Is Employee Monitoring Legal? A State-by-State Essential Guide (2026)

Is Employee Monitoring Legal in the US? It depends on the state and whether you are monitoring employees with company-owned equipment, alerting employees in writing, and observing state consent laws. All but two or three states require only one party to consent, though some require two, while others simply require you to tell employees. There is no one federal law, and that is part of the trouble.

Note: This is a fairly general overview of the law and is not to be taken as legal advice. If you are planning on instituting an employee monitoring legal program, consult an employment attorney – Laws change too rapidly and also differ by state.

Key Takeways

• Tracking USU’s company PC or any of USU’s company systems is legal by default (h.02,4:) this fall due to the federal “business purpose” exception:k.02,3)
• Consent requirements differ by state – Some states only need employer to disclose, some require the employee to agree to audio/video
• Personal devices-there’s a gray area here.5 If you want to monitor them, you’ll need to have obtained a clear, written consent prior.
• Unattributable clockiness is very often unlawful, even if you are using a company computer.
• Written policy + notice is the single biggest factor that separates legal tracking from a lawsuit risk.
• Their own state’s laws, not the company’s home state.

What Counts as “Employee Monitoring” in 2026

It’s useful to establish exactly what people mean by “monitoring” before you consider whether to ask, “Is it legal?” if monitoring is being carried out. Not all forms of monitoring are equal in the eyes of the law.

Monitoring of screen, screen time, and monitored activities (e.g., subjects covered; websites visited, etc.) – uses of tablet, what activity they spend most time on in a day

• GPS/Location tracking: niche for field teams, delivery folk, company vehicles, etc.
• E-mail chat & call monitoring: Reviewing work communications such as e-mail, chat, and phone calls sent through company systems.
• Keystroke logging: capturing each keystroke (most sensitive to the law)
• Webcam or screen recording: recording the visual activity on the screen generally needs the most extensive justification and the most explicit notice.

Just by trial-ing the actual device, a retail chain that tracks a company’s delivery van through GPS faces very different legal risks from a software firm polling an employee’s keystrokes on a company’s home computer. The device owner, its location, the employee’s job, everything impacts the legal calculus.

Consider comparing the following real-world circumstance: a logistics firm that monitors its GPS on its company trucks as they deliver the goods, so long as it is not excessive, job-related, and the drivers are informed. Now, assume a marketing firm installed screen-capture software without warning, on an employee’s personally-owned laptop, one that is only occasionally used to pick up work email. The second has more significant legal exposure, even though both are ’employee monitoring’.

What computer, whether you disclosed and whether it has a job connection, is more relevant than merely saying they are an ‘employee monitor‘?

Is It Illegal for Employers to Track Employees?

Absolutely, in all but the exceptional cases-if the computer is owned by your employer, then monitoring is nearly always legal under U.S. Law, specifically the Electronic Communications Privacy Act’s business purpose exception:

This includes:

• Websites visited during work hours
• Applications and software used
• Files accessed, created, or transferred
• Time spent active vs. Idle

If saved as screenshots or as activity logs (if such logging is available and disclosed in the policies)

Monitoring becomes questionable when outside of the computer’s business use.

Are You Allowed to Track Your Employees?

Yes – In the most typical scenario, employers may monitor employees if that monitoring is connected to employer-owned equipment and is performed for a legitimate business reason and is identified by a written policy.

This scenario encompasses most tracking:

The “short” take: if it’s your gear, used during work, and you have a policy, you’re generally fine. The moment the use of personal devices, personal time, or imprompt recording increases, the risk goes up markedly.

The Federal Baseline: What U.S. Law Actually Allows

The Electronic Communications Privacy Act (ECPA) is primarily the federal statute that addresses employment monitoring. The Act bars the interception of electronic communications, but with a “business purpose” exception. This permits an employee to monitor employee communications on a company system if the purpose of such is for “business” reasons, such as security, quality control, or efficiency concerns.

Federal law establishes the minimum standards, and states then impose additional, frequently more stringent, requirements.

It’s also helpful to see why the business purpose exception was created in the first place. When ECPA was enacted, the legislators foresaw that there were business justifications for owners and operators of systems to be able to access communications on those systems, such as protecting trade secrets, ensuring customer service, avoiding harassment, and bolstering security.

The exception is not an unintended loophole, but rather reflects a considered compromise in cases where a business has a compelling interests that outweigh an individual’s expectation of privacy. Of course, those boundaries are blurry in focus with respect to personal accounts, personal devices, and the use of off-hours personal time, at which point the justification for a business purpose begins to break down, and the law of the individual state takes center stage.

One-Party vs. Two-Party Consent States (Why It Changes Everything)

This is the largest fork in the road when it comes to legality monitoring. Particularly on issues of any recording of audio or video.

• One-party consent allows recording if you are the sole party to the conversation who is aware it’s being recorded. This means the employer need not be unaware.
  
• Two-party (all-party) consent states: everyone being recorded knows about it and gives consent, including the employee and often also the person they’re speaking to (e.g., a customer in a support call).

The following states have two-party consent laws: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington.

If your company does business or has employees living in any of these states, listen up: call recording and any audio-based monitoring systems require documented consent, rather than the employee handbook page you thought had it.

State-by-State Essential Employee Monitoring Laws (2026)

Instead of listing the states one by one (which drowns all the interesting information), here is a common grouping of states:

This is the largest fork in the road when it comes to legality monitoring. Particularly on issues of any recording of audio or video.

• One-party consent allows recording if you are the sole party to the conversation who is aware it’s being recorded. This means the employer need not be unaware.
  
• Two-party (or all-party) consent states that everyone being recorded is aware of it and gives consent, including the employee and often also the person they’re speaking to (e.g., a customer during a support call).

Least-Restrictive States

Follow the federal baseline with fewer additional state-level requirements, though a written policy is still strongly recommended as best practice. Examples: Texas, Georgia, Ohio, Arizona

Practical rule of thumb

If you employ remote workers, look at the laws of the state where the employee is based, not necessarily where you are located. This can trip up more employers than anything else.

Remote & Hybrid Employees: Does Monitoring Law Change at Home?

Is that a yes? This is where the majority of compliance errors are made.

Home Wi-Fi network

Surveillance of traffic on an employee’s home network (as opposed to when that employee is accessing the company network through a VPN, and doing so on their own device) needs to be carefully considered from a privacy perspective, and is a lot more risky than surveillance on-site.

Multi-state Remote Teams

Texas-based company with a remote California-based employee-that employee falls under the field of California’s more advanced consent rules, not Texas’s. Personal equipment used for work–unless using a “bring your own device” policy is monitored with personal phone, laptop, in almost every state, you need clear, documented consent.

A real-world example

A company that is located in a one-party consent state has enabled recording on all support calls. A new remote hire in Illinois, a two-party consent state, starts work without the employer making any change. Now they’re out of compliance – for their own support calls.

What Employers Are Legally Required to Disclose

Many states codify “you may monitor” and go into detail as to how an employer must inform the employee.

• Written policy requirement: All documenting policies should be written, not just verbal policies.
  
• Disclaimer: Laws in certain states, including Connecticut, Delaware, and New York, mandate, by law, that employers have to give a prior notice of electronic monitoring to the employees before the beginning of work.
  
• Signed acknowledgement: To avoid confusion, it’s best (or even required!) to get employees to sign that they have read and understood the policy.
  
• Continual transparency: Exposures should not be once-and-for-all; exhibitions should be reevaluated at the adoption of each tracking aid.

Gray Areas: BYOD, Personal Devices, and Off-the-Clock Monitoring

It is this step where l riesgosos legales makes itself present. Some of the gray areas are:

Using your own devices for work-related activity (i.e., on Facebook, MSN, Google Reader, your personal email, Hulu, etc.) during ‘work hours’ and monitored by your employer is somewhat legally ambiguous unless it is very clearly defined and you have explicitly given the proper consent

• Location tracking is not limited to scheduled shifts – fairly easy to justify tracking an employee’s phone after they clock out, but should not be happening outside of scheduled shifts (phone issued to the employee by the company)
  
• Watching your own accounts and private ones of friends – usually illegal, some states have laws against employers asking for your social media passwords.
  
• Monitoring off-duty communications-these are communications sent from an employee’s home or personal phone (including work-related messages) outside of normal working hours. It is usually not monitored.

Monitoring Practices That Are Rarely Legal Anywhere

While I have not elaborated much on these practices, regardless of state, these often constitute serious legal risks almost anywhere in the U.S.:

• Bathroom, Locker Rooms, or Break Room Audio/Video recording.
• Surveillance without notice or a written policy
• Having logged into someone’s personal email or social media accounts without permission.
• Overestimating how long you need to follow a position or task after your employee leaves the clocking.
• Use monitoring software on employees’ or customers’ systems without their consent, or installing on their devices.

How to Build a Legally Compliant Monitoring Policy (Step-by-Step)

Step 1

Audit everything you are already tracking. Create an inventory of all tools, devices, and data types being monitored within your firm.

Step 2

Verify your state’s consent needs. Determine whether the interests of each employee are located within the one-party, two-party, or notice required areas.

Step 3

Write a policy. Specify what is being monitored, the reasons for it, how long the data is stored, and who can access it.

Step 4

Ensure documented employee acknowledgement. Signed or electronically logged acknowledgment provides the employer and employee’s right to be known.

Step 5

Select monitoring solutions designed for compliance. Seek out ones that let you have explicit notifications, refinable controls, and audit trails versus silent and outright monitoring.

Conclusion

While the question is employee monitoring in the U.S. Is legal, the boundaries of that legality will vary by your employees’ locations, what you’re capturing, and how you’re notifying them. States that require two-party consent (such as California and Illinois) will call for consent before recording, while the majority rules in any other state, allowing written disclosure to suffice.

Teams working remotely and in hybrid environments continue to complicate the issue, since the leeway isn’t the employer’s, but that of the employee’s state.

The best step that isn’t to just try to avoid having any employee monitoring, should be to give your staff transparency with the policy and a comprehensive record of it. Always choose solutions that embed the practices into the action.