Workplace surveillance rules have become stricter. While employers still have broad rights to monitor their resources and protect property, more states are now turning these rights into specific notice laws, biometric rules, and wiretapping statutes with real consequences.
Using monitoring software without checking the rules first can be expensive. Fines range from $100 in Delaware to $500–$3,000 in other states, with even higher costs from BIPA lawsuits in Illinois. This guide gives HR, legal, and IT leaders a state-by-state overview, sample notice language, and key features to include before rolling out monitoring software.
Are Employers Allowed to Monitor Employees in 2026?
Yes, it is possible for employers to monitor employees in 2026 but they should be cautious as not everything can be monitored with unlimited access. Employees can expect their employers to monitor application use, internet use, device performance, login times and access to the company’s systems. The monitoring will be permissible or not depending on what is being monitored, the reason, whether the employee is made aware and consent obtained and relevant legislation.
As workplaces become more remote and hybrid, organizations leverage employee monitoring tools to safeguard company data, enhance security, optimize productivity, and address compliance obligations. But when monitoring is overly intrusive, concealed, or unconnected to business use cases, it can raise privacy and compliance concerns.
Federal Legal Baseline: ECPA & Common Law Privacy
Courts consider employee privacy on company-owned computers to be balanced by the “reasonable expectation of privacy” standard established in O’Connor v. Ortega and City of Ontario v. Quon. At that threshold, monitoring is allowed if ownership and consent can be proved.
The Electronic Communications Privacy Act (ECPA). Under the ECPA, intercepted electronic communications have just two exceptions that employers rely upon:
- Business extension exception – it is permissible to tap on the normal course of business and on devices and networks that are owned by the company.
- Prior consent exception – once at least one party has consented, monitoring can occur, often captured through an employee’s signed acceptable use policy on hire.
The Stored Communications Act (SCA) – The SCA covers communications held on third-party servers, like unopened email. Employers usually have access to all communications on their own servers and cloud tenants if device ownership and administrator rights are included in the employment agreement.
Explicit State Notice Statutes: New York, Connecticut, Delaware, and Maine
Four states require written notice, and in some cases signed acknowledgement, before electronic monitoring can begin.
- New York: Civil Rights Law § 52-c
Private employers must give employees prior written or electronic notice of monitoring at hiring, and the notice must be posted in a conspicuous physical location or on the company intranet. Employees must acknowledge the notice in writing or electronically. The attorney general enforces the law, with civil penalties of $500 for a first offense, $1,000 for a second, and $3,000 for each offense after that. There is no private right of action. - Connecticut: General Statutes § 31-48d
Connecticut requires prior written notice describing both the type of monitoring used and where it takes place. Undisclosed monitoring is allowed only where the employer has reasonable grounds to suspect illegal conduct or a hostile work environment. The Labor Commissioner enforces the statute through civil penalties of $500 for a first offense, $1,000 for a second, and $3,000 for the third and each subsequent offense, the same three-tier structure as New York’s law, not the lower figures some compliance summaries cite. - Delaware: Code Title 19, § 705
Employers can satisfy Delaware’s notice requirement two ways: a one-time signed written notice, or a daily electronic notice, such as a login banner, shown each time the employee accesses company systems. Violations carry a civil penalty of $100 per instance, and each unnotified employee can count as a separate violation.
- Maine: 26 M.R.S. § 620-A
Maine’s law, enacted in January 2026 and effective July 14, 2026, goes further than the other three. Employers must give written notice before monitoring begins, renew it annually, and disclose monitoring to job applicants during interviews. Audiovisual monitoring inside an employee’s home or personal vehicle is restricted unless the job specifically requires it, and employees can decline to install monitoring apps on personal devices. Penalties range from $100 to $500 per violation, enforced by the Maine Department of Labor.
Comprehensive State Privacy Structure & Biometrics
Additional protections for California employees: California employees recently became full participants in the consumer-style data rights at work that the CCPA granted in 2019, by losing the exemption for employee data at the start of 2023. Employers require a Notice at Collection, issued before you are subject to constant surveillance, which explains the specific categories of data being collected (for example, URL data, time on page, IP addresses).
Biometric Privacy Statutes: IL (BIPA), TEXAS (CUBI), WA
Other types of biometric monitoring such as facial recognition, keystroke dynamics and fingerprint scanning are governed by other laws. These include:
- Illinois BIPA (740 ILCS 14/), employers must obtain informed written consent and adhere to a published retention schedule, and employers cannot profit from biometrics. Statutory damages are $1,000 for each negligent violation and $5,000 for each intentional or reckless violation.
- Texas CUBI (Tex. Bus. & Com. Code 503.001) and Washington’s biometric privacy law (RCW 19.375) both set forth the same two requirements of each state: prior informed consent and reasonable security measures.
50- US State Statutory Compliance Summary
Understanding local wiretapping and consent laws is critical for deploying compliant monitoring tools. The following matrix outlines the legal standards for all 50 states in 2026.
| State | Computer / Web Monitoring Notice | Audio / Call Recording Standard | Biometric / Location Specifics |
|---|---|---|---|
| California | Notice at Collection (CPRA) | Two-Party Consent (All parties) | Strict data minimization (Penal Code § 632) |
| Connecticut | Prior Written Notice | Two-Party Consent for recorded calls | Specific location notice required |
| Delaware | Written Notice or Daily Banner | One-Party Consent | $100 penalty per violation |
| Maine | Prior & Annual Notice (26 M.R.S. § 620-A) | One-Party Consent | Home/vehicle surveillance & BYOD restrictions |
| Illinois | AUP recommended; BIPA for biometrics | Two-Party Consent | BIPA written consent required |
| New York | Prior Written Notice & Acknowledgement | One-Party Consent | N.Y. Civ. Rights Law § 52-c |
| Texas | AUP recommended; CUBI for Biometrics | One-Party Consent | Tex. Bus. & Com. § 503.001 |
| Washington | AUP recommended | Two-Party Consent | Biometrics RCW 19.375 |
| Florida | AUP recommended | Two-Party Consent | Strict interception liability |
| Massachusetts | AUP recommended | Two-Party Consent | Mass. Gen. Laws ch. 272, § 99 |
| Pennsylvania | AUP recommended | Two-Party Consent | 18 Pa. Cons. Stat. § 5703 |
| Remaining 39 States | Common law baseline; AUP recommended | Mostly One-Party Consent (except MD, MI, MT, NH, NV) | Standard common law protections apply |
When Screenshots, Audio, Video, and Keystroke Logging Raise the Risk
Some monitoring features may not present the same legal liabilities. Most computer telemetry features high-level information (example: time on application and domain tracking) are universally accepted under federal and state law. However, no one is defending raw employee inputs and full AV recording.
✅ Keystroke Logging (Keyloggers):
Recording precise keystrokes is a Compliance and Cybersecurity Nightmare. Recording extremely sensitive personal data such as personal bank credentials, passwords, health- related queries and privileged communication is standard practice in keystroke logging. Under the CPRA, FTC enforcement principles and common law, recording personal credentials on a generalised basis would constitute a breach of data minimisation obligations and expose you to direct data breach liability.
✅ Continuous Video and Webcam Surveillance:
Using software that covertly turns on cameras or constantly records video inside an employee’s home office remotely triggers a common-law “intrusion upon seclusion” claim. In a remote work context, videotaping an employee’s home environment, family members, or other personal space without good cause and/or with little or no affirmative consent often violates the common-law “reasonable expectation of privacy.”
✅ Ambient Audio and Call Interception:
Audio surveillance is regulated by federal and state wiretapping laws. For example, in 12 “two-party” (all-party) consent states like California, Florida, Massachusetts, Pennsylvania, among them, recording room sound or open-line voice calls without the agreement of every conversationalist is a criminal felony and puts employers at statutory risk.
✅ Indiscriminate Screen Scraping vs. Triggered Captures:
Uninterrupted Windows desktop screen capture results in great compliance risk under HIPAA, PCI-DSS and state privacy laws. When employees are accessing their medical portals or viewing their bank account or other confidential financial records, capture for privacy-first HIPAA and PCI-DSS compliance must be replaced with policy-initiated screenshots.
Remote Work, BYOD, and Labor Rights: Key Legal Boundaries
Three challenging regulatory intersections must be navigated by corporate legal and HR teams in the modern distributed environment and mobile workforce before deploying monitoring technology.
1. Multi-Jurisdictional Remote Work (Which State Law Applies?)
A common compliance mistake is believing that the location of the legal entity F(company headquarters or register place of business) is the sole factor determining the applicable jurisdiction where workplace monitoring occurs. In reality, the applicable jurisdiction will typically be the employee’s physical work location, not the employer’s.
So a Texas-based employer monitoring a remote employee who lives and works in New York must comply with New York’s Civil Rights Law § 52-c for that employee, regardless of where the monitoring system itself is hosted. If that same employer has another remote employee working from California, that employee’s monitoring is instead governed by the CPRA’s Notice at Collection requirements. Multi-state employers end up complying with several states’ rules at once, one per employee’s actual location, not one for the whole company.
2. Bring Your Own Device (BYOD) vs. Corporate Hardware
Installing monitoring apps on personal devices: The increase in monitoring apps on bring your own device (BYOD) exponentially raises the Privacy Risk. Employees’ personal devices not only constitute corporate intellectual property, but become a home for family pictures, bank statements, medical histories and the like. To defend against intrusion upon seclusion claims, companies should either deploy endpoint tracking agents only on employer-owned devices or containerize corporate access via virtual desktop infrastructure (VDI) with monitoring isolated within the virtual session.
3. NLRB Section 7 & Protected Concerted Activity
Employers cannot use surveillance tools to chill or interfere with protected concerted activity, discussing pay, working conditions, or organizing, under the National Labor Relations Act. The Board’s 2023 guidance memo on electronic monitoring and algorithmic management (GC 23-02) was rescinded by Acting General Counsel William Cowen in February 2025 via GC 25-05, along with roughly thirty other memos. The underlying Section 7 statutory protections remain in force even without that guidance document; monitoring that specifically targets organizing activity is still an actionable unfair labor practice.
The Operational Impact: Productivity, Retention, and Compliance
Employees’ response to monitoring is significantly influenced by whether they are aware of it. According to a 2025 ExpressVPN survey of 1,500 US workers, stress or anxiety is associated with workplace spying among more than half of employees, and about half say they would be willing to leave their job should oversight increase numbers consistent with Gartner’s unique estimate that only about 50% of employees now trust their employer with data.
On the other hand, research by the American Management Association has long shown positive correlations between policy-based, recognized monitoring and increased productivity, and the inverse when employees learn they are being tracked without their knowledge.
Insider-threat timing follows a similar pattern. A Securonix analysis of confirmed insider-threat cases found that employees planning to leave typically begin showing data-exfiltration behavior between two weeks and two months before their last day, which is why offboarding-stage data loss prevention, not indiscriminate day-to-day surveillance, tends to catch the highest-risk activity.
Employee Monitoring Legal & Compliance Checklist Before Deployment
Before installing workplace monitoring agents across corporate endpoints, HR executives, IT directors, and general counsel should execute the following 5-phase compliance checklist to ensure statutory alignment and operational integrity.
- Phase 1: Legal & Jurisdictional Scoping
Account for all states in which any employee or independent contractor physically works. Verify how this aligns with the notice statutes for New York, Connecticut, Delaware and Maine, as well as the scope of duty for California’s CPRA. - Phase 2: Data Minimization & Capability Audit
Stop keystroke collection, continuous webcam video, and ambient sound collection, unless a documented business purpose supports their use. Require screenshots to be sent only upon the occurrence of specific security events. - Phase 3: Policy Drafting & Handbook Updates
Revise corporate AUP and Employee Handbook policies to specify: (1) the nature of tracked device telemetry, (2) why telemetry data is being collected for business purposes, (3) how long the data is kept, and (4) who in the organization is authorized to receive telemetry reports. - Phase 4: Statutory Notice & Signed Acknowledgment
Distribute and gather signed notices. Onboarding materials will include the state disclosures, with signed acknowledgments on file for New York, Connecticut, and Delaware employees, as well as daily login banners where selected. - Phase 5: Technical Governance & Role-Based Access (RBAC)
Limit monitoring dashboards only to the permitted compliance, IT and HR roles via role-based access control, and maintain an automatic purge schedule (30 to 90 days is standard) to prevent the data filling up indefinitely.
How CurrentWare Enables Out-of-the-Box Legal Compliance
CurrentWare offers a suite of privacy-centric user activity monitoring and endpoint security modules built to satisfy our customers’ most demanding statutory compliance requirements, including NY Civil Rights 52-c, CT 31-48d, DE 705 and the CPRA.
Rather than capturing everything a user does, the platform is built around objective activity data instead of invasive capture methods:
- Objective Activity Telemetry: BrowseReporter tracks active application engagement, URLs visited, and performs idle time tracking without utilizing invasive keystroke loggers that capture personal passwords or banking data.
- Privacy-First Location Tracking: Utilizing CurrentWare’s Location Insights, administrators can classify work time as “Office,” “Remote,” or “Hybrid” by analyzing IP subnets and default gateway MAC addresses, avoiding intrusive GPS tracking entirely.
- Contextual Smart Captures: Instead of continuous video feeds, screenshot monitoring can be configured with smart triggers to capture screens strictly during policy violations.
- Proactive Security: BrowseControl enforces granular category filtering, blocks file downloads, and handles application blacklisting to prevent data exfiltration.
- Data Sovereignty: Since CurrentWare runs on your premises or private cloud tenant, telemetry data stays in your organisation’s sovereign boundary. As a vendor, CurrentWare has no access to employee data, nor does it process or share it.
Customers in regulated industries also prefer less-invasive tracking. “With Access Patrol, I can say we can rest assured someone isn’t going to go and plug something into any of our [machines],” says First Choice Health’s Nicholas Scheetz, IT Service Desk Supervisor. Sa’rah Plesner, EHOB’s IT Manager, said she was looking for “something robust enough to get the info required without being invasive,” like keystroke tracking.
Compliant Policy Acknowledgement Template
The following statutory disclosure template is designed to satisfy NY Civil Rights Law § 52-c, CT Gen. Stat. § 31-48d, DE Code Tit. 19 § 705, and CPRA Notice at Collection requirements.
NOTICE OF ELECTRONIC MONITORING AND ACCEPTABLE USE ACKNOWLEDGMENT
To All Employees, Contractors, and New Hires:
In accordance with applicable state and federal law, [Company Name] monitors electronic devices, systems, and networks it provides for business use. Monitoring may include:
- Internet and application usage (URLs visited, active/idle time)
- File transfer activity to USB devices and cloud storage
- System logon/logoff timestamps
- Contextual screenshots, captured only when a security policy is triggered
This monitoring does not include continuous audio recording, continuous video recording, or individual keystroke logging.
Data is collected for legitimate business purposes, protecting confidential information, meeting cybersecurity obligations, and enforcing this acceptable use policy, and is retained for [90 days] unless a security investigation requires longer retention.
Employee Acknowledgement: I confirm that I have received, read, and understood this notice, and that I have no reasonable expectation of privacy when using company-provided equipment.
Employee Signature: Date:
Frequently asked
Frequently Asked Questions:
-
Concentrate on non-intrusive, factual productivity and security metrics over intrusive, subjective individual surveillance. Say no to keystroke loggers and real-time video surveillance. Instead, opt for objectively-measurable websites and application usage, time-on-task, and URLs visited. Keep employees visible in surveillance mode, and implement screenshot surveillance only when they run counter to your security policies.
-
Security and privacy-aware employee monitoring software is like endpoint surveillance technology that is (a) designed to be compliant with state’s employee disclosure laws and (b) powered by personal data privacy best practices. Fresh solutions like CurrentWare are powered by on-premises or private-cloud data sovereignty, employ role-based access control (RBAC), and do not include cross-border or invasive measurements like continuous GPS tracking and ambient audio.
-
To monitor employees legally and ethically without violating privacy rights, employers must establish an explicit acceptable use policy, enforce role-based access controls, and comply with state notice laws before collecting telemetry. Furthermore, monitoring should be strictly separated from Bring Your Own Device (BYOD) hardware, limiting oversight exclusively to employer-owned endpoints and utilizing Data Loss Prevention (DLP) tools like CurrentWare AccessPatrol to audit file egress rather than indexing personal file contents.
-
This monitoring of all employee computing activity is carried out by an endpoint agent that runs on every worker’s desktop, communicating with the admin console to let it know what apps employees are using, which sites they’re visiting, and how much bandwidth they’re consuming. To successfully implement this in 2026, you’ll need to include in your employee handbook clear guidelines for which site categories are acceptable for company access, install a tracking system and configure automated summary reports that roll up team behavior, not minute-by-minute monitoring of individual team members.
Conclusion:
Workplace monitoring law in 2026 prefers transparency to breadth of listening. In New York, Connecticut, Delaware, and Maine, employers must notify workers in writing before any monitoring takes place, and in California CPRA before gathering more general data from employees. The penalty for failing to do so increases with each penalty, for each employee. It’s not less monitoring, it’s transparent, reduced monitoring with disclosure, and a retention limit that does not stay long after it is no longer needed.
Note – This guide is for informational use only, and does not constitute legal advice. Monitoring requirements are specific to each state and are subject to change without notice. Please verify the current requirements with employment counsel prior to adopting or relying on any provision set forth herein.