Employee monitoring laws by US state

Updated on 6 July 2026

No federal law requires US employers to tell employees about monitoring, but a growing group of states does. Connecticut, Delaware, New York and, from July 2026, Maine require notice before electronic monitoring begins, and California, Illinois, Colorado and Virginia regulate monitoring through privacy, consent and data protection statutes. This page is general information, not legal advice.

For how these rules fit the global picture, see is employee monitoring legal.

Which US states have employee monitoring laws?

Eight states come up in every compliance conversation: Connecticut, Delaware and New York have dedicated notice statutes, Maine joins them when LD 61 takes effect in July 2026, and California, Illinois, Colorado and Virginia reach monitoring through broader privacy and consent law. Multi-state employers usually adopt the strictest standard, written notice with acknowledgment, for everyone.

The table below summarises what each of the eight states requires of employers, with the statutes and penalties verified in June 2026.

Does Connecticut require notice of employee monitoring?

Yes. Under Conn. Gen. Stat. § 31-48d, an employer that engages in any electronic monitoring must give prior written notice to affected employees describing the types of monitoring that may occur, and must post a notice of those monitoring types conspicuously in the workplace. "Electronic monitoring" is defined broadly as collecting information on the employer's premises about employees' activities or communications by any means other than direct observation.

There is one exception: where the employer has reasonable grounds to believe employees are breaking the law, violating the employer's or other employees' legal rights, or creating a hostile workplace, and monitoring may produce evidence of it, monitoring may proceed without notice. The Labor Commissioner enforces the statute with civil penalties of $500 for a first offence, $1,000 for a second and $3,000 for each offence after that. One honest wrinkle: the statute's "on the employer's premises" wording predates remote work, so most employers apply its notice standard to remote staff as a matter of prudence rather than settled obligation.

Does Delaware require notice of employee monitoring?

Yes, with a choice of route. Under 19 Del. C. § 705, an employer may not monitor or intercept an employee's telephone conversations, email or internet usage unless it either gives an electronic notice of the monitoring at least once each day the employee accesses the employer's email or internet systems, or gives a one-time notice, in writing or electronically, that the employee acknowledges in writing or electronically.

Most employers take the one-time acknowledged notice at onboarding. The statute does not cover processes that manage email volume or protect systems without targeting an individual's usage, or law enforcement acting under a court order. The civil penalty is $100 per violation, small individually but multiplied across an unnotified workforce.

Does Maine require notice of employee monitoring?

Yes, from July 2026. LD 61, An Act to Regulate Employer Surveillance to Protect Workers, became law in January 2026 and makes Maine the fourth state with a dedicated monitoring-notice statute. Employers must disclose surveillance to applicants during interviews and give employees written notice of it annually.

Maine goes further than the older notice states in two respects. It prohibits audiovisual monitoring of employees in their homes, personal vehicles and on their personal property unless the job requires it, and it bans requiring employees to install monitoring software on personal devices. The Maine Department of Labor enforces the law with civil fines of $100 to $500 per violation. The statute takes effect roughly ninety days after the legislative session closes, expected mid July 2026, so employers with Maine staff should have notices ready now.

Does New York require notice of employee monitoring?

Yes. Civil Rights Law § 52-c, in force since 7 May 2022, requires any private employer with a place of business in New York that monitors telephone, email or internet access or usage to give each new hire prior written notice, obtain the employee's acknowledgment in writing or electronically, and post the notice conspicuously for all employees. The notice must say that any and all such communications may be monitored at any and all times and by any lawful means.

System administration activity that manages volume or protects the network, and is not targeted at an individual, is exempt. The Attorney General enforces the law, with penalties of $500 for a first offence, $1,000 for a second and $3,000 for the third and each one after. A deeper page on this law is at New York's electronic monitoring law.

Is employee monitoring legal in California?

Yes, but California regulates it more actively than any other state. There is no single monitoring-notice statute; instead, the California Consumer Privacy Act has applied fully to employee data since January 2023, so employees must receive a notice at collection describing what categories of data monitoring collects and for what purposes, and they hold access, deletion and correction rights. CPPA regulations effective from January 2026 require risk assessments for high-risk processing, including where automated decision-making technology feeds significant employment decisions such as hiring, promotion, discipline or termination, with those automated-decision duties phasing in through 2027.

Two older rules still bite. Penal Code § 632 requires all-party consent to record a confidential communication, and recording employees in private spaces is unlawful everywhere. Enforcement fines run to $2,500 per violation, or $7,500 per intentional violation. The detail is on California's employee monitoring rules.

Is employee monitoring legal in Illinois?

Yes, but two consent statutes constrain how. The Illinois eavesdropping law, 720 ILCS 5/14, makes it a criminal offence to surreptitiously record a private conversation without the consent of all parties. A dedicated exemption allows telephone service observation for quality control and training in call-centre settings, but only with notice to current and prospective employees, prominent workplace signage, and access to unmonitored personal lines.

The sharper edge is the Biometric Information Privacy Act. Any monitoring that captures biometric identifiers, fingerprint clock-ins, face scans or voiceprints, requires written informed consent and a published retention policy first. BIPA carries statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless one, with a private right of action that has produced some of the largest privacy settlements in the country.

Does Colorado require notice of employee monitoring?

Only for public employers, so far. Under C.R.S. § 24-72-204.5, the state and any agency, institution or political subdivision that operates an email system must adopt a written policy on any monitoring of email, including the circumstances in which it happens. Private employers have no general notice duty, and the Colorado Privacy Act does not cover data about people acting in an employment context.

The horizon item is Colorado's artificial intelligence law. Originally passed in 2024 as the first comprehensive state AI act, it was scaled back and rescheduled in May 2026, and now takes effect on 1 January 2027 with a narrower focus on disclosure and transparency where automated decision-making technology is used in consequential decisions, including employment. Employers whose monitoring feeds automated scoring or decisions should watch its final shape.

Does Virginia require notice of employee monitoring?

No, and this is the most miscited state on the list. Several compliance guides state that Virginia requires employers with ten or more employees to post an electronic monitoring policy, citing Code of Virginia §§ 40.1-143 through 40.1-147. Those sections do not exist. They come from House Bill 1887, introduced in the 2003 session, which would have added a workplace privacy chapter to Title 40.1 but was never enacted; Title 40.1 contains no such chapter today.

What Virginia actually has: one-party consent for recording conversations under Va. Code § 19.2-62, a ban on demanding employees' social media credentials under § 40.1-28.7:5, and a consumer data protection act that expressly excludes data about people acting in an employment context. Monitoring company devices for business purposes in Virginia is governed by the federal baseline below.

What monitoring rules apply in every US state?

The federal Electronic Communications Privacy Act sets the floor nationwide. Employers may monitor communications on company-owned systems for legitimate business reasons under the business-purpose exception, or with one party's consent, which a signed acceptable-use policy provides. Personal accounts and clearly personal communications fall outside the business-purpose exception even on company hardware.

Beyond the ECPA, two rules hold everywhere: recording in places with a reasonable expectation of privacy, such as bathrooms and changing rooms, is unlawful, and common-law privacy claims remain available where monitoring is highly offensive and unjustified. Audio recording adds its own layer, since several states beyond Illinois and California require all-party consent to record conversations.

How does privacy-first monitoring reduce state-law risk?

State monitoring law punishes two things: silence and excess. Every statute above either demands that employees know what is collected, or limits how much can be collected and kept. A monitoring design that is transparent to employees and keeps no raw footage starts on the right side of both.

ScreenJournal is an AI work visibility tool that reads on-screen work as it happens, turns it into a detailed timeline of what each person actually did, and then deletes the raw screen data. Timelines accumulate into a searchable chronicle of everyone's work history, and from them ScreenJournal generates timesheets and reports automatically and drafts standup summaries on request, answering questions about any of it in plain English.

Against these statutes, that design works in the employer's favour. There is no screenshot or video archive to secure or produce, because the transient video capture is deleted immediately during processing; what is kept is the work timeline, a derived record of the work. Capture is scoped to work apps and work-related activity, personal activity is skipped in real time, and PII is removed during processing, which answers the excess question. And transparency is structural rather than a policy document: employees see the same activity view managers do and can redact personal entries before a manager sees anything. A redacted entry is erased entirely and never appears in anyone's search; redaction is unavailable only for roles a company flags as a data-leak risk.

Proof: employees share the manager's view of their own data, and the member timeline carries a Redact control and an auto-hidden "Personal" entry type.

The notice obligations in Connecticut, Delaware, New York and, from July 2026, Maine still sit with the employer regardless of the tool chosen, so written notice and acknowledgment belong in onboarding wherever your team sits. How this approach compares with screenshot and recording tools is at ScreenJournal vs the alternatives, and the design principles are in our privacy blog.

ScreenJournal is currently available in India and the Philippines, with California and New York City coming soon.

Frequently asked questions

Can my employer monitor my computer without telling me?

In Connecticut, Delaware, New York and, from July 2026, Maine, no: notice is required before electronic monitoring, and in Delaware and New York it must be acknowledged. In most other states, monitoring company-owned devices for business purposes is lawful without notice under federal law, although California requires a notice at collection for employee data.

Which states require consent rather than just notice?

Illinois requires written consent before collecting biometric data such as fingerprints or face scans, and both Illinois and California require all parties to consent before a private conversation is recorded. The notice states, Connecticut, Delaware and New York, plus Maine from July 2026, require disclosure, with acknowledgment in Delaware and New York, rather than genuine opt-in consent.

Which state's law applies to remote employees?

Usually the state where the employee physically works, which is why multi-state employers tend to adopt the strictest applicable standard, typically written notice with acknowledgment, for everyone. The question is not fully settled, so take advice before relying on the employer's home state alone.

What happens if an employer monitors employees without the required notice?

Civil penalties in the notice states: up to $3,000 per offence in Connecticut and New York, $100 per violation in Delaware, and $100 to $500 per violation in Maine from July 2026. Illinois biometric violations carry statutory damages of $1,000 to $5,000 per violation through private lawsuits, and California privacy violations draw fines of up to $2,500, or $7,500 if intentional.

This page is general information, not legal advice. Statutes were verified against primary sources in June 2026; laws change, so confirm with counsel in your state before acting.