Do employers have to notify employees before monitoring them with AI?

In Connecticut, New York and Delaware, yes, whatever the software. Connecticut wants prior written notice of the types of monitoring, and a conspicuous posting counts. New York wants a notice on hiring that the employee acknowledges, plus a posting. Delaware accepts a daily electronic notice or an acknowledged one-time notice.

Can an employer monitor employee Slack or email messages?

Often, yes, with consent. The federal Wiretap Act bans intercepting communications unless a party has given prior consent or another exception applies, and a signed monitoring acknowledgment is the usual way to get it. Three states also want notice. Section 7 of the NLRA protects concerted activity, so don't point the tool at talk about pay or organizing.

Does GDPR restrict AI monitoring of EU employees?

Yes. You need a legal basis; if it's legitimate interests, it fails where staff's rights override your interest. You can only collect what's necessary for the purpose. A DPIA is required where the monitoring is likely to be high risk, and national rules apply on top. In Germany the works council has co-determination rights over monitoring devices.

Is biometric monitoring treated differently?

Yes. Illinois BIPA requires written notice of the purpose and term and a written release before collection, plus a public retention policy. Texas requires notice and consent before capture and destruction within a year of the purpose ending. Washington requires notice, consent or an opt-out mechanism before enrolling biometrics for a commercial purpose.

Can employers use AI scores to discipline or fire people?

In Illinois, using AI with a discriminatory effect in discipline or discharge is a civil rights violation, and staff must be told AI is used. Under GDPR, staff have the right not to be subject to a significant decision based solely on automated processing, with limited exceptions that require human intervention on request.

AI Employee Monitoring Laws: What Employers Can Do

Open-plan office with computer workstations Image: Unsplash, used under the Unsplash License.

This is for the person about to approve an AI monitoring tool: screenshot capture, productivity scores, message analysis, a flight-risk dashboard. The short answer is that you can use most of them in the US, but some states want notice first, wiretap law wants consent, biometrics need their own consent, and labor law limits what the tool may watch. In the EU the bar is higher and the works council may get a say.

Most of the US rules below weren't written for AI. That's the point: they cover the new tools exactly as they cover a keystroke logger. We read each statute and the GDPR text on October 20, 2026. The steps run in the order you'd do them.

1. List what the tool actually collects

Start with the data, not the vendor's feature list. Ask the vendor, in writing, which of these the tool collects and keeps:

Content of email, chat or calls (versus metadata such as times and recipients)
Screenshots or screen recordings, and how often
Keystrokes and mouse activity
Location
Face, voice or fingerprint data
Any score or prediction it produces about a person, and what goes into it

Each item maps to a different rule below. Content brings in wiretap and labor law, face and voice data bring in biometric law, and scores bring in discrimination and automated-decision rules.

Rows of security cameras mounted on a grey brick wall Image: Unsplash, used under the Unsplash License.

2. Give the notice each state requires

Connecticut, New York and Delaware have general electronic monitoring notice laws. They cover monitoring by any electronic means, so an AI tool is included.

State	Law	Who it covers	What you must do	Penalty
Connecticut	Conn. Gen. Stat. 31-48d	Any employer, collecting information on its premises by electronic means	Prior written notice to affected employees of the types of monitoring; a conspicuous posting counts as the notice. Exception: reasonable grounds to suspect misconduct the monitoring may show	Labor Commissioner, after a hearing: up to $500, $1,000, then $3,000 per offense
New York	Civil Rights Law 52-c	Employers with a place of business in New York monitoring phone, email or internet use	Written or electronic notice upon hiring, acknowledged by the employee, plus a conspicuous posting	Attorney General: civil penalty, rising per offense
Delaware	19 Del. C. 705	Employers with a place of business in Delaware monitoring a Delaware employee's phone, email or internet use	An electronic notice each day the employee uses the systems, or a one-time notice acknowledged in writing or electronically	Civil penalty per violation

Connecticut's version has no private lawsuit: the official annotation says enforcement is limited to proceedings before the Labor Commissioner. New York's notice uses blanket statutory wording (any and all use may be monitored at any time), so you don't have to list tools one by one. Our employee monitoring laws by state tracker has the New York, Delaware and Connecticut details.

Screenshot of Connecticut General Statutes section 31-48d on electronic monitoring notice Screenshot: Conn. Gen. Stat. 31-48d, Connecticut General Assembly (cga.ct.gov).

California has no general monitoring notice statute of this kind, but two laws matter. The CCPA's partial exemption for employee data became inoperative at the start of 2023, so employee data now gets CCPA notices and rights. And the Invasion of Privacy Act (Penal Code 632) makes it an offense to record a confidential communication without the consent of all parties, which reaches tools that record calls or meetings.

The federal Wiretap Act, part of the Electronic Communications Privacy Act, bans intercepting communications. One exception lets a person intercept where "one of the parties to the communication has given prior consent." That's why a signed monitoring acknowledgment matters even outside the three notice states: it's the consent. In California, recording a confidential call needs every party's consent, not one.

4. Keep the tool away from union activity and health signals

Labor law. Section 7 of the National Labor Relations Act protects employees' right "to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection." A tool that flags messages about pay or organizing for managers is the kind of use to rule out in the configuration. The NLRB's former General Counsel issued a memo on electronic monitoring, GC 23-02; the Acting General Counsel rescinded it on February 14, 2025. Section 7 itself hasn't changed.

Disability law. The ADA bars employers from making inquiries of an employee "as to whether such employee is an individual with a disability or as to the nature or severity of the disability" unless job-related and consistent with business necessity. A tool that infers stress, mood or a medical condition from voice or typing gets close to that line. Switch those features off unless counsel has signed them off.

5. Treat biometrics as a separate project

A fingerprint reader with a keypad mounted on a wall next to a glass door Image: Pexels, used under the Pexels License.

If the tool reads faces, voices or fingerprints (attendance by face scan, voice analysis on calls), three state laws add steps:

Illinois BIPA (740 ILCS 14/15): inform the person in writing that biometrics are collected and of the purpose and term, get a written release first, and publish a retention and destruction policy.
Texas (Business and Commerce Code 503.001): inform before capture and get consent; destroy the data within a reasonable time and no later than a year after the purpose expires. For an employer's security use, the purpose is presumed to end when employment does. The Attorney General enforces it.
Washington (RCW 19.375.020): before enrolling a biometric identifier in a database for a commercial purpose, give notice, get consent, or provide a way to prevent later commercial use.

Our BIPA AI hiring checklist covers the Illinois release in detail.

6. Decide what the scores may decide

Productivity and risk scores feed decisions about people, and that's where the newer rules bite.

Illinois: since January 1, 2026, using AI "that has the effect of subjecting employees to discrimination on the basis of protected classes" in discipline, discharge, promotion or other terms of employment is a civil rights violation, and so is failing to tell employees that AI is used. See the Illinois AI employment law guide.
EU: Article 22 GDPR gives people the right "not to be subject to a decision based solely on automated processing" that has legal or similarly significant effects. Where an exception applies (a contract or explicit consent), the employer must offer at least human intervention, a chance to give their view and to contest the decision. Our GDPR Article 22 guide goes further.

A simple rule covers both: a score can start a conversation, and a named person makes the decision and writes down why.

7. For EU staff: legal basis, minimum data, DPIA, works council

Legal basis. If you rely on legitimate interests (Article 6(1)(f)), that basis fails "where such interests are overridden by the interests or fundamental rights and freedoms of the data subject." Write the balancing test down.
Only what's necessary. Article 5(1)(c) requires data that's "adequate, relevant and limited to what is necessary." Continuous screenshots of everyone are hard to defend if spot checks or metadata would do.
DPIA. Article 35 requires an impact assessment before processing that's "likely to result in a high risk." Systematic AI monitoring of staff is a strong candidate; do one.
National rules. Article 88 lets member states set specific rules on employee data, including "monitoring systems at the work place." In Germany, the works council has a right of co-determination over "the introduction and use of technical devices designed to monitor the behaviour or performance of the employees" (Works Constitution Act, Section 87).
Transparency. Where Article 22 decisions are made, the privacy notice must give "meaningful information about the logic involved."

Screenshot of section 87 of the German Works Constitution Act, co-determination over monitoring devices Screenshot: Works Constitution Act, Section 87 (official English translation), Federal Ministry of Justice (gesetze-im-internet.de).

What to keep on file

The vendor's written answer on what the tool collects (step 1), dated
Each version of the monitoring notice, the date it went live, and signed or electronic acknowledgments (Connecticut, New York, Delaware)
Biometric notices, releases and your published retention policy
The configuration showing which features are off (sentiment, health inference, keyword flags on pay or union terms)
For each score-driven decision: who decided and why
For EU staff: the legitimate interests assessment, the DPIA, and works council minutes or agreement

What we could not confirm: whether any US court has applied the Connecticut, New York or Delaware notice laws to an AI tool specifically; we found no such decision. We also didn't find federal agency guidance on AI monitoring in force after the NLRB memo's rescission.

Correction (October 20, 2026): An earlier version implied Texas law requires written consent and a published retention schedule for biometric data. Texas's Section 503.001 requires notice and consent before capture, with no written-form rule, and deletion no later than one year after the purpose expires. It also said New York requires a new notice whenever monitoring practices change and a description of what is monitored, and that Delaware always requires prior written notice; New York's notice is given upon hiring in the statute's blanket wording, and Delaware also accepts a daily electronic notice.

Correction (October 20, 2026, full review): We rewrote this guide against the statutes. Earlier versions said Connecticut's notice must describe the methods used (the statute says the types of monitoring, and a posting counts), that GDPR requires a DPIA for all large-scale employee monitoring (only where high risk is likely), that Article 22 gives a right to object (it's a right not to be subject to solely automated decisions), and that the NLRB has "signaled increased scrutiny" of AI monitoring (the memo was rescinded in 2025). Unsourced claims about Florida, the Washington health data law, French law, EU court rulings, BIPA settlement sizes and HIPAA were removed.