Is Employee Monitoring Legal? A State-by-State Guide (2026)

Is Employee Monitoring Legal? A State-by-State Guide (2026)

Employee monitoring is legal across the United States — but legal doesn’t mean no rules. The legal landscape is a patchwork: a permissive federal baseline layered with a growing number of state-specific notice and consent requirements, several of which changed significantly heading into 2026. This guide breaks down what applies where, so you can monitor company devices without exposing your business to legal risk.

The Federal Baseline

The Electronic Communications Privacy Act (ECPA) is the primary federal law governing employee monitoring, and it gives employers two main paths to lawfully monitor:

Business Purpose Exception — employers may monitor electronic communications on company-owned equipment when there’s a legitimate business reason, such as productivity tracking, security, compliance, or quality assurance.

Consent Exception — monitoring is permitted when at least one party to the communication has consented, which in practice often means the employee agreeing via a policy acknowledgment or by starting a time-tracking tool themselves.

Federal law does not require employers to notify employees before monitoring begins — that requirement only exists where specific state laws impose it.

States With Explicit Notice Requirements

A small but growing group of states require written notice before electronic monitoring begins, regardless of whether the employee otherwise consents:

Connecticut — requires written notice under state statute

Delaware — requires written notice under state statute

New York — requires written notice and visible posting of the monitoring notice

Colorado — requires notice under the Colorado Privacy Act

California — as of January 2026, California’s AB 1221 introduced significant new requirements, including justifying why more invasive methods (like continuous screenshotting) are necessary when less invasive monitoring could achieve the same purpose

Maine — a 2026 update treats continuous screen capture as a form of enhanced surveillance requiring stronger justification

Several additional states had employee monitoring bills in committee during the 2025–2026 legislative session, including proposals in Massachusetts and New Jersey — the general trend across states is toward more disclosure requirements, not fewer.

States Requiring All-Party Consent for Recording

This is the biggest fork in the road specifically for audio or video recording (as opposed to general activity monitoring). States with all-party (also called “two-party”) consent laws include California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington. If your company has employees in any of these states, call recording or any audio-based monitoring needs documented, explicit consent — a line buried in an employee handbook typically isn’t sufficient on its own.

Personal Devices and BYOD

Monitoring an employee’s personal device (bring-your-own-device, or BYOD) is treated far more cautiously than monitoring company-owned equipment. Explicit, informed, written consent is required in most jurisdictions for BYOD monitoring — Colorado specifically requires written consent for this, and California’s AB 1221 places additional restrictions on personal device monitoring. The safest practice, regardless of state, is limiting monitoring to company-owned devices; if BYOD monitoring is genuinely necessary, limit its scope to work applications only and get clear written consent first.

GPS and Vehicle Tracking

GPS tracking of company-owned vehicles is legal in all 50 states, but a growing number require notice or consent before activation. New York, Connecticut, and Delaware currently have the most explicit written-notice requirements for GPS and electronic monitoring generally. California, Texas, Minnesota, and Virginia have consent-based statutes that can affect GPS tracking, though employer-owned vehicle exemptions typically reduce the burden. For company-owned vehicles specifically (as opposed to personal vehicles used for work), most states don’t require explicit consent, since vehicle ownership generally implies the right to track it — written acknowledgment from employees is still good practice everywhere.

Biometric Data

If your monitoring tools use fingerprint scanning, facial recognition, or other biometric identifiers — even just for login — Illinois’s Biometric Information Privacy Act (BIPA) imposes its own strict requirements and has an active history of enforcement. This applies regardless of whether your broader monitoring program otherwise complies with your state’s general rules.

Compliance Checklist for Employers

1. Limit monitoring to company-owned devices wherever possible — this alone avoids the majority of legal complexity.
2. Provide written notice before monitoring begins, even in states that don’t strictly require it — it’s a low-cost way to reduce legal and reputational risk everywhere.
3. Get explicit written consent for any audio or video recording, especially if you have employees in an all-party consent state.
4. Apply data minimization — only collect what’s necessary for your stated business purpose, and restrict access to monitoring data to managers or HR staff with a legitimate need.
5. Review your policy annually — state laws in this space are changing quickly; several new bills were introduced in the 2025–2026 legislative session alone.
6. Get separate, explicit consent for any BYOD monitoring, and scope it to work applications only.

Frequently Asked Questions

Do I need to tell employees they’re being monitored?

Federal law doesn’t require it, but a growing number of states (Connecticut, Delaware, New York, Colorado, California, and Maine) do require written notice as of 2026. Providing notice everywhere, even where not strictly required, is the lower-risk approach.

Can I record employee phone calls without consent?

Only in “one-party consent” states, and even then, documented consent is safer practice. In the eleven-plus all-party consent states, you need every participant’s explicit agreement.

Is monitoring an employee’s personal phone legal?

Only with explicit, informed, written consent in most states, and it should be scoped to work-related apps and data only, not the entire device.

What’s the safest overall approach?

Monitor only company-owned devices, provide written notice regardless of state requirements, document a clear business purpose, and limit data access to those who need it.

Bottom Line

Employee monitoring is broadly legal in the US, but 2026 has brought some of the most significant state-level changes in years, particularly in California and Maine. The safest approach for any multi-state employer is to build your monitoring policy around the strictest state you operate in, rather than the federal minimum — it’s simpler to maintain one compliant standard than to track exceptions state by state.

This article is for general informational purposes and isn’t legal advice. Consult a licensed employment attorney for guidance specific to your business and the states where you operate.