Employee Monitoring Laws by State: What Employers Need to...

If you're implementing screenshot monitoring for your remote team, understanding the legal landscape is essential. Employee monitoring is legal across the United States, but the rules vary significantly from state to state — and getting it wrong can expose your business to lawsuits, fines, and employee relations problems.

This guide covers the federal framework, breaks down the states with specific monitoring laws, and gives you a practical compliance checklist that works everywhere.

Disclaimer: This article provides general information about employee monitoring laws for educational purposes. It is not legal advice. Laws change frequently, and specific situations may require different approaches. Consult an employment attorney licensed in your state for guidance specific to your organization.

The Federal Framework

Before diving into individual states, understand the baseline: federal law generally permits employer monitoring of employee activity on company-owned equipment.

Electronic Communications Privacy Act (ECPA) of 1986

The ECPA is the primary federal law governing electronic monitoring. It includes two key exceptions that apply to employers:

Business Purpose Exception — Employers can monitor electronic communications if there is a legitimate business purpose (like billing verification or quality assurance)
Consent Exception — Monitoring is permitted when at least one party to the communication has consented

For screenshot monitoring used for billing verification, both exceptions typically apply: there's a clear business purpose (proving work was done), and the employee consents by starting the time tracker.

Computer Fraud and Abuse Act (CFAA)

The CFAA prohibits unauthorized access to computers. This generally doesn't restrict employers monitoring their own equipment, but it reinforces the importance of monitoring only company-owned devices or devices where the employee has installed monitoring software with informed consent.

Key Federal Principle

Federal law sets a permissive baseline — it allows monitoring but doesn't require specific notice or consent procedures. That's where state laws come in, often adding stricter requirements.

States with Specific Monitoring Laws

Several states have enacted laws that go beyond the federal baseline. Here are the ones employers need to pay closest attention to.

Connecticut

Law: Connecticut General Statutes § 31-48d

Connecticut was one of the first states to regulate electronic monitoring in the workplace. The law requires:

Written notice to employees before engaging in electronic monitoring
Notice must be provided at time of hiring or when monitoring begins
Monitoring includes email, internet access, and telephone use
The notice must describe the types of monitoring that may occur

What this means for screenshot monitoring: You must provide written notice to Connecticut-based employees before implementing screenshot monitoring. Include screenshot capture in your monitoring policy and distribute it before monitoring begins.

New York

Law: New York Civil Rights Law § 52-c (effective May 2022)

New York's law specifically targets electronic monitoring of employees:

Written notice required upon hiring that electronic monitoring may occur
Employee must acknowledge receipt of the notice in writing or electronically
Employer must post the notice in a conspicuous place visible to all employees
Covers monitoring of telephone, email, and internet access and usage

What this means for screenshot monitoring: New York employers must provide written notice, obtain signed acknowledgment, and post a visible notice. This is one of the more prescriptive state laws — make sure your onboarding process includes the monitoring disclosure.

Delaware

Law: Delaware Code Title 19, § 705

Delaware requires employers to give notice before monitoring:

Written notice required for monitoring of telephone, email, and internet access
Notice must be provided to each employee individually
Must be given at time of hire or when monitoring policy changes

What this means for screenshot monitoring: Delaware-based employees must receive individual written notice before screenshot monitoring begins.

California

California doesn't have a single employee monitoring statute, but its strong privacy protections create requirements:

California Constitution, Article I, § 1 — Establishes a right to privacy that applies to private employers
California Consumer Privacy Act (CCPA) — Requires disclosure about data collection practices, including employee data
California Privacy Rights Act (CPRA) — Extended CCPA protections to employee data
Penal Code § 632 — All-party consent required for recording confidential communications

What this means for screenshot monitoring: California's layered privacy framework means employers should provide clear notice about screenshot monitoring, disclose what data is collected and how it's used, and ensure monitoring doesn't capture protected private activities. Screenshot monitoring of work activity during tracked hours generally falls within permissible bounds, but the notice and disclosure requirements are extensive.

Illinois

Law: Biometric Information Privacy Act (BIPA), 740 ILCS 14

While BIPA doesn't directly regulate screenshot monitoring, it's relevant if your monitoring tool collects biometric data (facial recognition, fingerprint scans):

Written consent required before collecting biometric data
Strict requirements for storage, retention, and destruction
Private right of action — employees can sue directly, with statutory damages

What this means for screenshot monitoring: Standard screenshot monitoring (capturing screen contents) doesn't typically trigger BIPA. However, if your tool uses facial recognition or keystroke biometrics, you'll need BIPA-compliant consent. Stick to screen capture and you're on solid ground.

Colorado

Law: Colorado Privacy Act (CPA)

Colorado's privacy law includes employee data protections:

Requires notice about data processing activities
Employees have rights to access, correct, and delete their data
Employers must conduct data protection assessments for processing that presents heightened risk

What this means for screenshot monitoring: Implement a privacy notice that covers screenshot data collection, provide employees access to their own screenshots, and document your data protection practices.

Maryland

Law: Maryland Wiretapping and Electronic Surveillance Act, Md. Code, Cts. & Jud. Proc. § 10-402

Maryland is an all-party consent state for intercepting communications:

All parties to a communication must consent to interception
Applies to oral, wire, and electronic communications

What this means for screenshot monitoring: Screenshot monitoring captures screen contents rather than intercepting communications, so the wiretapping statute typically doesn't apply directly. However, if screenshots capture communication content (chat messages, emails), the all-party consent principle argues for explicit employee consent. Get written consent to be safe.

Texas

Texas is generally employer-friendly regarding monitoring:

No specific employee electronic monitoring statute
Follows federal ECPA framework
One-party consent state for communications

What this means for screenshot monitoring: Texas doesn't impose additional requirements beyond federal law. Written notice and consent are still best practice but aren't statutorily mandated for screenshot monitoring specifically.

States Without Specific Monitoring Laws

The majority of states don't have specific employee electronic monitoring statutes. In these states, the federal ECPA framework applies, and employers generally have broad rights to monitor activity on company equipment.

However, "no specific law" does not mean "no rules." Even in these states:

Common law privacy torts may apply if monitoring is unreasonably intrusive
Employment contracts or handbooks may create obligations
Union agreements may restrict monitoring
Reasonable expectation of privacy principles still apply to personal devices and off-hours activity

This matters if your screenshot monitoring captures communications (emails, chats visible on screen):

In these states, only one party to a communication needs to consent to monitoring. Since the employer typically has consent from the employee (via the monitoring policy), this is straightforward. Most states follow one-party consent.

In these states, all parties to a communication must consent. States requiring all-party consent include:

California
Connecticut (for telephone)
Florida
Illinois
Maryland
Massachusetts
Montana
New Hampshire
Pennsylvania
Washington

For screenshot monitoring: This distinction is most relevant if screenshots capture communications with third parties (client chats, phone conversations shown on screen). Screenshot blurring and privacy controls help mitigate this concern.

Practical Compliance Checklist

Regardless of which state your employees work in, following these steps ensures compliance everywhere:

1. Create a Written Monitoring Policy

Your policy should cover:

What is monitored — Screen captures during tracked work hours
Why monitoring occurs — Billing verification, client transparency, proof of work
When monitoring happens — Only during active time tracking (employee-initiated)
What protections exist — Screenshot blurring, encryption, access controls, retention limits
Employee rights — Ability to view own screenshots, request deletion where applicable
Who has access — Specify roles that can view screenshot data

Use our Employee Monitoring Policy Template as a starting point.

2. Provide Written Notice Before Monitoring Begins

Distribute the policy to all employees before activating monitoring
For new hires, include in the onboarding process
Document the date each employee received the notice

3. Obtain Written Acknowledgment

Have each employee sign (physically or electronically) that they received and understood the policy
Keep signed acknowledgments on file
Re-obtain acknowledgment when the policy changes materially

4. Post the Policy Visibly

Required in New York, but good practice everywhere:

Post in a common area (physical or virtual)
Include in the employee handbook
Make it accessible in your HR portal

5. Limit Monitoring Scope

Monitor only during active, employee-initiated time tracking
Only capture work-related screen content on work devices
Don't monitor personal devices without explicit consent
Never monitor outside of work hours

6. Implement Privacy Controls

Enable screenshot blurring for sensitive content
Set appropriate data retention periods
Restrict access to screenshots by role
Encrypt data in transit and at rest

7. Document Everything

Keep records of policy distribution dates
Maintain signed acknowledgments
Log any changes to monitoring practices
Conduct periodic compliance audits

If you have employees in the European Union, GDPR applies in addition to US state laws. GDPR requirements include:

Lawful basis for processing (typically legitimate interest)
Data Protection Impact Assessment for monitoring activities
Strict data minimization — only collect what's necessary
Employee access rights — employees can view, correct, and request deletion
Cross-border transfer rules if data moves outside the EU

For a comprehensive GDPR guide, see our post on GDPR compliance for screenshot monitoring.

Multi-State Compliance

Many companies have employees across multiple states. The practical approach:

Apply the Strictest Standard Everywhere

Rather than maintaining different policies for each state, adopt a single policy that meets the requirements of the strictest state where you have employees:

Written notice (required by CT, NY, DE)
Signed acknowledgment (required by NY)
Visible posting (required by NY)
Data access rights (required by CA, CO)
Biometric data protections (required by IL if applicable)

This is simpler to manage and ensures compliance regardless of where employees are located or relocate to.

Keep Policies Updated

State monitoring laws are evolving. Several states have introduced or expanded privacy legislation in recent years. Review your monitoring policy at least annually, and whenever new privacy legislation passes in states where you have employees.

How Visual Timesheets Supports Compliance

Visual Timesheets is designed with compliance in mind:

Employee-initiated tracking — Monitoring only occurs when employees actively start the timer
Screenshot blurring — Protects sensitive information visible on screen
Data encryption — Screenshots encrypted in transit and at rest
Access controls — Role-based permissions limit who can view screenshots
Employee visibility — Employees can view their own captured screenshots
Configurable retention — Set data retention periods that match your policy
Audit trails — Document who accessed what data and when

These features align with the requirements of even the strictest state laws when combined with proper notice and consent procedures.

Key Takeaways

Employee monitoring is legal in all 50 states when done properly
Six states (CT, NY, DE, CA, CO, IL) have the most specific requirements
Written notice + signed acknowledgment is the universal best practice
Apply the strictest standard everywhere for simpler multi-state compliance
Monitor only during work hours on work-related devices
Privacy controls (blurring, encryption, access limits) are essential
Document everything — policy distribution, acknowledgments, and changes
Review annually as state laws continue to evolve

Getting Started

Download our Employee Monitoring Policy Template and customize it for your organization
Run a compliance audit to identify gaps in your current practices
Review our GDPR compliance guide if you have EU-based employees
Implement screenshot monitoring with proper notice and consent
Consult an employment attorney for state-specific guidance

Ready to implement compliant screenshot monitoring? Start your free trial with HiveDesk — built with privacy controls and compliance features from the ground up.

Employee Monitoring Laws by State: What Employers Need to Know in 2026

The Federal Framework