Employee Monitoring

US federal rules

The main federal law is the Electronic Communications Privacy Act of 1986, which includes the Wiretap Act and the Stored Communications Act. Two exceptions let most employers monitor work communications:

• Business use exception: monitoring business calls on business equipment in the ordinary course of business. Once the employer realizes a call is personal, it should stop listening.
• Consent exception: monitoring is allowed if one party to the communication consents. Employers get consent through policies and acknowledgments signed at hire.

The National Labor Relations Act adds a limit: monitoring that targets union or other protected concerted activity, or creates the impression that such activity is being watched, can be an unfair labor practice. The ADA limits collecting and using medical information, which some wellness and productivity tools can capture.

Call recording consent and contact centers

Federal law and most states require only one party's consent to record a call. A minority of states require the consent of all parties, including California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, and others have all-party rules in some situations. A call between a customer in one state and an agent in another may be governed by the stricter rule.

That is why contact centers play "this call may be monitored or recorded for quality and training purposes" and record agent consent in onboarding paperwork. Quality monitoring, screen recording and speech analytics are standard and lawful when disclosed. The call monitoring entry covers how quality teams use them.

PCI rules on card data and HIPAA rules on health information also affect what can be recorded and kept. Pause-and-resume or automatic redaction for payment details is common.

State notice, biometric and privacy laws

Several states require employers to tell employees about electronic monitoring in advance. New York's law, effective in 2022, requires written notice at hiring, an employee acknowledgment, and a posted notice. Connecticut and Delaware have notice laws too.

Biometric privacy laws are where large damages have occurred. Illinois' Biometric Information Privacy Act (BIPA) requires written notice, a written release and a published retention policy before collecting fingerprints, face scans and similar data, including for timeclocks. It gives employees a private right of action, which led to many class actions; a 2024 amendment limited damages to one recovery per person rather than per scan. Texas and Washington have biometric laws enforced by the state.

California's privacy law (the CCPA as amended by the CPRA) has applied to employee data since 2023, requiring a notice at collection and giving employees rights to know, correct and delete some data. Other states have passed comprehensive privacy laws, mostly with employee data exemptions. Rules vary by state, so check each one where you have staff.

Remote and work-at-home employees

Remote work pushed monitoring into homes: keystroke logging, periodic screenshots, webcam checks, idle-time tracking and location data. For a work-at-home agent program, the practical rules are:

• Monitor company devices and systems, not personal devices beyond a managed work profile.
• Do not turn on webcams or microphones covertly. Camera-on requirements should be limited to specific purposes, such as identity checks or coaching sessions, and disclosed.
• Stop location tracking when the employee is off duty.
• Do not use idle-time data alone to cut pay for non-exempt employees; time worked must be paid under the FLSA, and false "idle" flags lead to wage claims.
• Tell employees in writing exactly what is collected, why and who sees it.

Overly intrusive monitoring also raises attrition. Agents who feel watched by every keystroke leave, and in a 400-seat remote program that cost shows up in recruiting budgets quickly.

Europe: GDPR, works councils and the AI Act

Under the GDPR, monitoring employees requires a lawful basis, which is usually legitimate interests rather than consent because employee consent is rarely considered freely given. It must be necessary and proportionate, transparent, limited to its purpose and, for systematic monitoring, usually preceded by a data protection impact assessment. Covert monitoring is allowed only in narrow cases. See GDPR in recruitment for the related candidate rules.

In Germany and several other countries, works councils have co-determination rights over technical systems that can monitor employee behavior or performance, so tools cannot go live without agreement.

The EU AI Act prohibits AI systems that infer emotions in the workplace, except for medical or safety reasons, from February 2025. AI systems used to monitor and evaluate workers' performance and behavior are classed as high-risk, with obligations for providers and deployers phasing in.

A practical monitoring policy

Write a policy that lists each type of monitoring, the purpose, who can access the data, how long it is kept and how employees can raise concerns. Have every employee acknowledge it at hire and when it changes. Review new tools with HR, legal and IT before rollout, and ask whether a less intrusive method would meet the same goal. This page is informational, not legal advice.