Employee Monitoring Laws by Country: The Consent Form That Helps in the US Rarely Counts in Europe

Employee monitoring laws allow most workplace monitoring in most countries, but the condition attached to it changes at every border. In the United States the question is usually whether you gave notice or obtained consent. In the European Union and the United Kingdom the question is whether the monitoring is necessary and proportionate, and a signed consent form rarely helps. In Germany, Italy and France a works council or union may also have a say before the tool is switched on.

That difference trips up employers that copy one policy across several countries. This guide compares employee monitoring laws in the US, the EU, the UK, Canada and Australia, drawing on statutes, regulators and court decisions rather than vendor summaries. It covers what each place requires, what each monitoring method needs, the changes that arrived in 2026, and sample wording for an employee monitoring consent form. If you are choosing a tool rather than checking the law, our employee monitoring software comparison covers that side.

Is employee monitoring legal? The short answer by country

Yes, employee monitoring is generally legal in every jurisdiction covered here, provided you meet the local conditions and stay away from the specific practices each place bans. And is employee monitoring software legal? The answer is the same, because these laws regulate what you collect and how, not the product category. The table sets employee monitoring laws by country side by side.

Notice, consent and proportionality are three different tests

Most guides use these words as if they meant the same thing, but they do not, and mixing them up is a common and avoidable mistake.

• Notice means you told people. It is a one way act, and in New York, Connecticut, Maine and NSW it is the central legal requirement.
• Consent means people agreed. Under the US wiretap law, the agreement of one party to a communication can make an interception lawful, so a signed form does real work.
• Proportionality means the monitoring is justified by its purpose and no more intrusive than it needs to be. This is the test in Europe and the UK, and neither notice nor consent will rescue monitoring that fails it.

The reason a consent form travels so badly is the power gap between employer and employee. The European Data Protection Board says it is “problematic for employers” to rely on consent because it is unlikely to be freely given, and it names camera observation at work as an example. An earlier EU opinion called consent “highly unlikely” to be a legal basis at work unless employees can refuse without adverse consequence. The UK regulator takes the same line: consent “is not usually appropriate in the employment context”.

So the same form can do three different jobs depending on where it is used. In a US state with no monitoring statute, it supports the consent exception and reduces any expectation of privacy. In New York it is close to the required acknowledgement, though the statute asks for notice rather than agreement. In Paris or Berlin it works as evidence that you informed people, which is useful, but it does not give you a legal basis for the processing.

Employee monitoring laws in the United States

The US has no single employee monitoring law. Federal rules focus on communications and on labor rights, and states add notice, biometric and location rules on top. In broad terms, employers have considerable room on systems they own, so many US employee monitoring laws are about telling people, recording calls properly and staying away from a few protected areas.

Federal law

The Wiretap Act, part of the Electronic Communications Privacy Act, makes it unlawful to intercept wire, oral or electronic communications, then allows it where a party to the communication has given prior consent. A second route is the ordinary course of business exclusion, and for stored messages the Stored Communications Act excepts conduct authorized by the provider of the service, which is often the employer on its own email system. These three provisions help explain why a clear policy is useful even in states that have no monitoring statute.

Two other federal points tend to be missed:

• Labor rights. The National Labor Relations Act protects employees who discuss pay and working conditions together, with or without a union, and watching those discussions can create liability. An earlier General Counsel memo that took a hard line on electronic monitoring was rescinded in 2025, but that withdrew enforcement guidance and left the statute in place.
• Wage and hour exposure. Monitoring data can work against you. Under federal rules, work the employer knows or has reason to believe is happening counts as paid time, and management cannot simply accept the benefit. The Labor Department’s remote work bulletin says employers do not usually have to sort through every record to find unreported hours, yet it also notes that consulting other records could be practical in some circumstances. An activity log showing a nonexempt employee working late is therefore hard to ignore.

Employee monitoring laws by state

Employee monitoring laws by state fall into four groups: notice statutes, biometric statutes, location rules and recording rules. New York, Connecticut, Delaware and Maine have general electronic monitoring notice laws. Maine is the newest of the four.

California needs its own paragraph, because California workplace surveillance laws are still changing. Employee data has been inside the California Consumer Privacy Act since the employment exemption expired at the end of 2022. Labor Code 435 already bans audio or video recording in restrooms, locker rooms and changing rooms, and Penal Code 637.7 restricts electronic tracking devices, with an exception where the owner, lessor or lessee of the vehicle consents. Two 2026 laws, AB 1883 and AB 1331, take effect at the start of 2027. The first bans AI surveillance tools that read emotional states or collect neural data. The second bans monitoring in workplace bathrooms and lets employees leave tracking devices behind when they go in. Penalties run up to $500 per violation.

Those two bills also define a “workplace surveillance tool” broadly, and the definition names “continuous incremental time-tracking tools” alongside video and geolocation. They do not ban such tools outright, but the wording suggests that state lawmakers now see automatic capture as surveillance. Separately, the No Robo Bosses Act stops employers relying solely on automated systems for discipline or termination from mid 2027.

Two other state rules apply to almost any employer. Recording a call needs the consent of everyone on the line in states such as California, Washington, Florida, Massachusetts and Pennsylvania, so a call with a customer in one of them can fall under the stricter rule. And 27 states, by the National Conference of State Legislatures’ count, limit what employers can demand on personal social media accounts. California, for example, bars asking for a username or password.

Employee monitoring laws in the EU: GDPR and national rules

Employee monitoring GDPR questions start from a different place than US ones. Every piece of data about an identifiable worker is personal data, so the employer needs a lawful basis, a stated purpose, the smallest workable data set and a limit on retention. The GDPR also requires an impact assessment before processing that is likely to carry high risk (Article 35), lets member states add employment rules that cover monitoring systems at the workplace (Article 88), and sets the top fine tier at 20 million euros or 4% of worldwide annual turnover, whichever is higher (Article 83).

In practice, private employers often rely on legitimate interests rather than consent, as Amazon did in the French case below, which means balancing their interest against the worker’s rights. The European Court of Human Rights supplies the checklist. In Bărbulescu v. Romania (2017), the Grand Chamber faulted national courts for not asking whether the employee had prior notice, what the extent and intrusion of the monitoring were, what specific reasons justified it, and whether less intrusive measures were available. In López Ribalda v. Spain (2019), the same court accepted covert cameras without prior notice, but only because there was reasonable suspicion of serious misconduct and significant losses, and it weighed the extent and consequences of the measure.

The AI Act adds a further layer. Article 5 prohibits AI systems that infer emotions in the workplace, except for medical or safety reasons, and that ban already applies. AI used to monitor or evaluate workers is classed as high risk, and the 2026 amendment moved those duties to the end of 2027.

What the French cases show

France has produced the two most useful enforcement examples, and the better known one has changed. In 2023 the French regulator, the CNIL, fined Amazon France Logistique 32 million euros over warehouse scanner indicators, including one that flagged items scanned less than 1.25 seconds apart. Many articles stop at that figure. In 2025 the Conseil d’État reduced the fine to 15 million euros. It found that the three real time indicators were not unlawful for lack of a legal basis, given narrow facts such as an idle flag that fired only after more than 10 minutes of inactivity. It upheld the finding that keeping all the indicators for 31 days, without separating them by purpose, breached data minimization.

The lesson is more specific than “monitoring is banned.” A logistics employer could measure its scanners in real time, but it could not justify a long, undifferentiated store of that data about each worker.

The second case involves a small company, which makes it closer to most readers. In 2024 the CNIL fined a real estate firm 40,000 euros. Software on remote workers’ computers marked them inactive after 3 to 15 minutes without keyboard or mouse use, and that time could lead to salary deductions. It also took screenshots at intervals of 3 to 15 minutes, and cameras recorded image and sound continuously in the office. The CNIL found no legal basis for the inactivity and screenshot processing, said the inactivity measure could not reliably count working hours, and noted that no impact assessment had been done. Enforcement has continued since: 16 organizations were sanctioned in 2025 over video surveillance of employees alone.

France, Germany, Italy and Spain compared

The GDPR sets a floor, and employment law adds a second gate. If you operate across Europe, this is where a single rollout date usually fails, because some countries require consultation or approval before installation.

Employee monitoring laws in the UK

UK employee monitoring laws mirror the EU approach, and the Information Commissioner’s Office has published detailed, practical guidance. Its monitoring workers guidance, which is under review after the Data (Use and Access) Act, says you must be clear about your purpose and select the least intrusive means. You must inform workers about any monitoring apart from very exceptional covert cases, and you must carry out an impact assessment before high risk processing, with keystroke monitoring and biometric data among its examples.

The ICO’s method by method guidance is blunt. Device activity monitoring “is likely to capture excessive amounts of workers’ personal information,” and employers are “particularly unlikely” to be able to justify capturing webcam shots or footage. Covert monitoring needs grounds to suspect crime or equivalent gross misconduct, senior authorization and a strict time limit. For interception of calls and emails in transit, the 2018 interception regulations also require all reasonable efforts to inform users.

The clearest enforcement example concerns time recording. In 2024 the ICO ordered Serco Leisure and associated trusts to stop using facial recognition and fingerprints to check attendance for more than 2,000 employees at 38 leisure facilities. The problem was necessity: ID cards or fobs would have done the job, and staff were not offered an alternative. Public opinion points the same way: in ICO research published in 2023, 70% of people surveyed in the UK said they would find workplace monitoring intrusive, and fewer than one in five, 19%, would feel comfortable taking a new job knowing they would be monitored.

Employee monitoring laws in Canada

Canada splits employee privacy law by employer type and province. PIPEDA covers employee information in federally regulated businesses such as banks, telecoms and transportation companies. Alberta, British Columbia and Quebec have their own private sector laws. The federal commissioner recommends that monitoring be “reasonable, proportionate and minimally intrusive,” and Canada’s federal, provincial and territorial privacy commissioners issued a joint resolution in 2023 calling on employers to inform staff about monitoring tools and to carry out privacy impact assessments.

Ontario has the most specific rule. Under its Employment Standards Act, an employer with 25 or more employees in Ontario at the start of a year must have a written electronic monitoring policy in place during the first two months of that year, and that holds even if the policy only says that it does not monitor. The policy describes how and in what circumstances monitoring happens and what the data can be used for. Copies go to staff within 30 days, and old policies are kept for three years. It covers personal computers used for work and home working. It is purely a transparency rule, though, because the government states that it creates no new privacy right and no right not to be monitored.

Quebec is stricter on biometrics. Its access to information commission asks for express written consent and for declaring a biometric database at least 60 days in advance.

Employee monitoring laws in Australia

Australia has no national workplace surveillance act. The federal privacy regulator says the Privacy Act does not specifically cover it, and private sector employee records are exempt from that Act, so state law does the work.

New South Wales has the most detailed employee monitoring laws of the jurisdictions covered here. The Workplace Surveillance Act 2005 sets these requirements:

• Written notice at least 14 days before surveillance starts, unless the employee agrees to less. Email counts as written notice.
• The notice states the kind of surveillance, how it works, when it starts, whether it is continuous, and whether it is limited or ongoing.
• Cameras must be clearly visible with signs at entrances, and vehicles or items with trackers need a visible notice.
• Computer surveillance must follow a policy that employees have been told about in advance.
• No surveillance in change rooms, toilets or showers, with a maximum penalty of 50 penalty units.
• No surveillance outside work, except computer surveillance of equipment the employer provides.
• Covert surveillance needs a covert surveillance authority, which cannot be used to monitor work performance.

The ACT Workplace Privacy Act 2011 also has a 14 day notice period and adds consultation on proposed surveillance. Two reforms are on the way. The NSW Digital Work Systems Act 2026 requires businesses to consider risks from excessive monitoring and excessive performance metrics in digital work allocation, and SafeWork NSW says the remaining provisions will start on dates still to be announced. In Victoria, the government announced plans for tougher surveillance laws in 2026 if re-elected, although a law firm review from mid 2026 said no bill had been introduced at that point.

What each monitoring method requires

Employee monitoring laws rarely treat all tools alike, so it helps to read them by method. The table shows where the risk sits for the methods employers ask about most. The cells give examples rather than a complete list, and the employee surveillance laws of your own jurisdiction take priority.

Employee monitoring outside the workplace needs its own warning, because location and personal life overlap there. NSW bans it outright for most methods. In the US, New York’s top court found a GPS device on a public employee’s personal car unreasonable because it ran beyond working hours, in Matter of Cunningham (2013). So can employers track your location? On a company vehicle or phone during working time, usually yes with notice. Outside working time or on a personal vehicle, the answer is often no, or only with a strong and specific reason.

What a missed requirement can cost

The penalties in employee privacy laws vary so widely that a small error can matter more in one state than a major one in another. Here is an illustrative calculation for a company with 200 employees that uses a fingerprint clock in Illinois without a written release. These are statutory figures, not predictions of an outcome.

The Illinois figures exclude legal fees, which the statute also lets a successful claimant recover, and a 2024 amendment limits each person to one recovery for repeated scans by the same method. The EU works differently again. Because the ceiling is the higher of 20 million euros or 4% of worldwide turnover, a company with 100 million euros in turnover faces a ceiling of 20 million euros, not the 4 million euros that the percentage alone would give. Actual fines can be far lower, and the CNIL said it took size and finances into account in the 40,000 euro French case.

Employee monitoring consent form: sample wording

An employee monitoring consent form is the document most employers look for first. Treat it first as a notice and acknowledgement, because outside the US the consent line may carry little weight. The wording below is a starting point for a US employer and needs review by your lawyer. In New York, keep the statutory language about monitoring “at any and all times and by any lawful means.” In the EU and UK, remove the consent line and keep the rest as an information notice, so that people confirm they have read it rather than agreed to it.

Employee monitoring notice and acknowledgement

[Company] monitors the following company systems: [email / internet use / phone calls / vehicle location / other]. We do this to [specific purpose, for example protect customer data or meet a safety requirement].

Monitoring takes place [when and where]. It does not cover [personal devices / time outside working hours / other exclusions]. Records are kept for [period] and can be seen by [roles].

You should not expect privacy when using these systems. Questions go to [name or role]. We will tell you before making any change to this notice.

I have read and received this notice and I consent to the monitoring it describes.

Name: ____ Signature or electronic acknowledgement: ____ Date: ____

For the wider document, use the employee monitoring policy template in our beginner’s guide, which also serves as an employee monitoring policy example. If you have remote staff, the same points belong in your remote work policy.

How to set up monitoring in more than one country

The steps below follow the common ground in regulator guidance, with the order arranged so that you discover blockers before you buy or install anything.

1. List where each person physically works.

   As a working assumption, expect the law of the place where someone works to apply, so a remote employee in Sydney or Berlin can bring that local rule into your program. Ontario’s rule, for example, counts employees in Ontario and covers home working. The home country of the company is only one data point.

2. Write down the purpose in one sentence.

   “Protect customer data on laptops” can be tested. “Improve productivity” is too broad, and it invites the question of why a less intrusive measure would not do.

3. Choose the least intrusive tool that meets that purpose.

   The UK guidance says this directly, and the Serco case turned on it. Cards were available, so face scans were not necessary.

4. Run an impact assessment.

   This is mandatory for high risk processing under the GDPR and UK GDPR, and Canada’s commissioners ask for one too. It is also a good written record in the US.

5. Speak to worker representatives early.

   In France, Germany, Italy and Spain this is a legal step that can delay or block installation, and the ACT in Australia adds consultation as well.

6. Give notice in the local form and on the local timing.

   That means 14 days in NSW, on hiring in New York, in interviews and once a year in Maine, and through a written policy in Ontario.

7. Set a retention period for each data type.

   The Amazon decision shows this is a separate failure point even when the collection itself survives review.

8. Review the setup every year.

   California, Maine, NSW and the EU all changed their rules within the last two years, so a policy that was accurate in 2024 may no longer be.

See work through tasks, deadlines and estimates instead of screenshots, and keep accurate time records with actiTIME

Try Free

Where monitoring programs go wrong

Beyond the rules themselves, a few patterns repeat in the cases above and in employment practice generally.

• Copying a US policy abroad. A form built around consent and “no expectation of privacy” reads badly in front of a European regulator, because it skips purpose, lawful basis and retention.
• Using activity data for pay. The French firm deducted salary on the basis of an inactivity timer the regulator said could not count hours reliably. Thinking time, calls and reading produce no keystrokes.
• Collecting first and deciding later. Tools default to long retention and wide dashboards. If nobody needs individual data after a shift, a month of it is hard to defend.
• Ignoring what the logs reveal. Evening activity can establish knowledge of unpaid hours in the US. Private messages or health details caught on screen can create separate problems in Europe.
• Letting monitoring drift. A security tool that begins feeding performance reviews has a new purpose, and in many places that needs a new assessment and a new notice.
• Forgetting other people. Screens, cameras and calls capture customers, family members at home and colleagues, and they have rights too.

The option with less legal exposure: hours on tasks

Most monitoring is bought to answer one question, which is whether the work is getting done, yet the tools answer a different one: whether a laptop was busy. That gap may be part of why regulators in the cases above found these systems disproportionate. In our view, a manager who runs a remote team well rarely needs that data, because the work itself is visible. Our guide on how to manage remote teams and the article on tracking time without micromanaging cover this in detail.

The approach has three parts. People log hours against tasks, every task has a deadline, and an estimate sits beside it. Comparing estimates with actual time shows who is overloaded and which work is running late, with no need for screenshots or keystroke logs. You also keep a record the law often asks for anyway. The US Department of Labor’s recordkeeping rules require a record of hours worked each day for nonexempt employees, and an EU court ruling from 2019 requires a system that measures the time each worker works each day.

actiTIME is built around this model. Employees record time themselves in a weekly timesheet or a calendar view, in the browser or the mobile app, against tasks organized by customer and project. Managers set deadlines and estimates on those tasks, read the Estimated vs. Actual Time Report, and can use timesheet approval so that people see and submit their own records. Prices start from $5 per user per month.

This does not remove the law entirely. Time records are personal data under the GDPR and UK GDPR, so staff still need to be told what is recorded and why, and retention still matters. The difference is the size of the question you have to answer. In our view, records people enter themselves about their own work are easier to justify than continuous capture of their screens, although no regulator has given that blanket assurance. For more on the productivity side, see how to monitor employee productivity and employee monitoring for remote workers.

We reduced payroll processing to 45 minutes per week

actiTIME is very robust, integrated well into your business process, and most important, helps you focus on your business instead of monkeying around with technology. actiTIME has reduced our payroll processing from 4-6 hours per week to 45 minutes per week.

Try actiTIME

FAQ

Can my employer monitor me without telling me?

It depends on where you work. In many US states, an employer can monitor company systems without a specific notice, though New York, Connecticut, Delaware and Maine require one. In the EU, the UK, NSW and the ACT, secret monitoring is lawful only in exceptional cases, typically a specific suspicion of crime or serious misconduct, with extra safeguards.

What are my employee privacy rights if I think monitoring went too far?

Start by asking for the policy in writing. In the EU and UK you can also make a data subject access request for the records held about you, and you can complain to the national regulator, such as the ICO or the CNIL. In the US, contact your state labor department, your state attorney general or an employment lawyer, and note that complaints in Illinois can go to court directly under the biometric law.

Can my employer monitor my personal phone?

Only within narrow limits. In Maine you may decline such apps, and elsewhere the employer generally needs your agreement and a work purpose, with monitoring limited to work data. If you use a personal phone for company email, the company may still be able to see traffic on its own email system, so ask what is captured before you enroll the device.

Check the law first, then ask whether you need the tool at all

Laws on employee monitoring reward the same habits everywhere: a clear purpose, the least intrusive method, honest notice and short retention. The signature on a form matters far less than those four, and outside the US it may matter very little. If what you need is a reliable view of who worked on what, you may not need monitoring at all.

To test that with your own team, start a free trial of actiTIME. It runs for 30 days with every feature on and costs nothing, and teams of up to 3 users can move to the permanent free version afterward.