Employee Surveillance Software: The Legal Limits

The shift to remote work has radically changed how managers oversee their teams. You might be working from your living room, but that does not mean you are working in private. Companies are increasingly deploying sophisticated monitoring tools, often called “bossware,” to track productivity. However, new state-level privacy laws are drawing lines in the sand regarding what is legally permissible.

The Rise of "Bossware" and Granular Tracking

Before discussing the laws, it is important to understand what these tools actually do. Software such as Hubstaff, ActivTrak, and Teramind offers capabilities that go far beyond checking if you are logged into Slack.

Modern surveillance software can capture:

  • Keystroke Logging: Recording every key pressed on the keyboard to analyze typing speed or capture content.
  • Screenshots: Taking automated snapshots of the employee’s screen at random intervals (often every 5 to 10 minutes).
  • Mouse Activity: Tracking cursor movement to ensure the user is “active.”
  • Application Usage: Logging exactly how much time is spent on Zoom versus Netflix or Amazon.
  • Location Tracking: Using GPS on company-issued mobile devices or laptops to verify the physical location of the worker.

While this data helps companies justify their remote payroll, it also creates significant legal liability if handled incorrectly.

Federal Law: The "Business Purpose" Loophole

In the United States, federal law heavily favors the employer. The primary legislation governing this area is the Electronic Communications Privacy Act of 1986 (ECPA).

Under the ECPA, employers are generally prohibited from intercepting oral or electronic communications. However, there is a massive exception known as the “business purpose exception.” This allows companies to monitor communications if they have a legitimate business reason to do so.

Furthermore, the “consent exception” allows monitoring if one party consents. In almost all modern employment contracts, signing your offer letter constitutes giving this consent. If you are using a company-owned laptop or a company-managed network, you should assume you have zero expectation of privacy. Federal law permits the monitoring of emails, browsing history, and file downloads on these devices.

The New Wave: State-Level Privacy Protections

While federal law remains stagnant, individual states are enacting strict regulations to protect workers. The “wild west” of unrestricted monitoring is ending in several key jurisdictions.

New York’s Section 52-c

New York has taken a leading role with Section 52-c of the Civil Rights Law. This law mandates that any private employer with a place of business in New York must provide written notice to employees upon hiring if their telephone, email, or internet access is being monitored.

This is a strict “transparency” law. Employers cannot secretly install keyloggers or screen recorders without the employee knowing the policy exists. They must obtain a written or electronic acknowledgment from the employee that they have received this notice.

California’s CCPA and CPRA

California offers the most robust protections under the California Consumer Privacy Act (CCPA) and its expansion, the California Privacy Rights Act (CPRA). As of 2023, the exemption for employee data expired.

This means California employees now have similar rights to consumers regarding their data:

  • Right to Know: Employees can ask exactly what data is being collected (e.g., “Are you recording my keystrokes?”).
  • Right to Correction: Employees can request corrections to inaccurate personal data.
  • Right to Limit Use: There are restrictions on collecting sensitive personal information (SPI), which could include the precise geolocation of a remote worker or the contents of private messages.

Connecticut and Delaware

Following the trend, Connecticut and Delaware have enacted similar “notice-upon-hiring” laws. In Connecticut, an employer who engages in electronic monitoring without prior written notice can be subject to civil penalties. This creates a financial risk for companies that try to deploy stealth monitoring software.

The "Mouse Jiggler" Controversy

The tension between surveillance and privacy recently came to a head in the banking sector. In 2024, Wells Fargo terminated over a dozen employees after discovering they were using “mouse jigglers.” These are small hardware devices or software scripts that simulate mouse movement to keep a computer from going idle.

This incident highlighted two legal realities:

  1. Monitoring is Active: Companies are not just collecting data; they are actively auditing it to make firing decisions.
  2. cat-and-mouse Games: While employees try to use technology to fake productivity, employers are within their legal rights to use detection software to catch this fraud, provided it occurs on company time and equipment.

Personal Devices and BYOD Risks

The legal waters get murkier when Bring Your Own Device (BYOD) policies are involved. If you use your personal MacBook for work, the company’s legal reach is limited.

Installing full-scale monitoring agents (like Time Doctor) on a personal device usually requires explicit, granular consent because it inevitably captures private data (like personal banking passwords or private medical searches). Legal experts generally advise companies against installing always-on monitoring software on personal devices due to the high risk of violating wiretapping laws.

Instead, companies often use “containerized” apps. For example, they can monitor everything you do inside the Microsoft Teams or Outlook app on your personal phone, but they cannot see what you do on your personal web browser or Instagram app.

Best Practices for Employees

If you are a remote worker concerned about privacy, follow these operational security steps:

  • Assume Observation: If the hardware has an asset tag on the back, assume IT can see everything on the screen.
  • Check the Handbook: Look for an “Acceptable Use Policy” or “Electronic Monitoring Notice” in your onboarding documents.
  • Physical Separation: Never conduct personal banking, medical appointments, or job hunting on a company computer. The “business purpose” exception in federal law is broad enough that a company could accidentally capture your sensitive data and face no penalty.

Frequently Asked Questions

Can my employer turn on my webcam without me knowing? Generally, no. While technically possible with certain malware-like “ratting” tools, using a webcam to record an employee in their home without consent generally violates wiretapping laws and creates massive liability regarding the expectation of privacy in a home. Most legitimate business software (like Zoom or Teams) requires you to actively toggle the camera on.

Is it legal for my boss to read my private Slack DMs? Yes. Slack is a workplace tool paid for by the enterprise. The workspace administrator can export data, including direct messages and private channel conversations, for legal or compliance reviews. You have no expectation of privacy on workplace chat platforms.

What happens if I live in a state with no specific privacy laws? If you live outside of states like California, New York, or Delaware, you default to the federal ECPA standards. This means your employer has broad discretion to monitor your activity on company-owned equipment without needing to provide specific notifications, as long as there is a valid business reason.

Can they track my location if I am not working? This is a high-risk area for employers. Continual GPS tracking of an employee outside of working hours (e.g., tracking a company car on the weekend or a company phone at night) can lead to invasion of privacy lawsuits. Most companies now use “geo-fencing,” which only logs location when you clock in or enter a specific job site.