Illinois Employee Monitoring Laws (2026): BIPA, Recording & More

Illinois regulates employee monitoring more heavily than almost any other state, combining an all-party consent recording law, a social-media-password ban, and the Biometric Information Privacy Act, whose fingerprint and face-scan rules have produced some of the largest employment-privacy settlements in the country.

This guide is part of our Employee Monitoring Laws by State series, which covers electronic-monitoring notice duties, social-media-password protections, and workplace video and GPS surveillance limits nationwide.

Information last verified on 2026-07-09. This article has not yet been reviewed by a licensed lawyer.

Does Illinois require employers to give notice before monitoring employees?

No, not in the form Connecticut, Delaware, New York, or Maine use. Those four states require a written or posted notice before an employer monitors phone, email, or internet activity. Illinois has not adopted a comparable general notice statute, so an Illinois employer monitoring its own email or computer systems relies on the same federal baseline that applies nationally: the Electronic Communications Privacy Act, 18 U.S.C. Sections 2510-2523, prohibits intercepting communications without consent, but Section 2511(2)(a)(i) allows the owner of a communication system to monitor use of that system in the ordinary course of business, subject to the limits federal courts have placed on continued monitoring once a call is identified as personal.

What makes Illinois distinctive is not a notice statute but three other laws layered on top of that federal baseline: the state's all-party consent recording rule, its social-media-password statute, and BIPA. Each is addressed below, and none of them should be confused with the electronic-monitoring notice category that Connecticut, Delaware, New York, and Maine occupy.

Recording employee calls and conversations in Illinois

Illinois is one of the strictest all-party consent states in the country. Under 720 ILCS 5/14-2, using an eavesdropping device to record a private conversation, defined as one where at least one participant had a reasonable expectation of privacy, without the consent of every party is a felony, generally a Class 4 felony for a first offense and a Class 3 felony for a subsequent one. This is a materially different baseline from the one-party consent rule most states use, and it means an Illinois employer cannot simply record a call it participates in the way an employer in a one-party state can; every party on the line, including the employee, generally needs to consent.

In practice, employers satisfy this through an acknowledged monitoring policy that puts employees on notice and secures their consent up front, which functions as the "all parties consented" element the statute requires. This cluster addresses only the employment overlay; the full consent framework, including exceptions, penalties, and the law's post-ACLU v. Alvarez history, is covered in depth on our Illinois Recording Laws: Workplace guide and is not repeated here.

Illinois' social media password law for employees

The Right to Privacy in the Workplace Act, 820 ILCS 55/10, added social media protections in 2013 and makes Illinois one of 27 states, per the National Conference of State Legislatures, with a law of this kind. Under Section 10(b)(1), it is unlawful for an employer or prospective employer to request, require, or coerce an employee or applicant to provide a username and password, or any other means of accessing a personal online account, or to demand access to that account in any other manner. Section 10(b)(1)(F) separately bars an employer from refusing to hire an applicant, or taking adverse action against an employee, because they declined to hand over that access.

The Act does not stop an employer from doing two things: maintaining lawful policies governing use of the employer's own electronic equipment, including internet, social-networking, and email policies, or monitoring use of the employer's own equipment and email accounts, so long as the employer does not request or use an employee's personal account password to do it. The practical line is between an employer's own systems, which it can monitor, and an employee's personal account, whose password it cannot demand.

Illinois' Biometric Information Privacy Act and employer time clocks

BIPA, 740 ILCS 14, enacted in 2008, is the country's strongest biometric-privacy law and is directly relevant to any Illinois employer using a fingerprint scanner, hand-geometry reader, or facial-recognition system for time-and-attendance or building access. Under Section 15(b), before collecting a biometric identifier or biometric information, an employer must inform the employee in writing that the data is being collected or stored, disclose the specific purpose and length of time it will be retained, and obtain a written release, which the statute now allows to be an electronic signature. Under Section 15(a), the employer must develop and make public a written policy establishing a retention schedule and guidelines for permanently destroying the biometric data, generally no later than three years after the employee's last interaction with the employer or when the purpose for collecting it has been satisfied, whichever comes first.

Section 20 gives "any person aggrieved" by a violation a private right of action, a remedy most other states' biometric laws do not provide, with liquidated damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation, plus actual damages, injunctive relief, and attorney's fees. A 2024 amendment, Public Act 103-769, effective August 2, 2024, limits a plaintiff to a single recovery per person per method of collection, overturning the earlier reading that each individual fingerprint scan could generate its own violation, which had driven the largest exposure numbers.

That earlier per-scan exposure is what produced Rogers v. BNSF Railway Co., the first BIPA case to reach a jury. In October 2022, a federal jury in the Northern District of Illinois found BNSF recklessly or intentionally violated BIPA by fingerprint-scanning roughly 45,600 truck drivers and other workers at its facilities without the required consent, and the court initially entered judgment for $228 million (45,600 violations multiplied by the $5,000 statutory rate). U.S. District Judge Matthew Kennelly later vacated that damages figure and ordered a new trial limited to damages; rather than retry the issue, the parties settled for $75 million, distributed to roughly 46,500 class members after fees and costs. More recently, trucking-camera vendor Lytx Inc. finalized a $4.25 million BIPA settlement, approved July 25, 2025, after truckers alleged its driver-facing safety cameras collected face-geometry data without consent between October 2016 and January 2025; claimants received payouts between roughly $631 and $845 each. Both cases illustrate the same pattern: equipment marketed for safety or time-and-attendance purposes still triggers BIPA's consent and retention duties when it captures biometric data from an Illinois workforce.

Our Illinois Biometric Privacy (BIPA) guide covers the statute's full definitions, exemptions, and litigation history; the summary above is limited to the employer-monitoring angle.

Video surveillance in Illinois workplaces

Illinois' unauthorized video recording statute, 720 ILCS 5/26-4, makes it unlawful to knowingly record or transmit live video of another person, without that person's consent, in a restroom, tanning bed, tanning salon, locker room, changing room, or hotel bedroom, and separately bars placing or causing a device to be placed in one of those locations with intent to do so. The offense escalates from a misdemeanor for placing a device with that intent to a felony for actually capturing the recording. The statute applies directly to an Illinois employer's camera placement: cameras in break rooms, sales floors, warehouses, and other common work areas are not covered, but a camera in a restroom or locker room is a criminal exposure regardless of the employer's stated security rationale.

GPS and vehicle tracking in Illinois

Illinois has no dedicated employer-vehicle-tracking notice statute comparable to New Jersey's. Its general electronic-tracking-device statute, 720 ILCS 5/21-2.5, makes unauthorized use of a tracking device a Class A misdemeanor, but it exempts tracking installed by, or with the consent of, the vehicle's owner or lessee, and that consent extends to any other driver or passenger of the vehicle. Because an employer typically owns or leases its fleet vehicles, this ownership exception generally covers routine GPS tracking of company vehicles. Illinois' stalking statute, 720 ILCS 5/12-7.3, separately criminalizes placing a tracking device on a person or their property as part of a course of conduct meant to cause fear, which targets malicious tracking rather than ordinary fleet management. For the state's full tracking-device framework, see our Illinois GPS Tracking Laws guide.

More Illinois Laws

• Illinois AI Meeting Recording Laws
• Illinois Alimony Laws
• Illinois At-Will Employment Laws
• Illinois Car Accident Laws
• Illinois Car Seat Laws
• Illinois Child Custody Laws
• Illinois Child Support Laws
• Illinois Common Law Marriage Laws
• Illinois Dashcam Laws
• Illinois Data Privacy Laws
• Illinois Deepfake Laws
• Illinois Divorce Laws
• Illinois Dog Bite Laws
• Illinois Drone Laws
• Illinois Emancipation Laws
• Illinois Expungement Laws

Disclaimer

This article provides general legal information about Illinois employee monitoring law as verified on 2026-07-09. It does not constitute legal advice and does not create an attorney-client relationship. Readers with a specific workplace monitoring or biometric-privacy dispute should consult a lawyer licensed in Illinois.

Related articles

• Employee Monitoring Laws by State: the complete hub
• Illinois Recording Laws: Workplace
• Illinois Biometric Privacy (BIPA)
• Illinois GPS Tracking Laws
• Indiana Employee Monitoring Laws

Last updated: 2026-07-09. Statutes cited reflect their in-force version as of 2026-07-09.