wiretap Act. The Foreign Intelligence Surveillance Court holds secret proceedings where only the government appears. To obtain an order, the Department of Justice must show probable cause that the target is a foreign power or an agent of one, and that a significant purpose of the surveillance is to obtain foreign intelligence. Agents do not need to show that a crime is being committed.4Bureau of Justice Assistance. The Foreign Intelligence Surveillance Act of 1978
The President may authorize surveillance without a FISA order for up to one year, but only when the Attorney General certifies that the monitoring is directed solely at communications between foreign powers and there is no substantial likelihood of capturing communications involving a U.S. person.4Bureau of Justice Assistance. The Foreign Intelligence Surveillance Act of 1978
Access to Stored Emails and Cloud Data
The Electronic Communications Privacy Act extended protection beyond real-time interception to cover emails on a server, files in cloud storage, and other digital records held by service providers.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 Its Title II, the Stored Communications Act, sets different access thresholds depending on what the government wants.
To obtain the contents of an email or other electronic communication held by a provider for 180 days or less, law enforcement must get a warrant based on probable cause. Cloud storage and remote computing services face the same warrant requirement when the government seeks message contents. Non-content records such as metadata, which reveal the timing, duration, and routing of communications, can be obtained with a lower-threshold court order or a subpoena, depending on the circumstances.6Congressional Research Service. Overview of Governmental Action Under the Stored Communications Act
The warrant must meet the same constitutional standard as any criminal search warrant: a sworn statement establishing probable cause, a particular description of the crime, and approval by an independent judge.7U.S. Department of Justice. The Purpose and Impact of the CLOUD Act – FAQs
Metadata Collection and Location Tracking
Pen Registers and Trap-and-Trace Devices
A pen register records outgoing dialing information; a trap-and-trace device captures incoming call data. Both collect metadata rather than content. Federal law prohibits installing either device without a court order, but the standard is significantly lower than for a wiretap: the government essentially needs to show the information is relevant to an ongoing investigation, not probable cause of a crime. Agencies must use equipment that captures only dialing, routing, and signaling information. Installing one of these devices without a court order carries up to one year in prison.8Office of the Law Revision Counsel. 18 USC 3121 – General Prohibition on Pen Register and Trap and Trace Device Use
Cell Phone Location Data
Your phone constantly communicates with nearby cell towers, generating records that can reconstruct where you’ve been over days, weeks, or months. In Carpenter v. United States (2018), the Supreme Court held that the government needs a warrant supported by probable cause before accessing historical cell-site location information. People have a reasonable expectation of privacy in their long-term movements even when the data is held by a phone company, and a lower-threshold court order under the Stored Communications Act is not enough.9Justia US Supreme Court. Carpenter v. United States, 585 US (2018)
The ruling narrowed the third-party doctrine, which had allowed the government to obtain records you shared with a business without a warrant. The Court noted that cell-site data is different from other business records because it is generated automatically, without any affirmative act by the user, and can reveal deeply personal information. Case-specific exceptions such as exigent circumstances may still justify a warrantless search.9Justia US Supreme Court. Carpenter v. United States, 585 US (2018)
Consent Rules for Recording Conversations
Whether you can legally record a conversation depends almost entirely on consent. Federal law allows recording if at least one person in the conversation agrees, meaning you can record your own calls and in-person discussions without telling the other person. The recording cannot be made for the purpose of committing a crime or a tort.10U.S. Department of Justice. Criminal Resource Manual 1055 – Exceptions to the Prohibitions – Other Consensual Interceptions
Roughly a dozen states go further and require every party to consent. If you’re on a phone call with someone in one of those states, that state’s law may apply even if yours follows the one-party rule. Violating an all-party consent law can result in felony charges and substantial civil damages.
Consent requirements generally apply only where the people being recorded have a reasonable expectation of privacy. Courts look at the totality of the circumstances: where the conversation happened, how loud the speakers were, and whether bystanders could overhear. A conversation on a busy sidewalk usually carries no expectation of privacy. A conversation inside someone’s home carries the strongest one. Recording in a public place at normal volume generally doesn’t trigger consent requirements; pulling someone into a private office and closing the door does.
Criminal and Civil Penalties
Criminal penalties for unauthorized interception under the Wiretap Act reach up to five years in prison.11Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Under the federal sentencing statute, fines for an individual convicted of a felony can run as high as $250,000.12Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
On the civil side, anyone whose communications were illegally intercepted can sue for the greater of actual damages plus the violator’s profits, or statutory damages of $10,000 or $100 per day of violation, whichever amount is larger. Punitive damages and attorney’s fees are also available in appropriate cases.13Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized State penalties vary widely and may be more severe in all-party consent jurisdictions.
Workplace Monitoring
What Employers Can Monitor
The Wiretap Act includes an exception for providers of communication services who intercept in the normal course of operations, and courts have extended this reasoning to employers who furnish telephones and computer systems to their workforce.5Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 Employers can monitor email, internet usage, and phone calls on company equipment when the monitoring serves a legitimate business purpose.
Employees using corporate devices have a diminished expectation of privacy. Courts routinely uphold an employer’s right to review stored emails on company servers, track web browsing on company laptops, and log software usage. A clear written policy that explains exactly what is monitored, distributed before monitoring begins and acknowledged in writing, is the strongest legal footing. Monitoring personal communications on company equipment without a business justification can still create liability; if an employer intercepts a clearly personal call and keeps listening after realizing it has nothing to do with work, the business-purpose exception may not protect them.
Video Cameras
Employers generally can install visible cameras in common work areas for security and productivity purposes, as long as employees are notified. Cameras in restrooms, locker rooms, and changing areas are prohibited. That’s not just civil liability territory. Recording in those spaces can result in criminal charges under state law.
BYOD and Personal Devices
Personal devices used for work sit in a gray area. No comprehensive federal statute directly addresses how far an employer can reach into an employee’s personal phone or laptop. The terms of the BYOD agreement do most of the work. A well-drafted policy typically covers the employer’s right to remotely wipe the device, access work-related data, and review the device during legal discovery. Signing that agreement likely waives the privacy protections you’d otherwise have. Without an agreement, an employer’s ability to access personal-device data is far more limited, and doing so without consent could trigger Wiretap Act or Stored Communications Act violations.
Remote Work
Remote employees are subject to the same federal surveillance laws as in-office workers. Employers increasingly use software that logs keystrokes, captures screenshots at intervals, tracks mouse movement, and even activates webcams. The legitimate business purpose requirement still applies. Monitoring work activity on a company-issued laptop during work hours is defensible. Activating a webcam that captures a remote worker’s living room, children, or personal conversations pushes into territory that may lack any business justification. Courts have reached inconsistent conclusions about whether keystroke logging even qualifies as an “interception” under the Wiretap Act, since many loggers store data locally rather than capturing it during transmission.
Biometric, AI, and GPS Monitoring at Work
Employers are deploying tools that go beyond traditional monitoring: biometric systems that scan fingerprints, faces, or retinas for timekeeping and access; AI-powered tools that analyze facial expressions, voice tone, email language, and typing cadence. No comprehensive federal law regulates these specific technologies in the workplace, and protections come from a patchwork of existing authorities.
The EEOC has identified AI-driven workplace surveillance as an enforcement concern. Federal anti-discrimination laws apply even when an employer uses automated systems to screen or monitor workers. If an AI tool disproportionately flags employees of a particular race, age, or disability status, the employer may face discrimination claims regardless of whether the algorithm was designed to be neutral.14U.S. Equal Employment Opportunity Commission. Employment Discrimination and AI for Workers The FTC approaches biometric data through its authority over unfair and deceptive trade practices, flagging concerns about inadequate disclosure, weak security, inaccurate or discriminatory results, and unsubstantiated bias-free claims.15Federal Trade Commission. Policy Statement on Biometric Information and Section 5 of the Federal Trade Commission Act A growing number of states have their own biometric privacy laws, but no single federal biometric privacy statute exists yet.
The National Labor Relations Act adds another limit. The NLRB General Counsel has taken the position that electronic surveillance tools, including cameras, GPS trackers, keystroke loggers, and screenshot software, presumptively violate the Act when they would tend to discourage a reasonable employee from exercising the right to organize. Even where a legitimate business need outweighs employee rights, the proposed framework would require the employer to disclose what technologies it uses, why, and how it handles the data. Secret surveillance to monitor union organizing activity is where employers get into the most trouble; recording workers’ conversations about wages, working conditions, or unionization can violate the NLRA even when the employer owns the equipment and has a general monitoring policy.16National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices
No specific federal statute governs employer use of GPS on vehicles or through employee phones. Tracking a company-owned vehicle during work hours is widely considered permissible, especially with a written policy disclosing the practice. Tracking an employee’s personal vehicle raises serious privacy concerns under state law. The reasoning of Carpenter, though it addressed government surveillance, informs this area: continuous location tracking reveals intimate details about a person’s life, so employers who track company vehicles around the clock, including weekends and vacations, operate in riskier territory than those who limit tracking to work shifts.