Employee monitoring law · United States (federal)
Federal law is permissive; the real constraints are state law and the NLRA.
Start from your state’s notice statute and wiretap consent rule, not from federal law.
- Region
- North America
- Instruments
- 3 governing
- Employer duties
- 3 listed
- Last reviewed
- August 22, 2026
United States (federal) · what the law requires
Notice and proportionality
There is no federal statute requiring notice of employee monitoring. The Electronic Communications Privacy Act permits interception with one-party consent or under the business-use exception, and employer-provided equipment carries a low expectation of privacy. The constraints that bite are state notice statutes, state wiretap law requiring all-party consent, and the NLRB's position that surveillance which tends to interfere with protected concerted activity can violate the NLRA.
- State law is where the duties areNew York, Connecticut and Delaware require notice. California, Illinois and others add consumer-privacy and biometric duties. Check every state you employ in, not just your headquarters.
- All-party consent states for recordingA dozen-odd states require every party to consent to recording a communication. This is a criminal statute in several of them.
- Do not surveil protected activityMonitoring that captures union or concerted activity, or that starts in response to it, draws NLRB attention regardless of state law.
The instruments, and which control answers each duty
- Electronic Communications Privacy Act: 18 U.S.C. §§ 2510–2523. Interception permitted with one-party consent or under the business-use exception; the baseline permission most US monitoring relies on.
- National Labor Relations Act: 29 U.S.C. § 151 et seq.. Surveillance that would tend to interfere with protected concerted activity is an unfair labour practice, applies to non-union workplaces too.
- Stored Communications Act: 18 U.S.C. §§ 2701–2712. Governs access to stored communications; accessing an employee's personal account is a different question from monitoring a work device.
No product does this part
What you must still do yourself
Compliance is a property of your deployment. These are the steps in United States (federal) that no vendor can complete on your behalf, and skipping them is what turns a rollout into a finding.
- 1Map your employee population to states and apply the strictest applicable rule per person.
- 2Get the acknowledgement that New York requires and post the conspicuous notice.
- 3Take counsel before monitoring anything that could touch protected concerted activity.
- If you get it wrongVaries enormously. Statutory notice penalties are modest ($500–$3,000 in New York), but Illinois BIPA is $1,000–$5,000 per violation with a private right of action, and class exposure there has run to nine figures.
Verify the claim
Every control above, on the page that describes it
- Capture policies scoped per team and per jurisdictionApply a different policy per state without running two systems
- No biometric collection; per-app deny-lists keep named tools out of the record entirelyKeep out of the categories that create private rights of action
- Notice and acknowledgement record carrying version and date per personEvidence the notice each employee received
Sources and review date
Last reviewed August 22, 2026This is a summary of how employee-monitoring rules generally work in this jurisdiction, written to help you scope a rollout and brief your own advisers. It is not legal advice, it is not a substitute for it, and law changes. Verify against the primary sources listed and take local counsel before you deploy.
Nearby jurisdictions
Monitoring law elsewhere in North America
- New YorkWritten notice on hire, signed acknowledgement, and a posted notice, all three.
- CaliforniaEmployees have full CCPA rights since 2023, including deletion and correction.
- IllinoisBIPA carries a private right of action. This is the state where monitoring gets sued.
- Canada (federal)Reasonableness is the statutory test, and the OPC applies a four-part necessity analysis.
- OntarioA written electronic monitoring policy is mandatory at 25+ employees, refreshed annually.
- QuebecLaw 25 adds privacy by default, impact assessments and a right to explanation.
Point it at one team for a week.
Create the account, put the agent on a handful of desks, and leave it alone. On Friday you read the week instead of reconstructing it: hours against their projects, focus and idle per person, and the timesheets already filled in.
Free for two seats. No card, and no sales call to sit through.