Employee monitoring laws in the United States give employers wide authority to watch what workers do on company equipment, and much narrower authority everywhere else. The Electronic Communications Privacy Act of 1986 sets the federal floor: intercepting communications is generally prohibited, but two exceptions—one for companies operating their own systems, one for consent—cover almost every workplace monitoring program in existence. What keeps the picture from being one-sided is a growing set of state notice rules, private-space protections, biometric statutes, labor law limits on surveillance that chills organizing, and emerging rules around AI-driven decisions.
What Federal Law Actually Allows
Two exceptions inside the federal Wiretap Act do most of the work.
The first is the provider exception. Under 18 U.S.C. § 2511(2)(a), a company that provides its own communication services to employees can monitor those communications when doing so is a normal part of operating the service or protecting the company’s rights and property.1Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Company email servers, internal messaging platforms, and phone systems all fit. The exception does not authorize random monitoring of personal calls on company phones that have no connection to the business.
The second is the consent exception. Section 2511(2)(d) makes interception lawful when at least one party to the communication has given prior consent.1Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Employers satisfy this through a monitoring disclosure in the handbook or an IT acceptable-use policy that workers sign at hiring. Courts have consistently held that continued use of company systems after clear notice also counts as implied consent, even without a signature.
There is also a separate rule for data at rest. Title II of the ECPA, the Stored Communications Act at 18 U.S.C. § 2701, makes it a crime to intentionally access stored electronic communications without authorization.2Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications Accessing emails or files on company-provided systems is generally fine when authorized by company policy. Accessing an employee’s personal email account or private cloud storage without permission is not.
When an employer crosses these lines, employees can sue under 18 U.S.C. § 2520. Statutory damages are the greater of $100 per day of violation or $10,000, so $10,000 is effectively the floor even for a brief violation. Courts can also award actual damages, the violator’s profits, punitive damages, and attorney’s fees.3Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized The statute of limitations is two years from the date you first had a reasonable opportunity to discover the violation.
What Employers Can Watch on Company Systems
Once the provider or consent exception is in place, the range of tools available to an employer is broad. Everything below runs on company-owned equipment or networks, which is what makes it legally straightforward.
- Email and messaging sent through a company address or internal chat platform. Employers routinely archive and review these for compliance, litigation holds, and policy enforcement.
- Web browsing on the company network. Employers can see every site you visit and how long you spend on each. Content filters block certain categories and log the attempts.
- Keystroke logging and screen capture. Software that records what you type or takes periodic screenshots is standard in industries handling sensitive data. Some tools capture continuous video of your screen through the workday.
- GPS on company phones and vehicles. Fleet management systems track location, mileage, and routes to verify business use.
- Productivity metrics. Active versus idle time, application usage, and task completion rates feed into performance reviews and workforce planning.
None of this requires more than the consent or provider exception. The legal work happens at the notice-and-consent stage, not when the monitoring begins.
Video and Audio Follow Different Rules
This is one of the most misunderstood areas of workplace surveillance, and getting it wrong can produce criminal liability rather than a policy problem.
Silent video in common areas—hallways, warehouses, retail floors, parking lots—is largely unregulated at the federal level. The Wiretap Act targets interception of communications, and a camera with no microphone does not capture communications. Employers use video extensively for loss prevention, safety, and security without triggering federal wiretap law at all.
Audio is different. The moment a camera records sound, it captures oral communications, and the Wiretap Act applies. Federal law needs only one party’s consent, but a majority of states have their own recording laws, and roughly a dozen require all-party consent. Every person in the conversation must agree. An employer who installs cameras with active microphones in an all-party-consent state without getting everyone’s agreement risks criminal charges under state law, even where federal law would allow the recording.
The safe practice is to keep microphones off unless there is a specific, documented reason for audio and consent from all parties in jurisdictions that require it.
Where Monitoring Is Off-Limits
Some spaces stay off-limits no matter how broad the monitoring policy. Restrooms, locker rooms, changing areas, and nursing rooms are areas where employees have a reasonable expectation of privacy, and cameras or microphones in those spaces expose employers to criminal prosecution for invasion of privacy and substantial civil liability. A signed consent to monitoring in work areas does not extend to spaces designed for personal privacy.
Off-duty life sits outside permissible monitoring in most situations. If you are not using company equipment or doing job-related work, your movements, communications, and internet activity remain your own. Courts draw a hard line: surveillance that reaches into an employee’s private life without a direct business connection will generally be found unlawful. The exception is when company property is involved—an employee using a company laptop at home, for example, where monitoring of the company’s own device remains defensible.
State Notice and Privacy Requirements
Federal law does not require employers to tell you they are monitoring before they start. The consent exception runs through policy acknowledgments, but the ECPA itself imposes no standalone notice mandate. States have stepped in to fill parts of that gap.
A small number of states, currently four, require employers to give written notice before beginning electronic monitoring. The specifics vary. Some require notice at hiring, others require a conspicuous posting in the workplace, and at least one lets employers choose between a one-time written notice and a daily electronic reminder each time an employee logs in. Penalties are relatively modest, typically starting at a few hundred dollars for a first offense and scaling up for repeats, but they give employees a concrete procedural right that federal law does not.
The bigger shift is comprehensive data privacy legislation. California requires employers to give employees a detailed “notice at collection” specifying what categories of personal information are gathered, the purpose for each, and how long the data will be retained. California employees can request a copy of their collected data, which the employer must provide within 45 days, and can request deletion of certain personal information, though employers can retain what they need for legal compliance or ongoing employment.4California Privacy Protection Agency. What General Notices Are Required by the CCPA Other states are moving in this direction.
Remote Work and Personal Devices
The shift to remote and hybrid work pushed monitoring tools into employees’ homes. The federal framework still applies, but the practical boundaries get blurry.
When you work remotely on a company-issued laptop, your employer keeps the same monitoring authority it would have in the office. Keystroke loggers, screen capture, productivity trackers, and web filters all run on company hardware regardless of where it sits. Some employers add webcam monitoring that periodically takes photos or records video to verify the employee is at their workstation. That is legally defensible under federal law when disclosed in a monitoring policy, though it pushes against privacy norms in ways office surveillance does not, because the camera is now in someone’s home.
Personal devices are a different matter. The Computer Fraud and Abuse Act prohibits unauthorized access to computer systems, and an employer that installs monitoring software on your personal phone or laptop without permission faces potential liability. Bring-your-own-device policies try to bridge the gap by getting advance consent to monitor work-related activity on personal hardware, but the scope of that consent matters. A BYOD agreement authorizing the employer to monitor “all activity” on a personal device likely overreaches. One limited to company applications and data has a stronger legal footing. If your employer runs a BYOD program, read the agreement carefully; it defines what you have consented to.
Biometric Data
Fingerprint scanners for timekeeping, facial recognition for building access, and retina scans for secure areas are now common. Biometric data involves permanent biological identifiers that cannot be changed if compromised, and a growing number of states treat it accordingly.
There is no comprehensive federal biometric privacy law. The landscape is state-driven and evolving. A handful of states have enacted specific biometric privacy statutes that typically require written notice of what data will be collected, informed consent before collection, retention and deletion schedules, and protection from unauthorized disclosure. Statutory damages can reach $1,000 per negligent violation and $5,000 per intentional or reckless violation, and class actions involving large workforces have produced settlements in the hundreds of millions of dollars.
Even in states without dedicated biometric laws, general privacy principles and breach notification statutes create some protection. If your employer asks you to scan a fingerprint or submit to facial recognition, you should get a written policy explaining the program before you provide any biometric data. The absence of one is a warning sign, not a gap to fill with assumptions.
AI-Driven Monitoring and Discrimination Risk
Traditional monitoring captures raw data. Newer tools use artificial intelligence to analyze it and make or recommend employment decisions—flagging workers as “low productivity,” recommending termination, or screening applicants through automated assessments. That creates legal risks beyond privacy.
Title VII of the Civil Rights Act prohibits employment practices that have a disparate impact on protected groups, even when the bias is unintentional. If an AI monitoring tool disproportionately flags employees of a particular race, gender, or age group as underperforming, the employer faces discrimination liability regardless of whether the algorithm was designed to be neutral.5U.S. Equal Employment Opportunity Commission. What Is the EEOC’s Role in AI The employer is on the hook even when a third-party vendor built and operates the tool. Some states have begun enacting AI accountability laws requiring risk assessments and anti-discrimination audits for AI systems used in employment decisions.
Monitoring and Union or Organizing Activity
The National Labor Relations Act guarantees private-sector employees the right to join together to improve wages, benefits, and working conditions, with or without a union.6Office of the Law Revision Counsel. 29 USC 157 – Rights of Employees Surveillance that interferes with those rights is an unfair labor practice.
In October 2022 the NLRB General Counsel issued a memo targeting electronic surveillance and automated management practices that chill protected activity. The proposed framework treats monitoring as presumptively unlawful when an employer’s surveillance practices, viewed as a whole, would tend to interfere with a reasonable employee’s ability to engage in protected organizing or collective action.7National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices That includes GPS badges, wearable devices, keyloggers, and webcam software when used in ways that let employers identify who is talking to organizers or joining collective action. Even when the monitoring has a legitimate business justification, the framework would require disclosure of what technologies are in use, why, and what the employer does with the data. It applies to all private-sector employers covered by the NLRA, not just unionized workplaces.
What to Do If Monitoring Crosses a Line
If you believe your employer’s surveillance is unlawful, early steps matter more than later ones. Document what monitoring you have observed, when you noticed it, whether you received prior notice, and whether a written policy exists. Preserve copies of policies, handbook pages, and consent forms you signed.
Your remedies depend on which law was broken. For federal wiretap violations, you have a private right of action under 18 U.S.C. § 2520 with a two-year statute of limitations and a $10,000 statutory damages floor.3Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized For state recording or biometric violations, remedies vary but often include statutory damages per violation, which can add up quickly in a class action. If the monitoring interferes with organizing or other protected concerted activity, you can file an unfair labor practice charge with the NLRB, which investigates at no cost to you.7National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices
A signed monitoring policy does not automatically make every form of surveillance legal. Consent to email monitoring on a company laptop does not authorize hidden cameras in a break room or access to your personal iCloud account. Employers sometimes treat a broad policy acknowledgment as a blank check, and courts do not agree. If the monitoring exceeds what the policy described, or reaches spaces or devices it should not, the consent may not hold.