Illinois Employee Monitoring Laws (2026): BIPA, Recording & More

Illinois regulates employee monitoring more heavily than almost any other state, combining an all-party consent recording law, a social-media-password ban, and the Biometric Information Privacy Act, whose fingerprint and face-scan rules have produced some of the largest employment-privacy settlements in the country.

This guide is part of our Employee Monitoring Laws by State series, which covers electronic-monitoring notice duties, social-media-password protections, and workplace video and GPS surveillance limits nationwide.

Information last verified on 2026-07-09. This article has not yet been reviewed by a licensed lawyer.

Does Illinois require employers to give notice before monitoring employees?

No, not in the form Connecticut, Delaware, New York, or Maine use. Those four states require a written or posted notice before an employer monitors phone, email, or internet activity. Illinois has not adopted a comparable general notice statute, so an Illinois employer monitoring its own email or computer systems starts from the same federal baseline that applies nationally: the Electronic Communications Privacy Act, 18 U.S.C. Sections 2510-2523, prohibits intercepting communications without consent (18 U.S.C. § 2511), but the business-extension exemption in Section 2510(5)(a) excludes employer-provided communications equipment from the Act's definition of an interception device when it is used in the ordinary course of business, subject to the limits federal courts have placed on continued monitoring once a call is identified as personal.

That federal baseline is not the whole picture, though. The Personnel Record Review Act, 820 ILCS 40/9, provides that an employer "shall not gather or keep a record of an employee's associations, political activities, publications, communications or nonemployment activities, unless the employee submits the information in writing or gives the employer express, written consent." The section carves out activities or associations involving the exploitation of a minor, activities occurring on the employer's premises or during working hours that interfere with the employee's or other employees' duties, and activities that constitute criminal conduct or may reasonably be expected to harm the employer's property, operations, or business. Any record the employer is permitted to keep becomes part of the employee's personnel file. So while Illinois does not tell an employer when it must announce monitoring, it does limit what an employer may retain about an employee's communications and off-duty life.

What makes Illinois distinctive beyond that are three other laws layered on top of the federal baseline: the state's all-party consent recording rule, its social-media-password statute, and BIPA. Each is addressed below, and none of them should be confused with the electronic-monitoring notice category that Connecticut, Delaware, New York, and Maine occupy.

Recording employee calls and conversations in Illinois

Illinois is one of the strictest all-party consent states in the country. Under 720 ILCS 5/14-2, using an eavesdropping device to record a private conversation, defined as one where at least one participant had a reasonable expectation of privacy, without the consent of every party is a felony, generally a Class 4 felony for a first offense and a Class 3 felony for a subsequent one. This is a materially different baseline from the one-party consent rule most states use, and it means an Illinois employer cannot simply record a call it participates in the way an employer in a one-party state can; every party on the line, including the employee, generally needs to consent.

In practice, employers satisfy this through an acknowledged monitoring policy that puts employees on notice and secures their consent up front, which functions as the "all parties consented" element the statute requires. This cluster addresses only the employment overlay; the full consent framework, including exceptions, penalties, and the law's post-ACLU v. Alvarez history, is covered in depth on our Illinois Recording Laws: Workplace guide and is not repeated here.

Illinois' social media password law for employees

The Right to Privacy in the Workplace Act, 820 ILCS 55/10, added social media protections in 2013 and makes Illinois one of 27 states, per the National Conference of State Legislatures, with a law of this kind. Under Section 10(b)(1), it is unlawful for an employer or prospective employer to request, require, or coerce an employee or applicant to provide a username and password, or any other means of accessing a personal online account, or to demand access to that account in any other manner. Two separate paragraphs protect a refusal. Section 10(b)(1)(E) bars an employer from discharging, disciplining, discriminating or retaliating against, or otherwise penalizing an existing employee for declining to hand over that access, for refusing to open the account in the employer's presence, or for filing a complaint under the Act. Section 10(b)(1)(F) covers the hiring side, barring an employer from failing or refusing to hire an applicant because of the same refusal.

The Act does not stop an employer from doing two things: maintaining lawful policies governing use of the employer's own electronic equipment, including internet, social-networking, and email policies, or monitoring use of the employer's own equipment and email accounts, so long as the employer does not request or use an employee's personal account password to do it. The practical line is between an employer's own systems, which it can monitor, and an employee's personal account, whose password it cannot demand.

Illinois' Biometric Information Privacy Act and employer time clocks

BIPA, 740 ILCS 14, enacted in 2008, is the country's strongest biometric-privacy law and is directly relevant to any Illinois employer using a fingerprint scanner, hand-geometry reader, or facial-recognition system for time-and-attendance or building access. Under Section 15(b), before collecting a biometric identifier or biometric information, an employer must inform the employee in writing that the data is being collected or stored, disclose the specific purpose and length of time it will be retained, and obtain a written release, which the statute now allows to be an electronic signature. Under Section 15(a), the employer must develop and make public a written policy establishing a retention schedule and guidelines for permanently destroying the biometric data, generally no later than three years after the employee's last interaction with the employer or when the purpose for collecting it has been satisfied, whichever comes first.

Section 20 gives "any person aggrieved" by a violation a private right of action, a remedy most other states' biometric laws do not provide. For a negligent violation the prevailing party recovers liquidated damages of $1,000 or actual damages, whichever is greater; for an intentional or reckless violation, liquidated damages of $5,000 or actual damages, whichever is greater. Liquidated and actual damages are alternatives, not additive. The section separately allows reasonable attorneys' fees and costs, including expert witness fees, and other relief such as an injunction. A 2024 amendment, Public Act 103-769, effective August 2, 2024, limits a plaintiff to a single recovery per person per method of collection, overturning the earlier reading that each individual fingerprint scan could generate its own violation, which had driven the largest exposure numbers.

That earlier per-scan exposure is what produced Rogers v. BNSF Railway Co., the first BIPA case to reach a jury. In October 2022, a federal jury in the Northern District of Illinois found BNSF recklessly or intentionally violated BIPA by fingerprint-scanning roughly 45,600 truck drivers and other workers at its facilities without the required consent, and the court initially entered judgment for $228 million (45,600 violations multiplied by the $5,000 statutory rate). U.S. District Judge Matthew Kennelly later vacated that damages figure and ordered a new trial limited to damages; rather than retry the issue, the parties settled for $75 million, distributed to roughly 46,500 class members after fees and costs. More recently, trucking-camera vendor Lytx Inc. finalized a $4.25 million BIPA settlement, approved July 26, 2025, after truckers alleged its driver-facing safety cameras collected face-geometry data without consent between October 2016 and January 2025; claimants received payouts between roughly $631 and $845 each. Both cases illustrate the same pattern: equipment marketed for safety or time-and-attendance purposes still triggers BIPA's consent and retention duties when it captures biometric data from an Illinois workforce.

Our Illinois Biometric Privacy (BIPA) guide covers the statute's full definitions, exemptions, and litigation history; the summary above is limited to the employer-monitoring angle.

Video surveillance in Illinois workplaces

Illinois' unauthorized video recording statute, 720 ILCS 5/26-4, makes it unlawful to knowingly record or transmit live video of another person, without that person's consent, in a restroom, tanning bed, tanning salon, locker room, changing room, or hotel bedroom, and separately bars placing or causing a device to be placed in one of those locations with intent to do so. The offense escalates from a misdemeanor for placing a device with that intent to a felony for actually capturing the recording. The statute applies directly to an Illinois employer's camera placement: cameras in break rooms, sales floors, warehouses, and other common work areas are not covered, but a camera in a restroom or locker room is a criminal exposure regardless of the employer's stated security rationale.

GPS and vehicle tracking in Illinois

Illinois has no dedicated employer-vehicle-tracking notice statute comparable to New Jersey's. Its general electronic-tracking-device statute, 720 ILCS 5/21-2.5, makes unauthorized use of a tracking device a Class A misdemeanor, but the exemption list in subsection (c) contains a provision written for exactly this situation. Subsection (c)(3) exempts tracking "when the vehicle is owned or leased by a business that is authorized to transact business in this State and the tracking device is used by the business for the purpose of tracking vehicles driven by employees of that business, its affiliates, or contractors of that business or its affiliates." A separate exemption at (c)(1) covers tracking a vehicle's registered owner, lessor, or lessee has consented to. Between them, routine GPS tracking of an employer's own fleet vehicles is generally outside the offense. Illinois' stalking statute, 720 ILCS 5/12-7.3, separately criminalizes placing a tracking device on a person or their property as part of a course of conduct meant to cause fear, which targets malicious tracking rather than ordinary fleet management. For the state's full tracking-device framework, see our Illinois GPS Tracking Laws guide.

Disclaimer

This article provides general legal information about Illinois employee monitoring law as verified on 2026-07-09. It does not constitute legal advice and does not create an attorney-client relationship. Readers with a specific workplace monitoring or biometric-privacy dispute should consult a lawyer licensed in Illinois.

Related articles

• Employee Monitoring Laws by State: the complete hub
• Illinois Recording Laws: Workplace
• Illinois Biometric Privacy (BIPA)
• Illinois GPS Tracking Laws
• Indiana Employee Monitoring Laws

Last updated: 2026-07-09. Statutes cited reflect their in-force version as of 2026-07-09.

More Illinois Laws

• Illinois AI Meeting Recording Laws
• Illinois At-Will Employment Laws
• Illinois Data Privacy Laws
• Illinois GPS Tracking Laws
• Illinois Recording Laws
• Illinois Whistleblower Laws