Employee Surveillance Laws: Cameras, GPS, and Biometrics

Employee surveillance laws in the United States start from a federal rule that gives employers wide authority to monitor activity on systems they own, then get tightened by a patchwork of state notice requirements, biometric privacy statutes, labor law protections, and, for government workers, the Fourth Amendment. What your employer can legally watch depends less on the technology and more on who owns the device, what state you work in, whether you were told, and whether the monitoring touches protected activity or protected characteristics.

The Federal Baseline

The Electronic Communications Privacy Act of 1986 is the main federal statute governing workplace monitoring. Its wiretap provision at 18 U.S.C. § 2511 generally prohibits intercepting wire, oral, or electronic communications, but two exceptions swallow most of what employers actually do.

The first is the provider exception. Anyone operating a communication service can intercept communications on their facilities when doing so is “a necessary incident to the rendition of his service or to the protection of the rights or property of the provider.”¹ An employer who runs the email server, manages the network, and issues the laptop generally qualifies.

The second is the consent exception. A party to a communication, or someone who has one party’s consent, can intercept it without violating the statute.¹ Most employers satisfy this with a monitoring disclosure in the handbook or onboarding paperwork. Signing the acknowledgment counts as consent under federal law.

The Stored Communications Act, 18 U.S.C. §§ 2701–2712, covers messages already sitting on a server. It bars unauthorized access but exempts the entity providing the communication service.² If your employer hosts your email, they can read stored messages without running afoul of it.

What Employers Can Watch on Company Equipment

On company-issued devices and networks, the range of monitoring tools is broad. Keystroke logging captures every character typed. Screen-capture software takes periodic snapshots. Endpoint monitoring records which applications you open, how long you use them, and what files you transfer. Some systems log clipboard activity to flag when sensitive data gets copied.

Courts consistently treat company hardware as the employer’s domain, and that includes a work laptop connected through a corporate VPN from your kitchen table. The frequent trap is logging into personal accounts on work machines. Personal email or social media checked from a company laptop is likely captured by the same monitoring tools that watch everything else on the device. The account being personal does not override the fact that the device and network belong to your employer.

Cameras, GPS, and Biometrics

Video and Audio

Security cameras in hallways, lobbies, warehouses, and other common areas are generally legal. The limit is reasonable expectation of privacy: restrooms, locker rooms, and changing areas are off-limits, and placing cameras there exposes an employer to civil liability and, depending on the jurisdiction, criminal charges.

Audio is a separate question. Federal law follows a one-party consent rule for recording conversations, but a significant minority of states require all parties to consent.³ That is why most workplace cameras run without sound. An employer who records audio without meeting the applicable consent rule faces liability even where the video itself is fine.

The National Labor Relations Act adds its own limits. Employers cannot use video surveillance to monitor union activities, and in unionized workplaces they must bargain with the union before deploying surveillance systems.⁴

GPS and Location

Employers routinely install GPS trackers in company vehicles, and when the vehicle belongs to the employer, that tracking is broadly permitted under federal law. The picture gets murkier with company-issued phones that go home with workers. No federal statute specifically governs employer GPS tracking; several states have added their own restrictions, and the general trend requires notice before location data is collected. If your employer tracks location through a company phone, that tracking likely continues around the clock unless you power the device off.

Biometric Data

Fingerprint scanners, iris readers, and facial recognition are increasingly used for timekeeping and building access. Biometric data is different from a password: if it leaks, you cannot change your fingerprint. A growing number of states have enacted biometric privacy laws requiring informed consent before collection, retention schedules, and specific destruction protocols, and violations have generated significant class-action litigation.

Remote Work and Personal Devices

The same ECPA framework that governs office monitoring applies to remote workers using company-issued equipment. Your employer can monitor a company laptop in your living room as legally as they can in a cubicle. What home-based monitoring adds is intrusion-upon-seclusion exposure that does not arise in an office, particularly when webcam-enabled software captures a worker’s private living space.

Bring-your-own-device arrangements sit in the most contested territory. Employers typically install mobile device management software that creates a work partition on your personal phone or laptop. The company can monitor that partition, but reaching into personal photos, messages, or private apps outside the container crosses legal lines in many jurisdictions. MDM software does not always stay neatly in its lane, and most employees have no way to verify what is actually being collected. Read the MDM agreement carefully before installing employer software; some grant access well beyond the work partition. Several states have started restricting off-hours monitoring of personal devices.

State Notice and Consent Rules

Federal law is the floor. A growing number of states require employers to notify workers before electronic monitoring begins, typically through written or electronic notice, posted conspicuously and acknowledged by each employee, disclosing that email, internet activity, and phone conversations may be monitored. Some states require the notice at hiring, with a signed acknowledgment kept on file.

Penalties for missing required notice vary by state but commonly follow a tiered structure, with escalating civil fines for repeated violations. Even in states without a specific monitoring-notification statute, an employer who fails to inform workers about surveillance is exposed to common-law invasion-of-privacy claims, because lack of notice undermines any argument that the employee consented.

Conversation recording adds another layer. A majority of states follow the one-party consent rule; a smaller group requires all-party consent, with severe penalties for violations.³ Employers with workers in multiple states have to meet the strictest applicable standard, which is why many default to all-party consent policies nationwide.

Public Employees and the Fourth Amendment

Government workers have a layer of protection private-sector employees lack. Because a public employer is a state actor, searches and surveillance must satisfy the Fourth Amendment, a standard that does not reach private companies at all.

In O’Connor v. Ortega, the Supreme Court held that whether a public employee has a reasonable expectation of privacy in the workspace must be assessed case by case. Where that expectation exists, the employer’s search must be reasonable at its inception and in its scope. A search is justified at inception when there are “reasonable grounds for suspecting that the search will turn up evidence that the employee is guilty of work-related misconduct” or when it serves a noninvestigatory work-related purpose like retrieving a file.⁵

Scope matters. A supervisor with reasonable suspicion can search a government employee’s desk and computer, but the search must stay proportionate to what triggered it. Rummaging through a personal briefcase requires stronger justification than opening a shared filing cabinet.⁶ Clear policies can diminish these privacy expectations by putting employees on notice, but constitutional protection cannot be eliminated entirely.

AI and Algorithmic Management

Traditional surveillance records what you do. Algorithmic management uses that data to influence or make employment decisions: scoring productivity from keystrokes, flagging idle time, analyzing tone in messages, predicting which workers are likely to quit.

The NLRB General Counsel issued a memo in late 2022 proposing that employer surveillance and automated management practices should be treated as a presumptive violation of the National Labor Relations Act where, viewed as a whole, they “would tend to interfere with or prevent a reasonable employee from engaging in activity protected by the Act.”⁷ Under that approach, even an employer with a legitimate business need would have to disclose the technologies used, the reasons for using them, and how the collected information is applied.

State regulation is moving faster. Several jurisdictions now require bias audits and public disclosure when employers use automated decision tools in hiring and promotion. Colorado’s AI Act, effective in 2026, imposes risk-management obligations on deployers of “high-risk” AI systems, including annual reviews for algorithmic discrimination, impact assessments, and disclosure to consumers affected by consequential decisions. A federal executive order on AI policy has signaled potential preemption of state laws deemed overly burdensome, so this area remains in flux. If an automated system affects your schedule, pay, performance reviews, or continued employment, disclosure and appeal rights may exist depending on where you work.

Off-Duty Conduct and Social Media

Employer surveillance does not always stop when you clock out. Monitoring of public social media is generally legal, and many employers review profiles for background checks or ongoing reputation management. Accessing a private account through deception or coercion crosses into territory most jurisdictions prohibit.

Roughly half the states have enacted some form of off-duty conduct protection, preventing discipline for lawful activities outside work hours. The scope varies: some laws cover only tobacco use, others any legal activity on personal time. Even where these protections exist, employers can usually act when off-duty conduct has a direct workplace impact. Threats, harassment-policy violations, posts that misrepresent the employee as speaking for the company, or serious disruption to business relationships generally fall outside the protection.

Under the NLRA, social media posts critical of an employer may qualify as protected concerted activity if the purpose is to encourage group discussion about working conditions like pay, scheduling, or safety.⁸ Firing someone for a post that amounts to collective griping about wages can be an unfair labor practice whether or not the workforce is unionized.

Remedies When Monitoring Crosses the Line

When surveillance goes past what the law allows, several paths are available, and the right one depends on what happened.

Start internally. Document the issue and file a complaint through human resources. That creates a paper trail and gives the employer a chance to correct course. Skipping this step can weaken later claims if an agency or court asks whether you tried to resolve the problem first.
ECPA civil action. If your employer violated the wiretap provisions or the Stored Communications Act, you can sue for damages. Under 18 U.S.C. § 2520, the court awards the greater of actual damages plus the violator’s profits, or statutory damages of $100 per day of violation or $10,000, whichever is larger. Attorney’s fees and punitive damages are available in appropriate cases.⁹
NLRB charge. If surveillance chilled your ability to discuss working conditions, organize, or engage in other protected concerted activity, file an unfair labor practice charge. The NLRB treats spying on union activities, and even creating the impression of spying, as violations of the Act.⁴
EEOC charge. When monitoring targets employees based on race, sex, religion, national origin, age, disability, or other protected characteristics, file with the Equal Employment Opportunity Commission. You generally have 180 calendar days from the discriminatory act, extended to 300 days if a state or local agency enforces a similar anti-discrimination law.¹⁰
State-law claims. Many states provide additional causes of action, including invasion-of-privacy torts, biometric privacy violations, and penalties under state-specific electronic monitoring statutes.

These options are not mutually exclusive. An employee whose biometric data was collected without consent and who was also targeted based on race might pursue a state biometric-privacy claim, an EEOC charge, and a common-law invasion-of-privacy action at the same time. The EEOC deadline is the one that catches people out most often. If discriminatory monitoring is even a possibility, file the charge early; you can withdraw later, but you cannot file after the deadline passes.¹⁰

1
Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
2
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
3
Justia. Recording Phone Calls and Conversations Under the Law: 50-State Survey
4
National Labor Relations Board. Interfering with Employee Rights (Section 7 and 8(a)(1))
5
Justia. O’Connor v. Ortega, 480 U.S. 709 (1987)
6
Federal Law Enforcement Training Centers. Warrantless Workplace Searches of Government Employees
7
National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices
8
National Labor Relations Board. Concerted Activity
9
Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized
10
U.S. Equal Employment Opportunity Commission. How to File a Charge of Employment Discrimination