Employee Monitoring Laws in the U.S., EU and UK: A Plain Guide

Usually, yes, within limits. Employee monitoring laws in the U.S. allow monitoring of the computers and accounts an employer provides when there is consent or a business use. Some states, such as New York, Connecticut and Delaware, also require written notice first. In the EU and the UK, data protection law allows monitoring that is necessary, proportionate and explained to staff before it starts.

This is general information, not legal advice. We read each law below on its official source on October 12, 2026. Laws change and differ by location, so check the rules where each employee works, or ask an employment lawyer.

What do U.S. employee monitoring laws say at the federal level?

The main federal law is the Electronic Communications Privacy Act. Its wiretap part, 18 U.S.C. section 2511, makes it a crime to intentionally intercept a wire, oral or electronic communication. Two parts of it matter for employers:

• Consent. Section 2511(2)(d) says an interception isn't unlawful when the person is a party to the communication or one of the parties gave prior consent. The exception doesn't apply when the purpose is a criminal or tortious act.
• Business use. Section 2510(5)(a) doesn't count telephone equipment furnished by a communications provider and used in the ordinary course of business as an intercepting device.

The Stored Communications Act, 18 U.S.C. section 2701, protects stored messages such as email. It doesn't apply to conduct authorized by the person or entity providing the communications service, or by a user for their own messages.

Neither law sets out a notice rule for monitoring. Notice rules come from the states, so a written monitoring policy that each employee acknowledges is a practical base for both.

Employee monitoring laws by state

Several states add their own laws on employee monitoring. These four show the main patterns. It isn't a full list, so check every state where your employees work.

New York employee monitoring law

New York's law applies to employers with a place of business in the state that monitor employees' phone calls, email, or internet access or usage. The notice must say that any of these may be monitored at any time and by any lawful means. The attorney general enforces it. It doesn't cover processes that manage the type or volume of email, voicemail or internet use for system maintenance or protection, as long as they don't target one person.

Connecticut employee monitoring law

Connecticut covers electronic monitoring on the employer's premises by any means other than direct observation, including computers, phones and cameras. The employer gives prior written notice of the types of monitoring and posts it where employees can see it. An employer can skip the notice when it has reasonable grounds to believe an employee is breaking the law, violating others' legal rights or creating a hostile workplace. The monitoring also has to be able to produce evidence of that misconduct.

California employee monitoring law

California's AB 1331 was approved on September 30, 2026 (Chapter 851, Statutes of 2026) and adds sections 1560 to 1565 to the Labor Code. Unless a court orders it, an employer may not use a workplace surveillance tool to monitor employees in a workplace bathroom. Employees may also leave such tools behind when they go in. The law's definition of a workplace surveillance tool includes "continuous incremental time-tracking tools" as well as video and audio surveillance.

Separately, the California Consumer Privacy Act covers California residents who are employees or job applicants, since their exemption expired on December 31, 2022. A business the CCPA applies to has to tell them how it collects, uses and keeps their personal information.

How does employee monitoring and workplace privacy law work in the EU?

In the EU, the General Data Protection Regulation (GDPR) governs employee monitoring, since a monitoring tool processes personal data about employees. It reaches employers outside the EU too. Article 3(2)(b) applies it to a non-EU company whose processing relates to monitoring the behavior of people in the EU.

• Tell people first. Article 13 requires the employer to give employees information, including the purposes of processing, at the time their data is collected.
• Check the risk. Article 35 requires a data protection impact assessment (DPIA) before processing that is likely to result in a high risk to people's rights.
• Look up national rules. Article 88 lets each member state set more specific rules for employee data, with particular regard to monitoring systems at the workplace.

The Article 29 Working Party, an independent EU advisory body on data protection, published an opinion on data processing at work in 2017. It says consent is highly unlikely to be a legal basis for processing at work, unless employees can refuse without adverse consequences. Employers can sometimes rely on legitimate interests instead, when the processing is strictly necessary for a legitimate purpose and proportionate. Either way, employees should receive effective information about the monitoring.

What does UK law expect from employers who monitor?

The UK regulator, the Information Commissioner's Office (ICO), covers this in its guidance on monitoring workers. It says data protection law doesn't prevent you from monitoring workers, but:

• You must tell workers about any monitoring, in a way that's accessible and easy to understand.
• Covert monitoring is unlikely to be justified in most usual circumstances, and it should be authorized by senior management.
• You must carry out a DPIA before monitoring that's likely to be high risk, and the ICO says you should do one even when it isn't.
• Consent is not usually an appropriate lawful basis in employment.
• Homeworking is covered too, and workers' privacy expectations are likely to be higher at home.

The ICO notes that this guidance is under review after the Data (Use and Access) Act, so check it again before you rely on it.

What should employers do before monitoring starts?

Across these laws, the same steps come up again and again:

1. Write down the purpose

   Name the business reason, such as accurate timesheets, client billing or security. The EU and UK rules expect monitoring to be necessary for it.

2. Collect only what that purpose needs

   Keep monitoring to work devices and work time, and switch off what you don't use. Less data means less to explain and protect.

3. Give notice and keep proof

   New York asks for an acknowledged notice, Delaware for a daily notice or an acknowledged one-time notice, and New York and Connecticut for a posted notice. The GDPR and the ICO ask you to inform people before you collect their data.

4. Assess the risk in the EU and UK

   Run a DPIA and choose a lawful basis other than consent, such as legitimate interests.

5. Decide who sees the data and how long you keep it

   Limit access to the people who need it, and delete data once you no longer need it.

Our employee monitoring policy guide turns these steps into a template you can adapt, and how to explain employee monitoring to your team covers the conversation itself.

In short: in the places this guide covers, monitoring work computers is lawful when it has a clear purpose, stays proportionate and comes with notice. The details change by state and country, so write them into a policy and check the law where each employee works.