How to Ask HR What Is Monitored: Rights and Email Template

Most employees who want to know whether their screen, location or messages are being watched do one of two things: nothing, or an anxious search through Task Manager. There is a third option that works better than either, which is to ask in writing. In four states the employer is legally required to tell you, in a specific way, and in California a written request compels a detailed answer within 45 days. Everywhere else, a short, factual email to HR usually gets a real answer, because the person reading it knows the policy exists and knows that refusing to say what it covers looks worse than saying it.

This guide explains where you have a right to an answer and what it covers, how to read the policy you already signed before you ask, the eleven questions that produce useful answers, an email template you can send as written, what the common replies mean, and what to do if the answer is evasive or alarming. It is written for employees; employers can read it as a checklist of what a good monitoring notice already says. For how to check the device yourself, see how to detect employee monitoring software.

Where you have a legal right to an answer

Note what the notice laws do not do. They require the employer to say that monitoring may occur, not which tool is installed, how often screenshots are taken or who reviews them. The New York notice is one sentence. To learn the specifics you still have to ask, and the notice laws give you the standing to do so without it seeming odd: you are following up on a disclosure the employer made.

Read the policy before you ask

You almost certainly signed a document that answers part of the question. Find it before writing to HR, because the reply will refer to it and because a question the policy already answers makes the rest of your questions easier to dismiss. Look in the employee handbook, the acceptable-use or IT policy, the onboarding packet, the remote work agreement and the device agreement for sections titled Electronic Communications, Acceptable Use, Monitoring, Privacy, Company Property or Information Security. The phrases that matter:

• "No expectation of privacy": the standard clause, meaning the employer reserves the right to review anything on its systems. It does not tell you whether anyone does.
• "May be monitored" versus "is monitored": the first reserves a right, the second describes a practice. Most policies say the first.
• "At any time" or "24/7": monitoring is not limited to working hours; see after-hours monitoring.
• Named tools or categories: "productivity software," "screenshots," "keystroke," "location," "video." A policy that names categories has usually been drafted by someone who knows what is deployed.
• "Personal devices" or "BYOD": what you agreed to on your own phone, which is where surprises live. See personal phone monitoring.
• Retention and access: who may view monitoring data and for how long it is kept. Rarely present, which makes it a good question.

Also note what the policy does not mention. Webcams, microphones, keystroke logging and location tracking are intrusive enough that a policy drafted in good faith names them if they are used, so silence is weak evidence they are not, and a direct question settles it.

The eleven questions

Ask about facts, not intentions. "Do you trust us" gets a speech; "how often are screenshots taken" gets a number or a dodge, and either is informative.

1. Which monitoring or productivity software, if any, is installed on my company computer? (Name of the product.)
2. Does it capture screenshots or screen video, and at what frequency? Are they blurred?
3. Does it log keystrokes or the content of what I type?
4. Does it record or activate the webcam or microphone under any circumstances?
5. Does it track location, and if so on which devices and during which hours?
6. Does it run outside my working hours, and is any data collected when I am clocked out or on leave?
7. What is collected about my use of work accounts on my personal devices (email, Teams, Slack, VPN)?
8. Who can view the data: my direct manager, HR, IT, security, a vendor? Is it reviewed routinely or only when there is a concern?
9. How long is the data kept, and is it used in performance reviews, productivity scores or disciplinary decisions?
10. Is any of the data analyzed by automated or AI tools to score productivity, flag behavior or infer emotional state?
11. How can I see the data held about me, and whom do I contact to correct or question it?

Question 10 matters more each year. Several products score activity or flag "risk" automatically, California's regulations on automated decision-making technology give employees rights around such systems from 2027, and New York City's and Colorado's AI laws touch employment decisions. An employer that uses an automated score for anything consequential should be able to say so; see AI in performance reviews.

The email template

Send it to HR, copying nobody, from your work account (which is itself monitored, and that is fine; you want this on the record). Keep the tone the same as a question about benefits enrollment: routine, specific, not accusatory. Replace the bracketed parts.

Subject: Question about monitoring of company devices and accounts

Hi [Name],

I have read the [Electronic Communications / Acceptable Use] policy in the handbook, which says that company systems may be monitored. I would like to understand what that means in practice for my role, so I can use company equipment appropriately and keep personal matters off it. Could you let me know:

1. Which monitoring, security or productivity software is installed on my company [laptop / phone], and whether it captures screenshots, screen recordings or keystrokes, and how often.
2. Whether any software can access the webcam, microphone or location on company devices, and during which hours.
3. Whether any monitoring applies outside my scheduled working hours, or to my use of work accounts on my personal phone.
4. Who has access to monitoring data, how long it is kept, and whether it is used in performance evaluations or automated productivity scoring.
5. How I can request a copy of the data held about me.

[For New York, Connecticut or Delaware: I believe this falls under the written monitoring notice required by [Civil Rights Law 52-c / General Statutes 31-48d / 19 Del. C. 705]; I do not recall receiving or signing one, and would appreciate a copy if one exists.]

[For California: Please treat this as a request to know under the California Consumer Privacy Act, including the categories and specific pieces of personal information collected about me through workplace monitoring, the purposes, the retention period and any third parties it is shared with.]

Thank you. A written reply would be helpful so I have it for reference.

[Your name]
[Role, team]

If you prefer to ask your manager first, do, but follow up with HR in writing afterward; managers often do not know what IT has deployed, and their answer is not the company's.

The California request, which is different

California employees of covered businesses have more than a right to a notice. Under the Consumer Privacy Act as amended by the Privacy Rights Act, since January 1, 2023 they have the same rights as consumers: to know the categories and specific pieces of personal information collected, the sources, the purposes and the third parties it is shared with; to correct inaccurate information; to delete information not required to be kept; and to receive the information in a portable format. A request must be answered within 45 days, extendable once by 45 more, and the employer must verify your identity but may not retaliate. Monitoring data (screenshots, activity logs, location history, productivity scores) is personal information. Employers may withhold data where an exemption applies, such as an ongoing internal investigation, but must say so. The Privacy Protection Agency's regulations on automated decision-making technology, in force from 2027, add a right to a pre-use notice and to opt out of or appeal certain automated employment decisions. Covered businesses are those with more than about $26 million in annual revenue (indexed), or that handle data on 100,000 or more consumers or households, or that earn half their revenue from selling or sharing personal information; most mid-size and large California employers qualify.

What the replies mean

• A direct answer naming the tool and settings. The best outcome, and more common than people expect. Keep it. It also tells you what the employer believes is proportionate, which is useful if the practice later changes.
• "Please refer to the policy." The policy reserves rights without describing practice, so this is a non-answer. Reply once, politely, saying you have read the policy and are asking what is actually installed and collected. In New York, Connecticut, Delaware and California, cite the statute.
• "We do not monitor employees." Usually means no productivity software, and usually omits security tooling that logs web traffic and files. Ask whether that includes web filtering, endpoint security and device management. Treat the statement as a commitment; if monitoring later appears, it is evidence.
• "We monitor only when there is a concern." Plausible and common. Ask what triggers a review and who approves it. The Connecticut statute's misconduct exception works this way.
• "IT handles that; we cannot discuss security configurations." Security teams legitimately decline to detail defenses, but whether screenshots of your screen are taken is not a security configuration. Ask HR to confirm the employee-facing facts (screenshots, keystrokes, webcam, location, hours) even if the product names are withheld.
• No reply. Send one follow-up after a week. In the notice states, a continued non-response is itself a violation you can report to the state labor department or attorney general. In California, the 45-day clock is running.

What to do with the answer

• Adjust your behavior to the facts, not the fear. If screenshots are taken every ten minutes, personal browsing on the work laptop stops. If only web domains are logged, the stakes are lower. Our screen monitoring guide and work laptop guide explain what each kind of monitoring exposes.
• Check the answer against the device. The detection guide shows how to see installed agents, management profiles and screen-recording permissions. A discrepancy between the answer and the machine is worth a second, specific email.
• If the answer reveals something the notice should have covered, in New York, Connecticut or Delaware, you can file with the state labor department or attorney general; penalties are per violation and the complaint is free. In California, an incomplete access response can be reported to the Privacy Protection Agency.
• If the answer reveals webcam or microphone access, keystroke logging of personal accounts, or tracking of a personal device you did not agree to, read webcam and keylogger rules and consider advice; some of these cross from policy questions into wiretap and computer-crime statutes.
• If you want the practice changed, you are more effective with colleagues than alone. A joint request from several employees to limit monitoring is protected concerted activity under federal labor law in every workplace, and in a unionized one the union can demand bargaining. Framing helps: ask for monitoring limited to working hours and to company devices, for screenshots to be blurred or replaced by activity logs, and for a statement that data will not drive automated scoring; these are the changes employers most often agree to.
• Keep the thread. Save the policy, your email and the reply outside the company systems, in your personal email or printed. If monitoring is later used against you, the record of what you were told is the first thing a lawyer or labor department will ask for.

If you are the employer reading this

Every question above should already be answered in your monitoring notice. A notice that names the categories of data collected, the tools (or at least their functions), the hours, the access controls, the retention period and the uses, and that states plainly whether webcams, microphones, keystrokes and location are involved, satisfies New York, Connecticut, Delaware and California at once and removes the reason for this email. It also removes the suspicion that the email reflects. Our monitoring policy template and guide to writing a policy employees will sign have the language, and the monitoring statistics show what disclosure does to trust: employees who know what is collected report materially higher trust in their employer than those who suspect but do not know.

Key takeaways

• New York, Connecticut and Delaware require private employers to give written notice that electronic monitoring may occur; New York also requires a signed acknowledgment and a posting. None requires the employer to say which tool is used or how often it collects.
• California employees of covered businesses can make a Consumer Privacy Act request and receive the categories and specific pieces of monitoring data held about them within 45 days.
• Read the policy you signed first: 'may be monitored' reserves a right, 'is monitored' describes a practice, and silence on webcams, keystrokes and location is a reason to ask directly.
• Ask about facts: which software, screenshots and frequency, keystrokes, webcam and microphone, location and hours, personal devices, who sees the data, retention, use in reviews, automated scoring, and how to see your own data.
• Send the request to HR in writing from your work account, in a routine tone, and keep the policy, the email and the reply outside company systems.
• 'Refer to the policy' is a non-answer; 'we do not monitor' usually omits security logging; 'only when there is a concern' is plausible and worth a follow-up about triggers.
• A joint request from several employees to limit monitoring is protected concerted activity in every workplace; in unionized workplaces the union can demand bargaining.