Employee Monitoring and the Law: A 2022 State-by-State Guide

The Legal Patchwork

There is no comprehensive federal law governing employee monitoring in the United States. The Electronic Communications Privacy Act (ECPA) of 1986 provides some baseline protections, but it was written before the internet and has a massive "business purpose" exception that renders it nearly toothless for workplace monitoring.

The result is a state-by-state patchwork that's complex, inconsistent, and rapidly evolving. As of early 2022, the landscape looks roughly like this:

If you're operating across multiple states — which most remote-friendly companies now are — you need to understand the requirements in every state where you have employees. This guide covers the current landscape and where it's heading.

States with Active Monitoring Laws

Connecticut: Requires employers to give written notice of electronic monitoring to employees prior to commencing monitoring. The notice must describe the types of monitoring that may occur. This is one of the strongest state-level protections currently in effect.

Delaware: Similar to Connecticut, requires employers to give notice of monitoring of telephone, email, and internet use. Notice must be provided at least once, and the law covers both current and prospective employees.

New York: Effective May 2022, employers who monitor telephone, email, or internet must provide written notice upon hiring. The notice must be acknowledged in writing or electronically by the employee.

Texas and Colorado: Have laws restricting video surveillance in private areas but no comprehensive electronic monitoring statutes.

Pending Legislation to Watch

Several states have bills in committee or under consideration that would significantly impact employee monitoring:

• California (AB 1651): Would require employers to disclose monitoring before hiring and limit monitoring to work hours only. Given California's influence on national policy, this could set a standard.
• New York (S2628): Would expand the new notice requirement to include specific details about the types of data collected, retention periods, and employee access rights.
• Illinois: Building on the Biometric Information Privacy Act (BIPA), proposed legislation would extend similar consent requirements to broader categories of employee data.
• Massachusetts, Washington, and Virginia all have monitoring-related bills at various stages.

We track these developments continuously and update our compliance documentation as laws change. Our customers receive alerts when new legislation in their operating states affects their monitoring configuration.

Practical Compliance Recommendations

Given the evolving and inconsistent legal landscape, here's our recommendation: build to the highest standard regardless of where you currently operate. Specifically:

• Always notify employees before monitoring begins. Even where not legally required, notification is basic respect and protects you against future legislation.
• Get written acknowledgment. Have employees sign that they've been informed about monitoring practices. Digital acknowledgment is fine.
• Limit monitoring to work hours. Several pending laws would require this, and it's good practice regardless.
• Provide data access rights. Let employees see what's collected about them. GDPR already requires this for European employees; extending it to all employees is simpler than maintaining different systems.
• Document your purposes. Be able to articulate why each type of data is collected and how it's used.

The compliance landscape is moving in one direction: more transparency, more employee rights, more employer obligations. Organizations that get ahead of this trend avoid the scramble of reactive compliance. For a privacy-first approach to monitoring, see our ethical monitoring framework.