Maryland Employee Monitoring Laws: Passwords, Cameras & GPS

Maryland has no general law requiring employers to give notice before monitoring computers or phones. It does bar employers from demanding a social media password under Md. Code, Lab. & Empl. § 3-712, the first law of its kind in the country, and it pairs that with one of the strictest two-party consent recording laws in the United States.

Information last verified July 9, 2026. This article covers Maryland state law on employer monitoring of employees. It does not restate Maryland's two-party consent recording framework in depth or its general GPS-tracking law; both are covered in the linked guides below.

Federal Baseline: No Dedicated Maryland Notice Law

Maryland has not passed a Connecticut, Delaware, New York, or Maine-style statute requiring an employer to give advance notice before monitoring an employer-owned phone, computer, or email system. Absent a state notice law, monitoring of those systems runs on the federal floor set by Title I of the Electronic Communications Privacy Act (ECPA), codified at 18 U.S.C. §§ 2510-2523.

The Act's definition of a covered "device" excludes equipment an employer furnishes and uses in the ordinary course of its business, 18 U.S.C. § 2510(5)(a)(i), a business-extension exemption courts extend to an employer that owns the system being monitored. The exemption narrows once a call is identified as personal, as the Eleventh Circuit held in Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983), a decision widely followed outside its own circuit for the ordinary-course-of-business analysis. A Maryland employee who assumes state law separately requires an advance monitoring notice is mistaken; the federal exception, plus whatever written policy the employer chooses to adopt, is what actually governs.

Maryland's Social Media Password Law: Md. Code, Lab. & Empl. § 3-712

Maryland made history in 2012 as the first state to bar employers from demanding an employee's or applicant's social media credentials. Md. Code, Lab. & Empl. § 3-712 prohibits an employer from requesting or requiring that an employee or applicant disclose a username, password, or other means of accessing a personal account or service through an electronic communications device.

The statute bars retaliation directly: an employer may not discharge, discipline, or otherwise penalize, or threaten to discharge, discipline, or otherwise penalize, an employee for refusing to disclose that information, and may not fail or refuse to hire an applicant for the same refusal.

Section 3-712 draws a clear line between personal and work accounts. An employer may still require an employee to disclose credentials for a nonpersonal account or service that provides access to the employer's own internal computer or information systems, the same carve-out most other states' social-media-password laws use. The statute also restricts the employee's side of the relationship: an employee may not download the employer's proprietary information or financial data to a personal account without authorization. And it preserves a narrow employer-investigation path: if an employer receives information about an employee's personal-account activity that is relevant to a specific investigation, whether of a compliance violation or of the unauthorized download of proprietary or financial data, the employer may require the employee to share that content, though not the password itself.

Maryland's Commissioner of Labor can mediate a § 3-712 dispute informally, or authorize the Attorney General to seek injunctive relief and damages in the appropriate circuit court. That enforcement structure gives the law real teeth beyond a symbolic prohibition.

Maryland's Two-Party Consent Recording Law and Workplace Monitoring

Maryland is one of a small group of states requiring consent from every party to a conversation before it can be recorded. Under Md. Code, Cts. & Jud. Proc. § 10-402, it is a felony, punishable by up to five years in prison and a fine of up to $10,000, to intercept a wire, oral, or electronic communication unless the person intercepting it is a party to the communication and every other party has given prior consent.

That strict rule is a separate legal question from the employer-notice topic this cluster covers, and this article does not re-derive it. What matters for the workplace context is that an employer recording phone calls, meetings, or other communications in Maryland, not just silently observing them, needs all-party consent independent of any monitoring-notice analysis. See our guide to Maryland recording laws for the full consent framework, penalties, and exceptions, including the workplace-specific detail on recording calls and meetings.

Video Surveillance Limits: The Visual Surveillance Statute

Maryland Criminal Law § 3-901 makes it a misdemeanor to conduct, or procure another to conduct, visual surveillance of a person in a "private place" without that person's consent. The statute defines visual surveillance broadly, direct sight, mirrors, cameras, or an electronic device used to observe someone surreptitiously, but defines a private place narrowly as a dressing room or rest room in a retail store, not any location where a person might generally expect privacy from surveillance.

A violation carries up to 30 days in jail, a fine of up to $1,000, or both, and it is not a defense that the defendant owned the premises where the private place was located, a detail that matters directly for a retail employer, since owning the store does not license a hidden camera in the dressing room or restroom the statute covers. An individual placed under unlawful visual surveillance also has a civil cause of action for actual damages and reasonable attorney's fees. Maryland has not revised this statute in recent years; its 'private place' definition still covers only a dressing room or rest room in a retail store, so employers installing a camera in any other space employees use for changing, nursing, or personal hygiene should not assume the statute reaches it and should confirm current compliance with a Maryland attorney.

A Cautionary Example: The UMMS Keylogging Case

A class-action lawsuit filed in 2025 against the University of Maryland Medical System Corporation and the University of Maryland Medical Center illustrates what unchecked monitoring capability inside a workplace can do. Six current and former employees allege that a former UMMC pharmacist, Matthew Bathula, installed keylogging spyware on roughly 400 hospital workstations over nearly a decade, from 2016 to 2024, harvesting login credentials from about 80 coworkers. The lawsuit alleges he used those credentials to access coworkers' webcams and, in some instances, remotely activate home security cameras, including footage of new mothers pumping breast milk in closed treatment rooms at work. Bathula was later federally indicted.

This was unauthorized insider surveillance, not a sanctioned employer monitoring program, and it is not an example of Maryland's password or notice law being violated. It is a useful illustration of the negligent-supervision and negligent-security exposure an employer can face when it does not control who inside the organization can install monitoring software on company devices, a real-world reminder that a written monitoring policy is only as good as the access controls behind it.

GPS and Vehicle Tracking

Maryland has not enacted a dedicated statute requiring an employer to give notice before tracking a company vehicle, the way New Jersey has. Instead, Maryland addresses covert location tracking through its stalking law, Md. Code, Crim. Law § 3-802, which since a 2022 amendment expressly covers pursuing someone through a device that can pinpoint or track their location without consent. The statute carves out an exception for a "specific lawful commercial purpose," language that covers a business tracking vehicles it owns, lenders using GPS on financed vehicles, and telematics programs employees have agreed to. An employer tracking a company-owned vehicle generally fits within that exception; secretly tracking an employee's personal vehicle does not. For the fuller picture, including penalties and how Maryland's stalking law interacts with GPS trackers outside the employment context, see our guide to Maryland GPS tracking laws and the GPS Tracking Laws by State hub.

Biometric Monitoring: Time Clocks and Facial Recognition

Illinois' Biometric Information Privacy Act (BIPA), 740 ILCS 14, is the strongest biometric-privacy law in the country, requiring written consent before an employer collects a fingerprint or facial scan and creating a private right of action with statutory damages. Multiple trucking and logistics companies have paid multi-million-dollar BIPA settlements over driver-facing cameras and fingerprint time clocks used without the required consent. That specific regime is Illinois-only and does not extend to Maryland. A Maryland employer using biometric time clocks is not currently subject to a comparable state consent-and-damages statute, though general privacy-tort principles, and the visual surveillance statute discussed above where a biometric camera also captures images in a private place, can still apply depending on the facts.

Where to learn more

This guide focuses on the password, notice, and surveillance rules specific to the employment relationship in Maryland. For the state's two-party consent recording framework, see Maryland recording laws; for vehicle and device tracking outside the workplace, see Maryland GPS tracking laws; and for how other states handle notice, passwords, and surveillance, see the Employee Monitoring Laws by State hub.

Disclaimer

This article provides general legal information about Maryland employee-monitoring law as of July 9, 2026. It is not legal advice and does not create an attorney-client relationship. Laws change, and how a statute applies depends on specific facts. If you have questions about monitoring at your workplace, or believe your rights under Maryland law have been violated, consult a lawyer licensed in Maryland.

Related articles

• Maryland Recording Laws: Two-Party Consent
• Maryland GPS Tracking Laws
• Employee Monitoring Laws by State

---

Last updated: July 9, 2026. Statutes cited reflect their in-force version as of that date.

More Maryland Laws

• Maryland AI Meeting Recording Laws
• Maryland At-Will Employment Laws
• Maryland Data Privacy Laws
• Maryland GPS Tracking Laws
• Maryland Recording Laws
• Maryland Whistleblower Laws