US-CaliforniaDoes California law restrict employer use of employee monitoring software?
Yes, California law restricts employer use of employee monitoring software through laws requiring notice, prohibiting secret audio recording, and limiting access to personal electronic accounts.
What the Law Says
California imposes several legal limits on how employers may use employee monitoring software, grounded in privacy statutes, labor law, and data protection rules.
Employers must give employees at least 24 hours’ written notice before engaging in electronic monitoring — including keystroke logging, screen capture, GPS tracking, or email scanning — if that monitoring occurs on employer-provided devices or networks. This requirement stems from the California Invasion of Privacy Act (CIPA) and related interpretations.
Under Penal Code § 632, it is a crime to record ‘confidential communications’ — including in-person or phone conversations — without all parties’ consent. Courts have held this applies to workplace spaces where employees have a reasonable expectation of privacy, such as break rooms or private offices.
Labor Code § 980 prohibits employers from requiring or requesting employees to disclose usernames or passwords for personal social media or email accounts. It also bars employers from accessing personal electronic devices or accounts without consent.
The California Consumer Privacy Act (CCPA), as amended by the CPRA, now applies to employee personal information as of January 1, 2023 — ending the prior AB 25 exemption. Employers must provide notice at collection, honor opt-out requests for ‘sales’ or ‘sharing’, and respond to employee data subject requests (e.g., access, deletion) with limited exceptions.
Statutory TextAny person who, intentionally and without the consent of all parties to a confidential communication, uses an electronic amplifying or recording device to eavesdrop upon or record the confidential communication… is guilty of a crime.
— Penal Code § 632(a) — Eavesdropping on confidential communications
Statutory TextAn employer shall not require or request an employee or applicant for employment to disclose a username or password for the purpose of accessing personal social media…
— Labor Code § 980(a) — Employer access to personal social media accounts
What Courts Have Said
California courts have interpreted privacy statutes to protect workers from covert or overbroad monitoring, especially where expectations of privacy exist.
Defined ‘confidential communication’ under Penal Code § 632 as one where participants reasonably expect no third-party eavesdropping — a standard applied to workplace settings where privacy is expected.
Held that installing hidden video cameras in an office shared only by two employees violated their reasonable expectation of privacy, even on employer property, and constituted intrusion upon seclusion.
What to Do
Provide written notice at least 24 hours before deploying monitoring software — specify what is monitored and why.
Never record audio or video in areas where employees reasonably expect privacy (e.g., restrooms, break rooms, private offices) without consent.
Do not ask for or require employees’ personal account passwords or access to personal devices.
Update your privacy policy to comply with CCPA/CPRA requirements for workforce data, including notice at collection and response procedures for employee requests.
Audit monitoring tools annually to ensure they don’t capture personal data beyond business necessity.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.