Employee monitoring laws let your employer track most of what you do on company-owned computers, phones, networks, and vehicles, as long as it has a legitimate business reason or your consent — but federal wiretap rules, the National Labor Relations Act, state notification statutes, and privacy protections for restrooms, personal accounts, and off-duty conduct all set hard limits. Crossing those limits can cost an employer statutory damages of $10,000 or more per worker, plus attorney fees.1Office of the Law Revision Counsel. 18 U.S.C. 2520 – Recovery of Civil Damages Authorized
What Your Employer Can Monitor on Company Systems
The main federal statute is the Electronic Communications Privacy Act, 18 U.S.C. §§ 2510–2523. It makes intentional interception of wire, oral, or electronic communications a crime unless a statutory exception applies.2Office of the Law Revision Counsel. 18 U.S.C. 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Two exceptions do almost all the work in the workplace.
The first is the provider exception in 18 U.S.C. § 2511(2)(a)(i). Anyone operating a communication service can intercept communications during the ordinary course of business when doing so is necessary to render the service or protect the provider’s rights and property.3Office of the Law Revision Counsel. 18 U.S.C. 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Because most employers run their own email servers, phone systems, and internal networks, courts have used this exception to allow monitoring of communications carried over company infrastructure. Federal courts have read “ordinary course of business” to require a legitimate business purpose, routine rather than targeted monitoring, and some form of notice to the employee.
The second is consent, under 18 U.S.C. § 2511(2)(d). Interception is lawful when one party to the communication agrees to it, as long as the recording isn’t being done to commit a crime or a tort.2Office of the Law Revision Counsel. 18 U.S.C. 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Employers usually secure that consent through signed employment agreements, onboarding acknowledgments, or acceptable-use policies that you accept by continuing to use company systems. Consent can be explicit, like a signed form, or implied, like using a system after receiving a clear notice banner. That’s why the monitoring policy you clicked through during orientation carries real legal weight — it often provides the employer’s strongest defense.
The practical result: on company equipment where clear policies are in place, courts almost never find a reasonable expectation of privacy. If your employer’s written policy says company laptops, phones, and networks may be monitored, you cannot credibly argue you expected privacy on those systems. Courts will, however, look at whether the employer stayed inside the scope of its disclosed monitoring. An employer whose policy covers email review for security purposes but then digs through an employee’s private medical correspondence may face liability for reaching past its stated justification.
Stored Email and Personal Accounts
The ECPA also contains the Stored Communications Act at 18 U.S.C. §§ 2701–2712. While the wiretap provisions cover messages in transit, the Stored Communications Act protects messages sitting in an inbox or archive, and it criminalizes intentionally accessing stored electronic communications without authorization.4Office of the Law Revision Counsel. 18 U.S.C. 2701 – Unlawful Access to Stored Communications
The employer that provides the email service is authorized to access stored communications on its own platform. So if your employer hosts the mail server, it can read messages stored there. Where employers get into trouble is opening a personal email account or a private messaging service that happens to be logged in on a company device. That access falls outside the provider exception and can trigger penalties of up to five years in prison for a first offense committed for commercial advantage or in furtherance of another crime.4Office of the Law Revision Counsel. 18 U.S.C. 2701 – Unlawful Access to Stored Communications
About 27 states go further and prohibit employers from demanding or requesting login credentials for personal social media accounts. Employers can still set policies restricting personal social media use on company time and company devices, and they can monitor publicly available posts. What they generally cannot do is demand passwords, shoulder-surf login screens, or use administrative tools on the company network to reach into private accounts.
Video Surveillance and Camera Placement
No single federal statute specifically governs workplace video cameras. Employers have wide discretion to install cameras in common areas like hallways, entrances, loading docks, and open office floors, where workers have little expectation of privacy. The limits come from where cameras cannot go.
Restrooms, locker rooms, and changing areas carry a privacy expectation so strong that camera placement in them is unlawful in virtually every jurisdiction, even with a warning sign. Courts have consistently held that advance notice doesn’t cure the violation. Some jurisdictions extend similar protection to employee lounges or break rooms used for rest, though this varies by state.
Audio Recording
Audio raises higher hurdles than video because it directly triggers wiretap laws. Federal law follows the one-party-consent rule, but a significant minority of states require every party to a conversation to consent before it can be recorded. In those all-party-consent states, an employer cannot record workplace conversations, even on its own premises, without the knowledge and agreement of everyone captured. Violations can carry both criminal prosecution and civil liability.
Even in one-party-consent states, audio recording is not permitted everywhere. Capturing conversations in areas with a reasonable expectation of privacy — closed offices during confidential discussions, restrooms, medical consultation rooms — can cross the line regardless of the state’s consent rule.
GPS and Location Tracking
No single federal statute governs private employers’ use of GPS. The Supreme Court’s decision in United States v. Jones applied to law enforcement, so employer GPS tracking is governed largely by state law and general privacy principles. The prevailing rule is that an employer can track a vehicle it owns for legitimate business purposes: fleet management, route verification, driver safety, and theft prevention all qualify.
Notice is the wrinkle. Some states now require employers to give advance written disclosure before tracking company vehicles with employees behind the wheel, even though the employer owns the vehicle. Tracking a worker’s personal vehicle or personal phone without consent is far riskier and likely to draw claims under state privacy laws. If you use your own car or phone for work, check whether your employer’s tracking extends to personal devices and whether you actually consented to that in your employment agreement.
Biometric Data and Wearables
Wearable devices in warehouses, distribution centers, and healthcare settings can capture biometric data such as heart rate, body temperature, gait patterns, and location within a facility. When these devices collect information about your physical or mental condition, the collection may qualify as a medical examination or disability-related inquiry under the Americans with Disabilities Act. The ADA restricts such inquiries to situations that are job-related and consistent with business necessity, and the standard applies to all employees, not just those with known disabilities.
Employers cannot use health metrics from wearables to infer conditions like pregnancy or chronic illness and take adverse action based on those inferences. Workers who cannot use a wearable due to a disability or pregnancy-related condition are entitled to reasonable accommodations, including alternative monitoring methods. Any health data collected must be kept confidential and stored separately from general personnel files.
A growing number of states have also enacted biometric privacy laws that require informed consent before an employer collects fingerprints, facial scans, or other biometric identifiers. These laws often impose per-violation penalties that add up quickly across a large workforce. If your employer uses fingerprint scanners for time clocks or facial recognition for facility access, the legality depends heavily on where you work and whether proper consent procedures were followed.
Union Activity and Protected Concerted Activity
The National Labor Relations Act creates a limit on monitoring that applies to every private-sector workplace, union or not. Section 7 guarantees employees the right to engage in concerted activity — discussing wages, working conditions, and organizing — and Section 8(a)(1) makes it an unfair labor practice for employers to interfere with those rights.5National Labor Relations Board. Interfering with Employee Rights
Employers cannot spy on employees’ union activities, photograph or videotape workers engaged in peaceful protected activity, or create the impression that they are conducting surveillance on organizing efforts.5National Labor Relations Board. Interfering with Employee Rights The Board distinguishes between a supervisor who happens to see open union activity in a common area, which is not spying, and one who goes out of the ordinary way to observe it, which is unlawful surveillance. Coercively questioning employees about their union sympathies can also violate the Act depending on who is asking, where, how, and whether other unfair practices have occurred. Pointing a camera at a break room where employees are discussing working conditions, or recording a union meeting in the parking lot, can constitute unlawful surveillance regardless of the stated security purpose.
In October 2022, the NLRB General Counsel issued a memo proposing that electronic surveillance and algorithmic management should be treated as a presumptive violation of the Act when, viewed as a whole, they would tend to interfere with a reasonable employee’s ability to engage in protected activity.6National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices Under that proposed framework, employers whose monitoring outweighs Section 7 rights would be required to disclose the specific technologies in use, why they’re being used, and how the collected data is applied.
Remote Work and Personal Devices
The federal framework doesn’t change because you work from a kitchen table instead of a cubicle. On company-issued equipment, an employer generally keeps the same monitoring authority it has in the office, provided it gives adequate notice and obtains consent.
Personal devices are harder. An employer generally cannot force you to install monitoring software on a personal phone or laptop without explicit written consent, and even with consent, the scope must be clearly defined. Vague or open-ended consent provisions are more vulnerable to legal challenge than specific, limited ones. Monitoring should not extend to non-working hours. Several states protect employees from adverse action based on lawful off-duty conduct, and tracking what a remote worker does on personal time — even on a company device — can cross that line. System-wide security measures like firewalls and virus scanning that don’t target individual behavior are usually treated differently from keystroke loggers or screenshot tools aimed at measuring one person’s productivity.
If your employer asks you to install monitoring software for remote work, read exactly what it tracks, on what schedule, and whether it distinguishes between work hours and personal time.
State Notification Requirements
Federal law sets the floor, and a handful of states add their own requirements. About four states currently have formal statutes requiring employers to notify workers before conducting electronic monitoring. The specifics vary, but the common structure is a written notice describing the types of monitoring in use, often posted in a visible workplace location and acknowledged by the employee. Fines for noncompliance can range from $500 for a first violation to several thousand dollars for repeat offenses.
Even in states without a notification statute, workers still have protections through federal wiretap law, common-law privacy torts, and constitutional principles. The number of states adopting monitoring-related notification laws continues to grow, so checking your own state’s current rules is worth the effort.
Penalties When Monitoring Crosses the Line
Violating the federal wiretap law carries both criminal and civil consequences. Intentional interception can result in up to five years in federal prison.2Office of the Law Revision Counsel. 18 U.S.C. 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
On the civil side, any person whose communications were unlawfully intercepted can sue. A court may award whichever is greater: actual damages plus any profits the violator gained, or statutory damages calculated at $100 per day of violation or $10,000, whichever of those two figures is higher.1Office of the Law Revision Counsel. 18 U.S.C. 2520 – Recovery of Civil Damages Authorized That floor means a worker who cannot prove specific financial harm still walks away with at least $10,000 if the monitoring was unlawful. Attorney fees and litigation costs are recoverable on top of damages. State biometric privacy laws and state wiretap statutes add their own per-violation penalties, which can stack across a workforce.
If you think monitoring at your workplace has gone past what your employer disclosed or what the law allows, keep a record of the policy you signed, note what was actually monitored and when, and consider filing an unfair labor practice charge with the NLRB if the surveillance touched protected concerted activity. For wiretap or stored communications claims, an employment lawyer in your state can tell you whether the interception fits an exception or opens the door to statutory damages.