Watched at Work: When Your Employer's Monitoring Software Becomes Illegal Surveillance

There is a version of workplace monitoring that most developers accept as a reasonable cost of employment. Network traffic logs, access audits, version control histories—these are the routine instruments of corporate IT governance. Then there is another version, one that has grown quietly and aggressively over the past several years, in which companies deploy software that records every keystroke, photographs employees through their laptop cameras at random intervals, transcribes private messaging conversations, and triangulates the physical location of remote workers throughout the day.

The distinction between those two versions is not merely philosophical. In a growing number of US states, it is the difference between lawful oversight and a prosecutable offense.

The Monitoring Market Has Exploded—And So Has Its Appetite

The employee monitoring software industry was valued at approximately $5 billion in 2023 and is projected to exceed $15 billion by the end of the decade, according to market research firm Grand View Research. Much of that growth was seeded during the remote-work surge of 2020, when employers suddenly found themselves unable to physically observe their workforces. Products like Teramind, ActivTrak, Hubstaff, and Controlio rushed to fill the visibility gap, marketing themselves as productivity platforms while quietly offering surveillance capabilities that would have seemed extraordinary just a decade earlier.

What many developers do not realize is that these tools are frequently deployed silently—installed on company-issued devices without any notification beyond a buried clause in an employee handbook or an onboarding document signed during a chaotic first week. The software runs in the background, invisible in the task manager, capturing data that employees reasonably believe is private.

What 'Monitoring' Actually Looks Like Inside These Systems

The capabilities embedded in modern employee monitoring platforms extend well beyond what most workers imagine when they consent to 'standard IT monitoring.' Documented features across commercially available products include:

• Keystroke logging that captures everything typed across all applications, including personal email accounts accessed on a work device, banking portals, and private messages sent through personal accounts on a shared browser session.
• Periodic or continuous screen capture, sometimes as frequently as every thirty seconds, creating a visual archive of an employee's entire workday.
• Webcam activation triggered by inactivity or randomized schedules, capturing images of employees in their homes without explicit, real-time consent.
• GPS and IP geolocation tracking applied to remote employees, logging their physical location throughout the workday and sometimes beyond it.
• Email and Slack content analysis, including sentiment scoring that flags messages containing words associated with job searching, dissatisfaction, or union organizing.

That last capability deserves particular attention. Several documented cases have emerged in which monitoring software flagged employees who were discussing workplace safety concerns or compensation equity in private channels—information that was then used in disciplinary proceedings.

The Legal Landscape Is More Protective Than Employers Admit

Employers routinely assert broad rights to monitor activity on company-owned devices and networks, and federal law does extend them considerable latitude under the Electronic Communications Privacy Act of 1986. However, that latitude is neither unlimited nor uniform across the country.

California offers the most expansive employee protections of any US state. Under the California Consumer Privacy Act and Labor Code Section 980, employers are prohibited from requiring employees to disclose personal social media credentials and face significant constraints on monitoring personal accounts. California courts have also applied invasion of privacy torts to monitoring that captures personal communications, even on employer-owned hardware, when employees had a reasonable expectation of privacy.

Connecticut and Delaware both require employers to provide explicit written notice before monitoring electronic communications—not a generic acknowledgment buried in an employment agreement, but a specific, contemporaneous disclosure.

New York City passed the Stop Hacks and Improve Electronic Data Security Act and, more recently, enacted rules requiring employers to notify workers about electronic monitoring in writing at the time of hiring and annually thereafter.

Illinois presents additional complexity through its Biometric Information Privacy Act, which has been interpreted to cover certain forms of continuous facial monitoring via webcam.

At the federal level, the National Labor Relations Act provides protections that are frequently overlooked in this context: monitoring employees for signs of union activity or workplace organizing, and using that data to discipline or terminate workers, constitutes an unfair labor practice regardless of what device the communications occurred on.

Recognizing When the Line Has Been Crossed

Developers attempting to assess whether their employer's monitoring practices are legally actionable should apply a four-part framework:

1. Scope beyond work function. Does the monitoring capture data that has no conceivable relationship to job performance—personal financial activity, medical search history, communications with family members? Scope creep of this nature weakens the employer's legitimate-business-purpose defense substantially.

2. Absence of meaningful disclosure. Was notification provided in a form that a reasonable person would actually encounter and understand, prior to monitoring beginning? A clause on page forty-seven of an onboarding packet likely does not satisfy Connecticut's or Delaware's notice requirements.

3. Use of data for protected activity suppression. If monitoring data has been used—or you have reason to believe it is being used—to identify employees engaged in protected concerted activity, wage discussions, or safety complaints, this moves from employment policy into potential NLRA violation territory.

4. Physical intrusion into personal spaces. Webcam activation in a home environment, without explicit and specific consent to that feature, raises serious Fourth Amendment analog claims under state constitutional law in several jurisdictions and may constitute a violation of state wiretapping statutes.

What Developers Should Do Now

If you suspect your employer is running monitoring software that exceeds these boundaries, document everything before taking any external action. Screenshot or photograph your device's running processes. Note dates and times when you observed anomalous behavior—unexpected webcam indicator lights, unusual CPU activity during idle periods, network traffic spikes.

Consult your state's department of labor website to identify applicable monitoring disclosure laws. The National Employment Law Project maintains a useful state-by-state summary. If you are in a state with notice requirements and received no such notice, you may already have a cognizable claim.

Whistleblowing channels available to you include the National Labor Relations Board for organizing-related surveillance, the Federal Trade Commission for deceptive data practices, and your state attorney general's office if state privacy statutes appear to have been violated.

Finally, consult an employment attorney before disclosing concerns internally. Retaliation against employees who raise privacy complaints is itself prohibited under several state statutes, but that protection is most durable when you have documented your concerns and sought legal counsel before your employer knows you are aware of the issue.

The power asymmetry between employers and employees in the monitoring context is real and significant. But so are the legal tools available to developers willing to understand them and use them deliberately.

Have information about unlawful workplace surveillance at a tech company? WhistleDev accepts secure, anonymous tips through our encrypted submission portal.