Utah Employee Monitoring Laws: Workplace Surveillance and Social Media (2026)

Utah employers can generally monitor company email, phone lines, and computer systems under the federal wiretap law's business-use exception, and despite a persistent online misconception, Utah has not enacted a Connecticut- or New York-style monitoring notice statute. Utah's real, verified protection is narrower: the Internet Employment Privacy Act bars employers from demanding a personal social media password.

This article provides general legal information about Utah employee monitoring law as of July 9, 2026. It is not legal advice and does not create an attorney-client relationship. Consult a Utah-licensed attorney about your specific situation.

Scope: This article covers Utah law on an employer's authority to monitor employees, access personal social media, and conduct workplace video, GPS, and biometric monitoring. It does not re-derive Utah's general one-party consent recording rules (see our Utah recording laws guide) or GPS law generally outside the employment context (see our Utah GPS tracking laws guide).

The Federal Baseline: the "Ordinary Course of Business" Exception

Utah's starting point for any workplace monitoring question is federal, not state, law. Title I of the Electronic Communications Privacy Act makes it unlawful to intentionally intercept wire, oral, or electronic communications without consent (18 U.S.C. § 2511, part of the Title I scheme at sections 2510-2523), but the 'business extension' exemption in 18 U.S.C. section 2510(5)(a) excludes equipment an employer furnishes and uses in the ordinary course of its business, a category extended to the phone, email, and computer systems its staff use, from the Act's definition of a regulated interception device, letting employers intercept communications on that system in the ordinary course of business.

The leading case applying this exception is Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983): once a monitored call is determined to be personal rather than business-related, the employer's ordinary-course exception generally ends. Utah has not enacted a state monitoring statute that narrows or expands this federal baseline; state law fills the gap only in the areas covered below.

Does Utah Require Notice Before Electronic Monitoring?

No, and this is worth correcting directly. Several online compliance guides describe Utah as requiring an employer to give prior written notice of electronic monitoring at hiring, acknowledged by the employee and posted conspicuously. That description is not Utah law; it closely tracks New York's Civil Rights Law section 52-c and appears to conflate Utah's actual statute, the Internet Employment Privacy Act, with New York's unrelated monitoring-notice law. Utah's IEPA, covered below, restricts an employer's access to an employee's personal internet accounts. It does not require notice before an employer monitors devices or a network it owns.

A small group of states, Connecticut, Delaware, New York, and (starting in 2026) Maine, do require this kind of notice. Utah is not among them, so a Utah employer can generally monitor company email, internet use, and phone lines on employer-owned systems relying on the federal ordinary-course exception, without a state-mandated notice step.

Utah's Social Media Privacy Law for Employees

Utah's genuinely state-specific employee monitoring statute is the Internet Employment Privacy Act (IEPA), Utah Code section 34-48-201 et seq. Section 34-48-201 prohibits an employer from requesting that an employee or applicant disclose a username and password, or a password alone, that provides access to the individual's "personal Internet account," defined as an account used exclusively for personal communications unrelated to any business purpose of the employer. The statute's operative verb is "request" alone; unlike most sister-state password laws it does not separately list "require," a verb the neighboring exceptions provision at section 34-48-202 does use. The practical difference is slight, because an employer that requires disclosure has necessarily requested it. The statute also bars an employer from taking adverse action, failing to hire, or otherwise penalizing someone for declining to disclose that information.

Section 34-48-202 preserves specific employer rights: requiring credentials needed only to access a device or account the employer itself supplies, and using information available in the public domain or obtainable without the protected login credentials. Where Utah's law differs from Tennessee's comparable statute is enforcement. Under section 34-48-301, a person aggrieved by a violation may sue the employer directly, and a court that finds a violation must award the aggrieved person up to $500. The remedy is a flat, capped amount, not open-ended damages, but it is still a real private right of action that gives a Utah employee a usable path to court that several neighboring states' password laws lack.

Video and Audio Surveillance in Utah Workplaces

Utah undertook a substantial recodification of its criminal code effective May 7, 2025, and Utah's voyeurism offense, formerly a single section at 76-9-702.7, was split into three separate sections as part of it. Section 76-12-306, Voyeurism, covers viewing, or attempting to view, a person's body "with or without the use of an instrumentality," where the person has a reasonable expectation of privacy and has not consented, so long as the conduct does not amount to a violation of section 76-12-307. The dividing line between the two sections is recording, not aided versus unaided vision: watching through a camera, a lens, or a live feed falls under section 76-12-306 as long as nothing is recorded. It is a class B misdemeanor, elevated to a class A misdemeanor for certain aggravating circumstances, and carries no felony tier. Recording is covered separately, and more seriously, by section 76-12-307, Recorded or Photographed Voyeurism: secretly using a camera or other recording device to videotape or photograph a person's body without consent in a place where they have a reasonable expectation of privacy is a class A misdemeanor, elevated to a third-degree felony if the victim is under 14. Distributing the resulting images is its own, more serious offense under section 76-12-308, a third-degree felony that becomes a second-degree felony if the image is of a child under 14. An employer that installs a camera in a restroom, locker room, or changing area, even for loss-prevention reasons, risks prosecution under section 76-12-307 regardless of a posted monitoring policy, and an employer who live-monitors such a feed without recording it remains squarely within reach of section 76-12-306. Anyone relying on the pre-2025 section number, 76-9-702.7, or assuming section 76-12-306 reaches only unaided naked-eye viewing, is working from an outdated or incomplete citation.

Audio recording is governed separately by Utah's one-party consent rule under Utah Code section 77-23a-4, part of the Interception of Communications Act. A person who is a party to a communication, or who has a party's consent, may record it; intercepting one without being a party or consent is a third-degree felony carrying up to five years, with a civil remedy under section 77-23a-11. Our Utah workplace recording guide covers that consent question, including an employee's own right to record at work, in depth.

GPS and Vehicle Tracking of Utah Employees

Utah has not enacted a dedicated employer vehicle-tracking notice statute comparable to New Jersey's N.J. Stat. section 34:6B-22. The relevant general-purpose law, Unlawful Installation of a Tracking Device, was renumbered from section 76-9-408 to section 76-12-305 in the May 2025 recodification. It makes it a class A misdemeanor to knowingly install, or direct another to install, a tracking device on a motor vehicle owned or leased by another person without permission. Exceptions cover a licensed private investigator installing a device for a legitimate business purpose (subject to limits protecting individuals covered by a protective order and their family), installation under a court order, and a peace officer acting in an official investigation.

Utah's provision has three separate prongs. The vehicle-installation prong is built around the "vehicle owned or leased by another person" element: a Utah employer installing GPS tracking on a vehicle it owns outright is not tracking a vehicle owned by someone else, so that prong does not reach the scenario. The statute separately criminalizes placing a tracking device on an individual's person or personal property, and using a tracking application on a device in an individual's possession, without permission, regardless of vehicle ownership, so an employer tracking an employee through a personal device or location app still needs the employee's permission. The vehicle analysis changes for an employee's personal vehicle or one leased to someone other than the employer, where the owner's or lessee's consent becomes necessary. For the general framework, see our Utah GPS tracking laws guide.

Biometric Monitoring: Time Clocks and the Utah Consumer Privacy Act

Employers increasingly use fingerprint or facial-recognition time clocks. Illinois' Biometric Information Privacy Act, 740 ILCS 14, is the strongest law of this kind nationally, requiring written consent and creating a private right of action with statutory damages; it does not apply outside Illinois, and Utah has no equivalent.

Utah does have the Utah Consumer Privacy Act (UCPA), Utah Code section 13-61-101 et seq., effective December 31, 2023, which classifies biometric data as sensitive data when processed to identify a specific individual. Unlike Montana's or Tennessee's opt-in model, the UCPA uses an opt-out structure: a controller must give clear notice and an opportunity to opt out, rather than obtaining consent first. Either way, the protection does not reach the workplace. Section 13-61-101's "consumer" definition expressly excludes an individual acting in an employment or commercial context, so a fingerprint or face scan collected for a time clock falls outside the UCPA entirely, which is also enforced only by the Utah Attorney General with no private right of action. Utah employees rely mainly on employer policy and common-law privacy claims. See our Utah biometric privacy guide for how the consumer-facing rules work outside employment.

What Utah Employees Can Do About Monitoring Concerns

The right response depends on what happened. A demand for a social media password, or retaliation for refusing one, can support a civil suit for up to $500 under Utah Code section 34-48-301, a capped but real statutory remedy. A camera in a restroom or locker room can support both a law enforcement report under Utah's recorded-voyeurism statute, section 76-12-307, and a civil invasion-of-privacy claim. A wiretap violation supports a criminal complaint plus a civil suit under section 77-23a-11.

Because Utah recently renumbered many privacy-related statutes, confirm you are working from the current section number, not an older citation still circulating online. Monitoring tied to a protected characteristic or a workers' compensation claim may fall under the Utah Labor Commission or the NLRB instead. For the broader picture, see our Employee Monitoring Laws by State hub and our general US recording laws guide.

Disclaimer

This article provides general legal information about Utah employee monitoring law as of July 9, 2026. It is not a substitute for individualized legal advice. Employment monitoring disputes often involve overlapping statutes, employer policy, and federal law, and outcomes depend on specific facts. Readers should consult an attorney licensed in Utah for advice about a particular situation.

Related articles

• Employee Monitoring Laws by State
• Utah Recording Laws
• Utah Workplace Recording Laws
• Utah GPS Tracking Laws
• Utah Biometric Privacy Laws
• US Recording Laws by State

---

Last updated: July 9, 2026. Statutes cited reflect their in-force version as of that date.

More Utah Laws

• Utah AI Meeting Recording Laws
• Utah At-Will Employment Laws
• Utah Data Privacy Laws
• Utah GPS Tracking Laws
• Utah Recording Laws
• Utah Whistleblower Laws

Frequently Asked Questions

Can my employer read my work email in Utah?

Generally yes, once the email is on an employer-owned system. Utah has no state notice statute, so employers typically rely on the federal ordinary-course-of-business exception in 18 U.S.C. section 2510(5)(a) to review company email and internet use.

Can my employer ask for my Instagram or Facebook password in Utah?

No, not for a personal account. The Utah Internet Employment Privacy Act, Utah Code section 34-48-201, prohibits requesting a personal social media password, subject to narrow exceptions for employer-supplied devices and accounts.

Does Utah law require my employer to tell me I'm being monitored?

No. Some online sources incorrectly describe Utah as requiring written notice of monitoring at hiring; that description matches New York's law, not Utah's. Utah has not enacted a general electronic-monitoring notice statute.

Can my employer GPS track a company vehicle I drive in Utah?

Generally yes for the vehicle itself, if the company owns it. Utah Code section 76-12-305 (formerly 76-9-408) criminalizes installing a tracker on a vehicle owned or leased by someone else, so a vehicle the employer owns outright falls outside that prong. The same statute separately reaches placing a tracking device on a person or their personal property, or using a tracking application on a device in someone's possession, without permission, so tracking an employee through a personal phone or app is a different question.

Can my employer put a camera in a Utah workplace restroom or locker room?

No. Utah's recorded-voyeurism statute, Utah Code section 76-12-307 (part of the same 2025 recodification that replaced former section 76-9-702.7), prohibits secretly using a camera or other recording device to videotape or photograph someone without consent in a place where they have a reasonable expectation of privacy.

Can my Utah employer require a fingerprint scan for the time clock?

There is no Illinois-style biometric consent statute in Utah, and the Utah Consumer Privacy Act excludes employment-context data from its 'consumer' definition. Employees generally rely on employer policy and common-law privacy claims rather than a dedicated biometric statute.

What can I do if my Utah employer violates the social media password law?

An employee or applicant can sue under Utah Code section 34-48-301 and recover up to $500. The remedy is capped at that flat amount, but it is a real private right of action, which is more than some states' comparable laws provide.

Did any Utah privacy or surveillance statute numbers change recently?

Yes. A May 7, 2025 recodification of Utah's criminal code renumbered several relevant statutes, including the tracking-device law (76-9-408 to 76-12-305) and the voyeurism law, which was split from former section 76-9-702.7 into three new sections: 76-12-306 (viewing without recording), 76-12-307 (recording or photographing), and 76-12-308 (distributing the images). Older sources may still cite the previous single section number.