Can My Employer Use My Webcam or a Keylogger? Where the Law Draws Lines

These are the two monitoring tools people fear most, and the law treats them differently. A keylogger on a company-owned computer, disclosed in a policy, is lawful for a private employer in every US state; the liability starts when the keystrokes captured include passwords to your personal accounts and the employer uses them, which courts have treated as unauthorized access under federal law. Webcam monitoring has almost no US case law at all. No statute bans an employer from activating a camera on a company device, but recording in private places, capturing audio without consent, and demanding a camera stay on all day each run into criminal, wiretap or proportionality limits, and the one court anywhere to rule on compelled all-day webcam monitoring found it unlawful.

This guide covers what each tool captures and which products include it, the statutes that apply (the Wiretap Act, the Stored Communications Act, state eavesdropping and voyeurism laws, California's 2027 ban on emotion-inferring surveillance), the cases, how to check whether your camera or keystrokes are being captured, and what to do about it. The employer-side rules are in our ethical monitoring playbook.

Which tools do this

Keystroke logging is therefore a feature of security-oriented monitoring, not of time tracking; the time trackers most employers use say explicitly that they do not record keystrokes, only whether input occurred. Webcam capture is rarer still, and the main places employees encounter a required camera are video calls, remote exam proctoring and a few outsourcing contracts that demand it. Management and security tools (Intune, Jamf, Defender, CrowdStrike) can technically enable a camera but are not configured to monitor employees and would show in the device's camera permission list if they did.

Keyloggers: what the law says

No federal statute and no state statute bans an employer from installing keystroke logging software on a computer it owns. The Wiretap Act, 18 USC 2511, prohibits intercepting an electronic communication in transit without consent, and in United States v. Ropp (C.D. Cal., 2004) a court held that a hardware keylogger between keyboard and computer did not intercept anything, because keystrokes traveling inside one machine are not a communication in interstate commerce. Employee consent through an acknowledged policy, under 2511(2)(d), covers the rest, and New York, Connecticut and Delaware require only that the monitoring be disclosed.

The liability arrives in two steps that often follow. First, a keylogger captures everything typed, including the password to your personal Gmail, your bank and your health portal. Second, someone uses it. In Brahmana v. Lembo (N.D. Cal., 2009) an employer's keylogger captured an employee's personal email password, which was then used to read his account; the Wiretap Act claim survived dismissal because the court found the keystrokes could have been acquired as they traveled to the mail server. In Rene v. G.F. Fishers (S.D. Ind., 2011) a keylogger captured an employee's personal email and banking passwords; the Stored Communications Act claim for the subsequent account access survived. The rule those cases leave is that capturing the password may be lawful and using it is not, and that an employer which captures credentials it has no right to use has created a liability it can only avoid by never looking. Our personal email guide covers the account-access cases in full.

Two other limits apply. Keystroke data that records union or protected group activity is evidence of unlawful surveillance under the National Labor Relations Act whatever the policy says. And a keylogger that captures privileged communications with a lawyer, medical information or protected class information gives the employer knowledge it may later wish it did not have in a discrimination or retaliation case.

Webcams: what the law says

There is no US statute addressing employer activation of a webcam on a company device, and we found no US court decision on the question. The applicable law is assembled from four places:

• Video voyeurism and private-place statutes. Every state criminalizes recording a person in a state of undress or in a place where they have a reasonable expectation of privacy, such as a bathroom or bedroom; California Labor Code 435 bars audio or video recording in restrooms, locker rooms and changing rooms. A webcam on a laptop in an employee's bedroom, activated without notice, can meet those definitions, and the employer cannot control where the laptop is.
• The intrusion tort. Hernandez v. Hillsides (California Supreme Court, 2009) found that employees had a reasonable expectation of privacy in an enclosed office against a hidden camera, and that a covert camera is an intrusion, excused there only because it was narrowly aimed, operated at night and never recorded the plaintiffs. A webcam capturing an employee's home does not have those excuses.
• Proportionality. In the only reported decision on compelled remote webcam monitoring, a Dutch court in October 2022 ordered Chetu, a Florida software company, to pay about €75,000 to a remote employee it dismissed for refusing to keep his webcam on for nine hours a day, holding the demand a disproportionate interference with his private life. The ruling is under European law and does not bind a US court, but it is the case US lawyers cite when advising against the practice, and the Fourth Amendment reasoning in Ogletree v. Cleveland State University (N.D. Ohio, August 22, 2022), which held a remote proctoring room scan of a student's bedroom unreasonable, applies directly to public employers.
• Notice law. New York, Connecticut and Delaware require written notice of electronic monitoring; a webcam feature not described in the notice is a violation. Connecticut's Public Act 26-73 (October 1, 2026) requires location-specific notices, which for a remote worker means the home.

For a private employer outside those states, then, requiring a camera on during video calls is unremarkable, periodic webcam snapshots on a company laptop under a clear policy are probably lawful but have never been tested, and covert webcam activation is close to indefensible because the employer cannot know what room it is recording.

Microphones and audio: the strictest rules

Audio is where monitoring most often becomes a crime. The federal Wiretap Act allows recording with one party's consent, but California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania and Washington require the consent of all parties to a private conversation, with criminal penalties and, in California (Penal Code 632), statutory damages of $5,000 per violation. A microphone activated by monitoring software in an employee's home captures family members who have consented to nothing. Call recording with an announcement at the start of each call is lawful everywhere because the announcement obtains consent; ambient recording by a laptop is not, which is why no mainstream monitoring product offers it. AI meeting assistants that record and transcribe calls are the live version of this problem and are the subject of class actions against Otter.ai and Granola; our AI notetaker consent guide covers them.

California's 2027 rules

Two California laws effective January 1, 2027 are the first US statutes aimed at the newest forms of these tools. AB 1883 bars workplace surveillance technology that infers an employee's emotional state, and the collection of neural data, with a $500 penalty per violation; a webcam analytics tool that scores attention or mood from facial expression falls within it, and the governor's signing message asked for clarifying legislation in 2027. AB 1331 bars monitoring in workplace bathrooms, changing rooms, break rooms designated for personal use and similar areas, and extends to monitoring employees in their homes outside working time through employer devices, also at $500 per violation. California's constitutional privacy right and Penal Code 632 already provided the background; these add specific duties. Our January 1, 2027 roundup lists them with the other changes.

How to check your own device

1. Camera and microphone permissions. On a Mac, System Settings, Privacy and Security, Camera and Microphone list every application permitted to use them; an agent cannot capture without appearing there (hardware-level bypasses exist in theory and would be a far bigger problem than monitoring). On Windows 10 and 11, Settings, Privacy and security, Camera and Microphone show "Recently accessed" for each app with a timestamp, which is the best after-the-fact check.
2. The indicator light. On Apple laptops since 2008 the camera indicator is wired to the camera's power so that it lights whenever the sensor is active; researchers showed in 2013 that older models could be bypassed through firmware, and Apple has since hardened the design. Many Windows laptops have a similar light, some do not. Treat the light as reliable evidence of capture when on and as moderately reliable evidence of no capture when off.
3. Keystroke capture. There is no permission list for keyloggers on Windows. On a Mac, System Settings, Privacy and Security, Input Monitoring lists applications allowed to observe keystrokes; a keylogger must be there. On Windows, look for the monitoring products named above in Task Manager and installed apps; our detection guide has the process names. Hardware keyloggers, small devices between the keyboard cable and the computer, are detectable only by looking.
4. The policy. If the handbook or the New York, Connecticut or Delaware notice mentions keystroke logging or camera capture, it is in use somewhere. If it does not, the employer in those states cannot lawfully use it without updating the notice.
5. A camera cover is the only control over a company laptop's camera that depends on nothing the employer configured. Tape works.

What to do if you find one

• Do not remove it. Disabling software on a company device is almost always a policy breach and may be treated as misuse. Cover the camera, which no policy forbids.
• Stop typing personal credentials on the device immediately, change any personal passwords you have typed on it from another device, and turn on two-factor authentication. This is the step that matters whatever the law says.
• Ask in writing what is captured, how often, who reviews it and how long it is kept. In New York, Connecticut and Delaware you are entitled to that notice and can complain to the Attorney General or Labor Commissioner if it was never given.
• If the camera was active in a private space, or audio was recorded without consent in an all-party state, these are potential criminal matters; preserve the evidence (permission logs, timestamps, the indicator light if you can photograph it) and consult a lawyer before confronting the employer.
• If you are in a union, new keystroke or camera monitoring is a mandatory bargaining subject; tell your representative.
• Raising the issue with colleagues is protected concerted activity under the National Labor Relations Act whether or not you are unionized; our refusing monitoring guide covers what protection that gives and what it does not.

Key takeaways

• Keystroke logging on a company computer is lawful for private employers in every state when disclosed; it is offered by security-focused tools (Teramind, Veriato, InterGuard) and not by mainstream time trackers.
• The liability comes from using captured personal passwords: Brahmana (2009) and Rene (2011) let Wiretap Act and Stored Communications Act claims proceed against employers that did.
• No US statute or court decision addresses employer webcam activation directly; private-place recording laws, the intrusion tort (Hernandez v. Hillsides) and notice laws apply, and a Dutch court awarded about €75,000 against a US company for demanding nine hours a day of webcam (Chetu, 2022).
• Audio is the strictest: twelve states require all-party consent to record private conversations, California at $5,000 per violation, which rules out ambient microphone monitoring.
• California bans emotion-inferring surveillance (AB 1883) and bathroom and off-duty home monitoring (AB 1331) from January 1, 2027, at $500 per violation.
• Check camera and microphone permission lists and Windows' Recently accessed timestamps; on a Mac, Input Monitoring lists keystroke observers. A camera cover is the only control you fully own.
• If you find one, do not remove it; stop typing personal credentials on the device, change them elsewhere, and ask in writing what is captured.