Employee Monitoring Is Legal. That Doesn't Make It a Good Idea by Default.

Employee monitoring software is legal across the United States, the UK, the EU and Canada — provided you give employees notice, can name a legitimate business purpose, and keep the data collection proportionate to that purpose. That is the entire legal test, and most vendors will happily confirm it for you. 

What the law will not tell you is whether monitoring will actually work. The programs that fail rarely fail on a statute. They fail because they measure the wrong thing, get gamed inside a week, and burn more trust than they recover in output. Legality is the floor. It is not a strategy. 

Here is what compliance actually requires in 2026, where monitoring genuinely earns its place, and what to track instead of keystrokes. 

Key Takeaways 

• Monitoring is lawful on company-owned systems in the US under the Electronic Communications Privacy Act (ECPA), but a growing list of states adds mandatory written notice. 
• Connecticut’s new electronic surveillance law (Public Act 26-73) takes effect 1 October 2026 and replaces the 1998 statute - if your notice template predates it, it is out of date. 
• The UK, EU and Canada apply a stricter test: a lawful basis, a documented proportionality assessment, and in Ontario a written electronic monitoring policy for employers with 25+ employees. 
• Roughly a quarter of US workers already use evasion tactics - mouse jigglers, scheduled emails, idle apps - which means activity scores mostly measure who is willing to fake them. 
• Monitor risk and capacity, not presence. Cycle time, blocked time, coverage and rework rate answer the questions leaders are actually asking. 

What the Law Actually Requires: Notice, Legitimate Purpose, Proportionality 

Three obligations show up in nearly every jurisdiction, in different proportions. 

In the United States, notice is the trigger 

Federal law is permissive. The ECPA allows employers to monitor communications on systems they own, under the business-purpose and consent exceptions. If the laptop, network and email account belong to the company, the baseline position is that you may monitor activity on them. 

State law is where employers get caught. Connecticut, Delaware, New York and Texas require employers to tell employees that electronic monitoring is taking place, and California’s CCPA/CPRA has applied to employee data since January 2023 - which brings notice-at-collection, access and deletion rights into scope. 

The requirements are not interchangeable. New York expects written notice on hire plus a posted notice, enforced by the Attorney General with penalties escalating to $3,000 per violation. Delaware lets you choose between a daily reminder at login or a one-time notice with a signed acknowledgement. Connecticut has just rewritten its rules: Public Act 26-73 repeals and replaces the 1998 statute from 1 October 2026, with updated notice and posting obligations that explicitly contemplate AI-driven monitoring tools. 

Outside the US, proportionality is the trigger 

Under UK and EU GDPR, notice alone is not enough. You need a lawful basis — usually legitimate interests, which requires a documented balancing assessment — and systematic monitoring of employees will normally require a Data Protection Impact Assessment before rollout. The European Court of Human Rights set the practical test in Bărbulescu v. Romania: was the employee told in advance, was the intrusion proportionate to the aim, and could a less intrusive method have achieved the same result? 

Canada adds its own layer. Ontario requires employers with 25 or more employees to maintain a written electronic monitoring policy covering what is monitored, how, and for what purpose. PIPEDA applies a reasonable-purpose standard on top. 

None of this is onerous. A one-page notice, a named purpose per data type and a retention schedule satisfy most of it. The harder question comes next. 

The Three Cases Where Monitoring Is Genuinely Justified 

Monitoring earns its place when the data answers a question the business cannot answer any other way. That is three situations. 

1. Regulated data and insider risk 

Financial services, healthcare, legal and defence contractors carry statutory obligations to control where sensitive data travels. Access logs, data-loss-prevention alerts and file-movement records are not productivity tools — they are controls, and auditors ask for them. This monitoring is event-driven: it flags anomalies rather than scoring individuals. 

2. Time that is the product 

Agencies, law firms, accounting practices and BPOs invoice clients for hours. When a timesheet is a billing document, accuracy is a revenue and audit issue, not a trust issue. Employees accept this because the purpose is obvious and the data is visibly used. 

3. Safety, fleet and lone workers 

Drivers, field engineers and lone workers are monitored because location data shortens response time in an incident. The justification is duty of care - and it holds only as long as the tracking stops when the shift does. 

Notice what is missing: salaried knowledge work, where monitoring is usually deployed as a proxy for presence. That is the use case with the weakest justification and the worst return - and the one most vendors sell hardest. 

Why Activity Scores Get Gamed Within a Week 

Give a team a number that determines how they are perceived, and they will optimise the number. Goodhart’s law is not a theory in workforce analytics — it is a schedule. 

ExpressVPN’s 2025 survey of US workers found that roughly 24% already use evasion tactics: keeping unnecessary applications open to look active (16%), scheduling emails to mimic real-time work (15%), and mouse jigglers to hold a green status light (12%). Those tools cost less than a lunch and ship next day. Any metric built on input cadence - keystrokes, mouse movement, active window time - is defeated by them. 

The deeper problem is what the metric rewards. Activity scores measure typing, not thinking. The architect at a whiteboard, the analyst reading a 200-page filing and the writer staring at a paragraph all score badly. The employee cycling six tabs scores well. You end up with a number managers trust and your strongest performers quietly resent. 

Then there is the second-order cost. American Psychological Association research links monitoring to worse self-reported mental health, and multiple surveys put the share of employees who would consider leaving over increased surveillance near half. A programme that recovers a few percentage points of “active time” and triggers two resignations has not paid for itself. 

A 5-Step Rollout That Doesn’t Destroy Trust 

The difference between monitoring that works and monitoring that backfires is procedural. 

1. Write the purpose before you pick the tool. One sentence per data type: what decision does this data inform, and who makes it? If you cannot name the decision, do not collect the data. This sentence also becomes your legitimate interests assessment and your policy language. 
2. Announce before you deploy, not alongside. Publish the policy two to four weeks ahead and take questions in the open. Discovery is what turns a reasonable programme into a scandal - employees who learn about monitoring from a colleague react far worse than those told upfront. 
3. Collect at the narrowest level that answers the question. Aggregate over individual, category over content, working hours over always-on, company devices only. Most leadership questions are answered by team-level trend data, not individual screenshots. 
4. Give employees their own data. If a manager can see a dashboard, the employee on it should see the same dashboard. This single decision moves the tool from surveillance to self-management, and it is the clearest signal that the programme is about capacity, not compliance. 
5. Set a retention limit and a review date. Ninety days is a defensible default for granular activity data. Review the programme at six months against the purpose you wrote in step one, and switch off anything that has not informed a decision. 

What to Measure Instead of Keystrokes 

The questions leaders actually ask - are we staffed correctly, where is work getting stuck, which clients consume more effort than they pay for - are not answered by input metrics. They are answered by workflow data. Modern employee monitoring software can capture both; the choice of which signals to surface is yours, and it determines whether the tool reads as a management aid or a tripwire. 

Every metric on the right is about the work, not the worker. That makes the data defensible in a works council meeting, useful in capacity planning, and far harder to game - because gaming cycle time means delivering faster. Teams running this way pair a workforce analytics platform with clear delivery definitions, so the numbers mean the same thing in every team. 

Common Mistakes to Avoid 

• Deploying first and writing the policy afterwards. The policy is the legal record; retrofitting it is how notice requirements get missed. 
• Using one global configuration. A field engineer, a night-shift support agent and a senior analyst do not need the same data collected about them. 
• Monitoring personal devices under a BYOD policy without a clear boundary between work and personal data. 
• Letting monitoring data enter performance reviews without a documented rule for how it is weighted - this is where discrimination and works council disputes originate. 
• Keeping granular activity data indefinitely. Every extra month of retention is additional breach exposure with no analytical value. 
• Treating a vendor’s compliance page as legal advice. Vendors document what the software can do, not what your jurisdiction permits. 

The Bottom Line 

Legality is a low bar, and clearing it tells you nothing about whether a monitoring programme will work. Organisations that get value from employee monitoring software treat it as an instrument for understanding capacity, risk and flow. The ones that get resignations treat it as a way to check whether people are typing. 

Before you sign a contract, answer one question in writing: what decision will this data change? If you cannot answer it, the fact that monitoring is legal is beside the point.

FAQs 

Is employee monitoring legal? 

Yes. Employee monitoring is legal in the US, UK, EU and Canada when it is carried out on company-owned systems, for a legitimate business purpose, with appropriate notice. The limits are on scope and secrecy, not on the practice itself. 

Do employers have to tell employees they are being monitored? 

Under US federal law, no. Under state law, often yes - Connecticut, Delaware, New York and Texas require notice, and California requires notice at collection under the CCPA/CPRA. The UK, EU and Ontario all require transparency as a condition of lawful processing. 

Can an employer monitor a personal device? 

Only within limits, and only with genuinely informed consent. Under GDPR, monitoring personal devices is hard to justify as proportionate. The safer approach is to restrict monitoring to company-issued equipment and containerised work profiles. 

Does employee monitoring improve productivity? 

It improves visibility. Whether that becomes productivity depends on what you measure. Monitoring tied to workflow metrics such as cycle time and capacity tends to help; monitoring tied to activity scores tends to produce gamed data and attrition. 

What should go in an employee monitoring policy? 

What is collected, why, who can see it, how long it is retained, how employees can access their own data, and when the policy will be reviewed. Publishing it alongside the productivity monitoring tools you actually deploy - rather than months later - is what keeps the programme defensible.