WorkAuditor Blog

Do you need employee consent to monitor company computers? In most US states, the honest answer is no — a clear, published notice is legally sufficient, because continuing to use company equipment after receiving that notice counts as implied consent. But that general rule has meaningful exceptions, and the employers who assume it covers every situation are the ones who call me after the demand letter arrives.

A client once treated a single line in the employee handbook — "company devices may be monitored" — as blanket consent for a tool that recorded audio during video calls. The tool was legal in his state's neighbor, but not where his employees actually sat. The distinction between notice and consent isn't academic; it's a state-line problem.

The general US rule: notice, not a signature

Under the federal Wiretap Act, one-party consent is enough to monitor communications, and courts stretch that principle to cover employer monitoring on company systems. The consent can be implied: when a policy says monitoring occurs and the employee keeps working, most courts treat continued use as consent. That's why a written policy, a login banner, and an onboarding acknowledgment carry almost all the legal weight in most states — none of them requires a signature on a consent form.

Where explicit consent is actually required

The exceptions are specific and worth memorizing:

• Connecticut requires written notice before electronic monitoring begins, and courts there have been strict about the employer's burden.
• Delaware requires written notice tied to company-issued devices and phone and computer usage.
• All-party consent states — California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, and Washington among them — require consent from every party before recording a conversation, which includes audio captured by monitoring tools.
• Unionized workplaces: collective bargaining agreements frequently require negotiation or explicit consent before monitoring changes. The National Labor Relations Act protects employees who discuss working conditions, and monitoring aimed at union activity is an unfair labor practice.
• Illinois: biometric systems (fingerprint scanners, face-scanning time clocks) require signed, specific consent under the state's biometric privacy law.

When implied consent fails you

Implied consent has preconditions, and employers lose it when:

1. There's no policy at all — nothing to imply consent from.
2. The policy exists but was never shared with the affected employees.
3. Monitoring is hidden or covert, which undermines the notice entirely.
4. The tool reaches into personal accounts or private spaces where the employee reasonably expects privacy.
5. The policy says one thing and the software does another — collecting more than what was disclosed.

A logistics firm I worked with had a beautiful monitoring policy and a keylogger that captured passwords for personal banking sites anyway. The mismatch, not the monitoring, was the legal problem. Whatever you disclose, the software must match it.

Unions, contracts, and promises you've made

Beyond the law, your obligations can come from the deal itself. Collective bargaining agreements, employment contracts, and employee handbooks that promise privacy create enforceable expectations. If your handbook says "email is private and will not be read," that's a promise you've made — and monitoring email afterward is a breach, regardless of what the default rule would have allowed. Review your own documents before you review your software.

The GDPR and EU employees: consent is a trap

If any employee is in the EU, the consent calculation reverses. Under GDPR, consent in the employment context is presumptively not freely given due to the power imbalance, and regulators expect employers to rely on legitimate interest with a documented balancing test instead. The mechanics deserve their own guide, but the rule of thumb is: in the US, notice usually suffices; in the EU, consent usually shouldn't be your legal basis.

A simple decision flow

When a client asks whether they need consent, I walk them through four questions:

1. Which states do employees work in? (Connecticut, Delaware, and all-party consent states — yes to consent forms.)
2. Is any employee in the EU? (Consent is the wrong tool; use legitimate interest plus transparency.)
3. Are there unions or contracts that promise privacy? (They override defaults.)
4. Does the tool capture audio, biometrics, or personal-account content? (Each raises the consent bar.)

If the answer to all four is "no," a written policy plus signed acknowledgment is defensible. If any answer is "yes," run the specifics past counsel before launch.

Do you need employee consent to monitor company computers? Usually not — but "usually" is doing a lot of work, and the exceptions are exactly where lawsuits live. When you do need consent, the form itself matters, and the clauses that make one hold up are worth a separate checklist. For monitoring that keeps your disclosure honest, WorkAuditor is a cloud-based employee monitoring software for Windows and Mac with collection scopes you can configure to match exactly what your policy promises. See it at https://www.workauditor.com.