Is Employee Screenshot Monitoring Legal? What Employers Must Know

Is employee monitoring legal? In most countries, yes: employers can take screenshots of work computers when there's a legitimate business purpose, employees are told in advance, and the monitoring is proportionate to that purpose. The details vary a lot. Some US states require written notice, while EU and UK data protection law sets a much higher bar.

This is general information, not legal advice. Laws change and depend on your exact situation. Check with a lawyer in your jurisdiction before you start monitoring anyone. The sources below were checked in November 2026.

This guide covers the principles that apply almost everywhere, then the rules in the US, the EU, the UK and India, the difference between employees and contractors, and a checklist you can use before you switch screenshots on.

The short answer by region

The rest of this post explains each row and links to the law itself.

The principles that apply almost everywhere

Before looking at specific laws, it helps to know the ideas that run through nearly all of them. If your monitoring meets these, you're most of the way to compliance in most places.

1. A legitimate purpose. You need a specific reason, such as verifying billable hours for clients or protecting confidential data. "We want to keep an eye on people" isn't one.
2. Notice. Tell people before monitoring starts: what's collected, when, why, who sees it and how long it's kept.
3. Consent where the law requires it. Some laws ask for consent or a signed acknowledgment. In Europe, consent from employees is often not valid at all, as explained below.
4. Proportionality. Use the least intrusive method that achieves the purpose. If time against projects answers the question, screenshots may be too much.
5. Data security. Screenshots can capture personal messages, client data and passwords. Restrict who can see them and protect how they're stored.
6. Retention. Keep captures only as long as you need them, and delete them when someone leaves.
7. Access and correction. Let people see what was recorded about them and fix mistakes.

Is employee monitoring legal in the US?

In the US, employee monitoring on company equipment is generally legal, but federal law limits intercepting communications, and several states require written notice.

Federal law: the ECPA

The main federal law is the Electronic Communications Privacy Act (ECPA). It makes it an offense to intentionally intercept any "wire, oral, or electronic communication" (18 U.S.C. § 2511).

There are exceptions employers commonly rely on:

• Consent. Interception isn't unlawful where one of the parties to the communication has given prior consent, unless it's for a criminal or tortious purpose (§ 2511(2)(d)).
• Ordinary course of business. Equipment used in the ordinary course of business falls outside the definition of an intercepting device (18 U.S.C. § 2510(5)(a)).

The ECPA was written for phone calls and messages, not screenshots. But a screenshot can capture an email or a chat window, so the safe course is a written monitoring policy that employees read and acknowledge before tracking starts. That also lays the groundwork for the consent exception.

State notice laws

Several states go further and require employers to tell employees about electronic monitoring. Three to know:

New York. The law applies to private employers with a place of business in the state that monitor employees' phone calls, email, or internet access or usage. The notice must tell employees that their communications or internet use may be monitored "at any and all times and by any lawful means" (§ 52-c). Processes that only manage email or internet volume for system maintenance and protection, and don't target individuals, are excluded.

Connecticut. Connecticut has long required prior written notice of electronic monitoring, and a conspicuous posting counts as that notice. In 2026 the state replaced the section with Public Act 26-73, effective October 1, 2026. Among other changes, it requires a written statement for new hires before they start. Read the act itself for the exact wording.

Delaware. Employers may not monitor an employee's phone, email or internet use without either a daily electronic notice or a one-time notice the employee acknowledges in writing or electronically (§ 705).

California: employee data under the CCPA

Since January 1, 2023, covered businesses must apply the California Consumer Privacy Act's protections to employee data, including job applicants and independent contractors, according to the California Attorney General. That means notice of what you collect and why, and rights such as access and deletion.

Other states

Other states have their own privacy, wiretapping and data laws, and they change often. Check the rules in each state where you have employees or a place of business, not just where your company is registered.

Is employee monitoring legal in the EU?

In the EU, monitoring employees is allowed only when it complies with the General Data Protection Regulation (GDPR). Screenshots of someone's screen are personal data, so every GDPR duty applies.

You need a lawful basis, and consent rarely works

Every processing of personal data needs one of the lawful bases in Article 6 of the GDPR. Many employers assume a signed consent form is enough. In Europe, it usually isn't.

The EU's former body of data protection regulators, the Article 29 Working Party (now the European Data Protection Board), said in its Opinion 2/2017 on data processing at work that consent is "highly unlikely" to be a legal basis at work unless employees can refuse without adverse consequences. Because of the power imbalance, employees can rarely say no freely.

That leaves bases such as legitimate interests, which require you to weigh your interest against the employee's rights, and to show the monitoring is necessary and proportionate.

Screen capture faces a high bar

The same opinion looked at software that logs keystrokes and mouse movements, or captures screens at random or set intervals. Discussing home and remote working, it said such processing is disproportionate and the employer is very unlikely to have a legal ground under legitimate interests (Opinion 2/2017, section 5.4.1).

That doesn't make every screenshot unlawful, but it means continuous, routine screen capture of employees is hard to justify in the EU. Limited, purpose-bound capture that people control is a very different thing from constant surveillance.

Tell people, and do a DPIA

Articles 12 and 13 of the GDPR require clear information about the processing when you collect the data. For employee monitoring, that means a written notice before you start.

Article 35 requires a data protection impact assessment (DPIA) for processing that is likely to result in a high risk. The regulators' DPIA guidelines give "a company systematically monitoring its employees' activities, including the monitoring of the employees' work station" as an example where a DPIA is likely required.

National rules apply too

Article 88 of the GDPR lets each member state set more specific rules for employee data, explicitly including "monitoring systems at the work place". So check the national law of each country where your people work.

What enforcement looks like

In December 2024, France's regulator, the CNIL, fined a small real estate company €40,000 over employee monitoring. Its software took screenshots every 3 to 15 minutes, flagged periods without keyboard or mouse activity (which could be deducted from pay) and classified websites as productive or not.

The CNIL found:

• no lawful basis for the workstation monitoring, which it called intrusive and able to capture private messages and passwords;
• employees weren't properly informed;
• access used a shared administrator account;
• no DPIA had been carried out.

GDPR fines for the most serious breaches can reach €20 million or 4% of worldwide annual turnover, whichever is higher (Article 83(5)).

Is employee monitoring legal in the UK?

In the UK, monitoring workers is lawful when it complies with the UK GDPR and the Data Protection Act 2018. The regulator, the Information Commissioner's Office (ICO), published detailed guidance on monitoring workers in October 2023.

The ICO says data protection law doesn't prevent monitoring, but it must be necessary, proportionate and respect workers' rights. In practice, the guidance expects employers to:

• Have a clear purpose and choose the least intrusive way to achieve it.
• Identify a lawful basis. The ICO says consent is rarely appropriate in employment, because of the imbalance of power between employer and worker.
• Tell workers about the nature, extent and reasons for monitoring, in a way that's easy to understand.
• Do a DPIA for any monitoring likely to result in a high risk to workers. The ICO lists keystroke monitoring among its examples.
• Avoid covert monitoring except in exceptional circumstances, such as suspected criminal activity or gross misconduct, with senior sign-off, a DPIA and a tight time limit.
• Take extra care with home workers. The ICO's guidance on specific monitoring methods says people's expectations of privacy are likely to be higher at home, and you're more likely to capture family and private life.
• Let workers access their data. Monitoring records are personal data, so workers can request a copy.

Is employee monitoring legal in India?

In India, employee monitoring falls under the Digital Personal Data Protection Act, 2023 (DPDP Act) once its obligations apply.

Employment is a "legitimate use"

Section 7(i) of the Act allows personal data to be processed without consent for the purposes of employment, or to safeguard the employer from loss or liability, for example to prevent corporate espionage or protect trade secrets and confidential information.

That isn't a blanket exemption. Employers processing personal data still have duties under the Act, including reasonable security safeguards and erasing data once it's no longer needed for its purpose. Monitoring should stay linked to a genuine employment purpose.

When it applies

The government notified the DPDP Rules in November 2025 with an eighteen-month period for phased compliance, according to the Press Information Bureau. Most obligations on businesses therefore apply from 2027. The same release notes penalties of up to ₹250 crore for failing to maintain reasonable security safeguards.

If you monitor staff in India, use the transition period to document your purpose, limit what you capture and secure the data.

Contractors vs employees

Most monitoring notice laws, such as New York's and Connecticut's, are written for employees. Contractors are usually governed by the contract you sign with them. But that doesn't mean anything goes.

• Data protection still applies. GDPR, UK GDPR and India's DPDP Act protect individuals, whether they're employees or freelancers. In California, the Attorney General's notice on the CCPA expressly mentions independent contractors.
• Monitoring can affect classification. In the US, the IRS looks at whether a business controls "what the worker does and how the worker does his or her job" (IRS). Tight control over how someone works is one factor that points toward employment. No single factor decides it, but heavy monitoring of a contractor's process isn't neutral.
• Put it in the contract. If a client or agency requires screenshots for billable hours, say so in the contract: what's captured, when, who sees it and how long it's kept.

For contractors, monitoring tied to verifying billed hours is easier to justify than monitoring how they work.

A fair-monitoring checklist

Use this before you turn screenshots or activity tracking on:

Before you start
[ ] Written purpose (e.g. "verify billable hours for client invoices")
[ ] Checked the laws where each person works, not just where you are
[ ] Chosen the least intrusive option that meets the purpose
[ ] Completed a DPIA if you're in the EU or UK, or the risk is high
[ ] Lawful basis identified (EU/UK); not relying on employee consent alone
 
Telling people
[ ] Written notice: what's captured, when, why, who sees it, how long
[ ] Signed or electronic acknowledgment (required in New York and Delaware)
[ ] Notice posted where required (New York, Connecticut)
[ ] Contractors: monitoring terms written into the contract
 
Running it
[ ] Capture only while people are tracking billable or work time
[ ] Never record keystroke content or personal accounts
[ ] Access limited to the people who need it
[ ] People can see, and where possible delete, their own captures
[ ] Retention period set, with deletion when someone leaves
[ ] Review every six months, and switch off what you don't use

Where OneTrack fits

Software can't make monitoring lawful on its own, but it can make the principles above easier to follow. OneTrack, the desktop app for Tristiks Grow, was built with them in mind:

• It records nothing while the timer is stopped or paused, and screenshots are optional.
• It never records keystrokes or what anyone types, and keeps no log of websites visited.
• Anyone can delete their own captures, and the time they cover comes off the timesheet.
• Teammates can't open each other's screenshots, and screenshots never get a public link.
• When someone leaves an account, their captures are deleted 30 days later.

The full details are on how tracking works, our security page and time tracking with screenshots.

Frequently asked questions

Is it legal to take screenshots of employees' computers?

In most countries it can be, on company devices, with a legitimate purpose, advance notice and proportionate settings. The EU and UK set a high bar for routine screen capture, and some US states require written notice. Check the law where each person works.

Do I need employee consent to monitor them?

It depends on where you are. In New York and Delaware, employees must acknowledge a monitoring notice. In the EU and UK, consent is rarely a valid basis because of the power imbalance, so employers rely on other lawful bases and must still inform people.

Can I monitor remote employees on their own computers?

It's riskier. Personal devices hold private data, and the UK regulator says expectations of privacy are higher at home. If you must, limit capture to tracked work time and say so clearly in writing. Our guide on how to manage a remote team covers fair tracking for distributed teams.

Do I have to tell employees they're being monitored?

In the EU, the UK and several US states, yes. Even where the law doesn't require it, covert monitoring damages trust and is hard to defend. Tell people before you start.

How long can I keep monitoring screenshots?

There's rarely a fixed number of days. Data protection laws say to keep data only as long as the purpose needs, so set a retention period, write it into your policy and delete captures when someone leaves.

Wrap up

Screenshot monitoring is legal in many places when it's purposeful, open and proportionate, and risky when it's constant, hidden or used as a score. Write down why you're doing it, tell people, capture the minimum and get local legal advice.

For the management side, which metrics to track and how to introduce tracking to a team, read our guide to employee productivity tracking.