Can an Employer Record Conversations Without Consent? (2026)

Can an Employer Record Conversations Without Consent? (2026)

Whether your employer can legally record you depends on two stacked legal questions: which state's recording-consent rules apply, and whether any separate employer-monitoring notice statute also governs. Federal law (18 U.S.C. § 2511) sets a one-party consent floor; 12 states require all-party consent for at least some private conversations; and Connecticut, Delaware, and New York separately mandate written pre-monitoring disclosure.

Information last verified on August 3, 2026. This article has not yet been reviewed by a licensed lawyer.

Jurisdiction scope: This article addresses employer recording of employees under federal law (Electronic Communications Privacy Act, 18 U.S.C. §§ 2510-2522; Stored Communications Act, 18 U.S.C. §§ 2701-2712; National Labor Relations Act, 29 U.S.C. §§ 151-169) and the laws of all 50 US states, with detailed treatment of Connecticut, Delaware, New York, California, Florida, Nevada, Oregon, Pennsylvania, and Washington. It does not address Canadian recording law, court-authorized law enforcement wiretaps, or the employee-side right to record employers for Section 7-protected purposes (covered in the US recording laws parent hub). It covers the employer-to-employee direction of monitoring only.

---

The short answer: it depends on state law and the type of recording

In the 38 states and the District of Columbia that follow one-party consent, an employer-manager who is a participant in a conversation may record it without notifying the other parties. That authorization comes from the federal baseline in 18 U.S.C. § 2511(2)(d) and the parallel state statutes that track it. But an employer who places a hidden recorder in a room to capture conversations it is not participating in commits federal wiretapping, whatever the state consent rule says, wherever the recorded conversation carries a reasonable expectation of privacy under 18 U.S.C. § 2510(2). In the 12 all-party consent states (California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington), every participant's consent is required before recording begins. Several states split the rule by communication type rather than applying it across the board, so a manager in Nevada may lawfully record an in-person meeting yet break the law by recording the same conversation over the phone. Three states add a separate layer: Connecticut under Conn. Gen. Stat. § 31-48d, Delaware under Del. Code tit. 19, § 705, and New York under N.Y. Civ. Rights Law § 52-c require advance written notice to employees before any electronic monitoring, regardless of the recording-consent baseline. Video-only surveillance with no audio capture follows different rules and is broadly permitted in common work areas nationwide. No employer, anywhere, may install audio or video recording equipment in bathrooms, locker rooms, or changing areas: that is a crime in every state.

---

Federal law: ECPA, the business-purpose exception, and the Wiretap Act

What ECPA says about employer monitoring

The Electronic Communications Privacy Act of 1986 (ECPA), codified at 18 U.S.C. §§ 2510-2522, is the foundational federal statute for all private recording analysis, including employer monitoring. Title I, the Wiretap Act, prohibits the intentional interception of any wire, oral, or electronic communication. The definition of "oral communication" at 18 U.S.C. § 2510(2) covers only utterances made under circumstances justifying a reasonable expectation of privacy, anchoring the statute in the constitutional framework the Supreme Court established in Katz v. United States, 389 U.S. 347 (1967). For employers, two exceptions dominate the analysis: the business-purpose (ordinary course of business) exception and the consent exception. Both are tools that permit monitoring when properly used; neither is unlimited. A third federal statute, the Stored Communications Act at 18 U.S.C. §§ 2701-2712, governs access to stored emails, chat logs, and cloud files, and applies a separate analytical framework addressed below.

The business-purpose (ordinary course of business) exception: 18 U.S.C. § 2510(5)(a)(i)

The ordinary-course-of-business exception at 18 U.S.C. § 2510(5)(a)(i) excludes from the definition of an "intercept device" any telephone or telegraph instrument, equipment, or facility furnished to the subscriber in the ordinary course of business by a communications service provider. Courts interpret this to mean that an employer using its own telephone system to monitor calls for legitimate business purposes (quality assurance on a call-center line, training, or regulatory compliance) is not using a prohibited interception device within the statute's meaning. The key limiting word is "legitimate": courts require a nexus between the monitoring and a genuine business need. Once the personal nature of a call becomes apparent, the employer must stop monitoring immediately.

A recent district court decision shows how the exception is being applied to AI-enabled phone systems, though it arose outside the employment context. In Lisota v. Heartland Dental, LLC and RingCentral, Inc., No. 25-cv-7518 (N.D. Ill. Jan. 13, 2026), the plaintiff was a caller to a dental practice's call center, not an employee, and she sued over the recording and AI analysis of her own calls. The court granted the motions to dismiss, holding that AI-powered transcription and call analytics fall within the ordinary-course-of-business exception where the AI functionality is integral to the provider's core communications service rather than an add-on. Read the case for what it is: a pleadings-stage ruling by one district court, about a consumer caller, that does not bind any other court and does not directly decide whether employer-to-employee call monitoring survives ECPA.

The consent exception: 18 U.S.C. § 2511(2)(c) and (d)

The consent exception at 18 U.S.C. § 2511(2)(c) and (d) authorizes interception when one party to the communication has given prior consent and the interception is not for a criminal or tortious purpose. In a one-party consent jurisdiction, the employer-manager's own participation in the conversation satisfies this requirement: the manager is a party and has consented to the recording by making it. In all-party consent states, the consent exception requires that every party has given prior consent before the employer can lawfully record. Employee handbooks, onboarding acknowledgment forms, or call-center scripts that state "this call may be recorded for quality and training purposes" satisfy prior consent for the relevant parties. The consent must be prior: retroactive consent does not cure an unlawful interception under ECPA.

The Stored Communications Act: 18 U.S.C. §§ 2701-2712

The Stored Communications Act (SCA) at 18 U.S.C. §§ 2701-2712 governs data at rest: emails in inboxes, stored chat logs, completed call recordings, and cloud-hosted files. An employer that operates its own email servers qualifies as the "electronic communications service" provider under § 2701(a) and may access stored communications on those systems without violating the SCA. This service-provider exception is well-established. What the SCA does prohibit, however, is employer access to an employee's personal Gmail, iCloud, or social-media accounts without authorization: the employer is not the service provider for those platforms, so the exception does not apply. Accessing a personal account without the employee's consent is a federal crime under § 2701(a). The penalty structure at § 2701(b) escalates on two axes at once. A basic violation carries up to one year imprisonment for a first offense and up to five years for an offense committed after a prior conviction under the section. Where the access is committed for commercial advantage, malicious destruction or damage, private commercial gain, or in furtherance of any criminal or tortious act, the maximum is five years for a first offense and ten years for a repeat offense.

---

State employer-monitoring notice statutes: Connecticut, Delaware, New York, and beyond

Three states have enacted employer-specific electronic monitoring notice statutes that operate independently of the recording-consent regime. These statutes do not simply define when recording is lawful: they require advance written disclosure of the employer's monitoring practices before any monitoring begins. Compliance is mandatory; violation triggers civil penalties regardless of whether the underlying monitoring was otherwise lawful. These statutes are a separate legal layer that stacks on top of the state recording-consent rules described in the next section.

Connecticut (Conn. Gen. Stat. § 31-48d). Connecticut requires each employer that engages in any type of electronic monitoring to give prior written notice to all employees who may be affected, informing them of the types of monitoring that may occur, and to post that notice conspicuously where employees can read it. The statute defines "electronic monitoring" as the collection of information on the employer's premises concerning employees' activities or communications by any means other than direct observation, expressly including computers, telephones, cameras, and electromagnetic or photo-optical systems. Two carve-outs sit inside the definition: information collected for security purposes in common areas held out for public use, and collection already prohibited by state or federal law. The notice requirement also yields where the employer has reasonable grounds to believe employees are engaged in conduct that violates the law, violates the legal rights of the employer or other employees, or creates a hostile workplace environment, and monitoring may produce evidence of that misconduct. Connecticut courts have held there is no private cause of action under the section. Connecticut also sits among the 12 all-party consent states because Conn. Gen. Stat. § 52-570d creates a civil action for recording a private telephonic communication unless one of three conditions is met: prior consent of all parties obtained in writing or captured at the start of the recording, a verbal notification recorded at the beginning of the call, or an automatic tone warning repeated about every fifteen seconds. A recorded call-center announcement therefore satisfies Connecticut's phone rule, which is why the compliance answer here is procedural rather than a flat prohibition. Connecticut's criminal eavesdropping statutes reach non-participants rather than a participant recording their own call. See Connecticut workplace recording laws for the full framework.

Delaware (Del. Code tit. 19, § 705). Delaware's monitoring notice statute covers telephone conversations and transmissions, electronic mail and transmissions, and internet access and usage. Employers must either provide daily electronic notice each time the employee accesses employer-provided email or internet services, or give a one-time written or electronic notice that the employee acknowledges. A system-management exemption exists for processes performed solely for maintenance and protection of the email or internet system and not targeted at monitoring or intercepting an individual's communications, and the notice requirement does not apply to law-enforcement activity conducted under a court order. The $100 per violation penalty is the weakest deterrent of the three state statutes; compliance cost is minimal relative to litigation exposure. Separately, Del. Code tit. 11, § 1335(a)(4) makes it a class A misdemeanor to intercept a private conversation or telephone call without the consent of all parties, which is why Delaware appears in the all-party consent states group.

New York (N.Y. Civ. Rights Law § 52-c). New York's statute, signed November 8, 2021, and effective May 7, 2022, requires employers to give prior written notice to all employees subject to monitoring at the time of hiring. Employers must obtain a written or electronic acknowledgment from each employee, and must conspicuously post the notice in the workplace. The required notice content states that telephone conversations or transmissions, electronic mail or transmissions, and internet access or usage may be subject to monitoring at any and all times by any lawful means. The statute defines "employer" as any individual, corporation, partnership, firm, or association with a place of business in the state, and expressly excludes the state and its political subdivisions. Its exemption for automated processes covers systems that manage the type or volume of communications solely for computer system maintenance or protection and are not targeted at an individual's usage. The Attorney General enforces the section. New York is a one-party consent state for recording purposes under the federal baseline, which means the § 52-c notice obligation applies even though the underlying recording does not itself require all-party consent.

Colorado (Colo. Rev. Stat. § 6-1-1301 et seq., as amended). Colorado does not have a general employer electronic monitoring notice statute comparable to Connecticut, Delaware, or New York. H.B. 24-1130, "Privacy of Biometric Identifiers and Data," was approved May 31, 2024 and took effect July 1, 2025. It amended the Colorado Privacy Act to bar a controller from collecting a biometric identifier without first satisfying disclosure and consent requirements, to require a written retention, deletion, and incident-response policy, and specifically to restrict an employer's permissible reasons for seeking an employee's consent to biometric collection. Employers relying on fingerprints, facial recognition, or voiceprints should read the enacted bill for the exact list of permitted purposes rather than assume any given use qualifies. A companion measure, H.B. 24-1058, "Protect Privacy of Biological Data," was approved April 17, 2024 and took effect August 7, 2024; it expands the Colorado Privacy Act's definition of sensitive data to include biological and neural data, which reaches wearable and neurotechnology monitoring products marketed to employers. Colorado's scope remains narrower than the three-state notice framework: it governs biometric and biological data, not general electronic monitoring.

---

Recording-consent rules layered on top: 12 all-party states, 38 one-party states

The employer-monitoring notice statutes above tell you what written disclosure an employer must give before monitoring. The state recording-consent regime tells you whether the recording itself is lawful without all parties' consent. These are two separate legal layers, and both apply simultaneously. An employer in Connecticut must both post a § 31-48d monitoring notice and satisfy one of the three routes to lawful call recording under Conn. Gen. Stat. § 52-570d. An employer in New York must post a § 52-c notice even though New York follows one-party consent and the recording itself requires no employee agreement beyond the manager's own participation. California employers face the strictest recording-consent obligation under Cal. Penal Code § 632 (all-party consent for all confidential communications), but California has no separate employer-monitoring notice statute comparable to the three-state framework.

Across the country the split is 12 all-party consent states against 38 one-party consent states plus the District of Columbia. The 12 are California, Connecticut, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Oregon, Pennsylvania, and Washington. You will see other counts published, and they usually differ because of a handful of states whose rules split by communication type rather than applying one standard to everything.

Four of those states matter to employers directly:

• Oregon requires that all participants in an in-person conversation be specifically informed that it is being recorded (ORS 165.540(1)(c)), but permits interception of a telecommunication with the consent of at least one participant (ORS 165.540(1)(a)). An Oregon manager may lawfully record their own phone call and still break the law recording the same discussion in a conference room.
• Connecticut runs the other way. Conn. Gen. Stat. § 52-570d creates a civil action for recording a private telephonic communication unless all parties consented in writing or on the recording, a verbal notification was recorded at the start, or an automatic tone warning sounded at roughly fifteen-second intervals. The criminal eavesdropping provisions reach non-participants rather than a participant recording their own in-person conversation.
• Nevada is grouped with the one-party states but behaves like Connecticut on the phone. NRS 200.650 bars surreptitious use of a listening device on a private in-person conversation "unless authorized to do so by one of the persons engaging in the conversation," which is one-party consent. NRS 200.620(1) is drafted differently: it permits interception of a wire communication only where one party gave prior consent and an emergency made it impractical to obtain a court order first, two conditions joined by "and" rather than offered as alternatives. In Lane v. Allstate Insurance Co., 114 Nev. 1176, 969 P.2d 938 (1998), the Nevada Supreme Court read that conjunction, alongside the unconditional one-participant clause the Legislature wrote into NRS 200.650, as prohibiting the taping of a telephone conversation on one party's consent alone. Violations are a category D felony, and NRS 200.690 gives the recorded party actual or liquidated damages of $100 per day of violation with a $1,000 floor, plus punitive damages and attorney fees.
• Michigan is the closest call. Mich. Comp. Laws § 750.539c is written as an all-party rule, making it a felony to use a device to eavesdrop on a private conversation "without the consent of all parties thereto." Michigan courts have read a participant exception into it since Sullivan v. Gray, 117 Mich. App. 476, 324 N.W.2d 58 (1982), so a participant may record their own conversation. Michigan therefore sits in the one-party column on this site.

For the complete state-by-state breakdown, see the US recording laws parent hub and the all-party consent states guide.

---

NLRA limits on employer recording: when surveillance violates Section 7

Stericycle, Inc. (372 NLRB No. 113, 2023): the current work-rules standard

The NLRB in Stericycle, Inc., 372 NLRB No. 113 (2023), replaced the employer-favorable Boeing categorical standard with a more protective test. Under Stericycle, a facially neutral workplace rule is presumptively unlawful if it has "a reasonable tendency to chill employees from exercising their Section 7 rights" under the National Labor Relations Act. The employer may rebut the presumption by showing the rule advances a legitimate and substantial business interest that cannot be served by a more narrowly tailored rule. Applied to employer recording policies, this means a blanket prohibition on all employee recording in all locations at all times is presumptively unlawful: the employer must narrow the prohibition to specific spaces or contexts where a legitimate confidentiality interest exists. Stericycle is the governing Board standard as of the date this article was last verified, though the composition of the NLRB has shifted under the current administration and the standard may be subject to future revision. Only the Board can change it.

NLRB General Counsel Abruzzo Memo GC 23-02 on Electronic Surveillance (Oct. 31, 2022), rescinded February 14, 2025

General Counsel Jennifer Abruzzo's October 31, 2022 memo, GC Memorandum 23-02, available at the NLRB website, identified specific employer monitoring technologies that may violate Section 7: wearable devices, GPS tracking, RFID badges, keyloggers, screenshot and webcam monitoring software, and systems that automatically discipline workers based on productivity metrics. GC Abruzzo announced her intent to urge the Board to adopt a presumptive-violation framework when an employer's surveillance and management practices, viewed as a whole, would tend to interfere with protected activity. Under the framework she proposed, an employer would have had to disclose the monitoring technologies it used, the reasons for their use, and how the collected data was used, unless special circumstances justified covert monitoring. Read that memo as history, not as current guidance. GC Memorandum 23-02 was rescinded by Acting General Counsel William B. Cowen in GC Memo 25-05 on February 14, 2025, so it no longer states the Office of the General Counsel's enforcement position. What survives is its inventory of the monitoring technologies a General Counsel has identified as potentially unlawful under Section 7 analysis, which is still a useful checklist for an employer auditing its own tooling. The presumptive-violation framework it proposed was never adopted by the Board, and no Board precedent changed when the memo was withdrawn.

NLRB GC Memo GC 25-05: housekeeping rescission of Abruzzo-era enforcement memos (February 14, 2025)

On February 14, 2025, Acting General Counsel William B. Cowen issued GC Memorandum 25-05 rescinding a number of General Counsel memoranda issued during the Abruzzo era, including GC 23-02, the October 31, 2022 electronic-monitoring memo discussed above. The rescission is a housekeeping move that narrows the Office of the General Counsel's prosecutorial priorities. It is NOT a Boeing-era reinstatement, and it does NOT overrule any Board precedent. Stericycle, Inc., 372 NLRB No. 113 (Aug. 2, 2023), remains the controlling Board standard for evaluating workplace recording rules. Only the Board itself, not a General Counsel memorandum, can overrule Stericycle. Employers analyzing no-recording policies should continue to apply the Stericycle presumptively-unlawful framework until and unless the Board reaches a contrary decision.

NLRB Acting GC Memo GC 25-07: surreptitious bargaining recordings as per se violations (June 25, 2025)

Acting General Counsel William B. Cowen issued GC Memorandum 25-07 on June 25, 2025, taking the position that a party who secretly records a collective-bargaining session commits a per se violation of the NLRA. GC Cowen's memo, available at the NLRB website, directs NLRB regional offices to file complaint alleging a duty-to-bargain-in-good-faith violation under NLRA Sections 8(a)(5) and 8(b)(3) whenever an investigation reveals that any party (employer or union) surreptitiously recorded a bargaining session. The rationale stated in the memo is that "the use of surreptitious recordings during the collective-bargaining process is inconsistent with the openness and mutual trust necessary for the process to function as contemplated by the Act." GC Memo 25-07 is enforcement guidance directing regional enforcement, not a Board decision. It is persuasive authority for understanding current NLRB enforcement priorities but is not binding precedent.

NLRA enforcement in practice: the Apple Inc. case (NLRB Case No. 02-CA-295979)

The NLRB filed complaint against Apple Inc. in Case No. 02-CA-295979 alleging that Apple coercively interrogated an employee about union support and removed union literature from a break room. The Board, adopting the ALJ's findings, concluded that Apple violated Section 8(a)(1) on both counts.

The Fifth Circuit reversed both findings. In Apple Inc. v. NLRB, No. 24-60242 (5th Cir. July 7, 2025), the court granted Apple's petition for review and wrote that it reversed "because substantial evidence does not support either finding." On the interrogation count, the court found the manager's sales-floor conversation was routine and unaccompanied by hostility or threats of reprisal. On the literature count, the court rested on Apple's "evenhanded enforcement" of its facially neutral housekeeping and non-solicitation policies, pointing to a record showing that the company removed all unattended written materials regardless of content, and declined "to extend federal labor law to prohibit the evenhanded enforcement of facially neutral housekeeping and non-solicitation policies."

Two cautions for readers. The case is a reminder that overbroad or selectively enforced workplace rules remain exposed under the Stericycle standard, because it was even-handedness that saved Apple's policy. But the allegations concerned interrogation and union-literature removal, not a monitoring or recording policy. This case should not be characterized as a ruling on employer monitoring practices, and a Fifth Circuit holding binds only Louisiana, Mississippi, and Texas.

---

Scenario-by-scenario analysis: what is and is not permitted

Recording disciplinary meetings

Disciplinary meetings (performance improvement plans, termination notices, harassment investigations) are among the most legally fraught workplace recording scenarios. In one-party consent states, the employer-manager who attends the meeting as a participant may record it without informing the employee. In all-party consent states, the employer must inform the employee before recording begins. Two of the 12 need a closer read for an in-person meeting: Oregon squarely requires that every participant be specifically informed under ORS 165.540(1)(c), while Connecticut's all-party rule under § 52-570d is a telephone-recording statute and does not reach a face-to-face conversation. From the employee's side: in one-party states, the employee may also record the meeting without telling the manager. In all-party states, the employee may not record without consent either. The NLRA overlay here is important: in Weingarten situations (union employees' right under NLRB v. J. Weingarten, Inc., 420 U.S. 251 (1975) to a representative during investigatory interviews that may lead to discipline), an employer practice of covertly recording Weingarten meetings may constitute an unfair labor practice even in a one-party consent state, because the covert surveillance could have a reasonable tendency to chill protected concerted activity under the Stericycle standard.

Phone call monitoring: call centers and business lines

Under the ECPA ordinary-course-of-business exception at 18 U.S.C. § 2510(5)(a)(i), an employer operating its own phone system may monitor calls on business lines for legitimate business purposes: quality assurance, training, and regulatory compliance are the clearest examples. The obligation to stop monitoring once a call is identified as personal is well-established doctrine, grounded in the definition of "oral communication" and the reasonable-expectation-of-privacy framework from Katz v. United States, 389 U.S. 347 (1967). All-party state employers (California, Florida, and others) must obtain advance employee consent through signed employment agreements or use a recorded announcement on every call in addition to the ECPA business-purpose authorization.

Nevada deserves its own line in any multi-state call-monitoring policy, because a compliance team that files it under "one-party consent" will get the phone rule backwards. Nevada is one-party for in-person conversations under NRS 200.650, but NRS 200.620(1) permits interception of a wire communication only where one party consented and an emergency made a court order impractical, and Lane v. Allstate Insurance Co., 114 Nev. 1176, 969 P.2d 938 (1998), read that conjunction as barring the taping of a phone call on one party's consent alone. A Nevada call center therefore needs consent from every participant, employees included, and the exposure is criminal as well as civil: a category D felony under NRS 200.690, plus liquidated damages of $100 per day of violation with a $1,000 minimum, punitive damages, and attorney fees.

The "this call may be recorded" announcement satisfies consent for external callers but does not substitute for employee consent in states requiring all-party consent for internal communications. Connecticut, Delaware, and New York employers must additionally comply with their state monitoring notice statutes regardless of whether the recording itself requires all-party consent.

Video surveillance: cameras in the workplace

Video-only surveillance with no audio capture is not governed by the Wiretap Act and is broadly lawful in employer-controlled workplaces. No federal statute prohibits video cameras in workplace common areas, hallways, entrances, or production floors. The NLRB's position is that video surveillance directed at protected concerted activity (employees discussing wages, organizing, or filing complaints) may violate Section 7 if the surveillance is targeted, discriminatory, or conducted in a manner that would have a reasonable tendency to chill protected activity under the Stericycle standard.

Notice obligations for video are narrower than for other monitoring, and it is worth being precise about which statute does what. Connecticut's § 31-48d definition of electronic monitoring expressly names cameras and photo-optical systems, so a Connecticut employer's posted notice must cover workplace video. Delaware's § 705 and New York's § 52-c, by contrast, are written around telephone, email, and internet monitoring and do not name video. New York regulates workplace video through a different statute: Labor Law § 203-c bars an employer from causing a video recording of an employee in a restroom, locker room, or room designated for changing clothes unless authorized by court order, and gives the employee damages, attorney fees, and injunctive relief. No employer in any state may place cameras in bathrooms, locker rooms, or changing areas: state voyeurism statutes universally prohibit this, and criminal penalties apply.

Email monitoring and computer use surveillance

Employer access to email on company servers falls under the SCA service-provider exception at 18 U.S.C. § 2701(a): the employer, as the provider of the email infrastructure, may access stored communications on those servers without violating the statute. Monitoring keystroke logging, browser history, and screenshots on company-owned devices is broadly lawful under this framework, subject to state electronic monitoring notice obligations in Connecticut, Delaware, and New York. Personal email accounts (Gmail, personal Outlook) accessed via a company laptop are protected by the SCA even when accessed on company equipment: the employer is not the service provider for those platforms. Accessing an employee's personal account without authorization, even on a company device, is a federal crime under § 2701(a).

BYOD (bring your own device) monitoring

BYOD creates the sharpest employer monitoring ambiguity. Employers cannot lawfully monitor personal texts, personal call logs, or personal social media on an employee's personal device without explicit consent set out in a signed BYOD agreement. Mobile Device Management (MDM) software that creates a separate work container on the device, walling off personal data from employer access, is the legally defensible technical architecture. Even with a valid MDM agreement, monitoring must be narrowly tailored to work-related data within the work container.

The state notice statutes reach BYOD unevenly, so read them before assuming a single disclosure covers everything. Delaware's § 705 and New York's § 52-c are keyed to the communication type (telephone, email, internet) rather than to who owns the hardware, so employer-provisioned email and internet access on a personal phone falls within them. Connecticut's § 31-48d is drafted around collection of information "on the employer's premises," which makes its application to a personal device used off-site less clear-cut; a Connecticut employer should treat notice as the safe course rather than assume the statute stops at the property line. Colorado requires consent before collecting biometric identifiers under H.B. 24-1130, which reaches fingerprint or face unlock used for secure access on any device.

Bathrooms, locker rooms, and private spaces: universally prohibited

Installing audio or video recording equipment in bathrooms, locker rooms, changing areas, or nursing rooms is illegal in every state under state voyeurism and privacy statutes. New York Labor Law § 203-c explicitly prohibits employer video recording in restrooms, locker rooms, and employer-designated changing rooms absent a court order. Federal courts recognize an absolute reasonable expectation of privacy in spaces designed for bodily functions, personal care, or changing clothes, and no employer-employee relationship alters that expectation. California Penal Code § 647(j)(3)(A) makes it a misdemeanor to use a concealed camera to secretly record another identifiable person who may be in a state of full or partial undress, for the purpose of viewing the body of, or the undergarments worn by, that person, without that person's consent or knowledge, inside a bedroom, bathroom, changing room, fitting room, dressing room, or tanning booth or any other area where that person has a reasonable expectation of privacy, and with the intent to invade that person's privacy. Note what that means in practice: no employer policy, employment agreement, or business purpose makes such a recording lawful, and an employee cannot be required to consent to it as a condition of the job. The business-purpose exception at 18 U.S.C. § 2510(5)(a)(i) has no application here. The only authorization New York's Labor Law § 203-c recognizes is a court order, which is something an employer must persuade a judge to issue, not a permission it can write into a handbook.

Off-the-clock and remote-work monitoring

Employer monitoring rights extend to employer-provided devices even after working hours. If an employer issues a company phone or laptop, the employer generally retains monitoring rights over business communications on that device under its device-use policy, subject to the state monitoring notice obligations. Tracking an employee's GPS location via a personal device after work hours, accessing personal social media accounts off the clock, or intercepting personal communications at home falls outside legitimate employer monitoring and carries significant civil and criminal liability under both ECPA and the SCA. For remote workers, the home-office environment introduces additional complexity: a video call through a company platform on a company device is within the ordinary-course-of-business framework; a hidden monitoring application on a personal device used in a private home is not.

---

Recent developments: Stericycle, GC 25-07 on bargaining recordings, and AI call analytics under ECPA

The employer recording landscape changed on three significant fronts between 2023 and 2026.

First, Stericycle (372 NLRB No. 113, 2023) shifted the baseline for workplace rules analysis: blanket no-recording policies are presumptively unlawful under NLRA analysis, and employers must narrowly tailor those policies to specific legitimate interests. The Stericycle standard may itself be subject to revision given the change in NLRB leadership, but it remains the governing Board standard as of the verification date of this article, and only the Board can displace it.

Second, GC Memo 25-07 (June 25, 2025) created a per se NLRA violation category for surreptitious recording of collective-bargaining sessions. Both employers and unions must now treat covert bargaining recordings as conduct the NLRB will pursue as a duty-to-bargain violation under NLRA Sections 8(a)(5) and 8(b)(3).

Third, federal courts began addressing AI-powered monitoring tools. In Lisota v. Heartland Dental, LLC and RingCentral, Inc., No. 25-cv-7518 (N.D. Ill. Jan. 13, 2026), the court applied the ECPA ordinary-course exception to AI call-analytics functionality embedded in a business communications platform, reasoning that transcription and sentiment analysis built into the platform were integral to the core telecommunications service rather than add-on interception devices. Two limits matter before anyone treats Lisota as a green light for employee monitoring. The plaintiff was a consumer caller to a dental practice's call center rather than an employee, so the decision does not squarely address employer-to-employee monitoring. And it is a pleadings-stage ruling from a single district court, which binds no other court. Employers deploying standalone AI transcription tools bolted onto existing phone infrastructure should analyze independently whether those tools qualify as the employer's own telephone equipment used in the ordinary course of business, and should not assume a favorable answer.

---

Private workspaces vs. open-plan offices: reasonable expectation of privacy

The concept of "reasonable expectation of privacy" from Katz v. United States, 389 U.S. 347 (1967), underlies both Fourth Amendment doctrine and the civil-law framework for employer monitoring under ECPA. In a workplace context, courts have generally held that employees retain a lower expectation of privacy in shared work areas, on company-owned devices, and in employer-provided email systems, but a heightened expectation in private offices (particularly for confidential professional conversations), on personal devices, and in any space designed for bodily functions or personal care. The analysis is fact-specific and jurisdiction-sensitive. A private-walled office where an employee regularly holds confidential discussions likely meets the subjective and objective tests from Katz; a cubicle in an open-plan floor where conversations are audible to co-workers likely does not. The Katz framework intersects with ECPA's definition of "oral communication" at 18 U.S.C. § 2510(2): only utterances "uttered by a person exhibiting an expectation that such communication is not subject to interception under circumstances justifying such expectation" are protected. An overheard conversation in a crowded break room may not meet this threshold; a closed-door meeting in a conference room almost certainly does.

The voyeurism overlay operates independently: even where a reasonable expectation of privacy exists, consent or notice can satisfy recording-consent laws, but no employer policy or employment agreement authorizes the installation of recording devices in inherently private spaces. There is no employee waiver an employer can require that makes bathroom recording lawful.

---

What employees should know: your rights when your employer records you

Employees have several distinct categories of rights in employer monitoring situations. First, in Connecticut, Delaware, and New York, employees are legally entitled to receive written notice of monitoring practices before monitoring begins. Failure to provide that notice violates the applicable state statute and triggers civil penalties against the employer. Note who collects those penalties: Connecticut's Labor Commissioner and New York's Attorney General enforce their statutes, and Connecticut courts have held the section creates no private cause of action, so an employee's practical remedy is a complaint to the agency rather than a lawsuit.

Second, under the NLRA, an employer's blanket prohibition on all recording in all locations cannot lawfully prevent employees from recording workplace conditions to document safety violations, wage theft, or union organizing activity: that recording is protected concerted activity under Section 7, and a rule that would prohibit it is presumptively unlawful under Stericycle. Third, employees are not entitled to compel disclosure of an employer's recordings in most states outside of litigation or administrative proceedings, but those recordings are generally discoverable in employment disputes, discrimination claims, or NLRB proceedings once litigation commences. Fourth, the prohibition on bathroom and locker-room surveillance cannot be waived by employer policy, by an employment agreement, or by a consent an employer requires as a condition of the job. An employer policy purporting to authorize that surveillance is void. Fifth, even on a company-issued laptop, personal email and social media accounts accessed on third-party platforms (Gmail, WhatsApp, personal iCloud) are protected from employer access by the SCA at 18 U.S.C. § 2701. Sixth, where a covert recording violates a state recording-consent statute, the recorded party often has a private right of action for civil damages: California Penal Code § 637.2 ($5,000 per violation or three times actual damages), Nevada's NRS 200.690 ($100 per day of violation or $1,000, whichever is greater, plus punitive damages and attorney fees), and the federal civil remedy under 18 U.S.C. § 2520 ($10,000 minimum, plus punitive damages and attorney's fees) all provide standing to sue.

One practical caution before you act on any of this. Recording your own employer can be lawful under state law and still cost you your job, because at-will employment lets an employer terminate for violating a no-recording policy in situations that are not Section 7-protected. Confirming that a recording is legal is a different question from confirming it is safe, and the two answers are frequently not the same.

---

Penalties for unlawful employer monitoring

Federal and state law each provide separate penalty tracks for unlawful employer monitoring. The penalties stack: a California employer that covertly records employees on a business line without consent faces federal civil and criminal exposure under ECPA plus state civil and criminal exposure under Cal. Penal Code §§ 632 and 637.2.

Federal criminal penalties under 18 U.S.C. § 2511(4)(a). Unlawful interception of wire, oral, or electronic communications carries up to five years imprisonment and a fine under 18 U.S.C. § 3571. These criminal penalties apply to willful violations and are pursued by federal prosecutors, not private parties.

Federal civil damages under 18 U.S.C. § 2520. Any person whose communications are unlawfully intercepted has a private right of action for the greater of actual damages or $100 per day for each day of violation, with a minimum recovery of $10,000. Punitive damages and reasonable attorney's fees are available in addition. Employees can sue the employer directly under § 2520 without waiting for criminal prosecution.

Stored Communications Act penalties under 18 U.S.C. § 2701(b). A basic violation carries up to one year imprisonment for a first offense and up to five years for an offense committed after a prior conviction under the section. Where the offense is committed for commercial advantage, malicious destruction or damage, private commercial gain, or in furtherance of any criminal or tortious act, the maximum rises to five years for a first offense and ten years for a repeat offense.

Connecticut § 31-48d. Civil penalties of up to $500 for a first offense, $1,000 for a second, and $3,000 for a third and each subsequent offense, levied by the Labor Commissioner after a hearing. No private right of action.

Delaware § 705. Civil penalty of $100 per violation, recoverable in any court of competent jurisdiction.

New York Civ. Rights § 52-c. Civil penalties of up to $500 for a first offense, $1,000 for a second, and $3,000 for a third and each subsequent offense, enforced by the Attorney General.

California. Criminal penalties under Cal. Penal Code § 632: a first violation is punishable by a fine of up to $2,500 per violation, or up to one year in county jail, or a state prison term, or by both that fine and imprisonment, so it can be charged as a felony from the first offense. A subsequent violation raises the fine ceiling to $10,000 per violation. Civil damages under Cal. Penal Code § 637.2: the greater of $5,000 per violation or three times actual damages, with a private right of action.

Florida. Violation of Fla. Stat. § 934.03 is a third-degree felony under Florida law. Florida's penalty structure is among the most severe in the country.

Nevada. A willful and knowing violation of NRS 200.620 through 200.650 is a category D felony under NRS 200.690, and the recorded party may recover actual damages or liquidated damages of $100 per day of violation with a $1,000 minimum, whichever is greater, plus punitive damages and reasonable attorney fees.

NLRA remedies. NLRB enforcement for unlawful surveillance policies or surreptitious bargaining recordings results in an administrative order to cease and desist, rescind the unlawful policy, and post a notice to employees. NLRA remedies are administrative and do not include compensatory damages or civil fines, but the reputational, operational, and bargaining consequences of a Board order are significant.

---

TAKE IT DOWN Act (2025-2026): Federal NCII Overlay for Workplace Recording

Workplace recording disputes occasionally produce intimate-image misuse, particularly when an employer reviews body-camera or hidden-camera footage that incidentally captures a person in a state of undress. The federal TAKE IT DOWN Act, Pub. L. 119-12, signed May 19, 2025, adds a federal layer to this scenario.

The Act makes it a federal crime to knowingly publish nonconsensual intimate images of an identifiable adult, including AI-generated synthetic depictions. The criminal prohibitions took effect on signing. Section 3 gave covered platforms one year from enactment to establish a removal process, so that obligation has been in force since May 19, 2026: a covered platform must remove an identified depiction as soon as possible and no later than 48 hours after receiving a valid request, and failure to comply is treated as an unfair or deceptive act or practice enforceable by the FTC.

For employers, the practical implications are: (1) recordings that incidentally capture intimate imagery must be handled with strict access controls and retention limits; (2) sharing or transmitting such recordings to other employees, contractors, or vendors may independently violate the Act; (3) employer-sponsored AI tools that could be misused to generate sexual deepfakes from workplace recordings expose the employer to vicarious-liability risk. State NCII statutes operate in parallel; many states impose felony penalties and civil causes of action that exceed the federal Act's reach.

---

Disclaimer: This article provides general legal information about employer recording laws under federal and state law. It is not legal advice and does not create an attorney-client relationship. The laws summarized here reflect statutes and regulatory guidance as of August 3, 2026; subsequent amendments, court decisions, or NLRB Board actions may change the applicable rules. The information applies to the United States only and covers the federal ECPA framework and the state statutes and regulatory guidance cited throughout. Readers in Connecticut, Delaware, New York, California, Florida, Nevada, Oregon, Pennsylvania, Washington, and other all-party or employer-notice states should pay particular attention to the jurisdiction-specific rules applicable to their situation. Consult a licensed employment or labor attorney in your state for advice on your specific circumstances.

---

Related articles

• US recording laws by state: the 51-jurisdiction parent hub covering all state recording-consent regimes
• All-party consent states: the complete 2026 list: the 12 states requiring all-party consent, with per-state penalty details
• Connecticut workplace recording laws: Connecticut's split recording rules and § 31-48d employer monitoring obligations
• Colorado workplace recording laws: Colorado biometric consent requirements and one-party recording baseline

---

---

Last updated: August 3, 2026. Statutes cited reflect their in-force version as of August 3, 2026.