WorkAuditor Blog

The US has no single national law governing employee monitoring. Federal wiretap rules provide a baseline, but everything else depends on the state where the employee actually works. Employee monitoring laws by state differ mostly on one question — how much notice employees must receive before monitoring begins — and getting that wrong is how employers end up in court.

A client with a distributed team once asked me to validate a single policy across six states. The policy was excellent for Texas, where most of the team sat. It was inadequate for the two employees in California and Connecticut, and one in Delaware. We ended up with one master policy and three state-specific addendums. That's the reality of US workplace monitoring: you comply where the worker sits, not where your HQ is.

What federal law provides everywhere

Two federal statutes matter in every state. The Wiretap Act (18 U.S.C. § 2511) prohibits intercepting conversations and electronic communications in transit unless a party consents, and the Stored Communications Act (18 U.S.C. § 2701) protects stored messages from third-party access. Together they mean that disclosed monitoring on company systems is generally lawful in all 50 states. The differences start when states add their own requirements on top.

States with explicit monitoring statutes

Only a handful of states have statutes that speak directly to workplace monitoring, and they're worth memorizing because they change daily operations:

• Connecticut. Employers must give employees written notice before instituting electronic monitoring, with narrow exceptions for certain investigations. The state also restricts how collected data can be used.
• Delaware. Written notice is required before an employer monitors telephone or computer usage, and company-issued devices carry their own notification duties.
• California. The strictest large market. California's Invasion of Privacy Act requires all-party consent for recording confidential communications, and courts there have allowed class actions over tracking software to proceed on wiretap theories. Add the California Consumer Privacy Act, which now treats employee data like consumer data, and California employers face a genuine compliance stack.
• Everyone else: common law. Most states have no monitoring statute at all. There, the privacy analysis comes from the tort of intrusion upon seclusion: whether the employee had a reasonable expectation of privacy, and whether the intrusion is highly offensive. A published policy usually settles the first question; cameras in bathrooms settle the second against you.

The states that regulate around the edges

Beyond general monitoring statutes, targeted laws matter more than most employers expect:

• Illinois: the Biometric Information Privacy Act imposes strict consent rules and statutory damages on fingerprint, face-scan, and voiceprint systems — including time clocks and access readers.
• Maryland: employers cannot demand access to employees' personal social media accounts, and GPS tracking of employees' personal vehicles is restricted.
• Several other states have narrowly drawn rules — around recording conversations, credit checks, or social media passwords — that can surprise an out-of-state HR team.

The lesson is not to memorize all of it; it's to check the employee's state, not your own, before configuring anything.

Which state's law applies?

For remote work, the answer is usually the employee's state of residence and workplace, not your headquarters. If you're a Dallas company with a remote worker in California, you follow California's notice and consent rules for that employee. Courts regularly reject the argument that monitoring is governed by where the employer sits. If employees travel between states, rules can follow them; international movement triggers a separate set of laws entirely.

What works across state lines

You can't build one policy that satisfies every statute word-for-word, but you can build a base that no state will punish:

• Give written notice before monitoring starts.
• Collect signed acknowledgments.
• Limit monitoring to work-related activity on company devices.
• Never record audio in all-party consent states without signed consent.
• Keep personal accounts and private areas out of scope.
• Restrict data access and set retention limits.

State legislatures amend these laws regularly — California and Connecticut have both tightened their rules in recent years — so the practical habit is to re-review your monitoring setup with counsel at least once a year.

Employee monitoring laws by state reward the same behavior everywhere: disclosure first, monitoring second, and never more data than the job requires. For teams that want a head start on transparency, WorkAuditor is a cloud-based employee monitoring software for Windows and Mac with configurable collection scopes that you can align to state requirements before going live. See the platform at https://www.workauditor.com.