Daycare video surveillance laws are set almost entirely at the state level, through childcare licensing rules that dictate where cameras can point, what parents and staff must be told, and how recordings can be stored and shared. Layered on top are federal and state wiretapping statutes that govern any audio, and, for programs run by or affiliated with a federally funded school, the Family Educational Rights and Privacy Act. There is no single federal statute that covers the cameras themselves, which is why two daycares in neighboring states can operate under very different rules.
No Federal Law Covers the Cameras Themselves
A frequent misconception is that the Children’s Online Privacy Protection Act governs surveillance in childcare settings. It does not. COPPA applies to the collection of personal information from children under 13 on websites and online services.1eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule A fixed camera in a classroom sits outside COPPA’s scope. If a facility streams footage to parents through an app or website, the online piece could pull COPPA in depending on what the platform collects from users, but the camera itself is not what triggers it.
Because there is no comprehensive federal statute on physical surveillance in childcare, state licensing regulations do the work. Most states that address the issue require facilities to tell parents and staff that cameras are in use, disclose which areas are covered, and explain how footage is stored and accessed. Some require this disclosure in the parent handbook or enrollment paperwork. Others leave the details to the facility. Read your state’s childcare licensing rules closely before installing anything, because that is the document that will decide whether you are in compliance.
Audio Is the Biggest Legal Trap
This is where operators most often walk into criminal liability without realizing it. Many modern security cameras include microphones enabled by default. Recording audio is legally distinct from recording video, and it is governed by federal wiretapping law and a patchwork of state statutes that are usually stricter.
Federal law under 18 U.S.C. ยง 2511 prohibits intercepting oral communications unless at least one party to the conversation consents.2Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Violations can carry up to five years in prison. Under that one-party standard, a staff member who knows about the recording and participates in the conversation satisfies federal law. But roughly a dozen states, including California, Florida, Maryland, Massachusetts, Pennsylvania, and Washington, require all-party consent. In those states, every person whose voice is captured must agree.
For a daycare, the safest path is to disable audio recording entirely or to collect explicit written consent from every staff member and every parent whose child might be within microphone range. Posting a sign is not enough in all-party consent states. If your cameras record audio and you have not addressed this, it is worth fixing today.
Where Cameras Cannot Go
State rules and basic privacy law converge on one clear line: no cameras in any area where children or staff have a reasonable expectation of privacy. Bathrooms, changing areas, and nursing rooms are universally off-limits. Most state licensing rules that address surveillance either flatly prohibit cameras in those spaces or limit them to common areas such as classrooms, hallways, and outdoor play areas.
Staff break rooms fall in a gray area. Some states treat them as private spaces where monitoring is restricted; others permit cameras there with employee notification. When in doubt, keep cameras out of any room where adults change clothes or take personal breaks. That is where the most common complaints and legal challenges start.
Notifying Parents and Getting Consent
Nearly every state that addresses daycare surveillance requires, at minimum, that parents be told cameras exist, where they point, and what happens to the footage. Many go further and require written acknowledgment or consent before a child is recorded. Enrollment is the natural place to handle this. A clear surveillance disclosure in the registration packet, signed by the parent or guardian, creates the paper trail that protects the facility if a dispute arises later.
Your disclosure should cover the location of each camera, whether audio is captured, who can view the footage, how long it is stored, and whether any third party has access. Vague language like “the facility may use cameras for security purposes” invites disputes. Specificity protects everyone.
Custody situations complicate things. When parents share joint legal custody, both generally have the right to make decisions about the child’s participation in daycare programs, including consenting to or objecting to surveillance. If one parent objects and the other consents, the facility is not in a good position to resolve that dispute. Document both positions and, if necessary, require the parents to work it out through their custody arrangement or a court order before the child is recorded.
Notifying Staff
Employees have independent rights around workplace surveillance that exist separately from parental consent. State labor laws and childcare licensing rules typically require facilities to inform staff about camera systems before recording begins. Notification should cover which areas are monitored, whether audio is captured, how footage is reviewed, and who can see it.
The strongest approach is to include surveillance terms in the employment agreement and have each employee sign an acknowledgment during onboarding or annual training. What matters legally is that notice happened before recording started and that you can prove it. An employee who was never told about the cameras and later appears on footage used in a disciplinary action has a much stronger complaint than one who signed on their first day.
When FERPA Also Applies
FERPA enters the picture when the daycare is operated by or affiliated with a federally funded educational institution, such as a Head Start program or a preschool run by a public school district. Under FERPA, a video recording qualifies as an “education record” when it is directly related to a student and maintained by the institution or someone acting for it.3U.S. Department of Education. FAQs on Photos and Videos under FERPA General hallway footage that catches many children in passing is less likely to qualify. A clip pulled and placed in a specific child’s behavioral file almost certainly does.
Where FERPA applies, the facility cannot disclose education records without written parental consent unless a specific exception is met. Enforcement runs through the U.S. Department of Education, which can terminate federal funding if a facility fails to comply and voluntary correction efforts fail.4Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Parents cannot sue directly under FERPA itself, but they may have claims under state privacy law, negligence, or breach of contract.
Controlling Who Can See the Footage
Limiting access is both a legal requirement in many states and a basic risk-management practice. Typically, only administrators and specifically designated staff should be able to view recordings. Broad access across all employees increases the risk of footage being shared informally or viewed by someone with no legitimate reason.
Parents may ask to see footage of their own child, and state laws vary on whether facilities must honor that request. Some states give parents a right to view footage during an investigation into an incident involving their child. Others leave it to facility policy. Either way, a clear written access policy prevents ad hoc decisions that create inconsistencies and legal exposure. Password protection and role-based access controls should be standard, and an access log that shows who viewed what and when creates accountability if a leak has to be investigated.
Live-streaming through a third-party app introduces additional questions. Vendor contracts typically place responsibility for consents, state-law compliance, and access control on the daycare rather than the vendor.5WatchMeGrow. Terms of Use If a feed is hacked or improperly shared, the vendor’s terms of service may protect the vendor while leaving the facility exposed. Read indemnification clauses, data ownership provisions, and any language about what the vendor can do with recorded footage. Confirm that each parent sees only the feed from their own child’s classroom; unrestricted access lets one parent screenshot or record another family’s child, and the facility can bear the fallout.
Retention and Secure Disposal
No federal law sets a universal retention period for daycare surveillance footage, and state rules vary. Some state licensing regulations specify a minimum retention period. Others leave it to facility policy. A common practice is retaining footage for 30 to 90 days, which balances the ability to review an incident against the privacy risks of indefinite storage.
Whichever period you choose, enforce it. Footage that lingers indefinitely becomes a growing liability: subpoenaed in future litigation, accessed by departing employees, or exposed in a breach. Set automated deletion schedules and verify they actually run.
When footage reaches the end of its retention period, deleting the file is not enough. Standard deletion removes the reference but leaves the data on the storage device, where it can be recovered with readily available tools.6U.S. Department of Education. Best Practices for Data Destruction Proper disposal uses a secure overwrite utility that replaces the data with random information, making recovery infeasible. Disk formatting and basic file encryption before deletion are not enough on their own. For physical drives being decommissioned, physical destruction is the most reliable option.
Responding to Law Enforcement Requests
When police ask for footage, the facility’s obligations depend on whether FERPA applies and on state law. For FERPA-covered programs, the facility cannot simply hand over recordings that qualify as education records because an officer asked. Disclosure without parental consent is permitted only in limited circumstances: a health or safety emergency, or a judicial order or lawfully issued subpoena.3U.S. Department of Education. FAQs on Photos and Videos under FERPA
For facilities not covered by FERPA, state law controls. Some states require a warrant or subpoena before a business must turn over surveillance footage; others allow voluntary disclosure. Even where voluntary disclosure is legal, releasing footage without notifying the affected families can erode trust and generate state privacy claims. A safer practice is to require a subpoena or warrant before releasing anything and to notify parents when it is legally permitted. Write the protocol into your surveillance policy so staff are not making improvised decisions under pressure.
Mandated Reporting When Footage Shows Abuse
Childcare workers are mandated reporters of suspected child abuse and neglect in every state. That duty applies however the suspicion arises, including through reviewing surveillance footage. If a staff member or administrator sees something on camera that suggests a child is being harmed, the duty to report is triggered immediately.
Delaying to “review more footage” or “investigate internally first” is not a defense. Mandated reporting requires prompt reporting of suspicion, not proof. Preserve the footage as soon as a concern is identified, and disable any automated deletion for the relevant time period. Failure to report can carry criminal penalties for the individual who saw the recording and failed to act, separately from any consequences for the facility.
Uses That Are Off-Limits
Footage collected for child safety cannot be repurposed without proper authorization. Using recordings in marketing, posting clips on social media, or sharing footage with anyone outside the stated policy exposes the facility to privacy claims. State privacy laws broadly restrict use of footage to the purposes disclosed when consent was obtained.
Using footage to evaluate staff performance is a particularly sensitive area. Some states prohibit this unless the possibility is explicitly disclosed in the employment agreement. Even where it is not specifically prohibited, surprising an employee with a video-based performance review after telling them cameras existed only for child safety damages trust and invites complaints.
For FERPA-covered facilities the limits are more concrete. Education records, including qualifying video footage, cannot be disclosed without written parental consent except through specific statutory exceptions. Sharing recordings with researchers, other institutions, or the media without consent violates federal law.4Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights
Penalties for Getting It Wrong
Consequences come from more than one direction. State licensing agencies can issue fines, require corrective action plans, suspend a facility’s license, or revoke it. Administrative action can close a daycare faster than any lawsuit.
Audio violations carry the most severe potential consequences. An unlawful interception under federal wiretapping law is a felony punishable by up to five years in prison and substantial fines.2Office of the Law Revision Counsel. 18 U.S. Code 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications State wiretapping statutes can add their own criminal penalties. A facility that runs cameras with active microphones in an all-party consent state, without consent from every recorded person, is exposed to prosecution.
FERPA-covered facilities that improperly disclose education records risk losing federal funding, though the Department of Education typically pursues voluntary compliance first.4Office of the Law Revision Counsel. 20 U.S. Code 1232g – Family Educational and Privacy Rights Parents cannot sue directly under FERPA, but they can bring claims under state privacy statutes, negligence theories, or breach of contract if the facility violated its own stated policies.