Employee Surveillance Tech Governance: Where Productivity Monitoring Meets the Law

Executive Summary

Not long ago, buying employee monitoring software was an IT decision, something procurement signed off on without anyone upstairs blinking. That's changed, and pretty fast. Between a patchwork of new state privacy laws, a wave of biometric-data lawsuits, and at least one very public case tying monitoring software directly to worker injuries, what used to be a quiet productivity tool has turned into a genuine governance question. This piece looks at why that shift happened, walks through a case where monitoring tech ended up in a regulator's crosshairs, and lays out what a board should actually be asking before the next monitoring platform gets rolled out.

Quick Answer:

Is Employee Surveillance Software Legal, and Who Should Be Overseeing It?

Yes, in most cases, employee monitoring is legal in all fifty US states when it's applied to company-owned equipment for a legitimate business reason. What varies wildly is the notice employers owe workers, the consent needed for things like audio recording, and the extra rules around biometric data. Legal isn't the same as low-risk, though, which is exactly why this belongs on a board's radar rather than sitting quietly with HR and IT.

What's Driving Employee Surveillance Onto the Governance Agenda?

Start with how common this has actually become. A 2025 MIT study found that 80 percent of companies are now monitoring their remote or hybrid workers in some form, tracking browsing activity, capturing documents, mapping physical location, sometimes even logging keystrokes and mouse movement. That's not a niche compliance issue anymore, it's close to standard practice, which means the legal and reputational exposure tied to it is standard practice too.

Who's actually setting the rules here? A messy, fast-moving patchwork of state legislatures, not one clean federal framework. Illinois' Biometric Information Privacy Act has become the go-to weapon for monitoring-related lawsuits, largely because it gives employees a direct right to sue over biometric data, something most other state laws don't offer. California's AB 1221, now in effect for 2026, pushes further, requiring data minimization, giving employees access rights, and restricting monitoring outside of work hours. Connecticut and Delaware require employers to notify staff before rolling out monitoring software at all. Layer all of that together and you get a genuinely uneven landscape where the exact same tool can be low-risk in one state and a lawsuit waiting to happen in another.

Why does this matter beyond the legal department? Because covert or overly invasive monitoring is precisely what turns a productivity tool into both a legal problem and a trust problem at the same time. Monitoring with clear notice, a defensible business purpose, and real limits on what gets collected tends to stay on the right side of the law and, just as importantly, doesn't quietly wreck how employees feel about the company watching them work.

Real-World Example: When Monitoring Tech Becomes a Safety and Reputational Problem

The Amazon Kent case

In March 2022, Washington state's Department of Labor and Industries fined Amazon $60,000 over conditions at its Kent fulfillment center, classifying it as a willful serious violation for knowingly putting workers at risk of injury. The finding that made the case notable wasn't just about pace of work, it was that L&I's inspections found a direct connection between Amazon's employee monitoring and discipline systems and the rise in musculoskeletal disorders among workers. In other words, regulators didn't treat the monitoring software as a side issue. They treated it as a contributing cause of physical harm, tied to how the system pushed workers to keep pace or face consequences.

Why this matters beyond one warehouse

It was Washington's third citation against Amazon for similar issues at different facilities in the state, and by 2023 the tally had grown to five citations since 2021. That pattern is the real lesson here. A monitoring system doesn't need to be malicious to cause harm, it just needs to be built around metrics that reward speed without accounting for the human cost of sustaining that pace. And once a regulator draws a documented line between the software and physical injury, the exposure stops being a data privacy footnote and becomes an occupational safety and public reputation problem all at once.

The Boardroom View

It's easy to leave employee monitoring decisions to HR and IT and assume the legal team will flag anything risky. That assumption doesn't hold up well anymore. This sits squarely in risk and audit committee territory now, for three reasons that compound each other. First, the regulatory patchwork across states means a single monitoring rollout can create different compliance obligations depending on where employees are physically located, and getting that wrong invites regulatory penalties. Second, BIPA-style litigation has shown that biometric monitoring specifically carries outsized legal exposure, class actions built around exactly this kind of data collection have become common enough that legal teams now treat it as a predictable risk category, not a rare event.

Third, and harder to put a number on, there's the trust cost. Workplace monitoring tools have increasingly become a flashpoint in how employees feel about their employer generally, and there's growing scrutiny, including from worker advocacy groups, into whether surveillance tools are being used to discourage organizing or collective action. A board that only asks whether a monitoring tool is legally defensible, without asking whether it's corroding how people feel about working there, is missing half the risk.

A Practical Framework

None of this requires banning monitoring tools outright. It requires treating the decision to deploy them with the same governance discipline applied to any other material operational risk.

Tie every monitoring tool to a documented, legitimate business purpose. Vague justifications like general productivity tracking don't hold up well under scrutiny. The purpose should be specific enough that a regulator, or an employee, could understand exactly why the data is being collected.

Minimize what gets collected, deliberately. Tools that track work patterns through metadata, which applications are used and for how long, carry meaningfully lower legal risk than tools capturing screenshots, keystrokes, or biometric data. The more invasive the tool, the higher the bar should be before it's approved.

Give employees real notice before rollout, not buried in a handbook nobody reads. Several states already require this by law, and treating it as a baseline practice everywhere, not just where it's mandatory, closes a lot of the gap between what's legal and what actually preserves trust.

Review the legal landscape jurisdiction by jurisdiction before deploying anything new. A tool that's fine in most states can trigger BIPA exposure in Illinois or run headlong into California's AB 1221 requirements, and that review needs to happen before rollout, not after a complaint lands.

Name someone accountable for ongoing oversight, not just the initial purchase decision. Monitoring tools tend to get deployed for one purpose and quietly used for others over time. Periodic review of whether a tool is still being used the way it was originally justified is what catches that drift before it becomes a legal or trust problem.

Frequently Asked Questions

Is employee monitoring actually legal?

Yes, generally, when it's applied to company-owned equipment for a legitimate business reason. What changes state to state is the notice owed to employees, consent requirements for things like audio recording, and additional rules around biometric data specifically.

Do employers have to tell employees they're being monitored?

It depends on the state. There's no blanket federal disclosure requirement, but states including Connecticut and Delaware require notice before monitoring software is used, and more states are moving in that direction.

Can employers monitor personal devices?

Generally not without consent. Employers can't typically require employees to install monitoring software on personal devices, and monitoring in that context still has to respect employee privacy rights.

What's the biggest legal risk right now?

Biometric data collection, by a fair margin. Illinois' BIPA gives employees a direct right to sue, which has made it the epicenter of most employee monitoring litigation, and other states are watching that trend closely as they draft their own rules.

Does monitoring software ever create safety risks, not just privacy ones?

It can, and the Amazon Kent case is a clear example. When monitoring and discipline systems are built around speed metrics without accounting for physical strain, regulators have drawn a direct line between that software and workplace injury rates.

Key Insights

• Employee monitoring has gone from niche to near-standard practice, roughly 80 percent of companies now monitor remote or hybrid workers in some form.

• Biometric data collection carries outsized legal risk compared to other monitoring types, largely because of Illinois' BIPA and the litigation pattern it's created.

• Monitoring risk isn't purely a data privacy issue, the Amazon Kent case shows it can become a documented occupational safety concern too.

• The gap between what's legally permitted and what preserves workforce trust is often wider than boards assume, and covert or invasive monitoring is what closes that gap the wrong way.

  
  

Key Takeaways

•     Treat monitoring tool deployment as a governance decision, not just an IT or HR purchase.

•     Minimize data collection and tie every tool to a specific, documented business purpose.

•     Review legal exposure state by state before rollout, especially anywhere biometric data is involved.

•     Assign ongoing ownership so tools get reviewed periodically, not just approved once and forgotten.

Discover how boards can manage workplace monitoring risks, protect employee privacy, and build workforce trust through responsible technology oversight.

Take the next step in your governance journey.

 Visit Directors’ Institute, complete the webinar registration form, and gain actionable insights to navigate emerging boardroom challenges with confidence.