Employee Monitoring Laws by U.S. State

Reviewed for accuracy by Tarun Kumar Reddy on October 14, 2026.

There is no federal statute requiring an American employer to tell staff they are being monitored. Monitoring company equipment is broadly lawful across the United States, and the binding constraints come from a small number of states, from the federal wiretap rules that govern intercepting communications, and from whatever you promised your own workforce in writing. That combination is why a policy that is fine in one office can carry a penalty two states away.

Three states have a dedicated electronic monitoring notice law: Connecticut, Delaware, and New York. This page states what each one requires, quotes the penalty amounts, and links the statute so you can read it rather than take our word for it. It is not legal advice, and the obligation attaches to the employer rather than to whichever vendor sold the software.

The four states with a notice law

These are the states where electronic monitoring itself triggers a written notice duty. Every other state regulates monitoring through general privacy, wiretap, or recording law rather than through a monitoring specific statute. The notice wording each of those states requires is set out in our policy template with the notice clauses written out.

Connecticut

Connecticut General Statutes section 31-48d defines electronic monitoring as collecting information on the employer's premises about employees' activities or communications by any means other than direct observation. An employer doing any of it must give prior written notice to every affected employee describing the types of monitoring, and must post a notice in a conspicuous place where employees can read it.

There is an exception, and it is narrower than it first appears. An employer may monitor without prior notice where it has reasonable grounds to believe employees are engaged in unlawful conduct, in conduct that violates the legal rights of the employer or other employees, or in conduct creating a hostile workplace, and where the monitoring may produce evidence of it. That is a specific suspicion about identified conduct, not a general standing justification.

Penalties run to $500 for a first offense, $1,000 for a second, and $3,000 for a third and each subsequent one, levied by the Labor Commissioner after a hearing. Connecticut courts have held there is no private right of action, so enforcement runs through the Commissioner rather than through employee lawsuits.

Delaware

19 Delaware Code section 705 takes a different approach. Rather than a single notice at hire, an employer monitoring or intercepting telephone transmissions, email, or internet usage must either give an electronic notice at least once on each day the employee accesses employer provided email or internet, or give a one time notice that the employee acknowledges in writing or electronically.

The acknowledgment is the part employers miss. A one time notice that nobody signed does not satisfy the statute. Either you collect an acknowledgment once, or you display a notice every single day, and the daily banner is what most systems end up implementing because it needs no record keeping. If you take the signature route instead, our employee monitoring consent form has the wording for both, and explains why acknowledgment rather than consent is what the statute is asking for.

The penalty is $100 for each violation, which sounds trivial until you consider that the statute reads per violation rather than per employer, and that a claim can be filed in any court of competent jurisdiction rather than routed through a state agency.

New York

New York Civil Rights Law section 52-c requires an employer that monitors telephone conversations, email, or internet access by any electronic device to give prior written notice upon hiring to every employee subject to it. The notice must be in writing or electronic form and must be acknowledged by the employee, and a copy must be posted conspicuously where affected employees will see it.

The exemption covers processes designed to manage the type or volume of email, voicemail, or internet usage that are performed solely for computer system maintenance or protection. Spam filtering and capacity management sit inside it. Reading what an employee wrote does not.

Penalties are up to $500 for a first offense, $1,000 for a second, and $3,000 for a third and each subsequent offense, enforced by the Attorney General.

Maine

Maine is the newest and the broadest. 26 M.R.S. section 620-A, enacted as L.D. 61 and in force since 14 July 2026, covers employer surveillance generally rather than a named list of channels, reaching cameras, GPS, keystroke logging and biometric collection.

The notice duty runs twice. Applicants must be told about surveillance during the hiring process, and current employees must receive written notice at least once every calendar year. The annual repeat is the part that differs from the other three, which treat notice as a one time event at hiring.

Three exceptions matter in practice: cameras used for workplace safety and security, GPS and vehicle safety systems on employer owned vehicles, and surveillance in personal care service settings. The GPS carve-out is narrower than it looks, because it covers the employer's own vehicles rather than the employee's.

The law also restricts what may be monitored rather than only requiring disclosure. Audiovisual monitoring is barred in an employee's residence, personal vehicle and personal property unless the job genuinely requires it, and an employee may decline a request to install surveillance software on a personal device. Penalties run from $100 to $500 per violation.

If you employ anyone in Maine, the practical consequence is a recurring calendar item rather than a one off task. A notice given at hire in 2026 does not satisfy the 2027 duty.

What applies in the other 46 states

Everywhere else, monitoring is governed by rules that were not written with workplace software in mind, which makes them easier to trip over.

Federal wiretap law. The Electronic Communications Privacy Act restricts intercepting communications in transit. Employers generally rely on the business use and consent provisions, and consent is far more comfortable ground than a business use argument made after the fact.

State recording consent. Roughly a dozen states require all parties to consent to recording a conversation rather than just one. If your monitoring captures audio, that rule reaches it, and it applies to the person on the other end of the call as well as your employee.

Off duty conduct and location. Several states restrict tracking employees outside working hours or on personal devices. If your agent reports location, the question of when it stops matters more than what it collects. The device side of that question is in can my employer track my laptop location.

State privacy statutes. Comprehensive privacy laws in California and a growing number of other states create access and deletion rights that reach employee data. The obligation is to have an answer when somebody asks what you hold about them.

Several states restrict what you may act on rather than what you may collect. Illinois is the clearest example: our page on the Illinois Right to Privacy in the Workplace Act covers the lawful products and personal online account rules, and the biometric statute that carries a private right of action.

Location tracking sits differently again under these statutes, and Maine expressly carves out GPS on employer owned vehicles while covering it everywhere else. Our page on employee GPS tracking works through which vehicle and whose consent decides the answer.

What to do regardless of state

The compliant version and the version people accept are nearly the same document, which makes this cheaper than it looks.

1. Write the notice before choosing software. One page: what is collected, what is not, who can see it, how long it is kept. If you cannot write it, you are not ready to buy. Our guide to writing a monitoring policy has the structure.
2. Collect an acknowledgment. Delaware requires it outright, New York requires it, and everywhere else it converts a disputed fact into a filed document.
3. Post it where the work happens. Connecticut will require the specific monitored locations from October 2026, and posting is already the cheapest part of compliance.
4. Apply the strictest rule you are subject to. With a distributed workforce, notice duties follow the employee's location rather than the head office. Running one standard is simpler than running fifty.
5. Do not deploy a hidden agent. Covert monitoring cannot satisfy a notice duty, and in a notice state it converts a policy decision into a penalty.

For what the software actually does before you decide what to disclose, our explainer on computer monitoring covers the mechanics, and the privacy line covers what should never be collected in the first place.

Automated decision tools are regulated separately again, by New York City and Illinois rather than by the monitoring statutes above. Our guide to what the AI hiring rules require sets out both.

Key takeaways

• No federal statute requires an employer to disclose monitoring. Three states do: Connecticut, Delaware, Maine, and New York.
• Connecticut requires prior written notice plus a posted notice, with penalties of $500, $1,000, and $3,000 for successive offenses, enforced by the Labor Commissioner.
• Connecticut expands on October 1, 2026 under Public Act 26-73: the notice must name the specific monitored locations, and new hires get a plain language statement.
• Delaware requires either a daily electronic notice or a one time notice the employee acknowledges, at $100 per violation, enforceable in court.
• New York requires written notice on hiring, acknowledged, plus a conspicuous posting, enforced by the Attorney General.
• Elsewhere the constraints come from federal wiretap law, all party recording consent in roughly a dozen states, off duty and location limits, and state privacy statutes.
• Notice duties follow the employee's location, not the head office, so a distributed workforce inherits the strictest rule that applies to anyone on it.