Employee Tracking Devices: What U.S. Laws Employers Need to Know
Employee tracking devices can help businesses coordinate deliveries, protect equipment, and support workplace safety. They can also collect sensitive information about where workers go, how they work, and when they are active. In the United States, no single federal law governs every form of employee monitoring. Instead, employers must consider a combination of federal rules, state laws, the type of information collected, and whether workers received notice. Understanding those limits helps employers design monitoring programs that are transparent, proportionate, and legally sound.
What Counts as an Employee Tracking Device?
Employee tracking devices include more than GPS units. The term can cover technology that records a worker’s location, communications, activity, or use of company property. Monitoring may occur through a physical device or software installed on a work tool.
- GPS trackers: Collect the location of a company vehicle, phone, tablet, or other device.
- Vehicle telematics: Record location, speed, braking, mileage, engine diagnostics, and related driving data.
- Wearables and access systems: Use badges, smart watches, or sensors to record access, movement, or activity.
- Computer and phone monitoring: Log websites, applications, messages, calls, keystrokes, or device use.
- Biometric systems: Use fingerprints, face geometry, or other biometric identifiers to verify identity or record attendance.
The legal analysis depends on what the tool collects and how the employer uses it. A fleet GPS system, for example, raises different issues from software that records audio or captures an employee’s face.
Is There a Federal Law That Covers Employee Tracking Devices?
There is no comprehensive federal statute that categorically permits or prohibits all employee tracking. Several federal laws may apply, however, depending on the monitoring method and the workplace.
Electronic Communications Privacy Act
The Electronic Communications Privacy Act (ECPA) generally restricts the intentional interception of wire, oral, or electronic communications. Its rules can matter when an employer records calls, reads messages in transit, or monitors communications using workplace software. The statute has exceptions, including circumstances involving employer-provided systems and legitimate business purposes, but those exceptions are not a blanket authorization for every kind of surveillance.
For example, recording a business call may be treated differently from recording private conversations in a break room. State wiretapping laws may impose stricter consent requirements than federal law. Employers should not assume that owning a device or network makes every communication recorded through it fair game.
Stored Communications and Computer Access
The Stored Communications Act addresses certain access to communications held by service providers, while the Computer Fraud and Abuse Act concerns unauthorized access to protected computers. These laws are not general workplace-monitoring codes, but they can become relevant when an employer accesses accounts or systems without proper authorization. Monitoring should be limited to accounts, devices, and systems the employer is legally entitled to access.
Labor and Employment Protections
The National Labor Relations Act protects many private-sector employees’ rights to engage in concerted activity about workplace conditions. Monitoring that is used to discourage, identify, or punish protected organizing or group complaints can raise labor-law concerns. The National Labor Relations Board has addressed electronic surveillance in the context of workers’ rights; employers should assess whether monitoring practices interfere with protected activity.
Employers must also account for wage-and-hour rules. Under the Fair Labor Standards Act, covered nonexempt employees generally must be paid for all hours worked. If tracking software shows that an employee worked before clocking in, after clocking out, or during a purported break, the employer may need to address the time records and pay accordingly. A device’s data can be evidence of work time, but it does not replace accurate timekeeping or required pay.
State Laws Can Change the Rules
State requirements vary substantially. Some states require advance notice of electronic monitoring, while others regulate specific data types, communications, or uses of location information. A company with workers in multiple states may need different notices and procedures for different locations.
Electronic Monitoring Notices
Connecticut and New York, for example, have laws requiring covered employers to provide notice of certain forms of electronic monitoring. The details differ, including which monitoring activities are covered and how notice must be delivered. Employers should verify current requirements for each work location and ensure that notices describe the actual practices rather than relying on broad, vague language.
Even where a state does not require a specific notice, clear notice can reduce disputes and help establish that workers understand how company systems are monitored. A handbook statement alone may not satisfy a law that requires a particular written notice or acknowledgment.
Location Tracking and Off-Duty Privacy
GPS tracking of company vehicles during work may be easier to justify than tracking a worker’s personal phone around the clock. Several states restrict employers from demanding access to personal accounts or devices, and state privacy or employment laws may limit surveillance outside work. The rules are not identical, so employers should check local law before collecting location data from personal devices or continuing to track a company device after a shift ends.
A practical safeguard is to configure tracking to operate only during work hours or while a company vehicle is being used for business. If continuous tracking is operationally necessary, the employer should document the reason, explain the practice, and limit access to the resulting records.
Employee Data and State Privacy Laws
State consumer privacy laws may apply to employee-related personal information, but coverage and exemptions vary. California’s privacy framework, for example, covers employment-related personal information, subject to the law’s definitions and requirements. Other states may exclude data processed in an employment context or provide different protections. Employers should not assume that a privacy law’s consumer rights apply—or do not apply—without checking the law and its current regulations.
Privacy obligations can include disclosure, access, correction, retention, security, and limits on using data for unrelated purposes. Employers should identify what information each tracking tool collects, where it is stored, who can access it, and whether vendors use it for their own purposes.
Biometric Information
Biometric tracking deserves particular care. Illinois’ Biometric Information Privacy Act (BIPA), for example, regulates collection, storage, disclosure, and retention of biometric identifiers and information. It requires written disclosures and consent in covered circumstances and includes a retention-and-destruction policy requirement. Other states have biometric laws or related privacy protections, with different definitions and obligations.
Face-recognition attendance systems and fingerprint time clocks can therefore create legal exposure if implemented without the required notice, consent, or data safeguards. Employers should review the law where each worker is located before collecting biometric data.
Common Legal Risks by Tracking Method
| Tracking method | Key legal concerns | Practical safeguard |
|---|---|---|
| GPS in company vehicles | Notice, off-duty tracking, state privacy rules, and use of location records | Limit tracking to business use and explain what is collected |
| Audio or call recording | Federal and state wiretap or consent laws | Check every relevant state’s consent rules before recording |
| Computer or phone monitoring | ECPA, state notice laws, personal-account access, and data security | Monitor company systems with clear notice and limited access |
| Biometric time clocks | State biometric statutes, consent, retention, and vendor handling | Provide required disclosures and follow a documented deletion schedule |
| Activity or productivity software | Employee privacy, labor rights, wage records, and discrimination risks | Use relevant measures and review outcomes for accuracy and bias |
When Employee Monitoring May Become Discriminatory or Retaliatory
Tracking data can influence scheduling, discipline, performance reviews, or termination decisions. Those decisions remain subject to employment laws. Monitoring should not be applied selectively because of a protected characteristic, and tracking results should not be used to retaliate against workers for legally protected conduct.
Automated productivity scores can also be incomplete or misleading. A system may record idle time when a worker is helping a customer, handling a safety issue, or performing a task away from a monitored device. Employers should provide a way to review context and correct inaccurate records before taking serious action.
How Employers Can Build a Compliant Tracking Policy
A sound policy begins with a specific business reason. “Improving efficiency” alone may be too broad to guide responsible data collection. The employer should identify the operational need—such as dispatching service calls, safeguarding a vehicle, or maintaining accurate work-hour records—and choose the least intrusive tool that can reasonably meet it.
- Map the data: Record what each device collects, when it collects it, and whether it captures location, audio, video, biometric, or communication data.
- Check laws by location: Review federal rules and the laws of every state where affected employees work. Consider local requirements and collective bargaining agreements as well.
- Give specific notice: Explain what is monitored, why, when monitoring occurs, who can see the data, and how long records are retained. Obtain consent when required.
- Limit collection: Avoid personal accounts and unnecessary off-duty tracking. Disable features that are not needed for the stated business purpose.
- Control access and retention: Restrict data to authorized personnel, protect it with appropriate security, and delete it when it is no longer needed or legally required.
- Review vendors: Confirm that technology providers use data only as authorized, protect it adequately, and support deletion and access requests where required.
- Train decision-makers: Teach managers how to interpret tracking data, avoid overreliance on automated scores, and preserve accurate time records.
Policies should also explain how workers can raise questions or challenge inaccurate data. Employers should periodically audit whether the system remains necessary and whether its actual use matches the original notice.
What Employees Can Check About Workplace Tracking
Employees can review handbooks, device-use policies, onboarding documents, and any electronic-monitoring notice to learn what the employer says it collects. They can ask whether location tracking continues outside scheduled work, whether personal devices are included, and how long records are retained. A company device should generally be treated as potentially monitored, but the specific scope depends on the employer’s policy and applicable law.
Workers who believe monitoring is unlawful may consider documenting relevant facts and consulting a state labor agency, the National Labor Relations Board, a privacy regulator, or an employment attorney, depending on the issue. The appropriate route depends on the type of data and conduct involved.
Reliable Sources for Current Requirements
Because state laws and agency guidance change, employers should verify requirements using primary sources rather than relying only on summaries. Useful starting points include the Electronic Communications Privacy Act text, the National Labor Relations Board, the U.S. Department of Labor’s Fair Labor Standards Act guidance, and state labor and privacy agency websites. For California privacy requirements, consult the California Attorney General’s CCPA resources; for Illinois biometric requirements, consult the Illinois Biometric Information Privacy Act.
The central rule is practical: employee tracking devices are not automatically unlawful, but their legality depends on the data collected, the purpose, the notice and consent provided, and the laws where employees work. A transparent policy, narrow collection, and careful handling of records reduce risk while preserving legitimate business uses.