WorkAuditor Blog

Is employee monitoring software legal in the US? Yes — in most cases, American employers can lawfully track work activity on company-owned devices, provided they tell employees what they're doing and keep the scope reasonable. That's the short answer. The long answer is where compliance problems actually start, and it's the question I hear most often from HR leaders and founders.

A client called me last year after a viral headline claimed keystroke logging was "basically illegal." She had already told her team she planned to roll out monitoring, so nothing had gone wrong yet — but she was minutes from deleting a fully configured deployment. We worked through the actual legal framework in an hour. The software went live the next week with a written disclosure and a scoped policy. Nothing in her situation required scrapping the plan. She needed structure, not abandonment.

The federal baseline: the ECPA

The Electronic Communications Privacy Act of 1986 is the backbone of US workplace monitoring law, and it's really two statutes in one:

• The Wiretap Act (18 U.S.C. § 2511) bars intercepting wire, oral, or electronic communications while in transit — unless a party to the communication consents.
• The Stored Communications Act (18 U.S.C. § 2701) protects messages stored on servers, but it restricts third-party providers, not employers who own their own network.

Employers lean on the consent exception under the Wiretap Act. That consent can be explicit (a signed acknowledgment) or implied (a published policy stating that company systems are monitored). Federal courts have repeatedly held that an employee who keeps using a company computer after receiving a monitoring policy has consented. The reasoning is straightforward: a workplace machine is employer property, and the employee's privacy interest in its day-to-day use is minimal.

The Stored Communications Act rarely trips up employers when messages live on company servers and the employer acts within its own network. It does protect employee content held by third parties — a personal Gmail inbox, for instance — which is a separate topic I'll touch on below.

The common law layer: reasonable expectations

Every state also recognizes the tort of intrusion upon seclusion. This is the courts' escape valve when monitoring crosses a line. The test has two prongs: whether the employee had a reasonable expectation of privacy in the circumstances, and whether the intrusion would be highly offensive to a reasonable person.

This is why monitoring that's fine in an open office becomes unlawful in a bathroom, a locker room, or a remote employee's bedroom. It's also why cameras are the riskiest tool in the box. A small manufacturer once showed me a webcam app running silently on warehouse desktops. Nobody had been told. No lawsuit followed, but an employee noticed, the story reached the local news, and the company spent a month managing the fallout. The fix, which arrived late, was cheap: visible notice, a narrow policy, and cameras pointed only at work surfaces.

The state layer: all-party consent states

Federal law sets a one-party consent floor for recording conversations, but around a dozen states — California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, and Washington among them — require all parties to consent to the recording of a private conversation. In those states, recording audio without notice can carry criminal penalties, not just civil exposure.

Notice the word "audio." Screen activity, keystrokes, and app usage are regulated much more loosely than recorded speech. That's why many employers monitor screens and productivity but disable audio capture entirely. If you operate in an all-party consent state and need to record calls for training, you need explicit employee consent and, ideally, a signed form.

Where monitoring crosses the line

Across federal, state, and common law, monitoring becomes unlawful when any of these are true:

1. It runs without any notice or policy, which defeats consent.
2. It captures audio in an all-party consent state.
3. It reaches private areas or off-duty behavior with no business justification.
4. It harvests content from clearly personal, password-protected accounts.
5. It uses hidden tools — covert monitoring undermines consent and invites the largest damages.

What I tell every client

Is employee monitoring software legal in the US? Yes, when it's disclosed, scoped to work activity, and limited to company systems. The companies that get sued almost never have a written policy; the ones that defend themselves successfully almost always do. Write the policy first, tell employees what you collect and why, restrict who can see the data, and have local counsel review the package before launch. State laws change, and a thirty-minute attorney review is cheaper than a class action.

If you're ready to set this up the transparent way, WorkAuditor is a cloud-based employee monitoring software for Windows and Mac built around visible, policy-aligned activity reports. You can review the feature set at https://www.workauditor.com.