Internet Privacy at Work: The Rights You Actually Have

Internet Privacy at Work: The Rights You Actually Have

Updated September 2026

On your employer’s computer, network and email account, you have very little privacy. That’s the right assumption to start from.

There are four exceptions, though, and they’re enforceable. One of them carries statutory damages of $1,000 per violation plus your attorney’s fees, which is enough to make a case worth bringing even when nothing else happened. This article is about those four and when they apply.

If what you want to know is what your employer can technically see on a given device, that’s covered separately in can your employer see your browsing history.

The Default Rule

On company systems, your employer can log the sites you visit, read your work email, review your Slack and Teams messages including direct ones, record keystrokes, take screenshots, and track which applications you used and for how long.

The federal wiretapping statute does prohibit intercepting electronic communications, but it has two exceptions that cover nearly all of this: monitoring for a legitimate business purpose on the employer’s own system, and monitoring where someone consented. The consent is almost always the acceptable use policy you signed when you were hired.

That policy does something else too. Most privacy claims depend on showing you had a reasonable expectation of privacy, and a signed policy saying company systems are monitored is exactly what removes it.

Its scope has limits, though, and that brings us to the first exception.

They Can’t Log Into Your Personal Accounts

The Stored Communications Act, 18 U.S.C. § 2701, makes it unlawful to access someone’s stored electronic communications without authorization. It covers accounts held by outside providers: your personal Gmail, your private Facebook messages, your iCloud. Your employer’s acceptable use policy governs your employer’s systems. It doesn’t reach accounts sitting on servers they don’t own. Workplace email privacy covers where that line falls for email specifically, including what happens to cached copies on a company laptop.

If they go in anyway, you can recover $1,000 per violation as a matter of statute, plus actual damages, punitive damages and attorney’s fees.

Three cases show how this usually happens, and none of them involve anything unusual.

In Pure Power Boot Camp, an employer opened a former employee’s Hotmail and Gmail using passwords the browser had saved on a company computer. The employer’s argument was that leaving your password on a work machine amounts to consent. The court disagreed, and held that a policy about company computers said nothing about accounts hosted somewhere else.

In Van Alstyne, an employer kept getting into a former employee’s personal email account for several years after she left. The court found a violation.

Ehling is the useful comparison. A nurse had posted something on Facebook with her privacy settings restricted to friends. A coworker screenshotted it and passed it to management. Because the employer never accessed the account, there was no violation — but the court made clear that if they’d gone in themselves, past her settings, the answer would have been different.

The test is whether your employer got into an account you didn’t authorize them to enter. A saved password on a work laptop isn’t authorization.

If you think this has happened, talk to an employment attorney before you raise it internally. The evidence is in the access logs, and those sit with your employer.

In Some States, They Can’t Ask for Your Passwords

More than two dozen states prohibit employers from demanding access to your personal social media accounts. The statutes differ in the details, but they generally stop an employer from asking for your username or password, requiring you to log in while they watch, requiring you to add your manager to your contacts, or pressuring you to change your privacy settings.

These states include Arkansas, California, Colorado, Connecticut, Delaware, Hawaii, Illinois, Louisiana, Maine, Maryland, Michigan, Montana, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, Oklahoma, Oregon, Rhode Island, Tennessee, Utah, Vermont, Virginia, Washington, West Virginia and Wisconsin.

Every one of them allows an employer to look at anything public. A public post, a public profile, a comment on someone else’s public page — all of that is outside the protection and can be used in a decision about your job. In practice that’s how most people get into difficulty, rather than through an outright password demand. See fired for social media posts.

These statutes get amended often. Check your own state’s current provisions, or your state labor department, before relying on it.

Monitoring Aimed at Finding Out Who’s Talking About Pay

People tend to assume this one only applies where there’s a union. It doesn’t.

Section 7 of the National Labor Relations Act protects employees who act together about wages, hours or working conditions. The NLRB calls it concerted activity, and it applies in workplaces with no union involvement at all. Two people comparing salaries counts. A group complaint about scheduling counts.

Surveillance carried out to identify who’s doing that is an unfair labor practice, and so is making employees believe they’re being watched in order to stop them.

General monitoring of company systems is still lawful. What isn’t lawful is monitoring undertaken for that purpose, or discipline that comes out of it. So if several of you raised overtime in a group chat and the people who did got written up shortly after, the sequence is the case. That one goes to the NLRB rather than to court, and you have six months from the conduct to file.

Medical Information Has Separate Rules

If monitoring picks up something medical — a search, an email to a specialist, a benefits inquiry — the ADA requires your employer to keep employee medical information confidential and filed separately from ordinary personnel records.

Two things follow. A manager repeating what they learned is a violation on its own, whether or not the monitoring was permissible. And if the information fed into a decision about your job, the claim is disability discrimination rather than invasion of privacy, which is a considerably stronger position to be in.

Places and Methods With Specific Limits

Bathrooms and changing areas. Many states ban video surveillance anywhere employees undress, and where no statute applies the common-law claim for intrusion upon seclusion generally does. This is one of the few workplace privacy claims that’s straightforward.

Audio recording. Around a dozen states require everyone in a conversation to consent before it can be recorded, including California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington. In those states an employer can’t lawfully record workplace conversations without consent, which is why cameras there often have the audio switched off. See can your employer record you at work and are cameras at work an invasion of privacy.

Your own property. A bag or a personal car isn’t company property, and searching it raises different questions from searching a company desk. See can your employer search your personal belongings at work.

What You Do Off the Clock

A few states limit what an employer can do about lawful conduct outside work. California protects employees from discipline over lawful off-duty activity. Colorado prohibits firing someone for lawful activity away from the premises during non-working hours. New York Labor Law § 201-d covers political activity, recreational activity and the legal use of consumable products outside working hours.

These are read narrowly and they’re litigated hard. But if you were disciplined over something you did on your own time and your own device, and you’re in one of those states, it’s worth asking about.

Three States Have to Tell You

New York, Connecticut and Delaware require employers to give notice that they monitor. Connecticut’s requirements expanded on October 1, 2026 and now include telling employees which specific locations are monitored.

The statute citations and what each notice has to contain are in can your employer see your browsing history.

One limitation on New York and Connecticut: enforcement belongs to the state. You can’t sue over a missing notice yourself, though it’s a useful fact to have inside a larger dispute.

If You Think a Line Was Crossed

Work out whose system was involved. Company equipment and company accounts point you toward the four exceptions above rather than a general privacy claim. A personal account on your own device is a different analysis entirely.

Write down how you found out. In most of these cases the employee learns about it indirectly: a manager quotes something you never sent them, or mentions a detail they had no business knowing. Note the date, what was said and who else was there. That’s often the strongest evidence in the case, and memories of it fade quickly.

Don’t raise a Stored Communications Act problem internally first. The proof is in the access logs.

Look at the timing. Monitoring that intensified after you complained about something raises a retaliation question as well as a privacy one. See is this workplace retaliation.

Get a copy of the policy. It sets out the scope of your consent, and equally, where that consent stops.

Frequently Asked Questions

Do I Have Any Internet Privacy at Work?

Very little on company systems. What you do have is specific: your personal accounts under the Stored Communications Act, your social media credentials in 27 states, protection from monitoring aimed at concerted activity under the NLRA, and confidentiality for medical information under the ADA.

Can My Employer Ask for My Facebook Password?

Not in the 27 states listed above. Elsewhere there’s no specific prohibition, though the Stored Communications Act still applies if they access the account without your authorization. Anything public is fair game everywhere.

Can My Employer Read My Personal Email on a Work Computer?

Reading what’s on the screen while you have it open is one thing. Logging into the account is another, and that engages the Stored Communications Act — including where they used a password the work browser had saved. Courts have held that a saved password isn’t authorization. Workplace email privacy goes through both cases in detail.

Is It Illegal to Monitor Me Without Telling Me?

Only in New York, Connecticut and Delaware. Everywhere else no notice is required. What was monitored and why matters more than whether you were told.

Can I Sue for Invasion of Privacy?

General monitoring of company systems rarely supports a claim. Access to personal accounts, cameras in bathrooms or changing areas, unlawful audio recording, and monitoring of protected activity each can. Which claim you have decides where you file it: court, the NLRB, or a state agency.

Does the Policy I Signed Matter?

Yes, for company systems. It’s the consent that makes most monitoring lawful. It doesn’t extend to accounts and devices your employer doesn’t own, however broadly it’s written.

Related Articles

• Can Your Employer See Your Browsing History? — what’s visible on each kind of device
• Workplace Email Privacy — company accounts versus personal ones
• Can Employers Monitor Slack or Microsoft Teams Messages?
• Can Your Employer Record You at Work? — consent rules by state
• Fired for Social Media Posts — what counts as public
• What Information Can Your Employer Collect About You?

Disclaimer

This article is general information, not legal advice. Employment law varies by state and by situation, and the rules described here may have changed since this article was last updated. For guidance on your circumstances, consult a licensed employment attorney in your state. See our full Disclaimer and Terms and Conditions.