AI Workplace Surveillance: What Your Boss Can Legally Monitor

Can Employers Use AI to Spy on Their Employees?

Yes, employers can legally use AI to monitor employees in most U.S. states, with few limits. AI tools now track keystrokes, mouse movements, Slack tone, bathroom breaks, and even emotional states. The EU AI Act classifies workplace monitoring AI as high-risk, requiring human oversight. U.S. federal legislation (Stop Spying Bosses Act) remains stalled in committee.

Quick Facts

The Short Answer: What Employers Can Legally Do

Employers in the United States can legally monitor almost everything you do on company devices and networks. There is no single federal privacy statute governing employee monitoring. Instead, a patchwork of laws creates the rules — and the rules largely favor employers.

Read moreIs AI Taking Your Job? Data Says No (Mostly)

What employers can monitor on company systems:

• Keystrokes, mouse movements, and active application time

• 

  Read moreAI and Office Jobs: What Research Actually Shows

  Emails, Slack messages, and internal communications

• Web browsing history and application usage

• Screenshots and periodic webcam photos

• GPS location (in company vehicles or on company phones)

• Phone calls (length and content, with notice)

• Productivity metrics (units per hour, calls per shift, time away from desk)

• AI tool usage and prompt history

What employers generally cannot monitor:

• Personal devices without consent

• Off-duty conduct (in many states)

• Protected concerted activity (union organizing, discussing wages)

• Restrooms and lactation rooms (under state laws in California, Illinois, and others)

• Personal communications on personal accounts (without a legitimate business purpose)

The core legal principle: If it is on a company device or company network, assume it can be monitored. In most U.S. states, employers do not need your consent — only notice. And in many cases, notice is buried in an employee handbook you signed on your first day.

What AI Monitoring Actually Looks Like

AI-powered monitoring has moved far beyond simple time clocks and email filters. Here is what the technology does today.

Warehouse and Logistics Monitoring

Amazon is the most documented case. The company uses AI-enabled systems that track worker performance through time-on-task metrics, productivity quotas, video surveillance, and gamified ranking boards. Handheld scanners and badge swipes continuously track movement and pace.

In 2017–2018, Amazon’s AI monitoring system generated automated termination orders that bypassed human supervisors entirely, firing at least 300 workers at a Baltimore warehouse for failing to meet productivity quotas.

European regulators have pushed back. In February 2026, Italy’s data protection authority ordered Amazon to stop processing the personal data of 1,822 workers at a warehouse near Rome. The authority found that Amazon collected and shared with managers details of trade union and strike activities, medical conditions, family crises, and even bathroom breaks. Four video cameras were installed near restrooms and break areas. The French data protection authority fined Amazon €32 million for an excessively intrusive productivity monitoring system that tracked warehouse workers’ activities down to the second.

Corporate and Remote Worker Monitoring

For knowledge workers, AI monitoring takes a different form. Meta deployed internal software that captures mouse movements, keyboard activity, and navigation patterns to train AI agents. After significant employee backlash — one internal post was viewed by nearly 20,000 colleagues and protest flyers circulated in offices — Meta added a 30-minute pause feature and limited opt-out options for remote workers with bandwidth constraints and employees handling sensitive material.

Burger King rolled out Patty, an AI chatbot embedded in cashier headsets that tracks whether employees say “please” and “thank you” and chimes in when equipment needs attention.

Microsoft’s Purview Insider Risk Management now allows IT administrators to view employee prompts sent to AI platforms alongside AI-generated responses connected to flagged activity. Google, Meta, and Amazon have begun tracking AI tool usage and incorporating it into performance reviews and promotion decisions.

The Rise of Neuro-Surveillance

The frontier of workplace monitoring is cognitive data. Employers are showing growing interest in measuring attention, fatigue, emotional states, and mental performance through biometric, behavioral, and neural signals. Neurotechnology company Emotiv faced legal action in Chile over tools marketed as wellness devices that may have functioned as medical-grade monitoring equipment.

Some legal scholars argue that continuous neurophysiological surveillance transforms the employer-employee relationship qualitatively, giving employers “real-time, granular, largely unverifiable access to workers’ cognitive and affective states — attention, mental workload, stress, emotional valence — while employees remain epistemically and legally exposed.”

Is AI Monitoring Legal? A Jurisdiction-by-Jurisdiction Guide

United States: A Patchwork With Few Guardrails

The U.S. has no comprehensive federal privacy law for private-sector employees. The Electronic Communications Privacy Act (ECPA) prohibits intercepting communications in transit without a legitimate business purpose or employee consent. The Stored Communications Act restricts access to stored emails. For unionized workplaces, implementing new monitoring may trigger a duty to bargain under the National Labor Relations Act.

State laws vary. New York City Local Law 144 requires employers to notify candidates ten days before using automated employment decision tools. Illinois BIPA requires written consent before collecting biometric data. Connecticut requires prior written notice of electronic monitoring. Washington State introduced legislation in 2026 requiring 30 days’ advance written notice before implementing electronic monitoring for performance evaluations.

California’s CPRA regulations on automated decision-making technology, set for January 2027, will give employees the right to opt out and appeal to a human, and will mandate risk assessments.

European Union: The Strictest Regime

The EU AI Act, fully applicable from August 2026, creates the most comprehensive workplace AI protections in the world.

AI systems used to monitor and evaluate employee behaviour and performance are classified as high-risk in Annex III. This triggers strict compliance obligations: risk management systems, human oversight, data governance, technical documentation, and transparency to workers.

Article 5 of the AI Act explicitly prohibits the use of AI systems to infer emotions of a natural person in the workplace. Employers who deploy software designed to detect employee emotions — whether through facial analysis in video calls or sentiment analysis of emails — are in breach of the Act. Fines reach €35 million or 7% of global annual revenue, whichever is higher.

GDPR Article 22 prohibits fully automated decision-making that produces legal effects or similarly significant impacts, unless specific conditions are met. In practice, this means an AI system cannot fire you without meaningful human intervention.

Germany’s new KI-MIG (Act on Market Surveillance and Innovation Promotion of Artificial Intelligence), adopted in June 2026, adds a national enforcement layer, with the Federal Network Agency as the central market surveillance authority.

What the Lawsuits Reveal

Amazon: Italy, France, and the United States

The Italian data protection authority’s February 2026 ruling against Amazon is the most detailed regulatory finding on AI workplace monitoring to date. Inspectors found that Amazon collected and shared with managers union activities, medical conditions, family crises, and bathroom break records for 1,822 workers at the Passo Corese warehouse. The authority ordered an immediate stop, finding serious breaches of privacy rules.

France’s CNIL fined Amazon €32 million for an “excessively intrusive” productivity monitoring system that “tracked warehouse workers’ activities down to the second” and created “constant pressure on workers.”

In the United States, the NLRB has repeatedly found merit in complaints against Amazon for illegal anti-union conduct, including retaliatory firings, unlawful surveillance, and interference with organizing rights.

Meta: Keystroke Tracking Backlash and Discrimination Lawsuit

Meta’s employee monitoring program, launched in April 2026, captured mouse movements, keyboard activity, and navigation patterns to train AI agents. Internal opposition was immediate: one employee post discussing concerns was viewed by nearly 20,000 colleagues, and protest flyers circulated in company offices. Meta subsequently added a 30-minute pause feature and limited opt-out options.

Separately, 26 former and current Meta employees sued the company in July 2026, alleging that Meta used AI to select employees for layoffs in a way that discriminated against workers who had taken time away from work and therefore had fewer metrics to measure against their peers. Meta denied the allegations, stating that “workforce management and organizational decisions were and are made by people, not AI.”

New York Times: Union Surveillance Complaint

In May 2026, the New York Times Guild filed an unfair labor practice charge against the newspaper, claiming it used AI to “surveil and monitor” unionized employees. The union alleged that management “continually refused to provide information to the Tech Guild on the company’s use of AI.”

The Pattern

Across these cases, three patterns emerge:

1. Monitoring tends to expand beyond its stated purpose. Systems deployed for “productivity” end up collecting sensitive data about health, family, and union activity.

2. Transparency is rare. Employees often discover monitoring through internal leaks, not official disclosure.

3. Enforcement is reactive. Regulators act after journalists or unions expose abuses — not before deployment.

Does AI Monitoring Actually Improve Productivity?

No. The research is consistent: electronic surveillance does not improve performance, and it actively harms the conditions that make people want to perform.

Cornelius König, a psychology researcher at Saarland University, reviewed studies on employee monitoring in the 2025 Annual Review of Organizational Psychology and Organizational Behavior. He found little to suggest that electronic surveillance improved performance. “My general take is that monitoring isn’t going to matter as much as employers assume,” König said.

Despite the lack of evidence, the global market for employee-monitoring technology is expected to exceed $4 billion in 2026, largely due to major companies in North America.

A 2026 study in the Journal of Organizational Behavior found that AI monitoring intensity is negatively associated with well-being under low governance but neutral or positive under high governance. The technology itself is not the problem — the absence of oversight is.

A 2026 survey of 3,000 workers found:

• 59% of workers say digital surveillance damages trust

• Monitored workplaces run 17% lower on trust metrics

• Only 22% of employees know they are being monitored

The ILO’s April 2026 working paper on AI and psychosocial work environment concluded that AI-driven intrusive surveillance and loss of autonomy at work are linked to psychosocial risks for employees, including anxiety, depression, burnout, and other emotional disorders.

Is This Fear Realistic for You? A Decision Guide

Step 1: What kind of work do you do?

• Warehouse, logistics, or delivery → High risk. AI monitoring is standard in these industries, and bathroom-break tracking is documented.

• Call center or customer service → High risk. Calls are recorded, tone is analyzed, and scripts are enforced.

• Remote knowledge work → Moderate to high risk. Keystroke tracking and activity monitoring are common, especially at large tech companies.

• Office-based knowledge work → Moderate risk. Email, Slack, and application usage are often monitored; AI tool usage is increasingly tracked.

• Unionized workplace → Lower risk. Monitoring may trigger a duty to bargain, and protected concerted activity is shielded.

Step 2: What kind of device are you using?

• Company laptop or phone → Assume everything is monitored. Company devices are company property.

• Personal device with company software installed → High risk. MDM (mobile device management) software can access personal data.

• Personal device without company software → Lower risk, but employer may still have policies about BYOD.

Step 3: What state or country are you in?

• EU or UK → Strong protections. AI monitoring is high-risk, emotion recognition is prohibited, and human oversight is required.

• California, Illinois, Connecticut, Washington → Moderate protections. Notice and consent requirements exist.

• Most other U.S. states → Weak protections. Employers can monitor with minimal notice.

Step 4: What would happen if your employer saw everything you do on your work device?

• Nothing sensitive → Low personal risk.

• Personal conversations, health information, or job searching → High personal risk.

• Union organizing or wage discussions → Protected activity; monitoring may be unlawful.

How Workers Can Protect Themselves

Know Your Rights

1. Check your employee handbook. Look for monitoring disclosures. If you cannot find one, ask HR in writing what monitoring is in place.

2. Know your state law. California, Illinois, Connecticut, Delaware, and Washington have specific employee monitoring statutes. The EU and UK have stronger protections than any U.S. state.

3. Understand protected activity. Under Section 7 of the NLRA, you have the right to engage in concerted activity — discussing wages, working conditions, and union organizing. Surveillance that interferes with these rights may be unlawful.

Practical Steps

4. Use personal devices for personal matters. Do not check personal email, browse social media, or have sensitive conversations on company devices.

5. Assume Slack, Teams, and email are readable. Sentiment analysis tools scan message tone. Avoid sarcasm, frustration, and personal disclosures in company chat.

6. Turn off your webcam when not in meetings. Webcam monitoring is used in some workplaces.

7. Use the bathroom without your phone. If your company tracks badge swipes or device location, leaving your phone at your desk creates a false record of presence.

8. Document everything. If you believe you are being monitored unlawfully, keep records of when and how.

If You Are in a Union

9. Demand information. Your union has the right to information about monitoring technologies. The NYT Guild’s complaint is a model for how to push back.

10. Demand bargaining. In many jurisdictions, introducing new monitoring technology triggers a duty to bargain. Germany’s works council co-determination rights are the strongest model globally.

11. Demand algorithmic transparency. The EU AI Act requires disclosure of how high-risk AI systems work. U.S. unions are pushing for similar transparency.

If You Are a Manager or Employer

12. Conduct a risk assessment before deploying monitoring AI. The EU AI Act requires this. U.S. employers should do it voluntarily.

13. Implement human oversight. Fully automated termination decisions are illegal under GDPR Article 22 and increasingly scrutinized in the U.S.

14. Measure what matters. AI monitoring does not improve performance. If you are deploying it for productivity reasons, the evidence says it will fail.

15. High governance makes the difference. Research shows that AI monitoring intensity is negatively associated with well-being under low governance but neutral or positive under high governance. The governance, not the technology, determines the outcome.

Regulation and Government Response

United States

Stop Spying Bosses Act (H.R. 9402 / S. 2026). Introduced by Senator Markey, Senator Schatz, and Representative Deluzio in June 2026. Would require employers to disclose data collection publicly, prohibit collection of sensitive data (off-duty conduct, union organizing), create rules for automated decision systems, and establish a Privacy and Technology Division at the Department of Labor.

No Robot Bosses Act. Would prohibit employers from relying on automated decision systems to make hiring, firing, and discipline decisions; require pre-deployment evaluations and annual impact assessments; mandate transparency; and give workers the right to opt out of algorithmic management in favor of human review.

NLRB GC Memo 23-02. Former General Counsel Jennifer Abruzzo issued guidance directing NLRB Regions to submit cases involving “intrusive or abusive electronic surveillance and algorithmic management that interferes with the exercise of NLRA Section 7 rights.” The memo urged the Board to find that employers presumptively violate the NLRA where surveillance practices would tend to interfere with protected activity.

Status: Both bills remain in committee. The NLRB’s current enforcement posture under the Trump administration has rescinded several of Abruzzo’s memos, signaling a shift in labor policy.

European Union

EU AI Act. Fully applicable from August 2, 2026. Classifies workplace monitoring AI as high-risk (Annex III). Prohibits emotion recognition in the workplace (Article 5). Requires human oversight, risk management, transparency, and data governance. Fines up to €35 million or 7% of global revenue.

GDPR Article 22. Prohibits fully automated decision-making with legal or similarly significant effects. Requires human intervention in employment decisions.

Germany KI-MIG. National enforcement layer, with the Federal Network Agency as central market surveillance authority. Works councils have co-determination rights over monitoring technology under BetrVG §87(1) No. 6.

International

ILO Working Paper (April 2026). Examined how AI systems are transforming the psychosocial work environment. Found that “AI-driven intrusive surveillance and loss of autonomy at work are linked to psychosocial risks for employees.” Calls for stronger worker protections.

UNI Global Union. General Secretary Christy Hoffman stated: “This ruling confirms what workers, and their unions have been saying for years — that invasive surveillance and the collection of deeply personal information have no place in the workplace. Employers must respect workers’ fundamental rights to privacy, dignity and freedom of association.”

Common Questions

Can my employer legally read my Slack messages?
Yes, if you are using a company Slack workspace on a company device or network. Employers can access all messages, including direct messages. AI sentiment analysis tools may scan message tone. Do not discuss personal, medical, or union matters on company Slack.

Can my employer track my bathroom breaks?
In most U.S. states, yes, through badge swipes, sensor data, or camera placement near restrooms. However, California and Illinois prohibit monitoring in restrooms and lactation rooms. Amazon faced regulatory action in Italy for cameras placed near restrooms and break areas.

Does my employer need my consent to monitor me with AI?
In most U.S. states, no — only notice, which is often buried in an employee handbook. In the EU, employers generally rely on legitimate interest rather than consent, because consent in an employment relationship is rarely considered freely given. Some U.S. states (Connecticut, Delaware, Washington) require prior written notice.

Can my employer fire me based on AI monitoring data?
In the U.S., yes, unless the decision interferes with protected activity (union organizing, wage discussions) or violates a specific state law. In the EU, GDPR Article 22 prohibits fully automated termination decisions — a human must be meaningfully involved. Amazon’s AI system generated automated termination orders in 2017–2018, firing 300 workers without human review.

What is the Stop Spying Bosses Act?
A federal bill introduced in June 2026 by Senator Markey and Representative Deluzio. It would require employers to disclose data collection publicly, prohibit collection of sensitive data (off-duty conduct, union organizing), create rules for automated decision systems, and establish a Privacy and Technology Division at the Department of Labor. It remains in committee.

Does AI monitoring actually improve productivity?
No. A 2025 meta-analysis by Cornelius König found little evidence that electronic surveillance improves performance. Monitored workers are 1.5 times more likely to report poor mental health, and 56% report elevated stress levels. The global market for monitoring technology exceeds $4 billion despite the lack of evidence.

What is the EU AI Act’s rule on emotion recognition at work?
Article 5 of the EU AI Act prohibits AI systems that infer emotions in the workplace. Employers using facial analysis in video calls or sentiment analysis of emails are in breach. Fines reach €35 million or 7% of global revenue.

Can my employer monitor my personal phone?
If you have installed company software (MDM) on your personal phone, your employer may have access to a wide range of data, depending on the configuration. If you have not installed company software, your employer generally cannot monitor your personal phone unless you are using it for work in a way that creates a legitimate business justification.

What can I do if I believe I am being monitored unlawfully?
Document everything. Contact your union if you have one. File a complaint with your state attorney general, the NLRB (if protected activity is involved), or the relevant data protection authority in the EU. Consult an employment attorney.

Are warehouse workers especially at risk?
Yes. Warehouse and logistics workers face the most intensive AI monitoring: time-on-task metrics, productivity quotas, video surveillance, handheld scanner tracking, and gamified ranking boards. Amazon’s systems have been the subject of regulatory action in Italy and France and NLRB complaints in the U.S.

Key Takeaways

• 61% of companies now use AI-powered analytics to track employee performance, and 74% use some form of online monitoring. The global market for employee-monitoring technology exceeds $4 billion in 2026.

• U.S. employers can legally monitor almost everything on company devices and networks with minimal notice. There is no comprehensive federal privacy law for private-sector employees.

• The EU AI Act classifies workplace monitoring AI as high-risk and prohibits emotion recognition at work. Fines reach €35 million or 7% of global revenue.

• AI monitoring does not improve productivity. Research shows it harms mental health, erodes trust, and fails to deliver the performance gains employers expect.

• Amazon has faced regulatory action in Italy (worker data ban) and France (€32 million fine) for intrusive monitoring that tracked bathroom breaks, medical conditions, and union activity.

• Meta backtracked on keystroke tracking after employee backlash, adding a 30-minute pause feature and limited opt-out options. Employees sued over AI-driven layoff decisions.

• The NLRB has taken the position that intrusive electronic surveillance presumptively violates the NLRA when it interferes with protected concerted activity — though current enforcement is in flux.

• The Stop Spying Bosses Act and No Robot Bosses Act would create federal protections if passed, but both remain in committee.

• Employees can protect themselves by using personal devices for personal matters, knowing their state law, documenting monitoring, and — if unionized — demanding information and bargaining.

• Governance matters more than technology. AI monitoring is negatively associated with well-being under low governance but neutral or positive under high governance with human oversight.

Official & Trusted Resources

• NLRB GC Memo 23-02 — Electronic Monitoring and Algorithmic Management of Employees Interfering with the Exercise of Section 7 Rights. nlrb.gov

• EU AI Act — Regulation (EU) 2024/1689, Annex III (high-risk classification) and Article 5 (prohibited practices). eur-lex.europa.eu

• Stop Spying Bosses Act (H.R. 9402) — Full text. govinfo.gov

• No Robot Bosses Act — Full text. markey.senate.gov

• ILO Working Paper — “AI systems @ work: a changing psychosocial work environment” (April 2026). ilo.org

• Cornelius König Meta-Analysis — “Electronic monitoring and employee performance” (Annual Review of Organizational Psychology and Organizational Behavior, 2025). annualreviews.org

• Italy Data Protection Authority Ruling — Amazon Italia Logistica (February 24, 2026). gpdp.it

• NIST AI Risk Management Framework — Voluntary framework covering AI risk management. nist.gov

• GDPR Article 22 — Automated individual decision-making, including profiling. gdpr-info.eu