Employee monitoring laws in United States
Yes, and federal law is permissive about monitoring company systems — but several states now require advance written notice, and the state rules rather than the federal baseline are what a multi-state rollout has to be designed against.
Who has to agree before you start
The fact that decides the timeline, and the one that differs most between countries.
Staff must be told, in a prescribed way
No works council structure and no consultation duty outside a unionised workplace, where introducing monitoring may be a mandatory subject of bargaining under the National Labor Relations Act. The binding obligations are state notice requirements, which attach to the employee's location rather than the employer's.
No representative body has to agree, but the notice has a required form and timing — Poland's two weeks, New York's written notice on hiring, the ICO's expectation of genuine transparency. These rollouts move fastest, and the notice is the thing most often got wrong.
No general federal employee-privacy statute. The Electronic Communications Privacy Act sets a permissive federal baseline for monitoring company systems, and specific states — New York, Connecticut and Delaware among them — impose notice requirements on top.
The law that applies in United States
Named so you can check us, and so your own counsel has somewhere to start.
| Instrument | What it requires |
|---|---|
| New York Civil Rights Law § 52-c | Requires private employers with a place of business in New York to give prior written notice on hiring to employees subject to monitoring of telephone, email or internet use, obtain written or electronic acknowledgement, and post the notice conspicuously. Enforced by the Attorney General, with penalties of $500, $1,000 and $3,000 for successive offences; there is no private right of action. |
| Connecticut Gen. Stat. § 31-48d | Requires employers to give prior written notice of the types of electronic monitoring that may occur and to post that notice conspicuously, subject to a limited exception for monitoring during an investigation of suspected unlawful conduct. |
| Delaware 19 Del. C. § 705 | Requires employers to give notice before monitoring telephone, email or internet usage, either by a one-time written or electronic notice acknowledged by the employee, or by a daily electronic notice. |
| Electronic Communications Privacy Act, 18 U.S.C. § 2511 | Prohibits interception of electronic communications but carries business-use and consent exceptions that make monitoring of company-provided systems broadly permissible at federal level — which is why the constraints that matter are at state level. |
| California Consumer Privacy Act, as amended by the CPRA | Extends consumer privacy rights to employees and applicants of covered businesses, including notice at collection of the categories of personal information collected and the purposes — which functions as a de facto monitoring notice requirement in California. |
How a rollout is done here
- Map where employees actually are, not where the company is. State notice duties follow the worker, and a remote workforce can pull in states nobody planned for.
- Issue written notice before monitoring begins, and collect acknowledgement where the state requires it — New York and Delaware both do.
- Post the notice conspicuously where employees can see it; New York and Connecticut both require posting in addition to individual notice.
- Include the monitoring in the California notice at collection if you have covered California staff.
- In a unionised workplace, check whether introducing monitoring is a mandatory subject of bargaining before deploying it.
- Re-issue notice when the scope of monitoring changes materially.
What gets a rollout refused
- Designing to the federal baseline and missing the state layer. The ECPA's permissiveness is not the operative rule for a workforce spread across states.
- Notifying existing employees but missing the on-hire notice for new joiners, which is the form several statutes specifically prescribe.
- Forgetting the conspicuous posting requirement, which is separate from individual notice and is the easiest element to omit.
- Assuming remote workers are governed by the headquarters state.
- Ignoring state biometric statutes if the monitoring stack ever touches biometric identifiers; those carry private rights of action and statutory damages that the notice statutes do not.
Monitoring staff in United States — questions
Is employee monitoring legal in the United States?
Monitoring of employer-provided systems is broadly lawful at federal level, where the Electronic Communications Privacy Act's business-use and consent exceptions apply. The real constraints are state notice statutes — New York, Connecticut and Delaware require advance written notice, and California's privacy law requires notice at collection for covered employers.
Which states require notice before monitoring?
New York (Civil Rights Law § 52-c, in force since 7 May 2022), Connecticut (§ 31-48d) and Delaware (19 Del. C. § 705) impose specific electronic monitoring notice requirements. California's CCPA, as amended by the CPRA, requires notice at collection covering employee personal information. Others impose related duties, so the list should be checked against your actual footprint.
Do we need consent?
Generally no — the US statutes are notice statutes rather than consent statutes, though New York and Delaware require the employee to acknowledge the notice. That acknowledgement is evidence that notice was given, not consent to the monitoring.
Does a union change anything?
It can. Introducing electronic monitoring may be a mandatory subject of bargaining under the National Labor Relations Act, and the National Labor Relations Board has taken an active interest in surveillance that could interfere with protected concerted activity. In a unionised workplace this should be settled before deployment.
Sources and scope
Primary source: United States regulator and statute references, last read 2026-09-17.
This page is a plain-English summary of published law and regulator guidance, not legal advice, and it is not a substitute for advice on your own facts. Employment and data protection law changes; each page states the date its sources were last read. Before monitoring staff anywhere, take advice from qualified counsel in that country.
See where the hours actually went
Free for up to three people. Windows and macOS. No keystroke content on any plan, and screenshots off unless an administrator turns them on.