Worker monitoring in United States (federal): related rules
Using AI to track workers' activity, productivity, location, behavior or state through cameras, software or sensors. It clashes with privacy and dignity, so it requires proportionality and prior notice, and in the EU inferring emotions is banned.
Risk classification
Jurisdiction
Level
Date
Note
New York (incl. NYC)
Sector rules
—
New York electronic monitoring law (2022): prior written notice and acknowledgment.
California
Data protection
January 1, 2026
The CCPA covers employee data; risk assessments for systematic observation of workers.
Obligations related to this use case
Risk assessment before using ADMT or other high-risk processing
Applies to CCPA-covered businesses (revenue threshold, 100,000 residents or 50% of revenue from selling data) that use ADMT for significant decisions, infer traits of employees, applicants or students through systematic observation, process sensitive data, or train ADMT or facial recognition. Training models on your own data is not enough by itself. For processing that began before 2026 the deadline is December 31, 2027.
What the rule provides
Conduct and document the assessment before starting the processing.
Describe the specific purpose, data, concrete benefits, negative impacts and safeguards; involve the staff who take part.
Have it approved by a person with authority over the processing.
Review it at least every three years and update it within 45 days of a material change.
Keep it while the processing continues or for five years after completion, whichever is later.
For processing that already existed before January 1, 2026, the deadline is December 31, 2027.