Can Your Employer See Your Browsing History?

Can Your Employer See Your Browsing History?

Updated September 2026

On a work computer, assume yes. On your own phone using the office Wi-Fi, considerably less than most people fear.

The reason the answer splits like that is that two completely different things are usually called “monitoring.” One is software running on the device, which can see essentially everything. The other is watching traffic cross the network, which in 2026 sees much less than it used to. Which one applies to you depends entirely on whose device you’re holding.

Here’s the whole picture, then what the law says about it, and what you can actually do.

What They Can See, Device by Device

The single most useful sentence in this article: the device matters more than the network.

Why Incognito Mode Doesn’t Help at Work

This is the most common misunderstanding about browsing history, and it’s worth being precise about what private browsing actually does.

Incognito mode stops your browser from saving history, cookies and form data locally. That’s all it does. It is a feature for keeping things off a shared family computer.

It does nothing about:

Monitoring software on the device. If your employer has installed an endpoint agent — and most managed corporate laptops have one — it logs activity at the operating system level, before the browser’s privacy settings are involved. Incognito is invisible to it.

Network-level logging. Your DNS lookups still happen. Your connections still cross the company network. Incognito changes nothing about either.

Managed browser profiles. If your work browser is signed into a company Google Workspace or Microsoft account, administrators may have visibility into history through the management console regardless of browsing mode.

So incognito protects your browsing from the next person to use that laptop. It does not protect it from your employer.

What HTTPS Actually Hides

Nearly every site now uses HTTPS, and that genuinely changed what network monitoring can see. But it’s a narrower protection than people assume.

When you’re on a network your employer controls, they can generally see:

• The domain you connected to — from your DNS lookups and from the server name sent at the start of the encrypted connection
• When you connected and for how long
• How much data moved

What HTTPS keeps from them on that network:

• The specific page within the site
• What you typed, read, or searched
• Your passwords, messages and form contents

The practical upshot: over work Wi-Fi on your own phone, an employer can usually tell that you visited a job board. They generally cannot tell which listings you opened.

The exception that undoes all of it. If your employer required you to install a configuration profile, an MDM profile or a certificate in order to use the network or your email, they may have put a corporate root certificate on the device. That lets them decrypt HTTPS traffic and read everything, on a personal device. If you were asked to install something before your phone would connect, treat that phone as monitored.

On a Work Device, Assume Everything

Managed corporate devices commonly run software capable of recording:

• Every URL visited, with timestamps
• Keystrokes, including into sites the employer can’t otherwise read
• Periodic screenshots, or continuous screen recording
• Which applications ran and for how long
• Files copied to USB drives or uploaded to personal cloud storage
• Webcam and microphone access, on some configurations

Not every employer does all of it. But the capability is standard, it’s usually invisible while running, and there is no reliable way to check from the user side.

The correct assumption on a work device is that anything you do could be reconstructed later if someone had a reason to look. That’s not paranoia — it’s how these tools are sold.

For more on how this works when you’re at home, see whether your employer can monitor your computer while you’re working from home and whether they can install monitoring software on your personal computer.

The Federal Position: Mostly Legal

There is no general federal law preventing your employer from monitoring your use of their systems.

The Electronic Communications Privacy Act prohibits intercepting electronic communications, but it contains two exceptions that swallow the rule in an employment setting. The business purpose exception permits monitoring on the employer’s own system for legitimate business reasons. The consent exception permits it where a party has consented — and courts have consistently treated a signed acknowledgement of an acceptable use policy as consent.

Which is why the handbook matters. When you signed a policy saying company systems may be monitored and carry no expectation of privacy, you removed the main legal argument you would otherwise have had.

Two things that still constrain employers even where monitoring is permitted:

Medical and protected information. Health data gathered incidentally can trigger obligations under the ADA and other laws, and using it against you is a separate problem for the employer.

Protected concerted activity. Monitoring aimed at discovering whether employees are discussing pay, conditions or unionising can violate the National Labor Relations Act. Employees discussing pay with each other is protected activity.

Three States Require Notice — and Connecticut’s Rules Change on 1 October

Most states have nothing specific. Three require your employer to tell you, and the differences matter.

New York. Under Civil Rights Law § 52-c, every private employer in the state, regardless of size, must give written or electronic notice on hiring that telephone conversations, email and internet access may be monitored, get the employee’s acknowledgement, and post a notice in a conspicuous place. Civil penalties run from $500 for a first offence to $3,000 for later ones. Note one limitation: enforcement belongs to the attorney general, and there is no private right of action — you cannot sue over the missing notice yourself.

Connecticut. Section 31-48d has long required prior written notice describing the types of monitoring that may occur, plus a conspicuous posting. Public Act 26-73 takes effect on 1 October 2026 and adds three requirements: the written notice must identify the specific locations on the premises where monitoring occurs; notices must be posted at each of those locations; and anyone hired on or after that date must receive a plain-language written statement of which activities are prohibited and may be monitored without prior notice. Penalties are $500, then $1,000, then $3,000. Again, no private right of action.

Delaware. Under 19 Del. C. § 705, an employer must either give electronic notice each day the employee uses company email or internet, or give a one-time written notice that the employee acknowledges. The penalty is $100 per violation, and unlike the other two, it’s enforceable in any court of competent jurisdiction.

State monitoring laws are changing quickly — Connecticut’s amendment is five days away as this is written. This was verified in September 2026; check your state labor department before relying on it.

If you’re outside those three states, your employer generally owes you no notice at all, which is why the assumption in the section above is the safe one.

What You Can Actually Do

Keep personal browsing on a personal device and a personal network. This is the only measure that reliably works, and it costs nothing. Not the work laptop at home. Not your phone on the office Wi-Fi if you’d rather not have the domains logged.

Read the acceptable use policy once. It tells you what they’ve reserved the right to do, and it’s the document that decides whether you consented. If you’re about to raise a complaint or look for another job, read it first.

Use cellular data rather than work Wi-Fi for anything personal on your phone. Your carrier sees it; your employer doesn’t.

Be careful what you install. A profile or certificate required to join the network or read work email may hand your employer far more visibility into a personal device than you expect.

Assume searches on a work device are visible. Job boards, employment lawyers, medical conditions, complaints about your manager — all of it. This is the practical consequence people discover too late, and it comes up repeatedly in cases where an employee’s job search or legal research surfaced during a dispute.

If you’re in New York, Connecticut or Delaware, check whether you actually received the required notice. It won’t give you a lawsuit on its own, but a missing notice is a useful fact in a broader dispute, and the state can penalise it.

If monitoring is being used to target you specifically after a complaint, that’s a different question — see is this workplace retaliation.

Frequently Asked Questions

Can My Employer See My Browsing History in Incognito Mode?

On a work device, yes. Incognito stops the browser saving history locally, but monitoring software runs beneath the browser and network logging happens regardless. Incognito hides your browsing from the next person to use the laptop, not from your employer.

Can My Employer See What I Do on My Phone on Work Wi-Fi?

They can generally see which sites you connected to and when — the domains, not the pages. HTTPS keeps the content and the specific pages private. That changes if they required you to install a profile or certificate to join the network, which may allow them to see much more.

Can My Employer See My Personal Email on a Work Computer?

If you open it in a browser on a monitored device, assume yes — keystroke logging and screenshots capture what HTTPS would otherwise protect. See whether your boss can read your emails.

Does My Employer Have to Tell Me They’re Monitoring?

In New York, Connecticut and Delaware, yes. Almost everywhere else, no. And in New York and Connecticut only the state can enforce the notice requirement — you cannot sue over it yourself.

Can I Be Fired for What’s in My Browsing History?

In an at-will state, generally yes, if you breached an acceptable use policy. The exceptions are the usual ones: not for protected activity, not for a discriminatory reason, and not in retaliation for a protected complaint. Looking for another job on a work computer is a common and lawful reason for dismissal.

Can My Employer See My History After I Leave?

Yes. Logs and monitoring records sit on employer systems and typically remain available under their retention policy. Wiping a work laptop before returning it deletes the local copy, not the server-side records — and can itself be treated as misconduct or spoliation of evidence.

Related Articles

• Internet Privacy at Work — the broader picture
• Workplace Email Privacy — what they can read and when
• Can Employers Monitor Slack or Microsoft Teams Messages? — including DMs
• Can Your Employer Install Monitoring Software on Your Personal Computer?
• AI Monitoring at Work — what changes when software does the watching
• Can You Be Fired for Using Your Phone at Work?

Disclaimer

This article is general information, not legal advice. Employment law varies by state and by situation, and the rules described here may have changed since this article was last updated. For guidance on your circumstances, consult a licensed employment attorney in your state. See our full Disclaimer and Terms and Conditions.