Maryland Employee Monitoring Laws: Passwords, Cameras & GPS

Maryland has no general law requiring employers to give notice before monitoring computers or phones. It does bar employers from demanding a social media password under Md. Code, Lab. & Empl. § 3-712, the first law of its kind in the country, and it pairs that with one of the strictest two-party consent recording laws in the United States.

Information last verified July 9, 2026. This article covers Maryland state law on employer monitoring of employees. It does not restate Maryland's two-party consent recording framework in depth or its general GPS-tracking law; both are covered in the linked guides below.

Federal Baseline: No Dedicated Maryland Notice Law

Maryland has not passed a Connecticut, Delaware, New York, or Maine-style statute requiring an employer to give advance notice before monitoring an employer-owned phone, computer, or email system. Absent a state notice law, monitoring of those systems runs on the federal floor set by Title I of the Electronic Communications Privacy Act (ECPA), codified at 18 U.S.C. §§ 2510-2523.

For telephone monitoring, the Act's definition of a covered "device" excludes "any telephone or telegraph instrument, equipment or facility, or any component thereof" furnished to a subscriber or user and used in the ordinary course of business, 18 U.S.C. § 2510(5)(a)(i). That business-extension exemption narrows once a call is identified as personal, as the Eleventh Circuit held in Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983), a decision widely followed outside its own circuit for the ordinary-course-of-business analysis.

Monitoring of an employer's email and computer systems runs on different provisions, because the § 2510(5)(a)(i) exclusion is written for telephone and telegraph equipment rather than computer networks. Section 2511(2)(a)(i) allows an officer, employee, or agent of a provider of wire or electronic communication service to intercept a communication in the normal course of employment where doing so is a necessary incident to rendering the service or to protecting the rights or property of the provider. Section 2511(2)(d) permits interception where one party has given prior consent, which is the work an acknowledged written monitoring policy is generally meant to do. Courts have not cleanly extended the telephone-extension exemption to stored email. A Maryland employee who assumes state law separately requires an advance monitoring notice is mistaken; those federal provisions, plus whatever written policy the employer chooses to adopt, are what actually govern.

Maryland's Social Media Password Law: Md. Code, Lab. & Empl. § 3-712

Maryland made history in 2012 as the first state to bar employers from demanding an employee's or applicant's social media credentials. Md. Code, Lab. & Empl. § 3-712 prohibits an employer from requesting or requiring that an employee or applicant disclose a username, password, or other means of accessing a personal account or service through an electronic communications device.

The statute bars retaliation directly: an employer may not discharge, discipline, or otherwise penalize, or threaten to discharge, discipline, or otherwise penalize, an employee for refusing to disclose that information, and may not fail or refuse to hire an applicant for the same refusal.

Section 3-712 draws a clear line between personal and work accounts. An employer may still require an employee to disclose credentials for a nonpersonal account or service that provides access to the employer's own internal computer or information systems, the same carve-out most other states' social-media-password laws use. The statute also restricts the employee's side of the relationship: an employee may not download the employer's proprietary information or financial data to a personal account without authorization.

Subsection (e) then preserves two narrow investigation paths. Under (e)(1), the section does not prevent an employer, based on receipt of information about an employee's use of a personal account for business purposes, from conducting an investigation for the purpose of ensuring compliance with applicable securities or financial law, or regulatory requirements. Under (e)(2), the section does not prevent an employer, based on receipt of information about the unauthorized downloading of the employer's proprietary information or financial data to a personal account, from investigating that conduct. Read the operative words carefully: both are savings clauses that preserve an employer's ability to investigate. Neither gives a Maryland employer power to compel an employee to hand over personal-account content, and neither creates a general exception for investigating workplace misconduct.

Maryland's Commissioner of Labor can mediate a § 3-712 dispute informally, or authorize the Attorney General to seek injunctive relief and damages in the appropriate circuit court. That enforcement structure gives the law real teeth beyond a symbolic prohibition.

Maryland's Two-Party Consent Recording Law and Workplace Monitoring

Maryland is one of a small group of states requiring consent from every party to a conversation before it can be recorded. Under Md. Code, Cts. & Jud. Proc. § 10-402, it is a felony, punishable by up to five years in prison and a fine of up to $10,000, to intercept a wire, oral, or electronic communication unless the person intercepting it is a party to the communication and every other party has given prior consent.

That strict rule is a separate legal question from the employer-notice topic this cluster covers, and this article does not re-derive it. What matters for the workplace context is that an employer recording phone calls, meetings, or other communications in Maryland, not just silently observing them, needs all-party consent independent of any monitoring-notice analysis. See our guide to Maryland recording laws for the full consent framework, penalties, and exceptions, including the workplace-specific detail on recording calls and meetings.

Video Surveillance Limits: The Visual Surveillance Statute

Maryland Criminal Law § 3-901 makes it a misdemeanor to conduct, or procure another to conduct, visual surveillance of a person in a "private place" without that person's consent. The statute defines visual surveillance broadly, direct sight, mirrors, cameras, or an electronic device used to observe someone surreptitiously, but defines a private place narrowly as a dressing room or rest room in a retail store, not any location where a person might generally expect privacy from surveillance.

A violation carries up to 30 days in jail, a fine of up to $1,000, or both, and it is not a defense that the defendant owned the premises where the private place was located, a detail that matters directly for a retail employer, since owning the store does not license a hidden camera in the dressing room or restroom the statute covers. An individual placed under unlawful visual surveillance also has a civil cause of action for actual damages and reasonable attorney's fees. Maryland has not revised this statute in recent years; its 'private place' definition still covers only a dressing room or rest room in a retail store, so employers installing a camera in any other space employees use for changing, nursing, or personal hygiene should not assume the statute reaches it and should confirm current compliance with a Maryland attorney.

A Cautionary Example: The UMMS Keylogging Case

A class-action lawsuit filed in 2025 against the University of Maryland Medical System Corporation and the University of Maryland Medical Center illustrates what unchecked monitoring capability inside a workplace can do. Six current and former employees allege that a former UMMC pharmacist, Matthew Bathula, installed keylogging spyware on roughly 400 hospital workstations over nearly a decade, from 2016 to 2024, harvesting login credentials from about 80 coworkers. The lawsuit alleges he used those credentials to access coworkers' webcams and, in some instances, remotely activate home security cameras, including footage of new mothers pumping breast milk in closed treatment rooms at work. Bathula was later federally indicted.

This was unauthorized insider surveillance, not a sanctioned employer monitoring program, and it is not an example of Maryland's password or notice law being violated. It is a useful illustration of the negligent-supervision and negligent-security exposure an employer can face when it does not control who inside the organization can install monitoring software on company devices, a real-world reminder that a written monitoring policy is only as good as the access controls behind it.

GPS and Vehicle Tracking

Maryland has not enacted a dedicated statute requiring an employer to give notice before tracking a company vehicle, the way New Jersey has. Nor does Maryland impose a freestanding consent requirement on location tracking. Instead, location tracking appears in the state's stalking law, Md. Code, Crim. Law § 3-802, which since a 2022 amendment lists tracking someone "through the use of a device that can pinpoint or track the location of another without the person's knowledge or consent" as one of the ways stalking can be committed. Tracking alone is not the offense: § 3-802(a)(1) still requires a malicious course of conduct that the actor intends or should know will place the target in reasonable fear of serious bodily injury, assault, a sexual offense, false imprisonment, or death, or will cause serious emotional distress.

Subsection (b)(2) separately excludes conduct "performed to carry out a specific lawful commercial purpose," language that covers a business tracking vehicles it owns, lenders using GPS on financed vehicles, and telematics programs employees have agreed to. An employer tracking a company-owned vehicle generally falls outside the statute on both counts. Secretly tracking an employee's personal vehicle is a far riskier proposition. For the fuller picture, including penalties and how Maryland's stalking law interacts with GPS trackers outside the employment context, see our guide to Maryland GPS tracking laws and the GPS Tracking Laws by State hub.

Biometric Monitoring: Time Clocks and Facial Recognition

Illinois' Biometric Information Privacy Act (BIPA), 740 ILCS 14, is the strongest biometric-privacy law in the country, requiring written consent before an employer collects a fingerprint or facial scan and creating a private right of action with statutory damages. Multiple trucking and logistics companies have paid multi-million-dollar BIPA settlements over driver-facing cameras and fingerprint time clocks used without the required consent. That specific regime is Illinois-only and does not extend to Maryland.

Maryland does have one facial-recognition consent rule of its own, and it is easy to miss because it sits in the labor code rather than a privacy act. Md. Code, Lab. & Empl. § 3-717 bars an employer from using a facial recognition service to create a facial template during an applicant's interview unless the applicant signs a written waiver stating the applicant's name, the date of the interview, that the applicant consents to the use of facial recognition during the interview, and whether the applicant read the consent waiver. The section is much narrower than BIPA: it reaches the job-interview stage only, it says nothing about biometric systems used on current employees, and it carries no private right of action or statutory damages of its own.

Outside that interview rule, a Maryland employer using biometric time clocks is not currently subject to a comparable state consent-and-damages statute, though general privacy-tort principles, and the visual surveillance statute discussed above where a biometric camera also captures images in a private place, can still apply depending on the facts.

Where to learn more

This guide focuses on the password, notice, and surveillance rules specific to the employment relationship in Maryland. For the state's two-party consent recording framework, see Maryland recording laws; for vehicle and device tracking outside the workplace, see Maryland GPS tracking laws; and for how other states handle notice, passwords, and surveillance, see the Employee Monitoring Laws by State hub.

Disclaimer

This article provides general legal information about Maryland employee-monitoring law as of July 9, 2026. It is not legal advice and does not create an attorney-client relationship. Laws change, and how a statute applies depends on specific facts. If you have questions about monitoring at your workplace, or believe your rights under Maryland law have been violated, consult a lawyer licensed in Maryland.

Related articles

• Maryland Recording Laws: Two-Party Consent
• Maryland GPS Tracking Laws
• Employee Monitoring Laws by State

---

Last updated: July 9, 2026. Statutes cited reflect their in-force version as of that date.

More Maryland Laws

• Maryland AI Meeting Recording Laws
• Maryland At-Will Employment Laws
• Maryland Data Privacy Laws
• Maryland GPS Tracking Laws
• Maryland Recording Laws
• Maryland Whistleblower Laws

Frequently Asked Questions

Does my Maryland employer have to tell me if they are monitoring my work email?

Not under any Maryland statute. Maryland has not enacted a notice law like Connecticut, Delaware, New York, or Maine. Monitoring of an employer-owned email system is governed by federal law, chiefly the system-provider exception in 18 U.S.C. § 2511(2)(a)(i) and the one-party consent exception in § 2511(2)(d). The separate 'ordinary course of business' exclusion in § 2510(5)(a)(i) is written for telephone and telegraph equipment, not computer and email systems.

Can my employer ask for my Instagram or Facebook password in Maryland?

No. Md. Code, Lab. & Empl. § 3-712 bars a Maryland employer from requesting or requiring an employee or applicant to disclose a username, password, or other means of accessing a personal account, and bars retaliation for refusing.

Is Maryland a one-party or two-party consent state for recording?

Maryland is a strict two-party (all-party) consent state under Md. Code, Cts. & Jud. Proc. § 10-402. Recording a conversation without every party's consent is a felony punishable by up to 5 years in prison and a $10,000 fine. See our Maryland recording laws guide for the full framework.

Can my employer put a camera in the employee restroom or locker room in Maryland?

It depends. Md. Code, Crim. Law § 3-901 defines 'private place' narrowly as a dressing room or rest room in a retail store; on its face it does not reach a restroom or locker room at a non-retail workplace. For a retail employer, owning the building is not a defense to placing a hidden camera in a dressing room or restroom the statute covers. Surveillance in other workplace restrooms or locker rooms may raise separate legal issues under different law.

Can my Maryland employer track the company vehicle I drive?

Generally yes. Maryland has no statute requiring an employer to get consent before tracking a company vehicle. Its stalking law, Md. Code, Crim. Law § 3-802, lists tracking someone through a location device as one way stalking can be committed, but the offense still requires a malicious course of conduct that places the target in reasonable fear of serious harm or is intended to cause serious emotional distress. Subsection (b)(2) also excludes conduct performed to carry out a specific lawful commercial purpose. Tracking an employee's personal vehicle is a different question.

What can I do if my Maryland employer demands my social media password anyway?

Maryland's Commissioner of Labor can mediate a § 3-712 complaint informally, or authorize the Attorney General to pursue injunctive relief and damages in circuit court. An employee facing retaliation for refusing to disclose credentials should also consult a Maryland employment lawyer.

Does Maryland regulate fingerprint or facial-recognition time clocks?

Not through a BIPA-style biometric-privacy statute. Illinois' Biometric Information Privacy Act, which requires written consent and allows statutory damages, is Illinois-specific and does not extend to Maryland employers. Maryland does have one narrow rule, Md. Code, Lab. & Empl. § 3-717, but it applies only to using a facial recognition service to create a facial template during a job applicant's interview, which requires the applicant's signed waiver. It does not reach fingerprint or facial-recognition time clocks used on current employees.