Business video surveillance laws vary widely by state, and a camera setup that is fully legal in one state can trigger criminal charges or class action lawsuits in another. Federal law leaves silent video recording largely alone but strictly regulates audio. States then add their own rules on audio consent, prohibited camera locations, written notice to employees, and biometric data. The strictest state whose residents you record generally sets the standard you have to meet.
The Federal Floor
The Electronic Communications Privacy Act of 1986 is the main federal surveillance statute, and it has a significant gap: it does not cover silent video surveillance at all. Federal appeals courts have confirmed that the ECPA’s wiretap provisions apply only to the interception of wire, oral, and electronic communications, not to video recording without sound.1Congress.gov. Privacy: An Overview of the Electronic Communications Privacy Act A camera in a warehouse that records only images sits outside the ECPA entirely.
Audio is different. Under 18 U.S.C. ยง 2511, intentionally intercepting an oral, wire, or electronic communication is a federal crime, with a one-party consent exception for anyone who is part of the conversation or who has permission from a participant.2Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Criminal penalties reach up to five years in prison, and a person whose communications were illegally intercepted can sue for actual or statutory damages, punitive damages, and attorney fees.3Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized Federal law is the floor. Many states go further.
Audio Recording: One-Party vs. All-Party Consent States
Most states track the federal one-party model. A manager can record their own conversation with an employee, and a business can record customer calls as long as one employee on the line knows about it.
A smaller group requires all-party consent, meaning every person in the conversation has to agree before anyone can legally record. Violating an all-party law can bring criminal charges on top of civil liability. The states that generally require consent from all parties:
- California
- Delaware
- Florida
- Illinois
- Maryland
- Massachusetts
- Montana
- Nevada
- New Hampshire
- Oregon
- Pennsylvania
- Washington
A few of these have quirks. Connecticut imposes civil liability for recording phone calls without all-party consent, but its criminal wiretapping statute follows the one-party model. Delaware’s statute prohibits intercepting a conversation without the consent of all parties, though courts have noted some ambiguity in its scope. Montana and Oregon use a notification-based approach: recording is legal if all parties are informed the conversation is being captured, even without explicit agreement.4Montana State Legislature. Montana Code 45-8-213 – Privacy in Communications5OregonLaws. ORS 165.540 – Obtaining Contents of Communications
For businesses that record calls across state lines, the stricter state’s law typically controls. If a customer in Washington calls an office in Texas, Washington’s rules generally apply. The safest default is to treat every call as all-party and disclose the recording at the start.
Where Cameras Are Never Allowed
No state permits cameras in places where people have a reasonable expectation of privacy. Restrooms, locker rooms, changing rooms, and fitting rooms are off-limits everywhere. Most states treat covert recording in these spaces as a criminal offense; Florida, for instance, classifies covert recording in a place where someone would reasonably expect to undress as a third-degree felony for anyone 19 or older.
The line gets blurrier past the obvious cases. Private offices with closed doors, lactation rooms, and employee sleeping quarters in industries with overnight shifts all carry strong privacy expectations. Cameras aimed at a personal workspace in a way that captures screens, personal items, or phone use can also invite claims, even in nominally shared space.
Break rooms sit in a gray area. They are semi-private, and the National Labor Relations Board has taken the position that surveillance in break areas can interfere with employees’ rights to discuss wages, working conditions, and union activity.6National Labor Relations Board. Interfering With Employee Rights – Section 7 and 8(a)(1) The NLRB’s General Counsel has flagged installing cameras in break rooms in response to protected employee activity as a potential unfair labor practice.7National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices Break-room cameras are not automatically illegal, but the risk climbs sharply if the timing overlaps with any organizing activity.
States That Require Written Notice to Employees
Several states require employers to tell workers in writing that electronic monitoring is happening. These laws sweep in surveillance cameras, computer monitoring, email interception, and phone recording. Hanging a camera and moving on will not satisfy them.
Connecticut requires every employer conducting electronic monitoring to give prior written notice to all affected employees describing the types of monitoring that may occur, and to post the notice in a conspicuous location. Penalties start at $500 for a first offense and climb to $3,000 for a third and each subsequent offense. Employers investigating specific, articulable misconduct can monitor without advance notice.8Justia Law. Connecticut General Statutes 31-48d – Employers Engaged in Electronic Monitoring, Written Notice Required
New York requires written notice at the time of hiring that telephone conversations, email, and internet usage may be monitored. Employees must acknowledge the notice in writing or electronically, and the employer must post it visibly in the workplace. Penalties escalate the same way: $500, $1,000, and $3,000, enforced by the state attorney general.9New York State Senate. New York Civil Rights Law 52-c – Employer Notification of Electronic Monitoring
Delaware offers two compliance paths. An employer can provide a one-time written notice to each employee, or display an electronic notice each day the employee accesses employer-provided email or internet systems. Noncompliance costs $100 per violation.10Delaware Code Online. Delaware Code Title 19, Chapter 7 – Notice of Monitoring of Telephone Transmissions, Electronic Mail and Internet Usage
Even in states without a notification statute, failing to inform workers about surveillance weakens an employer’s legal position. Courts weigh whether employees had reason to know they were being monitored when evaluating privacy claims. A handbook provision describing the surveillance program, signed at onboarding, provides the strongest protection.
Biometric Data: The Fastest-Moving Area
Modern camera systems can capture fingerprints, facial geometry, iris patterns, and voiceprints. A growing number of states treat biometric data as fundamentally different from ordinary video, with stricter collection rules, consent requirements, and destruction timelines.
Illinois
Illinois’ Biometric Information Privacy Act is the most aggressive biometric law in the country. Any business collecting biometric identifiers must inform the individual in writing about what is being collected and why, disclose how long the data will be stored, obtain a written release before collection begins, and publish a written retention and destruction policy. BIPA also gives affected individuals a private right of action: $1,000 per negligent violation or $5,000 per intentional violation, plus attorney fees.11Justia Law. Illinois Compiled Statutes 740 ILCS 14 – Biometric Information Privacy Act Companies using facial recognition time clocks or biometric access systems without proper disclosures have faced class action settlements in the hundreds of millions of dollars.
Texas, Colorado, and Washington
Texas requires informing individuals and obtaining consent before capturing any biometric identifier for a commercial purpose, and requires destruction no later than one year after the purpose for collection expires. Only the state attorney general can enforce the law, but penalties reach $25,000 per violation.12State of Texas. Texas Business and Commerce Code 503.001 – Capture or Use of Biometric Identifier
Colorado requires any business controlling biometric identifiers to adopt a written policy that includes a retention schedule, a data breach response protocol, and deletion guidelines. Biometric data must be deleted by the earliest of three triggers: when the original collection purpose is satisfied, 24 months after the consumer’s last interaction, or within 45 days of determining the data is no longer necessary. Consent must be informed.13Justia Law. Colorado Revised Statutes 6-1-1314 – Biometric Identifiers
Washington prohibits enrolling a biometric identifier in a database for a commercial purpose without providing notice, obtaining consent, or offering an opt-out. Financial institutions and entities covered by federal health privacy laws are exempt.14Washington State Legislature. Revised Code of Washington 19.375.040 – Exclusions
City-Level Rules
New York City requires any commercial establishment that collects customers’ biometric information to post a clear sign near all customer entrances and flatly prohibits selling or profiting from biometric data. Damages run $500 per incident for disclosure failures and $5,000 per intentional sale or trade, with a private right of action. Portland, Oregon has gone further and banned private businesses in places of public accommodation from using facial recognition technology entirely.
Signage as a Legal Shield
Some states require conspicuous signs where video surveillance is in use, typically near entrances and large enough to read from a reasonable distance. Even where no statute demands it, posted notices are one of the simplest ways to cut legal exposure. A customer who walks past a “Video Surveillance in Use” sign has a much harder time later claiming they were secretly recorded, and in all-party consent states a prominent notice can help establish implied consent, though explicit agreement is safer.
Effective notice programs combine visible signage at entrances, written policies in employee handbooks acknowledged at hiring, and recorded announcements at the start of phone calls where audio is captured.
Footage Retention and Data Security
No single federal law tells every business how long to keep surveillance footage, but industry-specific rules create a patchwork. Financial institutions subject to Gramm-Leach-Bliley and PCI DSS generally retain footage from transaction areas for 30 to 90 days. Healthcare facilities often land in a similar range, and gaming and other high-security industries face state regulatory minimums that can require 90 days or more.
Retaining too little creates its own risk. If an incident happens and the footage is already overwritten, the business has lost its best evidence. A 30-day minimum is a common baseline for general business use, with longer retention for areas with high-value inventory or heavy public interaction.
Data security is the overlooked half. Networked camera systems carry the same vulnerabilities as any other connected computer, and unsecured systems have been exploited to reach business networks, spy on employees, and steal footage. Surveillance infrastructure should get the same treatment as other sensitive systems: encrypted storage, access limited to authorized personnel, regular software updates, and audit logs tracking who views footage and when.
Building a Multi-State Compliance Program
A surveillance program that is legal in one state can violate several laws in another. Businesses operating across state lines should identify the strictest applicable standard and build policies around it. A company with employees or customers in Illinois and California, for example, has to satisfy all-party audio consent and biometric privacy requirements at the same time.
A legally defensible program includes, at minimum:
- A written policy specifying where cameras are placed and what they capture
- Conspicuous signage at all monitored locations
- Employee notification during onboarding with a signed acknowledgment
- Separate, clearly documented consent for any biometric collection
- A retention and destruction schedule
Audio should stay disabled on cameras unless the business has specifically analyzed its consent obligations and put compliant disclosure procedures in place. Getting audio consent right almost never justifies the marginal security benefit of recording workplace conversations.