Employee Monitoring Compliance for Multi-State Employers

For multi-state employers, the rules on employee monitoring depend mostly on where each employee works, not where the company is headquartered. Federal law sets the floor, and a handful of states add notice, acknowledgment, posting or biometric consent rules on top. The practical answer is one master policy built to the strictest verified requirements, plus a few state-specific steps.

This guide is for HR, legal and IT leaders who run monitoring tools across employees in several states and need to know which rules actually apply.

Key takeaways

• Map monitoring obligations to each employee's work state. A remote employee who moves can bring new notice duties with them.
• New York and Delaware require notice of phone, email and internet monitoring that the employee acknowledges. Connecticut requires prior written notice and a posting, and its rules expanded on October 1, 2026.
• Biometric tools, such as face or fingerprint time clocks, need notice and consent in Illinois and Texas before any data is captured.
• The NLRA still bars spying on protected activity, even after the NLRB General Counsel's 2022 monitoring memo was rescinded.
• California AB 1221 and the Colorado Privacy Act are often cited as monitoring rules. Neither is one.

Why does the employee's work state matter more than headquarters?

Picture a company based in Texas with remote staff in New York, Connecticut, Delaware and Illinois. The Texas HR team writes a monitoring policy that meets Texas rules and rolls it out to everyone. A common mistake we see is assuming that's enough. New York's and Delaware's statutes apply to employers with a place of business in those states, and Illinois's biometric law applies to anyone collecting biometric data there, so part of that workforce may be under rules the policy never considered.

So your monitoring process needs each employee's current work location. When someone moves from Austin to Albany, the notice obligations move with them. Make a change of work state trigger a monitoring review, the same way it triggers a payroll tax review.

What does federal law allow?

The Electronic Communications Privacy Act (ECPA)

The federal Wiretap Act, part of the ECPA, is the baseline for intercepting communications. Two provisions matter most for employers:

• Consent. Under 18 U.S.C. 2511(2)(d), intercepting a communication isn't unlawful when one of the parties has given prior consent, unless it's done to commit a criminal or tortious act. A clearly written, acknowledged monitoring policy is how employers document that consent.
• Ordinary course of business. Under 18 U.S.C. 2510(5)(a), equipment furnished by a communications provider and used by the subscriber in the ordinary course of its business falls outside the definition of an intercepting device. Courts apply this exception narrowly, so don't rely on it alone, especially for listening to calls that turn personal.

The ECPA doesn't require a signed acknowledgment. Still, a written notice with an acknowledgment is the cheapest evidence of consent you can collect.

The National Labor Relations Act (NLRA)

Section 7 of the NLRA protects employees' right to engage in concerted activity for mutual aid or protection, whether or not they're in a union. The NLRB lists spying on union activity, creating the impression that you're spying, and photographing or videotaping employees during peaceful protected activity as violations.

In February 2025, the NLRB's Acting General Counsel rescinded memo GC 23-02, "Electronic Monitoring and Algorithmic Management of Employees." That changed enforcement priorities, not the statute. Don't use monitoring tools to watch organizing activity, and don't write policies that stop employees from discussing pay or working conditions.

Which states have monitoring notice laws?

The table covers state statutes checked against official sources. Read it as a starting point, not a complete list of every state rule that might touch monitoring.

State and law	What it covers	Core requirement	Penalty
New York, Civil Rights Law 52-c	Phone, email and internet access or usage	Prior written notice upon hiring, acknowledged in writing or electronically, plus a notice posted in a conspicuous place	Up to $500 first, $1,000 second, $3,000 third and later offenses (Attorney General enforces)
Connecticut, Gen. Stat. 31-48d as replaced by Public Act 26-73	Collecting information on the employer's premises about employee activities or communications by computer, phone, camera and similar systems	Prior written notice of the types of monitoring and specific locations; posted notice; plain-language statement for new hires	Up to $500 first, $1,000 second, $3,000 third and later offenses (Labor Commissioner)
Delaware, 19 Del. C. 705	Phone, email and internet access or usage	Daily electronic notice, or a one-time notice acknowledged in writing or electronically	$100 per violation
Illinois, Biometric Information Privacy Act (740 ILCS 14)	Biometric identifiers and information	Public retention and destruction policy, written notice of purpose and term, written release before collection	Private right of action: $1,000 or actual damages (negligent), $5,000 or actual damages (intentional or reckless)
Texas, Bus. & Com. Code 503.001	Capturing biometric identifiers for a commercial purpose	Inform the individual and get consent before capture; limits on sale and disclosure; timely destruction	Civil penalty up to $25,000 per violation (Attorney General enforces)

New York

Section 52-c applies to any individual or business with a place of business in New York that monitors employee phone, email or internet use. The employer gives prior written notice upon hiring that these communications may be monitored at any time by any lawful means, and the employee acknowledges it in writing or electronically. The employer also posts the notice in a conspicuous place that employees can readily see. For remote staff, an HR portal page is the usual approach, so record how and where you posted it. Processes that manage the type or volume of email, voicemail or internet traffic, aren't aimed at a particular person, and are used only for system maintenance or protection are excluded.

Connecticut

Public Act 26-73, approved June 4, 2026, replaced section 31-48d effective October 1, 2026. Employers must now give prior written notice of both the types of monitoring and the specific locations where it may occur, and post the notice in a conspicuous place, including at the locations where monitoring may happen. The location disclosure doesn't apply at airports or where the employer has reasonable grounds to monitor for security and employee safety. Employees hired on or after October 1, 2026 must get a plain-language written statement before they start work. Employers may skip prior notice when they have reasonable grounds to believe employees are breaking the law, violating others' legal rights or creating a hostile work environment, and monitoring may produce evidence of it.

The law is written around monitoring on the employer's premises. It doesn't clearly reach employees working from home, but giving Connecticut remote staff the same notice costs little and keeps your policy consistent.

Delaware

Section 705 covers employers with a place of business in Delaware, including the state and its agencies. It applies to monitoring or intercepting phone calls, email and internet use. You can either show an electronic notice of your monitoring policy at least once each day the employee uses employer-provided email or internet, or give a one-time notice the employee acknowledges in writing or electronically. Most employers choose the one-time acknowledgment because it fits into onboarding.

Illinois

BIPA applies whenever a timekeeping or monitoring tool collects biometric identifiers, such as face geometry or fingerprints. Before collection, the employer must tell the person in writing that data is being collected, state the specific purpose and how long it will be kept, and receive a written release. It must also publish a written retention schedule and destroy the data when the purpose is fulfilled or within three years of the person's last interaction, whichever comes first.

SB 2979, approved August 2, 2024 as Public Act 103-0769, made two changes: a written release includes an electronic signature, and an entity that repeatedly collects or discloses the same person's biometric data in violation of the Act commits a single violation, with at most one recovery for that person. Liquidated damages per violation stay at $1,000 for negligent and $5,000 for intentional or reckless violations, or actual damages if greater. Our article on the BIPA ruling for biometric time clock rollouts covers what to have in place before enrollment.

Texas

Texas has no general electronic monitoring notice statute, so communications monitoring follows the federal baseline. Biometrics are different. Section 503.001 requires informing the individual and getting consent before capturing a biometric identifier for a commercial purpose, restricts selling or disclosing it, and requires destruction within a reasonable time and no later than one year after the purpose expires. When an employer collects a biometric identifier for security purposes, the purpose is presumed to expire when employment ends. The Attorney General can seek up to $25,000 per violation.

Which monitoring laws are often misreported?

A few claims keep showing up in compliance content and don't hold up.

• California AB 1221. This workplace surveillance bill died in the Assembly on January 31, 2026, under Article IV, Section 10(c) of the state constitution. It isn't law. California employers still have obligations, though: the CCPA's exemptions for employment-related personal information expired on December 31, 2022, and the CCPA requires a notice at collection listing the categories of personal information collected and why.
• Colorado Privacy Act. The Colorado Attorney General states that the CPA doesn't apply to data maintained for employment records purposes, and that "consumer" doesn't include someone acting as an employee or job applicant. It doesn't create employee monitoring rules.

How do you build one monitoring policy that works across states?

No single state is strictest on everything. New York and Delaware focus on communications, Connecticut on monitoring at the workplace, and Illinois and Texas on biometrics. Build a master policy that takes the toughest element of each.

1. Inventory every tool. Email and chat retention, web filtering, endpoint monitoring, screenshots, call recording, cameras, GPS, badge readers, biometric clocks, and features like meeting transcription inside other software. Our overview of software companies use to monitor employees helps you spot categories you might miss.
2. Write down a business reason for each. Security, timekeeping accuracy, regulatory recordkeeping and safety are defensible. "Just in case" isn't, and it makes disputes harder to defend.
3. Use one notice that satisfies New York and Connecticut. Say that phone, email and internet use may be monitored at any time by lawful means, list the types of monitoring, and name the monitored locations on company premises.
4. Collect acknowledgment from everyone. New York requires it, and it's Delaware's most practical option. Doing it everywhere also gives you evidence of consent under the ECPA.
5. Post the notice physically at each site, including where monitoring happens in Connecticut, and electronically for remote staff. Record where and when.
6. Add a biometric module. A published retention and destruction policy, purpose-specific notice, and a signed or electronic release, applied wherever biometric tools are used, covers Illinois and Texas together.
7. Review audio recording and location tracking separately. Recording-consent rules for calls vary by state, and GPS on personal devices deserves explicit consent.
8. Set retention periods for monitoring data and actually purge it. Coordinate with your multi-state HR records retention schedule so legal holds override routine deletion.
9. Add an NLRA check. Confirm the policy doesn't restrict discussions of wages or conditions, and train managers not to use tools to watch organizing.

Compliance is only half the job. Monitoring that's legal but feels excessive still damages trust and retention, which is the focus of our piece on balancing workplace surveillance with productivity and trust. For the rollout itself, see the steps to implement an employee monitoring system.

FAQ

Do I need consent to monitor employees on company devices?

Federal law doesn't require a signed consent form for every kind of monitoring, but one-party consent is one of the ECPA's clearest defenses. New York requires a notice at hiring that the employee acknowledges, and Delaware requires either a daily electronic notice or an acknowledged one-time notice. Collecting a written or electronic acknowledgment from every employee is the simplest way to cover all three.

What changed in Connecticut's monitoring law in 2026?

Public Act 26-73 replaced section 31-48d effective October 1, 2026. Notices must now name the specific locations where monitoring may occur as well as the types, postings belong at those locations, and employees hired on or after that date must get a plain-language statement before starting work. Exceptions apply for airports and security or safety grounds. Penalties remain $500, $1,000 and $3,000 for successive offenses.

Did the 2024 BIPA amendment remove the risk of biometric time clocks?

No. It limits recovery to one per person when the same person's biometric data is repeatedly collected or disclosed in violation of the Act, and it confirms that an electronic signature counts as a written release. Liquidated damages of $1,000 per negligent and $5,000 per intentional or reckless violation still apply, so the policy, notice and release must be in place before any Illinois employee enrolls.

What to do next

• Pull a current list of employees by work state and flag New York, Connecticut, Delaware, Illinois and Texas.
• Update your Connecticut notice, postings and onboarding packet for the October 1, 2026 changes.
• Audit acknowledgments for New York and Delaware employees and fill any gaps.
• Confirm every biometric device has a published policy, written notice, signed or electronic release and a destruction process, and remove any policy language that treats AB 1221 or the Colorado Privacy Act as monitoring rules.

Statutes and agency guidance change, so confirm specifics with employment counsel before finalizing your policy. This article is general information, not legal advice.

Sources

• New York Civil Rights Law Section 52-c: Electronic monitoring, New York State Senate
• Public Act 26-73, Connecticut General Assembly
• 19 Del. C. 705: Notice of monitoring of telephone transmissions, electronic mail and Internet usage, Delaware Code Online
• Biometric Information Privacy Act, 740 ILCS 14/15, Illinois General Assembly
• Business and Commerce Code Chapter 503: Biometric Identifiers, Texas Legislature
• Interfering with employee rights (Section 7 and 8(a)(1)), National Labor Relations Board
• Colorado Privacy Act, Colorado Attorney General

Last reviewed: October 2026.