Employee monitoring laws in 2026: What’s legal in the US, UK, EU and Canada

9.5K

Quick overview: Employee monitoring laws in the US, UK, EU and Canada generally allow employers to monitor work activity, but each sets its own rules on notice, purpose and scope. In the US, federal law permits most monitoring of company systems for business reasons, while New York, Connecticut, Delaware and Maine also require notice. Under GDPR and UK GDPR, you need a lawful basis, clear information for workers and monitoring that is proportionate. In Canada, the rules depend on the province, and Ontario employers with 25 or more employees need a written monitoring policy. This guide is general information, not legal advice.

Employee monitoring laws decide what you can track, what you must tell people, and when you need extra approval. For HR, Legal and operations leaders, that question usually comes up before a rollout, not after one. Getting it wrong can mean fines, unusable evidence, or a team that stops trusting leadership.

Like labor laws for remote employees, these rules follow your people, not your head office. So a company in Texas with staff in New York, London and Toronto has to meet four different standards at once.

This guide covers the US, the EU, the UK and Canada in depth. After that, a summary table covers nine more countries, followed by eight practices for a transparent rollout.

This article is general information, not legal advice. Laws change and vary by location, so check with qualified counsel before you roll out any monitoring. Last reviewed: November 2026.

Table of Contents

• What counts as employee monitoring?
• Is employee monitoring legal in the US?
• Employee monitoring laws in Europe (GDPR)
• Employee monitoring laws in the UK
• Employee monitoring laws in Canada
• Other countries at a glance
• How to roll out employee monitoring legally: 8 best practices
• How Time Doctor supports a transparent rollout
• Final thoughts
• Frequently asked questions

What counts as employee monitoring?

Employee monitoring is any way an employer collects information about how employees work. Examples include tracking time and apps, reviewing work email, recording calls, using cameras and logging location. Most laws care less about the tool itself. Instead, they ask what you collect, whether employees know, and whether your purpose justifies it.

Common types of employee monitoring

Employers often combine several types of employee monitoring:

• Time and activity tracking: hours worked, apps and websites used, and idle time.
• Screen capture: screenshots of work computers at intervals.
• Communications monitoring: reviewing work email, chat or call recordings.
• Keystroke logging: recording what a person types.
• Video surveillance: cameras in offices, warehouses or stores.
• Location tracking: GPS in company vehicles or phones.
• Biometrics: fingerprint or face scans for clocking in.

However, each type carries a different legal risk. For example, time tracking on a company laptop is low risk in most places. By contrast, keystroke logging and biometrics draw the strictest rules.

Invasive vs. non-invasive monitoring

The legal line usually depends on how intrusive the method is and whether people know about it. The table below shows the difference. It also explains why regulators separate monitoring from surveillance.

Factor	Lower-risk monitoring	Higher-risk monitoring
Awareness	Disclosed in writing before it starts	Hidden or covert
Timing	Work hours only	After hours or on breaks
Devices	Company-owned devices and systems	Personal devices
Data type	Time, activity and app-level data	Message content, keystrokes, webcams, biometrics
Access	Limited to people who need it	Open to many managers

Is employee monitoring legal in the US?

Yes, employee monitoring is legal in the US when it serves a business purpose and follows federal and state rules. Overall, federal law sets a permissive baseline. However, a few states add notice duties, and others restrict recordings and biometrics.

Federal law: ECPA, SCA and NLRA

In particular, three federal laws matter most:

• Electronic Communications Privacy Act (ECPA). The Wiretap Act part of the ECPA bans intercepting communications. It has two key exceptions for employers. First, monitoring in the ordinary course of business is generally allowed. Second, interception is lawful if one party consents, which is why many handbooks include a monitoring acknowledgment.
• Stored Communications Act (SCA). This law limits access to stored messages. Still, it exempts the provider of the service. So an employer that runs its own email system can generally review messages stored on it.
• National Labor Relations Act (NLRA). Section 7 protects employees who act together about pay and working conditions. Therefore, employers can’t use monitoring to surveil union activity. In February 2025, the NLRB’s acting general counsel rescinded the 2022 memo that called for tougher scrutiny of electronic monitoring. Even so, Section 7 itself still applies.

Notably, no general federal rule requires employers to announce monitoring. That’s why state employee monitoring laws matter so much.

State employee monitoring laws

Four states have dedicated laws that require notice of electronic monitoring: New York, Connecticut, Delaware and Maine. California and Illinois add limits on recordings, employee data and biometrics.

State	Law	What employers must do	Penalty
New York	Civil Rights Law § 52-c, in force since May 7, 2022	Give written notice on hiring, get the employee’s written or electronic acknowledgment, and post the notice. Covers phone, email and internet use.	Up to $500, $1,000, then $3,000 per offense, enforced by the attorney general
Connecticut	Public Act 26-73, in force since Oct 1, 2026	Give prior written notice of the types of monitoring and the specific locations where it may happen. Post the notice in those locations. Give new hires a plain-language statement before they start.	$500, $1,000, then $3,000 per offense
Delaware	19 Del. C. § 705	Give an electronic notice each day the employee uses company email or internet, or a one-time notice the employee acknowledges. Covers phone, email and internet use.	$100 per violation
Maine	26 M.R.S. § 620-A, in force since July 14, 2026	Tell applicants during interviews, notify employees before any surveillance starts, and give written notice every year. No audiovisual monitoring in an employee’s home, personal vehicle or property unless the job requires it. Employees can refuse monitoring apps on personal devices.	$100 to $500 per violation
California	CCPA, plus Penal Code § 632	Since January 1, 2023, employee data is covered by the CCPA. Covered employers must give notice at collection and honor data rights. Recording a confidential conversation needs the consent of all parties.	Varies by law
Illinois	Biometric Information Privacy Act (BIPA)	Get a written release before collecting biometrics, such as fingerprints for time clocks. Since August 2, 2024, an electronic signature counts.	Statutory damages, now limited to one recovery per person

Recent state changes

Two laws changed in 2026. Maine’s took effect on July 14, and it goes beyond notice: it also limits surveillance in employees’ homes and on personal devices. Then on October 1, Connecticut’s notice rules expanded. Notices must now name the locations, so a change of office or camera placement may mean a new notice.as several federal laws that outline what employers can and cannot monitor:

California has more on the way. From January 1, 2027, new CCPA rules on automated decision-making apply to covered employers. They affect AI tools that make significant employment decisions without meaningful human involvement.

Employee monitoring laws in Europe (GDPR)

Employee monitoring is legal in the EU, but it’s one of the most regulated places to do it. The General Data Protection Regulation (GDPR) sets the baseline. Then national labor laws and the EU AI Act add more rules on top.

GDPR applies based on where people are, not their citizenship. It covers employers established in the EU. It also covers employers outside the EU that monitor the behavior of people in the EU.

What GDPR requires from employers

Under GDPR, every monitoring activity needs these elements:

1. A lawful basis. Employers usually rely on legitimate interests, a contract or a legal obligation. Consent rarely works. EU regulators said in Opinion 2/2017 that employees are seldom free to refuse it.
2. Transparency. Workers must get clear information about what you monitor, why, and how long you keep the data.
3. Proportionality. You must collect only what you need and use the least intrusive method that works.
4. An impact assessment. Systematic monitoring of employees often needs a Data Protection Impact Assessment (DPIA) before it starts.
5. Respect for worker rights. Employees can request the monitoring data you hold about them.

Fines for the most serious breaches reach €20 million or 4% of global annual turnover, whichever is higher. GDPR also lets each country add its own employment rules.

Similarly, courts look at the same issues. In Bărbulescu v. Romania (2017), the European Court of Human Rights found a violation. The employee hadn’t received advance notice of the nature and extent of the monitoring.

For example, keystroke logging is a high-risk method. Regulators treat it as highly intrusive, so expect to need a strong documented reason and a DPIA.

Country rules: Germany, France, Spain, Italy and the Netherlands

On top of GDPR, several countries give employee representatives a direct say.

Country	Main rule	What it means in practice
Germany	Works Constitution Act, § 87(1) no. 6	The works council must agree before you introduce any technical system that can monitor behavior or performance. Courts read this broadly.
France	Labour Code L1222-4 and L2312-38	Inform each employee before using a monitoring system, and consult the works council (CSE) first. The Cour de cassation has held that an employer can’t use a monitoring system that wasn’t disclosed in advance.
Spain	Data Protection Law 3/2018, Article 87	Set rules for using work devices, with worker representatives taking part, and tell employees about them.
Italy	Workers’ Statute, Article 4	Tools that allow remote monitoring need a union agreement or Labor Inspectorate approval. They may only serve operational, safety or asset-protection needs. Tools employees use to do their work, such as company email, don’t need the agreement, but employees must still be informed.
Netherlands	Works Councils Act, Article 27(1)(l)	The works council must consent to any system for monitoring staff attendance, behavior or performance.

The EU AI Act and workplace AI

The EU AI Act adds a newer layer. Since February 2, 2025, Article 5(1)(f) has banned AI systems that infer employees’ emotions in the workplace. The only exceptions are medical or safety reasons. For example, a tool that reads mood from webcam video or voice tone falls under the ban. 

Breaking a prohibited-practice rule can cost up to €35 million or 7% of global turnover. In addition, AI used to allocate tasks or evaluate performance counts as high-risk, and those duties are being phased in.

Employee monitoring laws in the UK

Employee monitoring is legal in the UK under the UK GDPR and the Data Protection Act 2018. The main practical source is the regulator’s guidance on monitoring workers, published in October 2023.

In short, the guidance sets clear expectations:

• Lawful basis: Most employers use legitimate interests. Consent is rarely appropriate because of the power imbalance at work.
• Transparency: Tell workers what you monitor and why, in plain language, before you start.
• DPIAs: Do one before high-risk monitoring. Examples include keystroke monitoring, reviewing emails and messages, and biometric data.
• Covert monitoring: Use it only in exceptional cases, such as suspected crime. Senior management should approve it.
• Access rights: Workers can ask for the monitoring data you hold about them.

The Data (Use and Access) Act 2025 is now changing parts of this framework. Most of its data protection changes took effect on February 5, 2026. They include a new “recognized legitimate interests” basis for a short list of purposes, such as preventing crime. However, routine productivity monitoring still needs the usual legitimate interests balancing test.

Employee monitoring laws in Canada

Canada has no single employee monitoring law. Instead, the rules depend on the province and the type of employer.

Jurisdiction	Main rule	What employers must do
Federally regulated employers	PIPEDA	Banks, airlines and telecoms follow PIPEDA for employee data. The Privacy Commissioner’s 2023 guidance says monitoring should be specific, targeted and minimally intrusive.
Ontario	Employment Standards Act, Part XI.1	Employers with 25 or more employees on January 1 need a written electronic monitoring policy before March 1. It must say how and why you monitor, and staff must get a copy.
Quebec	Private-sector privacy act, as amended by Law 25	Tell employees when you use technology that can identify, locate or profile them. Fines reach C$25 million or 4% of worldwide turnover.
Alberta	Personal Information Protection Act (PIPA)	You may collect employee information without consent for reasonable employment purposes. However, you must notify current employees first.
British Columbia	Personal Information Protection Act (PIPA)	The same approach applies: no consent is needed for reasonable employment purposes, but advance notice is.

In other provinces, private employers rely on common law, contracts and collective agreements. Even so, the federal guidance is a useful benchmark everywhere. It also confirms that employees can’t sign away their privacy rights as a condition of the job.

Other countries at a glance

Outside these four regions, most countries regulate monitoring through general data protection laws. The table covers ten common hiring markets.

Country	Main law	Key point for employers
Australia	NSW Workplace Surveillance Act 2005, ACT Workplace Privacy Act 2011	No single national law. In NSW, give 14 days’ written notice before camera, computer or tracking surveillance. Computer surveillance also needs a written policy.
Mexico	Federal data protection law for private parties	A new law replaced the 2010 law on March 21, 2025. Oversight moved from the dissolved INAI to a government ministry.
Brazil	General Data Protection Law (LGPD)	Employers usually rely on legitimate interests or the employment contract, with clear notice to employees.
India	Digital Personal Data Protection Act 2023	The rules were notified on November 13, 2025. Most employer duties apply from May 2027. Employment purposes are a “legitimate use” that doesn’t need consent under Section 7(i).
Singapore	Personal Data Protection Act 2012	Consent isn’t needed to manage the employment relationship. Still, you must tell employees the purposes.
Japan	Act on the Protection of Personal Information	The regulator’s Q&A recommends written internal rules, advance notice to employees and a named person in charge.
South Africa	POPIA and RICA	RICA bans intercepting communications unless an exception applies, such as written consent or a business exception. POPIA also governs any personal data you collect.
South Korea	Personal Information Protection Act	Collecting personal data generally needs consent unless an exception applies. In 2023, the Supreme Court held that workplace CCTV needed labor-management council consultation.
Chile	Law 19.628, to be replaced by Law 21.719	Law 21.719 is set to take effect on December 1, 2026. However, the government has proposed delaying it to 2027, so check its status.
Philippines	Data Privacy Act of 2012, Anti-Wiretapping Act (RA 4200)	Employers can rely on legitimate interests or the employment contract instead of consent, per a 2024 privacy commission opinion. It also expects a written policy and a privacy impact assessment. Recording calls needs the consent of all parties.

How to roll out employee monitoring legally: 8 best practices

Across all these employee monitoring laws, the same habits keep employers safe. They also protect employee trust, which sits at the center of the ethics of employee monitoring.

1. Map where your people work

After all, the law follows the employee’s location, not your headquarters. So list every state, province and country where your team works. Then check the employee monitoring laws in each one.

2. Define and document your purpose

First, write down why you need each type of monitoring. Examples include payroll accuracy, client billing or security. In the EU and UK, this record becomes part of your legitimate interests assessment or DPIA.

3. Choose the least intrusive option

Start with the lightest method that meets your purpose. For example, time and app-level data are usually enough to verify hours. In contrast, message content, keystrokes and webcams need much stronger reasons. Emotion-reading AI is banned at work in the EU.

4. Give written notice before monitoring starts

In fact, notice is the most common legal requirement. Several laws set specific rules:

• New York: notice on hiring, plus an acknowledgment.
• Connecticut: notice that names the specific locations.
• Delaware: daily notice or a one-time acknowledged notice.
• Maine: notice before surveillance starts, plus a written notice every year.
• New South Wales: notice at least 14 days ahead.

Also, keep signed or electronic acknowledgments on file.

5. Write a clear monitoring policy

A written employee monitoring policy explains what you monitor, why, who sees the data and how long you keep it. In Ontario, it’s a legal requirement for employers with 25 or more staff.

6. Involve employee representatives early

In Germany, France, Italy, Spain and the Netherlands, works councils or unions have a formal role. In South Korea, labor-management councils do. If you skip them, the rollout can be blocked or the data excluded as evidence. Even without a legal duty, involving staff early reduces pushback.

7. Limit access and retention

First, give access only to people who need the data for its stated purpose. Also set a retention period and delete data when it expires. Then secure it like any other sensitive record.

8. Let employees see their data, and review regularly

GDPR, UK law and Canadian guidance all give employees rights to their data. Letting people see their own records makes those requests simple. Finally, review your setup at least once a year, and update notices whenever tools, locations or purposes change.

How Time Doctor supports a transparent rollout

No software makes monitoring legal on its own. The law looks at your purpose, your notice and how much you collect. What the right tool can do is make a transparent setup easier to run and easier to defend.

Time Doctor helps leaders see how a distributed team actually works, with verification without surveillance. You control what gets captured, employees see their own data, and the whole system holds up to HR, Legal, and InfoSec review.

Here’s how that maps to the practices above:

Rollout practice	How Time Doctor supports it
Choose the least intrusive option	You decide what gets captured, and screenshot blurring is optional.
Let employees see their data	Employees see their own data.
Limit access	Role-based permissions control who sees what
Keep records fair	Manual time entry is available.
Clear security review	ISO 27001 · SOC 2 Type 2 · GDPR · HIPAA

More than 10,000 distributed teams use Time Doctor, and its security and compliance documentation is open for InfoSec teams to review.

Final thoughts

Employee monitoring laws differ in the details, but they agree on the basics. Have a clear business purpose, tell people before you start, collect only what you need, and protect what you collect. Where works councils or unions exist, bring them in early.

Before any rollout, check three things. First, confirm the employee monitoring laws in every location where your team works. Second, make sure your notice and policy match what your tools actually capture. Third, ask counsel to review anything high-risk, such as keystrokes, biometrics or covert monitoring.

Frequently asked questions