Employee Monitoring Laws by State: A 2026 Employer Guide
August 27, 2026
Amir Tavafi
12 min read
Employee monitoring laws by state aren't one law, they're a patchwork: a federal baseline, a handful of states with explicit notice requirements, and a longer list where consent alone covers you. Get one wrong and you're looking at a lawsuit. Get every one technically right, and you can still lose your best engineer to a competitor that skipped the keylogger, the screenshots, and the whole ActivTrak-style monitoring stack in the first place.
Key Takeaways
Q: Is employee monitoring legal in the US?
A: Yes, in most cases. Federal law, the Electronic Communications Privacy Act, permits employer monitoring of company-owned systems and networks, and most states allow it under one-party consent. A handful of states, including Connecticut, Delaware, and New York, add a specific requirement: written notice before you start.
Q: Which states require employers to notify employees before monitoring them?
A: Connecticut, Delaware, and New York have explicit electronic monitoring notice laws on the books, requiring written or posted notice before monitoring begins. More states have introduced similar bills in recent sessions, so treat this as a growing list, not a fixed one.
Q: What's the difference between one-party and two-party consent states?
A: In one-party consent states, only one person in a conversation needs to agree to it being recorded, and an employer usually counts as that party. In two-party (all-party) consent states like California, Illinois, and Massachusetts, everyone being recorded has to agree, which changes how you handle call recording and meeting transcription tools.
Q: Can employers monitor employees working from home?
A: Generally yes, on company-owned devices and accounts, regardless of where the employee is sitting. The legal exposure isn't about location, it's about what's being captured, keystrokes, screenshots, webcam, personal accounts, and whether the applicable state requires notice first.
Q: Do monitoring laws cover screenshots and keystroke logging specifically?
A: Not by name in most states, but capturing screen content or keystrokes raises the same consent and notice questions as any other monitoring, and adds legal and reputational risk since it can inadvertently capture passwords or personal content. Abloomify's device agents skip this category entirely: no screenshots, no keyloggers, no screen recording.
Q: Is monitoring legal even if employees don't like it?
A: Legal and defensible aren't the same thing. About 1 in 6 workers say they'd quit a job over surveillance-style monitoring, per 2026 research, and a Personnel Psychology meta-analysis found no evidence that monitoring actually improves performance. Staying inside the law doesn't guarantee you keep the trust, or the talent.
Workplace Surveillance Laws: The Federal Baseline Every Employer Starts From
Every state's employee monitoring rules sit on top of one federal law: the Electronic Communications Privacy Act of 1986 (ECPA), which governs when employers can intercept electronic communications like email, phone calls, and network traffic. ECPA gives employers two broad paths to lawful monitoring. The business-use exception lets you monitor communications in the ordinary course of business on equipment and networks you own, which covers most day-to-day IT, security, and productivity monitoring. The consent exception covers monitoring an employee has agreed to, usually through an acceptable-use policy signed at onboarding, a monitoring notice in the employee handbook, or a click-through banner at login. Neither exception is a blank check: courts have pushed back when monitoring strays into personal accounts accessed on a work device, or when it captures content well beyond what business use requires. Federal law sets the floor. States build the rest of the wall on top of it.
In practice, most employers satisfy ECPA with a written policy that says monitoring happens, what's monitored, and why, then get employees to acknowledge it at hire. That single document is also your best defense if a state adds its own notice requirement on top, since you're usually already halfway there.
One-Party vs. Two-Party Consent States (and Why It Matters for Call Recording)
Consent law is where employee monitoring laws by state diverge the most, and it splits into two camps. In one-party consent states, which cover the majority of the country, only one participant in a conversation needs to agree to it being recorded, and as the employer providing the phone line, meeting software, or call-recording tool, you generally count as that one party. In two-party, also called all-party, consent states, everyone in the conversation has to agree before it's recorded, which changes how you configure call recording, meeting transcription, and any tool that captures audio. States commonly categorized as two-party consent include California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania, and Washington, though exact rules and carve-outs vary by state, so confirm the current statute with counsel before rolling out call recording company-wide.
| Consent model | What it means | Example states |
|---|---|---|
| One-party consent | Employer's own participation in the call covers the recording | Most US states |
| Two-party (all-party) consent | Every participant must agree before recording | California, Connecticut, Illinois, Massachusetts, Washington, and others |
This distinction is about recording conversations specifically, wiretap-style statutes, not a blanket rule for every kind of monitoring. Tracking app usage, reviewing company email, or watching aggregated productivity metrics is governed separately, mostly by the notice and consent rules covered next.
The Three States With Explicit Electronic Monitoring Notice Laws
Connecticut, Delaware, and New York are the three states with monitoring-specific notice laws on the books, and each requires you to tell employees before you start, not after. Connecticut General Statutes § 31-48d, in place since 1998, requires employers to give prior written notice of electronic monitoring, typically posted somewhere employees will see it, with an exception for monitoring tied to a specific investigation of wrongdoing. Delaware's law (19 Del. C. § 705) works almost the same way: written or electronic notice before monitoring begins, acknowledged by the employee. New York's Labor Law § 203-c, effective since May 2022, requires employers to provide written notice and get a signed or electronic acknowledgment before monitoring employee email, internet usage, or phone activity. More states have introduced similar bills in recent legislative sessions, so treat this list as the floor, not the ceiling, and check your state's current session before assuming you're exempt.
The practical takeaway is the same across all three: build your notice into onboarding, keep proof employees acknowledged it, and don't wait for a state to pass a law before you start being transparent about what you monitor. It costs you nothing today, and it's the exact paper trail you'll want if a regulator, or an employee, ever asks.
What Actually Counts as "Monitoring" in 2026
The legal definition of monitoring hasn't kept pace with what monitoring software actually does, and that gap is where most employer risk lives. Screenshots, keystroke logging, screen recording, webcam capture, GPS tracking on company vehicles or phones, email and chat content scanning, and biometric timeclocks, which trigger separate laws like Illinois's Biometric Information Privacy Act, all count as monitoring in the eyes of regulators, even though only a handful of states name them individually. The more invasive the method, the more likely it crosses from "monitoring" into something that needs its own consent, its own notice, or its own policy language, because it's capturing content, not just activity. A tool that logs which app category someone used, and for how long, is a very different legal and trust conversation than one that's recording every keystroke or taking a screenshot every ten minutes.
This is also where the vendor you pick starts to matter as much as the state you're in. ActivTrak, Insightful, and Time Doctor all offer some combination of screenshots, keystroke logging, or screen recording as core features, which means every one of those data points needs its own legal review, in every state you operate in. A platform that never captures that content in the first place sidesteps most of that review because there's nothing to review.
Legal Doesn't Mean Safe: The Trust Cost of Getting It "Right"
Staying inside employee monitoring laws by state doesn't mean employees will accept being monitored, and the data on this isn't close. About 1 in 6 workers say they'd quit a job over surveillance-style monitoring, according to 2026 research, and a meta-analysis published in Personnel Psychology found no evidence that monitoring actually improves performance, which means a lot of employers are absorbing all the legal risk and the trust cost for a return that doesn't show up in the data. Compliance is the floor. It was never designed to answer the question employees actually ask, which is why does my employer need to see this.
How to Build a Monitoring Program That Doesn't Need a Legal Workaround
The employers who avoid both the legal risk and the trust cost tend to do the same three things: they monitor outcomes instead of content, they disclose what they collect before they collect it, and they pick a data source that was never going to trigger a two-party consent question in the first place. Outcome data, PR cycle times, deal velocity, capacity utilization, app-category usage, answers "is this person doing the work" without ever touching what was typed, said, or shown on screen, which means it clears the ECPA content bar, the state notice bar, and the wiretap-consent bar all at once, because there's no content to capture. That's the difference between measuring productivity without screenshots and building a legal review around every new monitoring feature you ship.
I built Abloomify's two data layers specifically so our own legal team never has to check a state-by-state monitoring notice list before a customer turns us on. The first layer is 100+ API integrations into tools you already use, GitHub, Jira, Google Workspace, Microsoft 365, pulling PII-free signals only: no email content, no message content, no file content. The second is an optional privacy-first device agent for Mac and Windows that reports aggregated usage and productivity metrics, no screenshots, no keyloggers, no screen recording, no content capture. Both layers are SOC 2 Type II certified and built to be GDPR and EU AI Act compliant by design. It's the same visibility a monitoring tool buyer wants, without the consent-law homework, and it's the same reason customers moving off tools like ActivTrak land on a privacy-first alternative instead of a stricter monitoring policy.
Compliance gets you out of a lawsuit. It's never once gotten anyone to stay.
FAQ
Is it legal to monitor employees without their knowledge?
In most states, yes, as long as it's on company-owned devices or accounts and doesn't violate wiretap consent rules for recorded conversations. Connecticut, Delaware, and New York are exceptions: all three require written notice before monitoring starts, regardless of intent. Best practice everywhere is disclosure first, since it costs nothing and removes the question entirely.
Do employee monitoring laws apply to remote and hybrid workers?
Yes. The legal analysis doesn't change based on where an employee is sitting, only based on what device, account, or network is being monitored and which state's law applies, typically the employee's work location, not the company's HQ. A remote employee in a two-party consent state still triggers that state's recording rules even if headquarters is elsewhere.
What is a workplace video surveillance policy, and do I need one?
A workplace video surveillance policy documents where cameras are placed, what they capture, who can access footage, and how long it's retained. It matters because several states restrict cameras in areas with a reasonable expectation of privacy, like bathrooms and locker rooms, and some require notice of camera placement. If you use physical cameras anywhere in your facility, a written policy is close to mandatory practice, not optional.
Can an employer read personal email on a work computer?
It depends on whether the account is personal or company-issued, and whether your policy says personal use of company equipment isn't private. Courts have generally sided with employers who clearly disclosed that company devices and networks are monitored, and against employers who accessed a personal webmail account through captured credentials without that disclosure.
Is GPS tracking of company vehicles legal?
Generally yes for company-owned vehicles used for business purposes, and several states have specific carve-outs allowing it. It gets legally murkier when the tracking covers a personal vehicle used for work or continues outside work hours, so most compliant programs limit GPS tracking to company assets and business hours only.
What happens if an employer violates state employee monitoring laws?
Penalties vary by state, from civil fines to employee lawsuits for damages, and violations of notice laws like Connecticut's or New York's can also surface as evidence in a broader wrongful-termination or retaliation claim, even when the monitoring itself wasn't the root issue. IT and HR leaders evaluating a monitoring vendor should ask upfront whether the tool captures content that could trigger these laws at all.
This article is general information, not legal advice. State employee monitoring laws change often. Confirm current requirements with employment counsel before you deploy monitoring in a new state.
Amir Tavafi
Co-Founder & CEO
Product leader and innovator with over 15 years of experience in the tech sector, grounded in AI and robotics. Previously led product development in fraud detection and AI solutions at Nasdaq Verafin.