Employee Monitoring and Workplace Privacy What Employers Can Track and Where the Limits Are

Employees in the United States generally do not have one broad federal right to be completely free from workplace monitoring. Employers can often monitor company devices, networks, email, internet use, location, security cameras, productivity systems, and other work activity for legitimate business purposes. But that does not mean an employer may spy on workers without limits.

The legal answer depends on what is being monitored, where it happens, whether the employee was notified, whether the device belongs to the employer or employee, whether audio or communications are intercepted, whether biometric or health data are collected, which state’s law applies, whether the monitoring interferes with union or other protected concerted activity, and how the resulting data are used.

The practical issue has become more important as monitoring moves beyond obvious cameras and time clocks. Modern systems can record keystrokes, screenshots, browser activity, location, badge movement, call metrics, work speed, application use, and sometimes biometric or behavioral data. The Federal Trade Commission has warned that workplace surveillance increasingly involves highly sensitive information and can extend onto employees’ personal devices or into remote-work environments.

This guide explains the U.S. legal and ethical landscape as of 2026. It is general information, not legal advice. State laws vary considerably, and employers considering monitoring should obtain legal guidance for the specific jurisdiction and technology involved.

Do Employees Have a Right to Privacy at Work?

Employees can have privacy rights at work, but those rights are narrower and more context-dependent than privacy in a private home.

A central practical question is whether the employee reasonably expected the activity or communication to be private.

That expectation may be weak when:

• the device belongs to the employer;
• the network belongs to the employer;
• a policy clearly states that activity is monitored;
• the monitoring occurs in ordinary work areas;
• the data are collected for security, compliance, productivity, or operational purposes.

The expectation may be stronger when:

• monitoring occurs in a restroom, changing area, or similarly private space;
• a personal device or personal account is involved;
• the employer secretly records private communications;
• monitoring continues outside working time without a clear business justification;
• sensitive health, biometric, or family information is collected.

The exact legal result still depends on federal and state law.

Common Forms of Workplace Monitoring

Company Devices Usually Come With Less Privacy

Employers generally have stronger grounds to manage and inspect systems they own.

A company laptop may contain security software that records logins, network traffic, installed applications, downloads, or suspected malware. Corporate email may be archived for legal and compliance purposes. A company phone may be managed remotely.

Employees should therefore read the employer’s acceptable-use and monitoring policies rather than assuming that deleting a file or message makes it private.

Connecticut’s official state employee monitoring notice, for example, explicitly warns employees that activities involving state computer equipment, email, internet usage, documents, and communications may be monitored, recorded, and reviewed and that deletion does not necessarily prevent retrieval.

Personal Devices Create Harder Questions

Bring-your-own-device programs can blur the boundary between work and private life.

An employer may have a legitimate need to secure work email or data on a personal phone, but a monitoring or mobile-device-management tool can potentially access more information than is necessary.

Good BYOD policy should explain:

• which data the employer can see;
• which apps or profiles it can control;
• whether location is collected;
• whether the employer can remotely erase data;
• what happens when employment ends;
• how personal information is separated from corporate information.

Employees should not have to discover those permissions only after installing the software.

Email Monitoring Is Not Unlimited

Federal electronic communications law can apply to interception and access to communications, including the Electronic Communications Privacy Act framework. The details are technical, and exceptions can apply where a service provider or party to a communication authorizes monitoring.

For employers, the safer conclusion is not “we own the system, so anything is legal.” Monitoring should be tied to a legitimate purpose, disclosed where required or appropriate, and configured to avoid collecting unnecessary personal communications.

State wiretap laws can impose additional requirements, particularly for audio or real-time communication interception.

Audio Recording Can Be Riskier Than Video

A camera without sound and a microphone recording conversations can raise different legal issues.

States vary in their consent requirements for recording conversations. Depending on the jurisdiction and circumstances, recording may require consent of one party or all parties.

An employer operating across multiple states should not assume the rule in headquarters’ state controls every remote employee or call.

Call-center quality monitoring is common, but notices to employees and callers, applicable state law, and the reason for recording all matter.

Private Spaces Are Different

Monitoring restrooms, locker rooms, changing rooms, or similar spaces creates especially serious privacy concerns and can be prohibited by state law.

Connecticut, for example, expressly prohibits employers from operating electronic surveillance systems to monitor employees in areas designed for health, personal comfort, or safeguarding possessions, including restrooms, locker rooms, and lounges.

Even where a statute is worded differently, employers should treat intimate private areas as fundamentally different from entrances, warehouses, retail floors, or other ordinary workspaces.

Some States Require Notice

There is no single nationwide employee-monitoring notice rule covering every technology. State requirements differ.

Connecticut has long required employers engaging in covered electronic monitoring to provide prior written notice describing the types of monitoring that may occur, subject to exceptions for certain investigations of suspected misconduct.

Connecticut enacted additional employee-surveillance legislation in 2026, illustrating how state law continues evolving as monitoring tools become more sophisticated.

Other states, including New York, also have electronic-monitoring notice requirements in particular contexts.

Multi-state employers should therefore maintain a jurisdiction-by-jurisdiction compliance process rather than one generic U.S. policy.

Union and Concerted Activity Has Special Protection

One of the clearest legal limits comes from the National Labor Relations Act.

Section 7 protects many private-sector employees when they act together concerning wages, hours, safety, and other working conditions, whether or not a union is already present.

The National Labor Relations Board states that employers may not spy on employees’ union activities or create the impression that those activities are under surveillance. Photographing or videotaping peaceful union or protected activity can also violate the Act absent proper justification.

This is important because a monitoring system that is lawful for routine security purposes can become unlawful if it is selectively used to identify or intimidate employees who are organizing or discussing working conditions.

A 2026 NLRB Example

In January 2026, NLRB Region 27 approved a settlement involving Peak Vista Community Health Centers. The underlying complaint alleged that physicians were terminated after collectively protesting a requirement to work additional hours without pay and participating in union organizing. The complaint also alleged threats and electronic surveillance in response to protected concerted and union activity.

The settlement provided approximately $1.2 million in backpay and frontpay to five doctors.

The example does not mean all electronic monitoring violates labor law. It shows that the purpose and context of monitoring matter.

Employees Can Discuss Wages and Working Conditions

Covered employees generally have federal rights to discuss wages and working conditions with one another.

An employer should not use monitoring tools to identify, punish, or discourage protected group discussion simply because management dislikes it.

This can apply to in-person conversation as well as certain digital communications, depending on the facts and workplace rules.

Remote Work Expanded the Surveillance Boundary

Remote work created a new monitoring problem: the workplace can now be inside an employee’s home.

Employers may want to measure whether work is being performed, but continuous webcam monitoring, screenshot capture, location tracking, or activity scoring can collect information about:

• family members;
• health conditions;
• religion;
• living arrangements;
• personal communications;
• private physical spaces.

The FTC has highlighted concerns that worker surveillance can extend to personal devices and off-site activity and that workers may not understand what information is retained or shared.

Productivity Scores Can Be Misleading

Digital monitoring often converts activity into metrics such as keystrokes, mouse movement, cases closed, calls per hour, or “active time.”

These metrics can be useful for some tasks but dangerous when treated as a complete measure of performance.

A worker may appear inactive because they are:

• thinking through a difficult problem;
• speaking with a client;
• reading a long document;
• mentoring a colleague;
• working on paper;
• waiting for a system response.

If employees know that only visible digital activity is rewarded, they may optimize for the metric rather than the work.

Algorithmic Management Raises New Issues

Monitoring systems increasingly feed data into automated tools that recommend schedules, performance ratings, discipline, promotion, or termination.

This can create risks involving:

• biased data;
• incorrect inferences;
• lack of transparency;
• disability discrimination;
• disparate impact;
• inability to challenge an error;
• using a proxy metric that does not measure real productivity.

Employers remain responsible for employment decisions even when software supplies the score.

Discrimination Law Still Applies

Monitoring does not create an exemption from federal or state anti-discrimination laws.

Suppose a productivity system penalizes employees who take disability-related breaks or misinterprets assistive technology as inactivity. An employer may create legal risk if it blindly applies the score without considering disability obligations.

Similarly, surveillance should not be targeted more heavily at workers because of race, religion, sex, national origin, disability, age, or another protected characteristic.

Biometric Data Can Trigger State Privacy Laws

Fingerprints, facial geometry, voiceprints, and other biometric identifiers are sensitive because they are difficult or impossible to replace if compromised.

Several states have enacted laws regulating biometric information, with different requirements around notice, consent, retention, disclosure, and remedies.

An employer introducing facial recognition or fingerprint time clocks should therefore conduct a separate biometric-law analysis rather than treating the technology as ordinary attendance software.

Location Tracking Should Have a Boundary

GPS tracking can be legitimate for:

• delivery routing;
• fleet security;
• dispatch;
• field-service verification;
• worker safety.

The privacy problem becomes much stronger when tracking continues after the shift ends or follows the employee during purely personal activity.

Employers should configure systems to collect the minimum location information necessary and clearly explain when tracking begins and ends.

Can Employers Monitor Social Media?

Public social-media posts are generally easier for an employer to view than private content, but employment decisions based on social media can still raise legal issues.

States may restrict employers from demanding passwords or access to private personal accounts. Protected concerted activity can also occur on social media when employees discuss work conditions together.

Employers should be cautious about collecting information they do not need because a social profile can reveal protected characteristics such as religion, pregnancy, disability, or political activity protected by some state laws.

Security Monitoring Is Legitimate but Should Be Proportionate

Organizations have real reasons to monitor systems.

Cybersecurity teams need to detect:

• malware;
• data theft;
• unauthorized access;
• credential compromise;
• insider threats;
• regulatory violations.

The strongest privacy framework does not prohibit all security monitoring. It asks whether the monitoring is proportionate to the risk and whether collected data are protected from misuse.

The Ethical Question Goes Beyond Legality

A monitoring practice can be legally defensible and still damage trust.

Employees may reasonably accept:

• security cameras at entrances;
• logging of access to sensitive customer records;
• tracking of company vehicles during delivery routes.

They may react very differently to:

• continuous screenshots;
• webcam observation at home;
• emotion-detection claims;
• off-duty location tracking;
• secret productivity scoring.

Trust matters because excessive surveillance can encourage workarounds, stress, turnover, and “performing activity” rather than performing useful work.

What Employers Should Disclose

A transparent monitoring notice should answer:

1. What data are collected?
2. Which devices and locations are monitored?
3. When does monitoring operate?
4. Why is the data collected?
5. Who can access it?
6. How long is it retained?
7. Is it shared with vendors?
8. Can it affect discipline, pay, scheduling, promotion, or termination?
9. How can an employee challenge inaccurate data?

“We may monitor everything” may reduce legal ambiguity in one sense while doing little to create informed trust.

Data Minimization Is a Better Design Principle

Employers should collect what they actually need rather than everything the software can technically capture.

If the purpose is verifying that a field technician arrived at a job site, the organization may not need a continuous 24-hour location history.

If the purpose is cybersecurity, it may not need webcam footage.

If the purpose is measuring customer response times, it may not need to record personal text messages.

Collecting less data also reduces cybersecurity and litigation risk.

Employee Monitoring Checklist

What Employees Can Do

If you are concerned about workplace monitoring:

• read the employee handbook and monitoring notice;
• assume company devices and accounts may be logged unless policy says otherwise;
• keep highly personal activity off employer systems when possible;
• check device permissions on any required monitoring app;
• ask when location or recording operates;
• document suspected selective or retaliatory surveillance;
• contact a union representative where applicable;
• seek legal advice when monitoring involves private spaces, protected activity, discrimination, retaliation, or sensitive personal data.

So, Do Employees Have a Right Not to Be Spied On?

The best answer is: employees have meaningful privacy and labor protections, but not a universal right to be free from all workplace monitoring.

Employers can often monitor work systems for legitimate purposes. The legal limits depend on the method, notice, location, state law, communications involved, protected activities, and use of the data.

The most defensible monitoring is targeted, transparent, necessary, and proportionate. The riskiest monitoring is secret, excessive, discriminatory, intrusive into private spaces or off-duty life, or aimed at discouraging legally protected employee activity.

Conclusion

Workplace technology has made employee surveillance cheaper and more detailed than ever. A manager no longer needs to stand behind a worker to observe activity; software can generate continuous records of digital behavior, location, communications, and performance.

U.S. law has not responded with one comprehensive federal workplace privacy right. Instead, protections come from overlapping electronic-communications rules, state privacy and monitoring laws, labor law, anti-discrimination law, biometric statutes, contracts, and workplace policies.

For employers, the safest principle is not “monitor everything because we can.” It is to define a legitimate purpose, collect the minimum necessary information, notify workers appropriately, protect the data, permit correction of errors, and make sure monitoring does not interfere with protected rights.

For employees, company systems should generally be treated as work environments rather than private personal spaces—but employers still have legal and ethical boundaries. Surveillance is a management tool, not unlimited permission to erase privacy.

Sources and Further Reading

• National Labor Relations Board — Employer Conduct and Section 7 Rights
• NLRB — Peak Vista Electronic Surveillance Allegations and 2026 Settlement
• Connecticut General Assembly — Electronic Monitoring of Employees
• State of Connecticut — Electronic Monitoring Notice
• Federal Trade Commission — Worker Surveillance and Sensitive Data