Employee Monitoring Lawsuits: 30 Cases, Settlements and What They Decided

The law of workplace monitoring in the United States is mostly case law, and most of the cases are about money. Thirteen Illinois biometric settlements over fingerprint time clocks total about $136 million. A truck driver class won a $228 million verdict against BNSF that was later replaced by a $75 million settlement. A New Jersey employer that read an employee's web-mail to her lawyer lost at the state supreme court; a California employer that read the same kind of email on a company computer won. The US Supreme Court upheld a city's review of an officer's pager messages while refusing to say whether he had any privacy right in them. And a Canadian accountant who sued for wrongful dismissal after her employer's time tracking software caught her logging hours she did not work was ordered to repay her employer.

This page collects the cases that actually decided something, grouped by what was monitored, with the court, the date, the money and the rule each one left behind. It covers biometric time clocks, email and messages, cameras and webcams, location and devices, time tracking data used against employees, AI hiring and recording tools, and the enforcement actions and pending cases of 2025 and 2026. Settlement figures are from court filings and settlement administrators; where a figure could only be found in secondary reports it is marked.

The numbers

Biometric time clocks: the BIPA cases

Illinois's Biometric Information Privacy Act is the only US statute that lets employees sue over monitoring technology for fixed damages without proving harm, and the result is the largest body of workplace monitoring litigation in the country. The decisions that built it:

• Rosenbach v. Six Flags (Illinois Supreme Court, January 25, 2019): a person whose fingerprint was collected without the statutory notice and release is "aggrieved" and may sue without any further injury. A consumer case, but it opened every employee case that followed.
• McDonald v. Symphony Bronzeville Park (Illinois Supreme Court, February 3, 2022): the Workers' Compensation Act's exclusivity does not bar an employee's BIPA claim against her employer over a fingerprint time clock.
• Tims v. Black Horse Carriers (February 2, 2023): five-year limitations period for all BIPA claims.
• Cothron v. White Castle (February 17, 2023): a claim accrues on every scan, not just the first. White Castle said its exposure could exceed $17 billion; the case settled in 2024 for about $9.39 million.
• Public Act 103-0769 (August 2, 2024) overrode Cothron: one recovery per person per method of collection. Gregg v. Central Transport (Seventh Circuit, April 1, 2026) held the amendment applies to cases pending when it passed; Illinois state courts have not decided.
• Rogers v. BNSF Railway (N.D. Ill.): the first BIPA jury trial, October 2022, returned $228 million for 45,600 truck drivers whose fingerprints were scanned at rail yard gates by a BNSF contractor. The judge vacated the award in June 2023 on the ground that damages were discretionary; the parties settled for $75 million in 2024. The case established that a company is liable for a vendor's collection done on its behalf.

The settlements themselves are on our biometric privacy laws by state page. The pattern across them: payroll and time clock vendors (Kronos, Ceridian, Paychex, iSolved, NOVAtime, Epay, Accu-Time, WorkEasy) were sued directly because BIPA reaches anyone who obtains the identifier, and employers (Speedway, Walmart, RR Donnelley, Lifespace, Compass) were sued whether or not the vendor had also paid. Walmart's $10 million (2021) concerned palm scanners on cash registers; Compass Group and 365 Retail Markets' $6.8 million (September 8, 2022) concerned fingerprint readers on break-room vending kiosks.

Email, messages and the expectation of privacy

The US cases draw one line consistently. Reading what passes over or sits on the employer's own systems, under a clear policy, is lawful. Logging into an employee's personal account, even with a password found on company equipment, is not, and it exposes the employer to Stored Communications Act liability and to exclusion of whatever it found. Our personal email guide walks through the distinction for employees.

Cameras, webcams and keyloggers

• Hernandez v. Hillsides (California Supreme Court, August 3, 2009): an employer installed a hidden camera in a shared office to catch someone viewing pornography at night; the two employees who used the office by day sued. The court held they had a reasonable expectation of privacy in an enclosed office and that the intrusion was real, but not "highly offensive" because the camera was narrowly aimed, operated only at night and never recorded them. The case is the template for defensible covert video: narrow purpose, narrow time, no capture of the innocent.
• Colgate-Palmolive (NLRB, 1997): installing hidden surveillance cameras is a mandatory subject of bargaining in a unionized workplace; the employer must bargain over their use, though not necessarily disclose their locations.
• Brahmana v. Lembo (N.D. Cal., 2009) and Rene v. G.F. Fishers (S.D. Ind., 2011): employers that installed keyloggers on work computers and captured employees' personal email and banking passwords faced Wiretap Act and Stored Communications Act claims that survived dismissal, because the keystrokes were acquired while being transmitted and then used to enter personal accounts. United States v. Ropp (C.D. Cal., 2004) had held a hardware keylogger between keyboard and computer was not an "interception" of an electronic communication; the civil cases distinguished it where the data left the machine.
• Chetu (Netherlands, October 2022): a Dutch court ordered a Florida software company to pay about €75,000 to a remote employee it dismissed for refusing to keep his webcam on for nine hours a day, finding the demand a disproportionate intrusion. The only reported decision anywhere on compelled webcam monitoring of a remote worker, and not US law.
• Ogletree v. Cleveland State University (N.D. Ohio, August 22, 2022): a public university's remote-proctoring "room scan" of a student's bedroom was an unreasonable search under the Fourth Amendment. A student case, but the reasoning applies to public employers who demand camera access to home workspaces.
• German Federal Labor Court (July 27, 2017): keylogger evidence collected without a concrete suspicion was inadmissible and the dismissal based on it void. The European position in one sentence.

Location, devices and personal accounts

• Arias v. Intermex Wire Transfer (Kern County, California, filed May 2015): a sales executive alleged she was fired for deleting an app that tracked her location 24 hours a day, including off duty, and sought $500,000. The case settled confidentially; it produced no ruling but is the reason most employer GPS policies now limit tracking to working hours. California Penal Code 637.7 separately bars GPS trackers on vehicles without the owner's consent.
• Cunningham v. New York State Department of Labor (New York Court of Appeals, June 27, 2013): the state attached a GPS device to an employee's personal car for a month to investigate time sheet fraud; the court held the search unreasonable in scope because it tracked him on evenings, weekends and vacation, while accepting that workplace GPS investigations can be lawful if confined to working hours.
• Lazette v. Kulmatycki (N.D. Ohio, June 5, 2013): a supervisor read 48,000 emails from a former employee's personal Gmail account that remained linked to a returned company BlackBerry. The Stored Communications Act claim survived; returning the device did not authorize reading the personal account.
• Rajaee v. Design Tech Homes (S.D. Tex., November 11, 2014): an employer remotely wiped a departing employee's personal phone, deleting personal photos and contacts, after he had used it for work email. The Computer Fraud and Abuse Act and Electronic Communications Privacy Act claims failed for lack of the statutory damages threshold and because the wipe was not an interception, but the case is why BYOD agreements now disclose wipe rights. Our personal phone guide covers the current position.
• Ehling v. Monmouth-Ocean Hospital (D.N.J., August 20, 2013): a nurse's private Facebook posts, shown to management by a coworker who was a friend, were protected by the Stored Communications Act, but the employer did not violate it because the coworker volunteered the screenshots. Accessing restricted social media through coercion would be different, and 26 states now bar employers from demanding social media credentials.

When the monitoring data is the evidence

Besse v. Reach CPA (British Columbia Civil Resolution Tribunal, January 11, 2023) is the case employers cite. An accountant working from home sued for wrongful dismissal; the firm counterclaimed with TimeCamp logs showing about 50 hours over a month recorded as worked with no corresponding activity, and the tribunal dismissed her claim and ordered her to repay about C$1,500 of wages and a C$1,100 advance, roughly C$2,756 in all. The software had been disclosed and installed with her knowledge; the tribunal relied on the logs as ordinary business records. In US wage litigation the same data cuts the other way more often: screenshot and activity logs from Hubstaff, Time Doctor and similar tools have been produced in FLSA collective actions to prove hours worked off the clock, and an employer that keeps activity data has answered the question of whether it knew about the work. Our time theft statistics page covers the Besse numbers in context.

AI hiring, recording and transcription tools

• EEOC v. iTutorGroup (E.D.N.Y., consent decree August 9, 2023): the first settled AI hiring discrimination case. The company's application software automatically rejected female applicants over 55 and male applicants over 60; it paid $365,000 to more than 200 applicants and agreed to anti-discrimination training and policies.
• Mobley v. Workday (N.D. Cal., filed February 2023): alleges Workday's applicant screening tools discriminated by age, race and disability. The court let the claim proceed on the theory that a vendor can be an employer's "agent" (July 12, 2024), conditionally certified a nationwide age collective of applicants over 40 (May 16, 2025), ordered Workday to identify customers using its HiredScore features (June 22, 2026), and received the plaintiffs' motion for class certification on September 14, 2026 with a hearing set for March 9, 2027. It is the case that will decide whether AI hiring vendors can be sued directly.
• Brewer v. Otter.ai (N.D. Cal., No. 25-cv-06911, consolidated October 22, 2025): class action alleging Otter's meeting assistant recorded and transcribed participants who never consented and used the recordings to train its models, under the Wiretap Act and California's all-party consent law. The court dismissed some claims and allowed others to proceed on August 13, 2026. Granola faces a similar complaint filed July 30, 2026 (N.D. Cal., No. 3:26-cv-07926). Our AI notetaker consent guide covers the practical rules.
• CVS Health and HireVue (Massachusetts, settled 2024): an applicant alleged that HireVue's video interview assessment was a lie detector test barred by Massachusetts law; the terms were not disclosed, and CVS stopped using the assessment in the state.

Our AI hiring laws by state page sets out the statutes that now sit alongside these cases.

Agencies and enforcement

• National Labor Relations Board. General Counsel Memo 23-02 (October 31, 2022) announced a framework treating intrusive electronic monitoring as presumptively unlawful where it interferes with organizing; it was rescinded by GC Memo 25-05 on February 14, 2025 and produced no Board decision. The Board's December 2023 decision against Starbucks found that surveilling employees' union activity with security cameras violated the Act, under long-standing law that predates the memo. Stericycle (August 2, 2023) remains the standard for whether a monitoring policy chills protected activity.
• Federal Trade Commission. The 2023 settlement with Rite Aid barred facial recognition surveillance in stores for five years after false matches; the order concerned customers but is the FTC's clearest statement on algorithmic surveillance.
• State notice laws. We found no published enforcement action under New York Civil Rights Law 52-c (in force May 7, 2022, penalties $500, $1,000 and $3,000), Connecticut's 31-48d (penalties $500, $1,000 and $3,000 since 1998) or Delaware's 19 Del. C. 705 ($100 per violation). Connecticut's expanded law, Public Act 26-73, took effect October 1, 2026 and adds location-specific notices; see our Connecticut guide.
• Data exposures. In April 2025 researchers found more than 21 million employee screenshots from the monitoring tool WorkComposer in an unsecured cloud bucket, and a similar exposure of about 13 million WebWork screenshots was reported in 2025. Neither has produced a reported lawsuit yet; both are why monitoring vendors' retention and storage terms belong in the contract.

Pending in 2026

• Mobley v. Workday: class certification hearing March 9, 2027.
• Otter.ai and Granola: discovery on the surviving recording claims.
• WorkEasy BIPA settlement: on appeal; Accu-Time: final approval status after the April 1, 2026 hearing not confirmed.
• x.AI v. Colorado: the challenge to Colorado's AI law that produced an order limiting enforcement of SB 26-189, which applies to employment decisions from January 1, 2027.
• California AB 1883 and AB 1331, banning emotion-inferring surveillance and bathroom monitoring from January 1, 2027, create new private penalties of $500 per violation that have not yet been tested.

What the cases add up to

1. Notice decides most cases. Smyth, Holmes, Quon and Besse went the employer's way because the policy was clear and known; Stengart went the other way because it was not. Our monitoring policy template is written to that standard.
2. Personal accounts are off limits whatever device they are opened on (Pure Power, Lazette, Van Alstyne).
3. Biometrics need a signed release before the first scan, from the employer and the vendor (Rosenbach, Rogers, and thirteen settlements).
4. Scope is judged by proportion. A camera aimed at one problem at night survived (Hernandez); GPS on weekends did not (Cunningham); a webcam for nine hours a day did not (Chetu).
5. Monitoring data is evidence for both sides. The same logs that caught the accountant in Besse prove off-the-clock work in wage cases.
6. AI tools inherit the employer's liability and may carry their own (iTutorGroup, Mobley).

Our employee monitoring laws by state page covers the statutes, and the employee monitoring statistics page covers how common each practice is.

Key takeaways

• Thirteen BIPA settlements over workplace biometrics total about $136.5 million, led by Kronos ($15.3M), Speedway ($12.1M) and Walmart ($10M); BNSF's $228 million verdict was vacated and settled for $75 million.
• Rosenbach (2019) let employees sue without proving harm; Cothron (2023) made every scan a violation; the August 2, 2024 amendment limited recovery to one per person, applied retroactively by the Seventh Circuit in April 2026.
• Reading email on the employer's own systems under a clear policy is lawful (Smyth 1996, Holmes 2011, Quon 2010); logging into an employee's personal account is not (Pure Power 2008, Lazette 2013, Stengart 2010).
• Covert cameras survive when narrow in purpose and time (Hernandez 2009); GPS tracking off duty does not (Cunningham 2013); a demand to keep a webcam on all day cost a US employer about €75,000 in a Dutch court (2022).
• Monitoring data works for employers (Besse v. Reach CPA, 2023, repayment ordered) and against them (activity logs produced in wage cases).
• EEOC v. iTutorGroup ($365,000, 2023) was the first AI hiring settlement; Mobley v. Workday, with a class certification hearing on March 9, 2027, will decide vendor liability; Otter.ai and Granola face recording-consent class actions.
• No enforcement action has been reported under the New York, Connecticut or Delaware monitoring notice laws; the NLRB's 2022 monitoring memo was rescinded in February 2025.