Employee Data Privacy: Employer Obligations by State (2026)

No single federal law protects employee privacy in the US: employers can generally monitor work email, internet use, and company devices under the federal Electronic Communications Privacy Act's consent and business-use exceptions, though Connecticut, Delaware, and New York generally require notice before monitoring. Personal accounts get more protection: accessing an employee's personal email without authorization can violate the federal Stored Communications Act, and several states, including California and Illinois, bar employers from demanding social media passwords.

Federal Employee Privacy Laws

While no single federal statute comprehensively addresses employee data privacy, several federal laws establish baseline protections.

Electronic Communications Privacy Act (ECPA)

The Electronic Communications Privacy Act of 1986 (18 USC 2510-2522) is the primary federal law governing employer monitoring of employee electronic communications. The ECPA generally prohibits intercepting electronic communications, but two exceptions make employer monitoring broadly permissible:

The consent exception. If an employee consents to monitoring, the interception is lawful. Most employers obtain consent through employee handbooks, acceptable use policies, or login banners stating that communications on company systems are subject to monitoring.

The business use exception (provider exception). An employer that provides the communications system (email servers, phone systems, company computers) can monitor communications conducted on those systems for legitimate business purposes. Courts have interpreted this exception broadly, allowing employers to monitor email, internet usage, and chat messages on company-provided devices and networks.

The ECPA does limit monitoring of purely personal communications even on company systems, though the boundaries of this limitation are fact-specific and vary by circuit.

Stored Communications Act (SCA)

The Stored Communications Act (18 USC 2701-2712), part of the ECPA, governs access to stored electronic communications. Under the SCA, employers generally can access emails stored on company servers. However, accessing an employee's personal email account (Gmail, Yahoo) without authorization violates the SCA, even if accessed from a company computer.

Americans with Disabilities Act (ADA)

The ADA restricts employer collection and use of medical information. Employers may not make disability-related inquiries or require medical examinations unless they are job-related and consistent with business necessity (42 USC 12112(d)). Medical records must be maintained in separate, confidential files with restricted access.

Genetic Information Nondiscrimination Act (GINA)

GINA (42 USC 2000ff) prohibits employers from requesting, requiring, or purchasing genetic information about employees or their family members, with narrow exceptions. Genetic information includes family medical history, genetic test results, and the fact that someone has sought genetic services. Violations can result in enforcement by the EEOC.

Fair Credit Reporting Act (FCRA)

The FCRA (15 USC 1681 et seq.) regulates employer use of background checks obtained from consumer reporting agencies. Before obtaining a background check, employers must provide written disclosure and obtain the employee's or applicant's written authorization (15 USC 1681b(b)(2)). If the employer takes adverse action based on the report, they must provide a copy of the report and a description of the consumer's rights before the action takes effect (15 USC 1681b(b)(3)).

Workplace Monitoring by State

Email and Computer Monitoring

Federal law permits workplace computer monitoring with minimal restrictions. State laws add modest requirements:

Connecticut (Conn. Gen. Stat. 31-48d) is the most protective state. Employers must give prior written notice to employees before monitoring email or internet activity. The notice must describe the types of monitoring that may occur. Failing to provide notice before monitoring violates the statute.

Delaware (Del. Code tit. 19, 705) requires notice before an employer monitors telephone, email, or internet use, but 705(b) gives the employer a choice of two routes: an electronic notice at least once during each day the employee accesses the employer-provided email or internet services, or a one-time notice that may be given in writing, in an electronic record, or in another electronic form and that the employee acknowledges either in writing or electronically. A violation carries a civil penalty of $100.

New York enacted the New York Civil Rights Law Section 52-c*2 effective May 7, 2022, requiring employers that monitor telephone calls, email, or internet access to provide prior written notice upon hiring. The notice must be posted in a conspicuous place and acknowledged in writing by the employee.

In all other states, employer monitoring of company-provided email and devices is largely unrestricted under federal law, provided the employer has not created a reasonable expectation of privacy (typically negated through handbook policies and login banners).

Biometric Data Collection

Biometric privacy is one of the fastest-evolving areas of employee data law. Several states have enacted specific statutes governing employer collection of fingerprints, facial geometry, retinal scans, voiceprints, and other biometric identifiers.

Illinois Biometric Information Privacy Act (BIPA). 740 ILCS 14 is the most significant biometric privacy law in the country because it provides a private right of action with statutory damages. Under BIPA, employers must:

• Provide written notice of the biometric data being collected and the purpose
• Obtain a written release from the employee before collection
• Publish a retention schedule and destruction guidelines
• Not sell, lease, trade, or profit from biometric data

Statutory damages are $1,000 per negligent violation and $5,000 per intentional or reckless violation. Following the Illinois Supreme Court's 2023 ruling in Cothron v. White Castle, each individual scan or collection event constitutes a separate violation. This has generated billions of dollars in potential exposure for employers using biometric timekeeping systems. A 2024 amendment capped damages at one violation per employee per method of collection in response. Workers in Illinois who clocked in with a fingerprint or face scan without signing a written release can ask an employment lawyer for a free case evaluation on whether the employer met BIPA's requirements (attorney advertising).

Texas (Tex. Bus. & Com. Code 503.001) prohibits capturing biometric identifiers for commercial purposes without consent. Unlike Illinois, Texas does not provide a private right of action; enforcement lies with the Texas Attorney General, who can seek penalties of up to $25,000 per violation. The Texas Responsible AI Governance Act, effective January 1, 2026, narrowed this consent requirement: it exempts biometric identifiers an individual has made publicly available themselves, and biometric data used only to develop, train, or evaluate AI models, unless that data is used to uniquely identify a specific person.

Washington (RCW 19.375) is narrower than it first appears, and it generally does not reach workplace timekeeping. RCW 19.375.020(1) bars enrolling a biometric identifier in a database for a commercial purpose without first providing notice, obtaining consent, or providing a mechanism to prevent later commercial use. RCW 19.375.010(4) defines a commercial purpose as sale or disclosure to a third party for the marketing of goods or services unrelated to the transaction in which the identifier was first obtained. An employer that enrolls employee fingerprints for its own timekeeping is neither selling them nor disclosing them for unrelated marketing, so the statute imposes no consent duty on that practice. Enforcement is through the Washington Attorney General.

Additional states: Colorado, Virginia, Connecticut, and other states with comprehensive privacy laws include biometric data as "sensitive data" requiring consent for processing, though these laws generally do not provide private rights of action.

Social Media Password Laws

A growing number of states prohibit employers from requesting or requiring employees or job applicants to disclose social media login credentials. As of early 2026, at least 28 states have enacted such laws, including:

These laws generally prohibit employers from: requesting login credentials, requiring employees to log in to personal accounts in the employer's presence, requiring employees to add the employer or its agents to their contacts, and retaliating against employees who refuse to comply.

GPS and Location Tracking

Employer tracking of employee location raises distinct legal issues depending on whether the tracking occurs on company-owned or personal devices and vehicles.

Company vehicles and devices. Employers generally can track company-owned vehicles and devices without specific employee consent under federal law. The reasoning parallels the ECPA business use exception: the employer owns the equipment.

Personal vehicles. Protection here is thinner than it is often described. It rests mostly on general criminal or constitutional law rather than on employment statutes:

• California courts have held that tracking an employee's personal vehicle without consent can constitute an invasion of privacy under the California Constitution.
• New York has no statute restricting employer GPS tracking. N.Y. Penal Law 120.45, the fourth-degree stalking statute, does define "following" to include the unauthorized tracking of a person's movements or location through a global positioning system, but that definition applies only to subdivision two of the section. Subdivision two additionally requires conduct engaged in intentionally and for no legitimate purpose that causes material harm to the person's mental or emotional health, after the actor was previously clearly informed to cease. An employer asserting a business reason for tracking would ordinarily fall outside it.
• Texas (Tex. Penal Code 16.06) prohibits installing tracking devices on vehicles owned or leased by another person without consent.

Off-duty tracking. Even where GPS tracking of company vehicles is legal, tracking employees during non-work hours raises additional concerns. California, Colorado, and New York courts have recognized employee privacy interests in off-duty location data, and several proposed state bills would explicitly restrict off-hours tracking.

Drug Testing

Drug testing privacy varies significantly by state:

• Random testing: Some states (Vermont, Connecticut, Minnesota, Montana, Rhode Island) restrict random drug testing to safety-sensitive positions only.
• Marijuana protections: As marijuana legalization expands, a growing number of states (California, New York, New Jersey, Montana, Nevada, Washington) prohibit employers from taking adverse action based on off-duty marijuana use or positive THC tests, with exceptions for safety-sensitive positions and federal requirements.
• Notice requirements: Many states require advance written notice of drug testing policies and procedures.

CCPA Employee Data Rights

The CCPA originally included a moratorium on employee data rights, which expired on January 1, 2023. California employees now have the same rights as consumers under the CCPA/CPRA, including:

• Right to know what personal information the employer collects and how it is used
• Right to delete personal information (subject to exceptions for legal obligations and employment administration)
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information
• Right to limit the use of sensitive personal information
• Right to non-retaliation for exercising these rights

Under Cal. Civ. Code 1798.100, employers must provide a privacy notice to employees at or before the point of collection describing the categories of personal information collected and the purposes for each category. This is separate from the public-facing privacy policy and must address the employment context specifically.

The practical impact has been significant. Large California employers have had to build new intake systems for employee data requests, train HR departments on response procedures, and audit the flow of employee data to third parties (payroll processors, benefits administrators, background check vendors).

Common Law Privacy Torts

Beyond statutory protections, employees may bring common law tort claims against employers for privacy violations. The four traditional privacy torts, as defined in the Restatement (Second) of Torts, are:

Intrusion upon seclusion. An employer invades an employee's privacy by intentionally intruding into a matter in which the employee has a reasonable expectation of privacy. Courts have found intrusion claims viable for: searching personal belongings without cause, hidden camera surveillance in restrooms or changing areas, and accessing personal email accounts without authorization.

Public disclosure of private facts. An employer publishes embarrassing private facts about an employee. Examples include disclosing medical conditions, sharing salary information publicly (in states without pay transparency laws), or revealing the results of drug tests.

False light. An employer publishes information that places an employee in a false light. This is less common in the employment context but can arise from misleading characterizations in references or public statements.

Appropriation of name or likeness. An employer uses an employee's name or image for commercial purposes without consent. This has become more relevant with employer social media practices and the use of employee images in marketing materials.

These common law claims are available in most states and exist independently of statutory protections. They provide a legal basis for employees to challenge privacy violations even in states without specific employee privacy statutes.

Emerging Issues

AI-Powered Workplace Monitoring

The use of AI tools to monitor employee productivity, analyze communications, and predict behavior is growing rapidly. Keystroke logging, screen capture, sentiment analysis of messages, and even webcam-based "attention tracking" are now commercially available. Few existing laws directly address AI workplace monitoring, though:

• Colorado's AI Act (originally SB24-205, substantially revised by SB26-189, signed May 14, 2026) will require, starting January 1, 2027, that employers notify employees when high-risk AI systems are used in consequential decisions affecting their employment.
• Illinois' AI Video Interview Act (820 ILCS 42) requires employers to provide notice and obtain consent before using AI to analyze video interviews, and to destroy videos within 30 days of a request.
• The FTC has warned that surveillance-based management practices may constitute unfair practices under Section 5.

Reproductive Health Privacy

Following Dobbs v. Jackson Women's Health Organization (2022), several states enacted laws protecting employee reproductive health data. Washington, California, and Illinois have enacted or proposed legislation restricting employer access to reproductive health information and prohibiting adverse employment actions based on reproductive health decisions.

Sources and References

This article provides general legal information about employee data privacy across US jurisdictions. Employment law varies by state and changes frequently. Consult an attorney for advice specific to your situation.

Frequently Asked Questions

Can my employer read my work emails?

Under federal law (ECPA), employers can generally monitor email on company-provided systems under the business use exception and consent exception. Most employers establish monitoring rights through acceptable use policies and handbook acknowledgments. Connecticut and New York require prior written notice before monitoring, and Delaware requires either an electronic notice each day the employee uses the employer's email or internet services or a one-time notice the employee acknowledges. Personal email accounts are protected by the Stored Communications Act even when accessed on work devices.

Can an employer require fingerprint scans for timekeeping?

Yes, but state law may require consent and notice. Illinois BIPA requires written notice and a signed release before collecting biometric data, with statutory damages of $1,000-$5,000 per violation. Texas requires consent before capturing a biometric identifier for a commercial purpose. Washington's law is narrower than it sounds: its notice and consent duty is triggered only by enrolling a biometric identifier for a commercial purpose, which the statute defines as sale or disclosure to a third party for unrelated marketing, so it does not reach an employer using fingerprints for its own timekeeping. In states without specific biometric laws, employers generally can require biometric timekeeping, though employees may have common law privacy claims.

Can my employer ask for my social media password?

At least 28 states prohibit employers from requesting social media login credentials from employees or applicants. These laws also prohibit requiring employees to log in while the employer watches, adding the employer to contacts, or retaliating against refusal. In states without such laws, no federal statute specifically prohibits the request, though the Stored Communications Act may apply.

Does the CCPA apply to employee data in California?

Yes. The employee data exemption expired January 1, 2023. California employees now have full CCPA/CPRA rights including the right to know, delete, correct, and opt out of sale of personal information. Employers must provide a privacy notice at the point of collection and respond to employee data requests within 45 days.

Can my employer track my location with GPS?

Tracking company-owned vehicles and devices is generally legal under federal law. Tracking a personal vehicle without consent is restricted in a smaller number of states: Texas makes it an offense to place a tracking device on a vehicle owned or leased by another person without consent, and California courts have treated it as an invasion of privacy under the state constitution. New York has no employer-tracking statute, and its stalking law reaches only intentional tracking done for no legitimate purpose that causes material harm after the person was clearly told to stop. Off-duty tracking of employees raises additional privacy concerns even with company vehicles, and several states are considering legislation to restrict after-hours location monitoring.

Can employers conduct random drug tests?

Federal law does not prohibit random drug testing, but several states (Vermont, Connecticut, Minnesota, Montana, Rhode Island) restrict random testing to safety-sensitive positions. A growing number of states also prohibit adverse action based on off-duty marijuana use or positive THC tests, including California, New York, and New Jersey, with exceptions for safety-sensitive roles.

What federal laws protect employee medical information?

The ADA prohibits disability-related inquiries and medical examinations unless job-related and consistent with business necessity. Medical records must be kept in separate confidential files. GINA prohibits employers from requesting genetic information. HIPAA does not directly regulate employers but does restrict the health plans they sponsor. State laws often add further protections for employee medical data.

Can employers use AI to monitor employee performance?

No federal law specifically prohibits AI-powered employee monitoring, though the FTC has signaled that excessive surveillance may constitute unfair practices. Colorado's AI Act (as revised by SB26-189, effective January 1, 2027) will require notice when high-risk AI systems influence employment decisions. Illinois requires consent for AI analysis of video interviews. Expect more state legislation in this area in the coming years.