Employee Privacy Laws: Monitoring, Background Checks, and Penalties

Employee privacy laws come from a patchwork of federal statutes, state laws, and common law rules, and they give workers less protection than most people expect. Your employer can generally monitor company systems, search company-owned spaces, and review your public online activity, provided a written policy is in place and you have acknowledged it. The real protections cluster around specific categories: medical and genetic information, biometric data, background check procedures, off-duty conduct in many states, and, for government workers, the Fourth Amendment. Where you stand depends on what the employer is trying to do, what you consented to, and which state you work in.

What Your Employer Can Monitor Electronically

The Electronic Communications Privacy Act is the federal law that governs employer monitoring of email, phone calls, chat platforms, and web activity.¹ On paper it prohibits intercepting communications in transit and accessing stored communications without authorization.² In practice, two exceptions swallow most of the rule.

The consent exception applies when one party to the communication has agreed to interception. When you signed your handbook acknowledging that company systems may be monitored, you gave that consent, and courts have consistently treated those acknowledgments as sufficient. A second exception lets an employer act as the service provider for its own systems in the ordinary course of business.³ Between them, these exceptions mean your employer can read emails sent through company accounts, review messages on company chat tools, log your browsing on company networks, and access messages stored on company servers.²

Personal devices are different. Under a bring-your-own-device arrangement, monitoring authority shrinks. Without explicit consent that specifically covers the personal device, intercepting communications on it can violate the Wiretap Act, and many state privacy laws demand consent that goes well beyond a general handbook signature.

Cameras, Searches, and Location Tracking

Whether surveillance is legal usually turns on whether you have a reasonable expectation of privacy in the space. Cameras in lobbies, warehouses, and production areas are broadly permitted because anyone in the space can already see you. Cameras in restrooms and locker room changing areas are prohibited in virtually every jurisdiction. Break rooms and private offices sit in a gray area governed by state law and company policy.

Searches of desks, lockers, and bags follow the same logic. If your employer has a written policy telling you that company-assigned storage is subject to inspection and you acknowledged it, a court is unlikely to find you had a privacy interest in those spaces. Without a policy, your position is stronger. Even with one, the search must be conducted reasonably; an aggressive or humiliating search can support a claim for intrusion upon seclusion, a common law tort covering invasions of private affairs that a reasonable person would find highly offensive.

GPS on Company and Personal Vehicles

No federal statute specifically addresses employer GPS tracking. For company-owned vehicles, tracking during work hours is broadly permitted when the employer has told you it’s happening. Around-the-clock tracking of a company vehicle you drive home is riskier, and courts have signaled that using off-hours location data to discipline an employee can cross privacy lines. Tracking your personal vehicle is a different matter entirely. Attaching a GPS device to a car you own without your consent is illegal in many states. If your employer asks you to install a location app on your personal phone, you are not obligated to agree without a clear policy and a legitimate business reason.

Medical, Mental Health, and Genetic Information

What the ADA Restricts

The Americans with Disabilities Act tightly controls when your employer can ask about your health. Before a job offer, disability-related questions and medical exams of any kind are off-limits.⁴ After a conditional offer, medical exams are allowed. Once you’re on the job, any medical inquiry or exam must be job-related and consistent with business necessity.⁵

Any medical information the employer collects must be kept in a separate file, apart from your regular personnel records, with access limited to supervisors who need to know about restrictions or accommodations, first aid personnel who may need it in an emergency, and government officials investigating ADA compliance.⁴ Your employer cannot tell coworkers about your condition, even if asked, and cannot disclose that you received a reasonable accommodation, since that alone reveals you likely have a disability.⁶

Mental health information gets the same protection. If you disclose a psychiatric condition to request an accommodation, that record must be stored separately and shared only through the narrow exceptions above.⁶ Even a casual mention of therapy to a manager becomes a confidential medical record once it reaches the employer. The confidentiality obligation attaches the moment the information arrives, regardless of how informally you shared it.

Genetic Information

The Genetic Information Nondiscrimination Act makes it illegal for employers to request, require, or purchase genetic information about you or your family members.⁷ That covers genetic test results, family medical history, and information about genetic services. None of it can be used in hiring, firing, promotions, or any other employment decision.⁸

GINA permits acquisition only in a handful of narrow circumstances: inadvertent disclosures, voluntary wellness programs with specific safeguards, and family history submitted for FMLA leave certification, among a few others.⁹ Outside those exceptions, even asking about a family member’s health at a company function can create liability.

Biometric Data

Fingerprint time clocks, facial recognition for building entry, and retinal scans for secure areas are increasingly common. No federal statute governs their use for general employment purposes. Protection depends entirely on state law, and the landscape is uneven.

A small but growing group of states have enacted biometric privacy statutes. Common features include written notice of the purpose and duration of collection, written consent before a scan, a published retention and destruction policy, and reasonable security measures. The most aggressive of these laws allow individual workers to sue for statutory damages of $1,000 to $5,000 per violation, which has produced very large class action settlements. Other states limit enforcement to the state attorney general and rely on civil penalties instead of private lawsuits.

If your employer starts collecting biometric data without telling you why, how long it will keep the data, and what happens to it when you leave, that silence alone can support a claim in states with biometric laws. Even where no biometric statute exists, ADA confidentiality rules may apply if the biometric data overlaps with medical information.

Background Checks and Criminal History

The FCRA Steps Your Employer Must Follow

When an employer uses a third-party agency to run a background check, the Fair Credit Reporting Act controls the process. Before the report is requested, the employer must give you a written disclosure in a standalone document containing nothing else, stating that a consumer report may be obtained for employment purposes. You then have to provide separate written authorization.¹⁰ Burying the disclosure in a job application or handbook violates the standalone requirement.

If something in the report leads the employer toward a negative decision, a two-step adverse action process kicks in. First comes a pre-adverse action notice that includes a copy of the report and a written summary of your FCRA rights, giving you a chance to dispute inaccuracies before the decision becomes final.¹⁰ The statute doesn’t set a specific waiting period, though the FTC has informally recommended at least five business days. After that gap, the employer sends the final adverse action notice.¹¹

Skipping any of these steps creates liability. For willful noncompliance, statutory damages run from $100 to $1,000 per violation, on top of actual damages, punitive damages, and attorney fees.¹²

Fair Chance Hiring

The Fair Chance to Compete for Jobs Act of 2019 restricts when federal agencies and federal contractors can ask about criminal history. Those employers cannot request the information before making a conditional offer, with exceptions for positions requiring access to classified information, sensitive national security roles, and law enforcement.¹³ Many state and local governments have adopted similar “ban the box” rules for private employers, with wide variation in scope and timing.

Off-Duty Conduct, Social Media, and Marijuana

What You Do on Your Own Time

A majority of states have laws preventing employers from taking adverse action based on your use of lawful products like tobacco outside of work, and many extend similar protection to political activity and affiliations. The underlying principle: an employer can’t control your private life unless your off-duty conduct is directly tied to job performance or a legitimate business interest.

Social Media

Employers can review anything you post publicly without a legal problem. Demanding access to private accounts is the harder question. More than half of states now prohibit employers from requiring applicants or employees to hand over social media login credentials, pull up their accounts in the employer’s presence, or change privacy settings to expose posts.

There is a federal overlay many workers miss. The National Labor Relations Act protects your right to discuss working conditions, pay, benefits, and workplace concerns with coworkers, and social media counts as a venue for that. If you post about unsafe conditions or unfair pay and get fired for it, that termination can violate federal labor law regardless of what the social media policy says. The protection has limits: purely personal gripes unconnected to collective concerns aren’t protected, and posts that are egregiously offensive or deliberately false lose their shield.¹⁴

Recreational Marijuana

Marijuana remains a Schedule I controlled substance under federal law as of 2026, and employees in safety-sensitive positions regulated by the Department of Transportation are still subject to federal drug testing rules that prohibit marijuana entirely. At the state level, the direction is different. A growing number of states prohibit employers from firing or refusing to hire workers solely because of off-duty recreational use or a positive test for non-psychoactive cannabis metabolites. Some carve out exceptions for safety-sensitive roles, federal contractors, and documented on-the-job impairment. Legality and job protection are separate questions, so check both for your state.

AI and Automated Hiring Tools

Employers are using algorithms to screen resumes, evaluate candidates, and monitor productivity. No comprehensive federal law governs these tools in employment, but local rules are emerging. One notable example requires employers using automated decision tools for hiring or promotion to commission an independent bias audit annually, publish the results, and notify candidates that an algorithm will play a role and what data it will use.

Existing laws still apply even without AI-specific legislation. A tool that disproportionately screens out candidates with disabilities can violate the ADA. One that uses genetic or health data runs afoul of GINA. The EEOC has signaled that employers are responsible for discriminatory outcomes from these tools whether they built them or bought them. If you were rejected by an automated system and suspect bias, you can file a charge with the EEOC the same way you would for any other employment discrimination claim.

Government Workers Have Extra Protection

The gap between public and private sector employees is one of the most important divides in workplace privacy law. If you work for a government agency, the Fourth Amendment limits your employer’s ability to search your workspace or monitor your communications. Public employee workplace searches must be reasonable in scope and inception, though no warrant or probable cause is required for routine work-related searches or investigations of misconduct.¹⁵

Private sector employees have no Fourth Amendment protection against their employers, because the Constitution restrains government, not private parties. Your privacy rights in the private sector come entirely from statutes like the ECPA, ADA, and GINA, plus any additional protections your state provides. Private employers generally have more latitude to search workspaces, monitor communications, and review digital activity than government employers, so long as they have an adequate policy and follow the applicable statutes.

Seeing Your Own Personnel File

Your right to inspect what your employer has written about you varies sharply by jurisdiction. Many states give employees the right to inspect their personnel files on request, with employer response deadlines ranging from 7 business days to 45 days. Other states give private-sector employees no access right at all. Where the right exists, it usually covers performance evaluations, discipline records, and other documents used in employment decisions, though some states exclude reference letters and investigation records. If your employer ignores a request, check whether your state imposes penalties for noncompliance; some do, some don’t.

What Employers Face for Violations

Penalties can be substantial. Under the ECPA, an employer who unlawfully intercepts electronic communications faces statutory damages of $100 per day of violation or $10,000, whichever is greater, on top of actual damages, with punitive damages and attorney fees also available.¹⁶ Criminal penalties for willful violations can reach five years in prison.

FCRA willful noncompliance produces $100 to $1,000 in statutory damages per violation, plus punitive damages and attorney fees.¹² Those per-person numbers look modest, but class actions covering thousands of applicants or employees routinely settle for millions. ADA confidentiality violations are enforced by the EEOC and can produce compensatory and punitive damages, with caps based on employer size. GINA violations follow the same enforcement framework and damage structure as ADA claims.⁸

State biometric privacy laws are the highest-risk area at the moment. In states with a private right of action, $1,000 to $5,000 per violation compounds quickly when an employer has been scanning hundreds of employees’ fingerprints daily without proper consent. The potential exposure in biometric cases dwarfs what most other workplace privacy statutes produce.

1
Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986 (ECPA)
2
Office of the Law Revision Counsel. 18 USC 2701
3
Office of the Law Revision Counsel. 18 USC 2511
4
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on Disability-Related Inquiries and Medical Examinations of Employees under the ADA
5
Office of the Law Revision Counsel. 42 USC 12112 – Discrimination
6
U.S. Equal Employment Opportunity Commission. Enforcement Guidance on the ADA and Psychiatric Disabilities
7
U.S. Equal Employment Opportunity Commission. Genetic Information Nondiscrimination Act of 2008
8
U.S. Equal Employment Opportunity Commission. Genetic Information Discrimination
9
U.S. Equal Employment Opportunity Commission. Fact Sheet – Genetic Information Nondiscrimination Act
10
Office of the Law Revision Counsel. 15 USC 1681b
11
Federal Trade Commission. What Employment Background Screening Companies Need to Know About the Fair Credit Reporting Act
12
Office of the Law Revision Counsel. 15 USC 1681n – Civil Liability for Willful Noncompliance
13
U.S. Department of the Interior. Fair Chance to Compete Act
14
National Labor Relations Board. Social Media
15
Justia Law. Government Workplace – Fourth Amendment – Search and Seizure
16
Office of the Law Revision Counsel. 18 USC 2520