"Is employee monitoring legal?" is the wrong question. The useful question is: legal to do what, to whom, on whose device, in which state? Once you frame it that way, the answer gets clear fast.
This is the companion to our state-by-state guide. Here we focus on the two layers that decide legality: the federal baseline and the state overlay.
Layer 1: the ECPA baseline
The Electronic Communications Privacy Act prohibits intercepting electronic communications — then immediately carves out the exceptions that make workplace monitoring lawful:
- Business-purpose exception: monitoring in the ordinary course of business on employer-provided equipment.
- Consent exception: monitoring where a party has consented (one-party consent federally).
The practical takeaway: activity monitoring on company devices for legitimate business reasons sits inside these exceptions. What lives outside the safe zone is intercepting communication content — message bodies, call audio — and monitoring personal devices or accounts.
This is the legal reason ProdView measures activity, not content. App usage, focus time, category, and idle are metadata about how time is spent, not what was said.
Layer 2: the state overlay
A minority of states add obligations on top of ECPA:
- New York, Connecticut, Delaware — explicit electronic-monitoring notice statutes. If you employ people there, written notice is mandatory, not optional.
- California — the CCPA/CPRA treats employee data as personal information, so you owe a notice at collection and must honor data rights. California is also a two-party-consent state for audio.
- Two-party-consent states (for recording conversations) — a separate trap if you ever record audio/video.
The three things that actually raise legal risk
If you remember nothing else, remember the risk ladder:
- Whose device? Company-owned is low risk; personal/BYOD is high risk.
- Content or metadata? Activity metadata is low risk; keystroke content and audio are high risk.
- Notice given? Written notice lowers risk everywhere and is required in NY/CT/DE.
Stay on the safe end of all three and you've handled the overwhelming majority of U.S. legal exposure.
What "legal" doesn't mean
Legal isn't the same as advisable or trusted. You can lawfully do things that wreck morale. The most durable monitoring programs go beyond the legal floor: they disclose clearly, measure the minimum needed, and let employees see their own data. We make the case for that in ethical employee monitoring.
This is general information, not legal advice — confirm specifics for your jurisdictions with counsel before deploying.