Workplace Privacy: What Your Employer Can and Cannot Monitor
Your employer reads your email. It tracks your location. It monitors your keystrokes. It records your calls. It searches your social media. How much of this is legal — and where the line falls — depends on what is being monitored, how, and whether you were told.
The modern workplace generates an extraordinary volume of data about its employees — where they are, what they type, how long they work, what they browse, who they communicate with, and how productive the employer’s algorithms judge them to be. The technology to collect this data exists, it is inexpensive, and employers deploy it with increasing enthusiasm. The legal question is not whether employers can monitor — in many cases, they can — but whether there are limits, and what happens when those limits are crossed.
California, as the state with the broadest constitutional privacy protections in the country, imposes more constraints on employer surveillance than most jurisdictions. The constraints are not absolute. But they are real, and they matter most in the situations where the monitoring is most invasive.
The California constitutional right to privacy
The California Constitution, Article I, Section 1, expressly includes “privacy” among the inalienable rights of all people. This provision applies to private employers — not only to government actors — and creates a right to privacy that employees can enforce in civil litigation.
A privacy claim under the California Constitution requires the employee to show: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) a serious invasion of that interest. The employer may defend by showing that the invasion was justified by a legitimate, competing interest — such as preventing theft, ensuring productivity, or protecting confidential information — and that the monitoring was reasonably tailored to serve that interest.
The balancing test is the key. The employee’s reasonable expectation of privacy is weighed against the employer’s legitimate business justification for the monitoring. The more invasive the monitoring, the stronger the justification must be.
Email and electronic communications
Employer monitoring of work email is generally permissible. When the employer provides the email system, it typically has the right to access, review, and monitor communications sent and received through that system — particularly when the employer has notified employees that the system is company property and may be monitored.
The notification matters. An employer that has a clear, written policy stating that company email is not private and may be monitored at any time has significantly reduced the employee’s reasonable expectation of privacy in that email. An employer without such a policy — or with a policy that is ambiguous — may face a stronger privacy challenge.
Personal email accessed on a company device presents a different question. An employee who checks personal email on a work laptop has a stronger privacy interest in the personal communications than in work email. Courts have recognized that personal communications, even when accessed through employer-provided technology, retain some degree of privacy protection — particularly when the employer’s monitoring policy does not clearly extend to personal accounts.
Text messages and messaging apps are increasingly significant. Employer monitoring of personal text messages — on an employee’s personal phone — is more invasive than monitoring company email, and the employee’s expectation of privacy is correspondingly higher. An employer that accesses an employee’s personal text messages without consent may face liability under both the California Constitution and the federal Stored Communications Act.
GPS and location tracking
Employers that provide company vehicles or mobile devices can generally track the location of those assets during working hours. A delivery company that uses GPS to monitor its fleet during shifts is engaging in reasonable business monitoring.
The analysis changes when the tracking extends beyond work hours. An employer that tracks a company vehicle’s location twenty-four hours a day — including when the employee uses it for personal purposes after work — is monitoring the employee’s personal movements. The privacy interest in off-duty location is substantial, and the employer’s business justification for after-hours tracking is typically weak.
Tracking an employee’s personal vehicle or personal phone raises even more serious privacy concerns. An employer that installs tracking software on an employee’s personal device without consent has invaded the employee’s privacy in a manner that is difficult to justify under any business rationale.
Computer and keystroke monitoring
Employer monitoring of computer activity — websites visited, applications used, keystrokes typed, files accessed — is common, particularly for remote workers. The legality depends on the scope of the monitoring, the employer’s policy, and the employee’s expectation of privacy.
Monitoring of work-related computer activity on employer-provided equipment, with notice, is generally permissible. An employer that informs employees that their computer usage is monitored and that the equipment is company property has established the framework for lawful monitoring.
Keystroke logging that captures personal passwords, private communications, and non-work-related activity raises more serious concerns — particularly if the employee was not clearly informed that this level of monitoring was occurring. The more granular and pervasive the monitoring, the stronger the employer’s justification must be.
Social media
Labor Code section 980 prohibits employers from requiring employees to disclose usernames or passwords for personal social media accounts, to access personal social media in the employer’s presence, or to divulge personal social media content. The statute protects the boundary between the employee’s public-facing social media presence and their private account access.
An employer may view an employee’s publicly available social media posts — what any member of the public can see — without violating section 980. But it may not demand login credentials, require the employee to accept a connection or friend request, or use coercive means to access content the employee has restricted.
The question of whether an employer can take adverse action based on publicly visible social media content is separate from the access question and is governed by the anti-discrimination, anti-retaliation, and political-activity protections discussed elsewhere in this series.
Video and audio surveillance
Employers may use video surveillance in the workplace for legitimate security purposes — monitoring entrances, parking areas, and common spaces. Video surveillance of areas where employees have a reasonable expectation of privacy — restrooms, changing areas, break rooms in some circumstances — is prohibited under Penal Code section 647(j) and may give rise to both criminal and civil liability.
Audio recording is more heavily restricted. California is a “two-party consent” state under Penal Code section 632: recording a confidential communication without the consent of all parties is a crime. An employer that records employee phone calls or in-person conversations without the employee’s knowledge and consent has violated the statute. Communications that are not confidential — conversations in open, public areas where there is no expectation of privacy — are not subject to this restriction.
Drug testing
Employer drug testing is permitted in California under certain circumstances, but it is not unlimited. Pre-employment drug testing is generally permissible. Random drug testing of current employees is more restricted — it is typically justified only for employees in safety-sensitive positions where impairment poses a genuine risk to the employee or others.
As discussed elsewhere in this series, AB 2188 prohibits employers from taking adverse action based on off-duty cannabis use and from relying on drug tests that detect non-psychoactive metabolites rather than current impairment. This statute does not prohibit all drug testing — it restricts the types of tests and the conclusions employers can draw from them.
What to do if your privacy has been invaded
An employee who believes their employer has engaged in unlawful monitoring or surveillance should consider:
What was monitored. Personal communications, personal devices, off-duty location, and off-duty conduct receive stronger privacy protection than work email on company equipment.
Whether notice was given. An employer that clearly disclosed its monitoring practices has weakened the employee’s expectation of privacy. An employer that monitored covertly has strengthened it.
Whether the monitoring was proportionate. Even lawful monitoring must be reasonably related to a legitimate business interest. Monitoring that is disproportionate to the interest it serves — blanket surveillance with no specific justification — may exceed the bounds of what the law permits.
Whether the monitoring revealed protected activity. If employer surveillance uncovered information about the employee’s disability, medical condition, political activity, union activity, or other protected characteristic or activity — and the employer subsequently took adverse action — the monitoring may have facilitated discrimination or retaliation, compounding the violation.
Your employer’s right to monitor the workplace is not unlimited. California’s constitutional privacy protections, combined with specific statutes governing social media access, audio recording, and drug testing, create boundaries that employers must respect. When those boundaries are crossed, the invasion is actionable.
This article is general information about California law and is not legal advice. Every situation turns on its particular facts.