Meta description: Learn how Illinois electronic monitoring laws affect workplace audio, video, computer, location, and biometric surveillance—and what employers risk when they fail to comply.
Employers in Illinois may use technology to protect people, property, and business information, but workplace monitoring can raise serious privacy and legal issues. Illinois does not have one law that governs every form of employee surveillance. Instead, requirements may come from the state’s eavesdropping law, biometric privacy law, workplace privacy rules, and federal statutes. Understanding what is being collected—and whether it captures a private conversation or biometric identifier—is essential to lawful monitoring.
What Illinois Electronic Monitoring Laws Cover
“Electronic monitoring” can refer to several different practices, including reviewing work email, recording workplace video, tracking company devices, monitoring GPS location, recording calls, or using biometric time clocks. These activities do not all follow the same legal rules. Audio recording and biometric data generally present greater legal risk than ordinary video surveillance or review of company systems.
Illinois has no single, comprehensive statute requiring employers to notify workers before every form of electronic monitoring. That does not mean monitoring is unrestricted. A recording may violate the Illinois Eavesdropping Act, and collecting fingerprints or facial geometry may trigger the Biometric Information Privacy Act (BIPA). Federal law, contracts, workplace policies, and the circumstances of the monitoring may also matter.
Employers should assess each tool separately: what it captures, whose information it collects, whether conversations are recorded, where monitoring occurs, and how long data is kept. A policy that addresses “monitoring” generally may not satisfy a law that requires specific notice and consent for biometric data.
Illinois Eavesdropping Law and Workplace Audio
The Illinois Eavesdropping Act, primarily found at 720 ILCS 5/14, governs certain uses of devices to hear, transmit, or record private conversations. Its application depends on whether the communication qualifies as a private conversation and whether the people involved consented. A workplace setting does not automatically make a conversation public.
As a practical compliance measure, employers should not secretly record conversations that employees or visitors reasonably expect to be private. Before recording meetings, calls, or conversations, employers should determine whether the Act applies and obtain appropriate consent. A workplace policy or sign may help communicate practices, but it should not be assumed to resolve every consent question in every situation.
Audio is often more legally sensitive than silent video. A camera that records images in a common work area may raise different issues from one that also captures speech. Employers should check whether cameras, conference platforms, call systems, or security devices have microphones enabled—and disable audio where it is unnecessary or legally uncertain.
Potential penalties for unlawful eavesdropping
Unlawful eavesdropping can result in criminal penalties under Illinois law. Depending on the conduct and circumstances, an offense may be charged as a felony. A person whose communication was unlawfully intercepted may also have civil remedies under the statute, which can include damages and, where authorized, attorney fees or other relief. The classification and consequences depend on the specific facts and applicable statutory provisions.
Because the Act is fact-sensitive and criminal exposure is possible, employers should consult Illinois counsel before adopting audio-recording practices. Employees and other affected individuals may also wish to preserve relevant information and obtain legal advice rather than relying on a general assumption that workplace recording is lawful.
BIPA Rules for Biometric Monitoring
Illinois’ Biometric Information Privacy Act, or BIPA, applies to specified biometric identifiers and information. The statute, 740 ILCS 14, identifies biometric identifiers such as a retina or iris scan, fingerprint, voiceprint, and scan of hand or face geometry. Biometric information derived from an identifier can also be covered. Ordinary photographs are not automatically biometric identifiers, but facial-recognition systems that extract face geometry may raise BIPA concerns.
Employers using fingerprint time clocks, facial-recognition access systems, or similar tools should review BIPA before collecting data. The law imposes specific requirements that are separate from general workplace notices. A company should not assume that an employee’s use of a device, or a broad handbook statement, supplies every required notice and release.
Core BIPA compliance steps
- Provide written notice: Before collection, inform the individual in writing that a biometric identifier or information is being collected or stored, explain the specific purpose, and state the length of time it will be kept and used.
- Obtain a written release: Secure a written release from the person or that person’s legally authorized representative, as required by the statute.
- Publish a retention and destruction policy: Make a written policy available to the public that sets out a retention schedule and guidelines for permanently destroying biometric data.
- Protect the information: Use reasonable safeguards and handle biometric data with at least the care used for other sensitive information, as required by BIPA.
- Limit disclosure and commercial use: Do not sell or profit from biometric identifiers or information, and do not disclose them except as the law permits or with the required consent.
BIPA generally requires destruction when the initial purpose for collecting the data has been satisfied or within three years of the individual’s last interaction with the private entity, whichever occurs first. A compliant retention policy should account for this limit and specify how data is securely destroyed.
BIPA lawsuit exposure
BIPA gives individuals a private right of action. The statute allows liquidated damages of $1,000 for each negligent violation or $5,000 for each intentional or reckless violation, or actual damages where applicable, along with potential injunctive relief and reasonable attorney fees and costs. Courts assess the claim and available remedies based on the facts and governing law.
Illinois amended BIPA in 2026 to address repeated collection and disclosure using the same method. Under the amendment, repeated biometric collection from the same person using the same method may constitute a single violation, and repeated disclosure in the same manner may likewise be treated as a single violation. The amendment followed significant litigation over how violations should be counted. Employers should review the current statutory text and legal developments rather than estimate exposure by simply multiplying every scan by a statutory amount.
Computer, Email, and Device Monitoring
Employers commonly review activity on company-owned computers, networks, email accounts, and mobile devices for security, productivity, or compliance. Illinois does not impose a universal advance-notice rule for every such review. However, monitoring should be tied to legitimate business purposes, described accurately in policies, and limited to appropriate systems and data.
Federal laws can also apply. The federal Electronic Communications Privacy Act (ECPA) generally regulates interception of electronic communications, with exceptions that may apply in particular circumstances, such as consent or ordinary-course business monitoring. Those exceptions are not blanket permission to capture every communication. Personal accounts, private devices, and communications unrelated to work can create additional legal and practical risks.
Illinois’ Right to Privacy in the Workplace Act, 820 ILCS 55, addresses particular workplace privacy matters, including employer access to personal online accounts. In general, employers may not require or request an employee or applicant to provide passwords or other account-access information for a personal online account. The law has exceptions, including certain investigations and access to employer-provided accounts or devices, so employers should distinguish personal accounts from company systems.
Good practice includes telling workers what systems may be monitored, explaining the business reasons, and clarifying that company equipment and accounts may be subject to review. Policies should not promise privacy that the employer does not intend to provide. At the same time, a policy does not eliminate legal limits on interception, access, or collection of protected information.
Video Surveillance and Location Tracking
Video monitoring may be used in entrances, inventory areas, production spaces, and other locations where security or operational needs justify it. Employers should avoid surveillance in places where people have a strong expectation of privacy, such as restrooms and changing areas. Monitoring in private or sensitive spaces can trigger serious legal, reputational, and employee-relations concerns even when the device records no audio.
GPS tracking through company vehicles or devices can help with dispatch, safety, and asset management. Employers should explain when tracking is active, which devices or vehicles are covered, and how location information is used. Tracking a personal device or following an employee outside work can raise additional privacy questions. Employers should limit collection to a defined business purpose and avoid collecting more location data than necessary.
Notice is a practical safeguard even when a specific Illinois statute does not require a particular notice for the monitoring method. Clear signage and written policies can reduce misunderstandings, support consistent administration, and help employees understand the scope of surveillance. Notice alone, however, does not make an otherwise unlawful recording or biometric practice lawful.
Compliance Checklist for Illinois Employers
- Inventory monitoring tools. List cameras, microphones, call-recording systems, email and network logs, GPS tools, access-control systems, and biometric devices.
- Identify the data collected. Determine whether a tool captures audio, personal communications, location, fingerprints, face geometry, or other sensitive information.
- Check consent and notice requirements. Review the Eavesdropping Act for audio and BIPA for biometric identifiers. Do not rely on a generic policy where a law calls for specific written notice or a release.
- Set a clear business purpose. Explain why each monitoring practice is needed and restrict access to people with a legitimate business role.
- Write and distribute policies. Describe monitored systems, the type of data collected, the purposes, and retention practices. Keep the language consistent with actual operations.
- Limit retention and secure data. Establish deletion schedules, access controls, and safeguards. Apply BIPA’s specific retention and destruction requirements to biometric information.
- Review vendors and settings. Confirm whether third-party software records audio, uses facial recognition, or stores data outside the employer’s systems. Configure tools to avoid unnecessary collection.
- Reassess changes. New software, a new purpose, or a change from silent video to audio recording can alter the legal analysis. Review practices before deployment.
What Employees Can Do About Suspected Illegal Monitoring
Employees who are concerned about workplace surveillance can review the handbook, privacy notices, or biometric release forms and ask what information is collected, why it is collected, and how long it is retained. They can also document the device or practice involved, dates, communications, and any notices provided. Avoid accessing or removing company data without authorization.
For suspected biometric violations, individuals may seek advice from an Illinois attorney about BIPA’s requirements and deadlines. Concerns involving recorded private conversations may require prompt legal review because both the facts and the applicable rules matter. A complaint to an employer or regulator may be appropriate in some situations, but it does not necessarily replace an individual’s legal remedies.
Key Takeaways on Illinois Electronic Monitoring Laws
Illinois electronic monitoring compliance depends on the technology and information involved. Audio recording can implicate the Eavesdropping Act; fingerprints and face-geometry scans can trigger BIPA’s written notice, release, security, and destruction requirements; and personal online accounts receive protections under the Right to Privacy in the Workplace Act. Employers should use transparent, purpose-limited monitoring and review each system before deployment. Because penalties and liability turn on specific facts and evolving law, this article is general information, not legal advice.