Employee Monitoring Notice and Disclosure Requirements

Federal law does not require most employers to tell workers they are being monitored, but four states do: Connecticut, Delaware, New York, and Texas each mandate written notice before electronic monitoring begins. California layers on a separate privacy disclosure that reaches monitoring data, and Illinois adds its own rules for biometric collection. Everywhere else, notice is not technically required, but a written, acknowledged policy is what preserves the federal Wiretap Act’s consent defense and defeats common law privacy claims. The practical employee monitoring notice requirements, then, come from three sources at once: state monitoring statutes, state privacy laws, and the federal exceptions employers rely on to monitor legally.

States That Require Written Notice Before Monitoring

If you employ anyone in Connecticut, Delaware, New York, or Texas, you need a compliant notice regardless of where the company is headquartered. The requirements differ enough that a single generic policy will not satisfy all four.

Connecticut

Connecticut requires prior written notice to every employee who may be affected by electronic monitoring, plus a conspicuous posting visible to the workforce. The posting itself satisfies the written notice requirement, so individual signed acknowledgments are not strictly required under the statute. Connecticut also allows an employer to skip notice when it has reasonable grounds to believe employees are breaking the law, violating the rights of the employer or coworkers, or creating a hostile work environment, and monitoring would produce evidence of that misconduct. Criminal investigations are exempt as well.¹

Delaware

Delaware gives employers a choice. Either provide a one-time written notice that the employee acknowledges, or deliver an electronic notice each day the employee accesses employer-provided email or internet. The daily-notice option is why some companies display a login banner reminding employees that activity is monitored. The penalty for noncompliance is $100 per violation, and the statute preserves any other remedies available under state or federal law. Delaware also exempts automated processes designed for system maintenance or managing email volume, as long as they are not targeting a specific individual’s communications.²

New York

New York requires written notice upon hiring for every employee subject to electronic monitoring, plus a conspicuous posting accessible to affected workers. The law applies to any private employer with a place of business in the state, regardless of workforce size. Government employers are excluded. Employees must acknowledge the notice in writing or electronically. Penalties escalate: $500 for the first offense, $1,000 for the second, and $3,000 for each subsequent offense. The statute expects employees to be told that communications “may be subject to monitoring at any and all times and by any lawful means,” so vague policy language will not clear the bar.³

Texas

Texas also requires notice before electronic monitoring, though its statute is more narrowly focused than the others. Employers with workers across multiple states should treat the strictest applicable requirement as their compliance floor rather than trying to tailor notices state by state.

California’s Privacy Notice Sweeps in Monitoring Data

California does not have a dedicated employee monitoring statute, but its Privacy Rights Act imposes a “notice at collection” obligation that reaches monitoring data. Before or at the point of collecting personal information from workforce members, California employers must disclose the categories of personal information being collected, the purpose for each category, and the retention period or the criteria used to determine how long the data will be kept. Sensitive personal information collected to infer characteristics about a worker must be disclosed separately. Sensitive personal information includes precise geolocation data, the contents of mail and email (unless the employer is the intended recipient), and information revealing union membership, health status, or racial and ethnic origin.

The practical effect is that any employer with California-based employees who uses keystroke logging, GPS tracking, email scanning, or screenshot capture needs to account for that collection in its California privacy notice. This runs parallel to any federal obligations and is broader in scope than the monitoring-specific statutes in other states.

Why Notice Matters Where It Is Not Required

Federal law does not mandate notice, but two features of the federal framework make written, acknowledged notice the safest posture everywhere.

The Wiretap Act makes it a crime to intentionally intercept wire or electronic communications in real time.⁴⁵⁶

The second reason is the common law tort of intrusion upon seclusion, which most states recognize. An employee generally has to show a reasonable expectation of privacy, an intentional invasion of that privacy, and an intrusion that would be offensive to a reasonable person.⁷ A clear monitoring notice defeats the first element by eliminating the expectation of privacy. Without notice, the claim becomes substantially easier to prove, and the intrusion is actionable whether or not the employer shared anything it discovered.

A few practical limits sit inside the federal framework. Under the business extension exception, a supervisor who realizes a monitored call is personal must stop listening; curiosity is not a business purpose. All-party consent states raise the bar for phone recording beyond federal one-party consent. And accessing stored communications on someone else’s system, rather than your own company platform, can violate the Stored Communications Act.⁸

Biometric Data Needs Its Own Disclosure

Fingerprint timeclocks, facial recognition for building access, and iris scanners collect biometric data that triggers a separate notice track. Illinois has the most aggressive statute. Under the Biometric Information Privacy Act, an employer must provide written notice that biometric data is being collected, specify the purpose and length of storage, and obtain a signed written release before collection begins.

Statutory damages run up to $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus attorneys’ fees. A 2024 amendment clarified that repeated collection of the same biometric identifier from the same person using the same method counts as a single violation, which limits aggregate exposure but still makes noncompliance expensive. Texas and Washington have their own biometric privacy statutes with different enforcement mechanisms, and additional states have enacted or are considering similar laws. Keep the biometric disclosure separate from the general monitoring notice; consent requirements and retention obligations differ, and mixing them creates gaps.

What the Notice Should Say

Whether the notice is satisfying a state mandate or just building a defensible policy, the content should cover the same ground. The goal is to eliminate any claim that employees did not know what was happening.

Types of monitoring in use. Name each method: keystroke logging, screenshot capture, email scanning, website tracking, GPS location, video surveillance, phone recording. Vague language like “electronic monitoring may occur” fails the clarity test in New York.
Devices and systems covered. Specify that company-issued laptops, phones, tablets, email accounts, messaging platforms, and network connections are subject to review. If monitoring extends to personal devices used for work, say so.
Frequency. State whether monitoring is continuous, periodic, or triggered by specific events like a security alert.
No expectation of privacy. A direct statement that employees should not expect privacy when using company equipment or company-provided accounts. One sentence does more legal work here than almost anything else in the document.
How the data will be used. Productivity measurement, security, compliance, investigation of misconduct — say which.
Retention period. How long monitoring records are kept and when they are destroyed.

Write in plain language. Concrete examples help: “This includes recording which websites you visit on your work laptop and capturing screenshots of your screen at regular intervals” is clearer than “electronic activity may be observed.”

Delivering and Documenting the Notice

Getting the notice into employees’ hands in a provable way matters as much as what it says. New York and Delaware both require the notice to be in writing, in an electronic record, or in another electronic form, and both require the employee to acknowledge receipt.³² Connecticut satisfies the notice requirement through conspicuous posting alone, which is a lower bar.¹

Most organizations should do all of the following, regardless of which state mandate applies:

New hire delivery. Present the notice during onboarding, before the employee first accesses any monitored system, and collect a signature or electronic acknowledgment at that point.
Conspicuous posting. Post the notice in a break room, common area, or company intranet page where employees will encounter it. This satisfies posting requirements in Connecticut and New York.
Employee handbook. Include the full policy so it goes out with every update.
Login banners. A brief notice at system login can serve as Delaware’s daily electronic notice and reinforces awareness everywhere else.

Keep signed acknowledgments for at least the duration of employment. If a terminated employee later claims they were monitored without consent, the acknowledgment is the first line of defense. EEOC regulations require personnel records to be retained for one year after involuntary termination, and many employers extend that timeline for monitoring-related documents.⁹

Remote Work, Personal Devices, and Social Media

Monitoring employees who work from home or use personal devices introduces complications that office-only surveillance does not. On a company-issued laptop connected to the company network, the employer’s authority is relatively clear. When monitoring software runs on an employee’s personal phone or captures video of their home office, the footing shifts.

For bring-your-own-device arrangements, no uniform legal standard exists. Courts have reached conflicting conclusions about whether employers have possession, custody, or control over data on employee-owned devices. A written BYOD policy that spells out what the employer can access, monitor, and remotely wipe is essential. Without one, both sides are guessing.

Monitoring software on personal devices can also inadvertently capture protected information. A keystroke logger or periodic screenshot tool does not distinguish between a work email and a message to a doctor about a medical condition. Anyone assigned to review monitoring data should be trained on how to handle that kind of inadvertent capture and given clear boundaries.

Personal social media accounts sit outside monitoring authority in most states. Over half have enacted laws prohibiting employers from requiring employees or applicants to hand over usernames and passwords for personal social media accounts, log in in front of a supervisor, add a manager to a contact or follower list, or change privacy settings to make posts visible to the employer. Retaliation for refusing is prohibited. Accessing an employee’s private social media communications without authorization can also violate the federal Stored Communications Act. Viewing publicly available posts and monitoring activity on employer-provided accounts remains permitted.

NLRA Limits That Notice Cannot Cure

The National Labor Relations Act protects employees’ rights to organize, discuss working conditions, and engage in collective action. Surveillance that interferes with those rights can constitute an unfair labor practice regardless of whether a monitoring notice is in place. Employers cannot surveil or create the impression of surveilling union meetings, photograph employees engaged in peaceful organizing, or coercively question workers about union sympathies.¹⁰

The NLRB General Counsel has urged the Board to treat electronic monitoring practices that would tend to interfere with or prevent a reasonable employee from engaging in protected activity as presumptively unlawful, flagging keyloggers, webcam capture, and GPS tracking specifically. Where the employer’s business need outweighs employee rights, that framework would still require disclosing the technologies used, the reasons for using them, and how collected information is used.¹¹ A 2026 General Counsel memorandum directed regional offices to focus enforcement on clear violations like rules banning wage discussions rather than pursuing cases based solely on the existence of a potentially overbroad monitoring policy. The underlying risk remains: monitoring that chills organizing can trigger an unfair labor practice charge even when the written notice is technically compliant.

Consequences of Skipping Notice

Penalties stack from multiple directions. State civil fines are the most direct: New York’s escalating penalties reach $3,000 per offense after two prior violations,³ and Delaware’s $100-per-violation structure can accumulate quickly when each day of monitoring without notice counts separately.² Illinois biometric violations run up to $5,000 per intentional violation.

Beyond statutory penalties, employees in most states can bring an intrusion upon seclusion claim, and a well-documented notice directly undermines the reasonable-expectation-of-privacy element. On the federal side, interceptions that violate the Wiretap Act carry statutory damages with a $10,000 floor and potential criminal prosecution.⁶ Evidence obtained through unlawful monitoring may also face admissibility challenges, defeating the reason the monitoring existed in the first place.

1
Justia Law. Connecticut Code 31-48d – Employers Engaged in Electronic Monitoring Required to Give Prior Notice to Employees
2
Justia Law. Delaware Code Title 19 705 – Notice of Monitoring of Telephone Transmissions, Electronic Mail and Internet Usage
3
New York State Senate. New York Civil Rights Law 52-C-2 – Employers Engaged in Electronic Monitoring Prior Notice Required
4
Bureau of Justice Assistance. Electronic Communications Privacy Act of 1986
5
Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited
6
Office of the Law Revision Counsel. 18 USC 2520 – Recovery of Civil Damages Authorized
7
Legal Information Institute. Intrusion on Seclusion
8
Office of the Law Revision Counsel. 18 USC 2701 – Unlawful Access to Stored Communications
9
U.S. Equal Employment Opportunity Commission. Recordkeeping Requirements
10
National Labor Relations Board. Interfering with Employee Rights Section 7 and 8a1
11
National Labor Relations Board. NLRB General Counsel Issues Memo on Unlawful Electronic Surveillance and Automated Management Practices