Employers can generally monitor company-owned phones in 2026, but only when there’s a legitimate business reason and, in a growing number of states, written notice to staff. The federal baseline (ECPA) permits it through the business-purpose and consent exceptions, but several states add stricter notice and consent rules. Here’s what’s actually required.
If you issue phones to your team, monitoring them for security, productivity, or compliance is normal and lawful. What trips employers up is the how: doing it quietly, without policy, or on the wrong device. Get the framework right and you avoid both employee distrust and legal exposure.
The federal baseline: ECPA
The Electronic Communications Privacy Act of 1986 (18 U.S.C. 2510-2522) is the main federal law governing electronic monitoring at work. It prohibits intercepting electronic communications, then carves out two exceptions that cover most employer monitoring:
- Business-purpose exception (18 U.S.C. 2511(2)(a)(i)): you can monitor communications on company-provided equipment when there’s a legitimate business reason.
- Consent exception (18 U.S.C. 2511(2)(d)): you can monitor when one party to the communication has given prior consent, which most employers obtain through a signed acceptable-use policy.
You can read the statute itself on the Electronic Communications Privacy Act reference. The key takeaway: ECPA is permissive for company devices, but it is a floor, not a ceiling. States can and do impose stricter rules, and ECPA does not preempt them.
State notice and consent rules
This is where employers get caught out. A handful of states require written notice before any electronic monitoring:
- Connecticut, Delaware, New York, and Colorado require some form of prior written notice and, in places, signed acknowledgment.
- New York is the strictest of the group: written notice on hiring, a signed or electronic acknowledgment from the employee, and a posted notice in a conspicuous place at the workplace.
- California’s AB 1221, taking effect in 2026, is the most significant recent state change and tightens disclosure obligations further.
Even in states with no specific statute, a clear written policy is the practical standard, because it establishes the consent and notice that ECPA’s exceptions rely on.
Recording calls: the two-party trap
If your monitoring includes recording phone calls, audio recording law applies on top of everything else. Eleven states plus D.C. require all-party (often called two-party) consent for recording calls: California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania, Washington, and Wyoming. In those states, everyone on the call, including the customer or outside party, must be informed. This is why business recordings open with “this call may be recorded.” If your team uses a call recorder on company lines, your policy and your call scripts both need to reflect the strictest state where your callers might be.
Personal phones are mostly off-limits
ECPA’s exceptions hinge on company-owned equipment. Monitoring an employee’s personal phone, even one used for some work, is a different and far riskier proposition. If you run a BYOD (bring your own device) setup, the safer path is a Mobile Device Management profile limited to the work container, with monitoring scoped only to company data and clearly spelled out in the BYOD agreement. Reaching into someone’s personal messages, photos, or location off the clock invites exactly the privacy claims you want to avoid.
Location tracking deserves its own caution. Following a company phone during work hours for legitimate logistics is generally defensible; tracking an employee’s whereabouts after hours is not. The NCSL’s location-tracking statutes are a useful reference for the state-by-state rules.
A compliant monitoring checklist
Before you monitor a single device, put this in place:
- Issue company-owned devices for anything you intend to monitor closely.
- Write a clear acceptable-use and monitoring policy that states what is monitored, how, and why.
- Get signed acknowledgment from every employee, especially in CT, DE, NY, and CO.
- Limit monitoring to a legitimate business purpose, not personal surveillance.
- Handle call recording to the strictest applicable state and inform outside parties.
- Avoid after-hours and personal-device tracking unless narrowly justified and disclosed.
- Secure the data you collect and limit who can see it.
Where SpyHuman fits for businesses
SpyHuman is consent-based monitoring software for Android devices you own and are authorized to supervise, including company-issued phones where staff have been informed and have consented. It is not built for secretly surveilling personal devices. You can see the monitoring features on the features page. Used the right way, with a written policy and signed consent, it supports lawful workplace monitoring rather than working around it.
The bottom line
Monitor company-owned phones, not personal ones. Have a written policy, collect signed consent, and follow your strictest state’s rules, especially on call recording and after-hours location. ECPA permits a lot, but state law and basic transparency are what keep you compliant.
This article is general information, not legal advice. Employment and privacy laws vary by state and change often. Consult an employment attorney before rolling out a monitoring program.
Frequently asked questions
Can an employer monitor a company-owned phone without telling employees?
Federally, ECPA’s business-purpose exception may permit it, but several states (CT, DE, NY, CO) require written notice, and a clear policy is the practical standard everywhere. Quiet monitoring invites legal and trust problems.
Do I need written consent to monitor employees?
In Connecticut, Delaware, New York, and Colorado, written notice or acknowledgment is required. Elsewhere it isn’t strictly mandated by statute, but a signed acceptable-use policy is strongly recommended because it establishes the consent ECPA relies on.
Can employers record phone calls on company phones?
Yes, with care. Eleven states plus D.C. require all-party consent, so everyone on the call must be informed. Set your recording practice to the strictest state where your callers may be located.
Can my employer track my personal phone?
Generally no. Monitoring should be limited to company-owned devices. For BYOD setups, tracking should be scoped only to the work container and clearly disclosed in a BYOD agreement.
Lawful use only: monitor devices you own, your minor child’s device as a parent or guardian, or a company device with the user’s informed consent.