GPS Employee Monitoring Laws by State: Notice and Vehicle Rules

Company vehicles can usually carry GPS — personal cars and always-on phone tracking are where state criminal and notice laws bite hardest.

There is no single federal statute that tells private employers when they may track a worker’s location. The federal floor is mostly communications privacy (the Electronic Communications Privacy Act), FLSA recordkeeping for hours worked, and Fourth Amendment case law that binds government — not private payroll systems. The rules that actually decide how a small employer runs GPS time clocks, geofencing, and fleet telematics sit in state criminal tracking statutes, workplace electronic-monitoring notice laws, and (in California especially) consumer-privacy statutes that now cover employees.

Four states have dedicated workplace electronic-monitoring notice statutes as of mid-2026: Connecticut, Delaware, New York, and Maine (effective summer 2026). Separate criminal statutes in California, Illinois, Texas, Florida, and others regulate attaching or using electronic tracking devices on vehicles and property. Those two stacks are easy to confuse — and confusing them is expensive.

This research maps the federal baseline, the strictest state regimes, company-vehicle versus personal-device lines, notice-and-consent rules for GPS time clocks and geofencing products, and the operational records that make monitoring defensible.

Which sections matter for you

Do you run GPS clock-in, geofencing, or fleet telematics on field crews? Start with the operational mechanism section and the five expensive mistakes.
Do you have workers in California? Read the California deep-dive (Penal Code §637.7 plus CCPA/CPRA location rules).
Do you have workers in Connecticut, Delaware, New York, or Maine? Read the electronic-monitoring notice statutes section.
Do employees drive personal vehicles for work, or install a tracking app on a personal phone? Read the private-vehicle and personal-device section.
Do you only track company-owned trucks or phones during work hours? Read the federal floor and the state-by-state table rows for your states.
Are you using fingerprint or face-scan timeclocks as well as GPS? Cross-link to buddy punching and biometric privacy research — this piece does not restate BIPA.

Quick reference

No comprehensive federal employee GPS statute. Private-employer location tracking is governed mainly by state criminal tracking laws, state electronic-monitoring notice laws, state privacy statutes, and common-law invasion-of-privacy claims.
Electronic monitoring notice states (communications / workplace systems): Connecticut (Conn. Gen. Stat. §31-48d), Delaware (19 Del. C. §705), New York (N.Y. Civil Rights Law §52-c*2), Maine (26 M.R.S.A. §620-A, L.D. 61 / P.L. 2025, ch. 524, effective summer 2026).
Vehicle / device tracking statutes (criminal): California (Penal Code §637.7), Illinois (720 ILCS 5/21-2.5), Texas (Penal Code §16.06), Florida (§934.425).
California owner-consent exception: §637.7 does not apply when the registered owner, lessor, or lessee of a vehicle has consented to tracking of that vehicle.
Illinois business-vehicle exception: 720 ILCS 5/21-2.5(c)(3) expressly allows tracking of business-owned or -leased vehicles driven by employees, affiliates, or contractors.
Maine employer-vehicle GPS carve-out: “Employer surveillance” excludes GPS or other safety devices on vehicles owned by the employer and operated by the employee.
California precise geolocation is “sensitive personal information” under the CCPA/CPRA — data used to locate a consumer within a circle of radius 1,850 feet or less (Civ. Code §1798.140(w), (ae)).
Federal Fourth Amendment GPS case: United States v. Jones, 565 U.S. 400 (2012) — government attachment and use of a GPS device on a vehicle is a search; it does not directly regulate private employers.
Biometrics cross-ref only: Illinois BIPA and related biometric timeclock rules live in buddy punching and time clock fraud research.

The 5 most expensive monitoring mistakes

Putting a tracker on a personal vehicle without owner consent. California Penal Code §637.7 makes it a misdemeanor to use an electronic tracking device to determine the location or movement of a person, with a vehicle-owner consent exception — not an employee-consent exception written the same way. Texas Penal Code §16.06 makes knowingly installing a tracking device on a motor vehicle owned or leased by another person a Class A misdemeanor unless effective consent (or a narrow defense) applies. A field tech’s personal truck is not “company property” just because it carries tools for jobs.
Skipping the Connecticut / New York / Delaware / Maine notice stack. Connecticut requires prior written notice (satisfied by a conspicuous posting) of the types of electronic monitoring that may occur on the employer’s premises. New York requires written notice upon hiring with employee acknowledgment plus a conspicuous posting for telephone, email, and internet monitoring. Delaware requires daily electronic notice or a one-time acknowledged notice for telephone, email, and Internet monitoring. Maine (effective summer 2026) requires notice before surveillance begins, interview-stage disclosure, and at least annual written notice. GPS time clocks often run alongside email and device monitoring; missing the communications-notice statute while fixing the GPS policy still leaves a fine surface.
Treating always-on personal-phone tracking as if it were a company truck telematics unit. Company-owned vehicle GPS during work hours is the cleanest pattern under most criminal tracking statutes. A continuous location stream from an employee’s personal phone, nights and weekends included, is a different product legally: it raises common-law privacy claims, California sensitive-location rules, Maine personal-device refusal rights, and (if biometrics are added) BIPA-class exposure covered in the buddy-punching research.
Confusing geofenced clock-in with secret surveillance. A geofence that records a punch when a worker enters a job site is still collection of location data. In notice states, describe it. In California, precise geolocation can be sensitive personal information under CCPA/CPRA. In Maine, employees may decline installing surveillance apps on personal devices. The fix is transparent, work-purpose, work-hours design — not silent collection.
Using location logs for discipline without a defensible record trail. Under the FLSA recordkeeping rules at 29 CFR §516.2, hours-worked records are the employer’s evidence. A GPS point that only says “device was near the job site” is weak if the system also lets workers punch from outside the geofence without an approval trail. When location data becomes the story in a wage dispute, incomplete logs help the other side as much as they help you — the same Mt. Clemens problem described in the buddy-punching research.

The federal floor — what does not exist, and what still matters

No federal private-employer GPS statute

Congress has not enacted a general “employee location tracking” act for private employers. Whether a private employer may track a worker’s location is almost always a state-law and common-law question, layered on federal communications and wage-hour rules that touch the same tools.

Electronic Communications Privacy Act (ECPA)

The federal Wiretap Act, codified primarily at 18 USC §2511, prohibits intentional interception of wire, oral, or electronic communications, with consent and provider exceptions. Location pings from a GPS module are not the classic “contents of a communication” fact pattern the Wiretap Act was written for, but monitoring that captures content of calls, texts, or emails on the same device is squarely in ECPA territory. Practical takeaway: if your “GPS product” also reads message content or records calls, you have a federal communications problem, not only a state tracking problem.

FLSA recordkeeping

29 CFR §516.2 requires accurate hours-worked records for non-exempt employees. GPS and geofence tools are often used to support those records — job-site presence, travel between sites, remote clock-in validation. They do not replace the duty to keep hours; they are secondary evidence of when and where work happened. Retention floors remain three years for payroll records and two years for supplementary time records under 29 CFR §§516.5–516.6.

United States v. Jones — government, not private payroll

In United States v. Jones, 565 U.S. 400 (2012), the Supreme Court held that the government’s attachment of a GPS device to a vehicle, and its use of that device to monitor the vehicle’s movements, is a Fourth Amendment search. The case is the landmark GPS privacy decision in U.S. law. It binds state actors. Private employers are not the government; Jones is still useful as context for why state legislatures criminalize secret trackers and why juries react badly to stealth personal-vehicle tracking.

Constitutional privacy in some states

California’s state constitutional right of privacy and common-law intrusion claims can reach workplace monitoring that is highly offensive and not justified by a legitimate business purpose — even when no single statute is a perfect fit. Other states recognize similar common-law privacy torts with different elements. Those claims are fact-specific; the operational defense is always the same: notice, consent where required, business purpose, and narrow collection windows.

California — criminal tracking plus privacy law

California is the strictest multi-layer stack for location monitoring: a criminal electronic-tracking statute, a broad constitutional privacy right, and employee-covered CCPA/CPRA rules that treat precise geolocation as sensitive personal information.

Penal Code §637.7 — electronic tracking devices

California Penal Code §637.7 provides:

“(a) No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person.

(b) This section shall not apply when the registered owner, lessor, or lessee of a vehicle has consented to the use of the electronic tracking device with respect to that vehicle.

(c) This section shall not apply to the lawful use of an electronic tracking device by a law enforcement agency.

(d) As used in this section, ‘electronic tracking device’ means any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals.

(e) A violation of this section is a misdemeanor.”

Three employer-facing points:

The prohibition is about using a tracking device to determine a person’s location or movement — not a narrow “stalking ex-spouse” statute by its text.
The clean statutory exception is owner/lessor/lessee consent for a vehicle. A company that owns the truck can consent as owner. Tracking an employee’s personal car without the registered owner’s consent is the high-risk fact pattern.
“Device attached to a vehicle or other movable thing” is physical-device language. Whether a pure software location stream from a phone app is always a §637.7 “device” is litigated and fact-dependent; employers should not treat “it’s only an app” as a free pass when the app’s job is continuous location of a person.

A violation is a misdemeanor. Subdivision (f) adds professional-license revocation exposure for certain Business and Professions Code licensees.

CCPA / CPRA — location as personal and sensitive information

As of January 1, 2023, the employee/applicant exemption from the California Consumer Privacy Act sunsetted. Covered businesses must treat workforce personal information under CCPA/CPRA rules, including notice-at-collection duties.

Under Civil Code §1798.140:

Geolocation data is listed as a category of personal information (§1798.140(v)(1)(G)).
Precise geolocation means data derived from a device and used or intended to be used to locate a consumer within a geographic area equal to or less than a circle with a radius of 1,850 feet, except as prescribed by regulations (§1798.140(w)).
Precise geolocation is sensitive personal information (§1798.140(ae)(1)(C)).

For employers that meet CCPA “business” thresholds, GPS time-clock coordinates and continuous tracking streams that meet the precise-geolocation definition are not ordinary payroll metadata. They trigger the sensitive-information regime, including the consumer’s right to limit use and disclosure of sensitive personal information for certain purposes.

Things employers consistently miss in California

Owner consent ≠ employee handbook footer. If the vehicle is titled to the worker, company policy language is not the same as registered-owner consent under §637.7(b).
Work-hours-only design is not optional as a risk control. Continuous personal-phone tracking after hours is the fact pattern that looks least like fleet management and most like surveillance of a person.
Notice-at-collection for employees should name location/geolocation categories when the company actually collects them — not bury “device data” in a consumer privacy policy nobody on the crew will see.
Geofence radius matters. A job-site geofence that locates a worker within roughly three-and-a-half football fields is inside the statutory 1,850-foot precise-geolocation circle.
Biometric + GPS stacks. A face-scan timeclock plus GPS is two compliance regimes. Biometrics are covered in the buddy-punching research; do not assume CCPA notice alone satisfies BIPA-style consent if Illinois workers are in scope.

Electronic monitoring notice states — CT, DE, NY, Maine

These statutes are about telling workers you monitor electronic systems. They are not identical to criminal tracking-device laws. GPS products often ride next to email, phone, and computer monitoring, so multi-state employers usually need both stacks.

Connecticut — Conn. Gen. Stat. §31-48d

Connecticut’s statute requires employers who engage in electronic monitoring to give prior written notice to affected employees of the types of monitoring that may occur. Posting in a conspicuous place constitutes that prior written notice.

Definition (load-bearing): “Electronic monitoring” means the collection of information on an employer’s premises concerning employees’ activities or communications by any means other than direct observation, including computer, telephone, wire, radio, camera, electromagnetic, photoelectronic or photo-optical systems — with exceptions for security cameras in public common areas and for monitoring prohibited by other law.

Why “on an employer’s premises” matters for GPS: Off-site tracking of company vehicles is not automatically the same as premises electronic monitoring. Connecticut trial-level authority has treated off-site GPS of city-owned vehicles as outside the notice statute’s premises definition — but posting notice remains the safer multi-system practice, and common-law privacy claims still exist.

Penalties: Labor Commissioner civil penalties up to $500 / $1,000 / $3,000 for first / second / subsequent offenses. No private right of action under the statute (Connecticut Supreme Court: 294 Conn. 461).

Misconduct exception: Prior notice is not required when the employer has reasonable grounds to believe employees are violating law, violating legal rights, or creating a hostile workplace environment, and monitoring may produce evidence of that misconduct.

Delaware — 19 Del. C. §705

Delaware prohibits employers from monitoring or intercepting telephone conversations or transmissions, electronic mail or transmissions, or Internet access or usage of a Delaware employee unless the employer either:

Provides electronic notice of the monitoring policies at least once each day the employee accesses employer-provided email or Internet services; or
Has first given a one-time notice in writing or electronic form that the employee acknowledges in writing or electronically.

Penalty: $100 civil penalty per violation. System-maintenance processes that are not targeted at a particular individual are excluded. Law-enforcement activity under court order is excluded.

Delaware’s text is telephone / email / Internet-focused. It is not a vehicle-GPS statute. Employers still pair it with tracking-device and privacy analysis when the same device does both email and location.

New York — Civil Rights Law §52-c*2

New York’s electronic monitoring notice law (effective May 7, 2022) is a second §52-c in the Civil Rights Law (hence the *2 designation in the statute books).

Who: Private employers with a place of business in New York (state and political subdivisions excluded).

What: Any employer who monitors or otherwise intercepts telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by an employee using electronic devices or systems (computer, telephone, wire, radio, electromagnetic, photoelectronic or photo-optical systems) must:

Give prior written notice upon hiring to employees subject to electronic monitoring, in writing or electronic form, acknowledged by the employee in writing or electronically; and
Post the notice in a conspicuous place readily available to employees subject to monitoring.

Statutory notice content: Employees must be advised that any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by any electronic device or system may be subject to monitoring at any and all times and by any lawful means.

Enforcement: New York Attorney General; civil penalties up to $500 first offense, $1,000 second, $3,000 third and subsequent. No private right of action in the statute.

Scope note for GPS products: The statutory text is about telephone, email, and internet usage — not a free-standing GPS consent law. New York employers who monitor email and run GPS time clocks still need the §52-c*2 notice for the covered channels; location collection should still be disclosed as a matter of policy hygiene.

Maine — 26 M.R.S.A. §620-A (L.D. 61 / P.L. 2025, ch. 524)

Maine enacted “An Act to Regulate Employer Surveillance to Protect Workers” as law without the governor’s signature on January 11, 2026 (H.P. 25 – L.D. 61; Chapter 524). It adds Subchapter 1-E to 26 M.R.S.A. chapter 7, new §620-A. The law takes effect in summer 2026 (90 days after legislative adjournment; commonly cited as mid-July 2026).

Definition: “Employer surveillance” means monitoring of an employee through an electronic device or system, including computer, telephone, wire, radio, or electromagnetic, photoelectronic, or photo-optical systems.

Explicit GPS carve-out: Employer surveillance does not include the use of surveillance cameras for security or safety purposes, or the use of global positioning system tracking or other safety devices on vehicles owned by the employer but operated by the employee.

Core duties:

No employer surveillance unless the employer notifies the employee before beginning.
No audiovisual monitoring in an employee’s residence, personal vehicle, or on the employee’s property as a means of employer surveillance unless required for job duties.
Employees may decline a request to install data-collection or transmission applications on personal electronic devices for employer surveillance.
Prospective employees must be informed during the interview process; current employees get written notice at least once per calendar year.
Penalties: $100–$500 per violation, Maine Department of Labor enforcement. No private right of action in the statute text.

Maine is the newest dedicated notice statute and the clearest modern text distinguishing employer-vehicle GPS from personal-device surveillance apps.

Private vehicle vs employer device — the practical split

Scenario	Usual legal posture	Highest-risk states
GPS/telematics on company-owned vehicle during work	Generally lawful; owner can consent; several statutes carve out business fleets	Still post notice in CT/NY/DE/ME where communications monitoring also occurs
GPS on personal vehicle without registered-owner consent	Often criminal or high-risk under tracking-device statutes	CA §637.7, TX §16.06, IL 720 ILCS 5/21-2.5 (unless exception), FL §934.425 (person-focused; business exceptions apply carefully)
Location app on company phone, work hours only	Strongest BYOD-alternative pattern	Disclose in handbook + state notices; limit after-hours collection
Location app on personal phone	Highest privacy risk; Maine allows employee refusal	ME §620-A(4); CA CCPA precise geolocation; common-law privacy
Geofenced clock-in only at job sites	Lower continuous-surveillance risk if transparent	Still disclose; treat coordinates as location data under CA privacy rules

Worked example — Marcus the HVAC lead

Marcus is the lead tech at a 22-person HVAC company. He drives a company van in Connecticut and a personal pickup for weekend on-call work in California when the firm opened a Bay Area branch.

Company van in Connecticut: Fleet GPS on the employer-owned van is the clean pattern. The firm still posts a §31-48d electronic-monitoring notice covering computers, phones, cameras, and related systems at the shop. Off-site vehicle GPS may fall outside the premises definition, but the posted notice plus a clear fleet policy is the operational standard.
Personal pickup in California: Installing a magnetic tracker under the bumper without Marcus (or the registered owner) consenting is the §637.7 problem. Safer alternatives: company vehicle for California calls, or a clock-in geofence / on-shift app with clear written consent and work-hours-only collection — not a hidden tracker.

Same employee, two states, two devices: the ownership of the vehicle and the transparency of the tool decide the risk more than the brand name of the software.

Other criminal tracking statutes employers actually hit

Illinois — 720 ILCS 5/21-2.5

Illinois prohibits using an electronic tracking device (defined as a device attached to a vehicle that reveals location or movement by electronic signals) to determine the location or movement of a person. Class A misdemeanor.

Business exception (employer-critical): The section does not apply when the vehicle is owned or leased by a business authorized to transact business in Illinois and the tracking device is used to track vehicles driven by employees, affiliates, or contractors of that business or its affiliates. Owner/lessor/lessee consent, law enforcement, state-agency fleet tracking, and manufacturer telematics with subscription consent are also excepted.

Texas — Penal Code §16.06

A person commits a Class A misdemeanor by knowingly installing an electronic or mechanical tracking device on a motor vehicle owned or leased by another person. Affirmative defense: effective consent of the owner or lessee before installation (plus limited law-enforcement / licensed-investigator defenses). Peace officers acting in investigations are outside the offense.

Employer read: Track company-titled vehicles as owner. Do not install hardware on employee-owned vehicles without the owner/lessee’s effective consent.

Florida — §934.425

Florida prohibits a “person” (defined as an individual, not a business entity) from knowingly installing or placing a tracking device or tracking application on another person’s property without consent, or using such a device/application to determine location or movement without consent. Consent is presumed revoked on certain divorce or protection-order filings.

Exceptions include law enforcement, court orders, certain parental and caregiver uses, a good-faith business-entity purpose exception, and owner/lessee motor-vehicle installation rules for the ownership/lease period.

Employer read: The statute is written primarily at individuals (stalking-style fact patterns). Business-purpose activity has a textual exception, but counsel should still separate company-asset tracking from personal-property tracking, and avoid “person” conduct that looks like secret installation on an employee’s private property.

State-by-state table

Rules below are employer-facing summaries for GPS / electronic monitoring. “No dedicated statute” does not mean “no risk” — common-law privacy, wiretap, and sector rules may still apply. Always confirm current code text before a rollout.

State	Dedicated workplace e-monitoring notice?	Vehicle / device tracking statute (selected)	GPS / location practical note
Alabama	No	No primary employer GPS notice statute	Company-vehicle tracking common; use notice as best practice
Alaska	No	No primary employer GPS notice statute	Same
Arizona	No	No primary employer GPS notice statute	Same
Arkansas	No	No primary employer GPS notice statute	Same
California	No dedicated CT-style notice statute; CCPA/CPRA employee privacy applies to covered businesses	Penal Code §637.7	Owner consent for vehicle trackers; precise geolocation = sensitive PI
Colorado	No CT-style monitoring notice for private employers generally; separate automated-decision and privacy rules may apply	Wiretap-style rules exist; not a CA/TX clone	Disclose location collection in privacy notices when required
Connecticut	Yes — §31-48d	Premises electronic monitoring notice; GPS off-site is definition-sensitive	Post types of monitoring; treat fleet GPS as policy + notice hygiene
Delaware	Yes — 19 Del. C. §705	Phone/email/Internet notice (daily or one-time acknowledged)	Pair with vehicle policy if devices do both
Florida	No	§934.425	“Person” excludes business entities; business-purpose exception; still avoid secret personal-property trackers
Georgia	No	No primary employer GPS notice statute	Company-vehicle tracking common
Hawaii	No	No primary employer GPS notice statute	Same
Idaho	No	No primary employer GPS notice statute	Same
Illinois	No CT-style notice statute	720 ILCS 5/21-2.5 with business fleet exception	Company vehicles OK under exception; personal vehicles need consent path
Indiana	No	No primary employer GPS notice statute	Same
Iowa	No	No primary employer GPS notice statute	Same
Kansas	No	No primary employer GPS notice statute	Same
Kentucky	No	No primary employer GPS notice statute	Same
Louisiana	No	No primary employer GPS notice statute	Same
Maine	Yes (summer 2026) — §620-A	Employer-vehicle GPS carved out of “employer surveillance”; personal-device install may be refused	Interview notice + annual written notice; no AV monitoring in home/personal vehicle unless job-required
Maryland	No CT-style notice; broader privacy statutes evolving	No CA-style employer tracking clone as primary tool	Disclose collection; watch MODPA sensitive-data rules for larger programs
Massachusetts	No	No primary employer GPS notice statute	Common-law privacy; company-vehicle tracking common
Michigan	No	No primary employer GPS notice statute	Same
Minnesota	No	No primary employer GPS notice statute	Same
Mississippi	No	No primary employer GPS notice statute	Same
Missouri	No	No primary employer GPS notice statute	Same
Montana	No	No primary employer GPS notice statute	Same
Nebraska	No	No primary employer GPS notice statute	Same
Nevada	No	No primary employer GPS notice statute	Same
New Hampshire	No	No primary employer GPS notice statute	Same
New Jersey	No	No primary employer GPS notice statute	Same
New Mexico	No	No primary employer GPS notice statute	Same
New York	Yes — CVR §52-c*2	Hire notice + acknowledgment + posting for phone/email/internet monitoring	GPS not the statute’s core text; still disclose location tools in policy
North Carolina	No	No primary employer GPS notice statute	Same
North Dakota	No	No primary employer GPS notice statute	Same
Ohio	No	No primary employer GPS notice statute	Same
Oklahoma	No	No primary employer GPS notice statute	Same
Oregon	No	No primary employer GPS notice statute	Same
Pennsylvania	No	No primary employer GPS notice statute	Same
Rhode Island	No	No primary employer GPS notice statute	Same
South Carolina	No	No primary employer GPS notice statute	Same
South Dakota	No	No primary employer GPS notice statute	Same
Tennessee	No (private-employer CT-style notice)	Public-sector rules may differ	Same baseline for private employers
Texas	No	Penal Code §16.06	Owner/lessee consent defense; company title solves installation on company trucks
Utah	No	No primary employer GPS notice statute	Same
Vermont	No	No primary employer GPS notice statute	Same
Virginia	No CT-style notice; VCDPA-style privacy for covered controllers	No CA-style tracking clone as primary tool	Privacy notice obligations may reach employee data for covered businesses
Washington	No CT-style notice; My Health My Data / biometric rules elsewhere	No CA-style tracking clone as primary tool	Disclose; biometrics → separate analysis
West Virginia	No	No primary employer GPS notice statute	Same
Wisconsin	No	No primary employer GPS notice statute	Same
Wyoming	No	No primary employer GPS notice statute	Same
District of Columbia	No CT-style notice	No CA-style tracking clone as primary tool	Same baseline; privacy policy hygiene

Operational mechanism — GPS time clocks and geofencing without the stealth problem

Clockspot’s product domain is time records, locations, approvals, and payroll handoff — not criminal defense. The operational habits that keep GPS time tools defensible:

Write the purpose first. Job-site verification, travel time, dispatch, and safety check-ins are legitimate business purposes. “See what they do on Sunday” is not a timekeeping purpose.
Prefer employer-owned devices and vehicles when continuous location is truly needed. Title and ownership solve half the criminal statutes.
Default to event-based collection for timekeeping. Geofenced clock-in/out, on-shift location samples, and job-arrival stamps beat 24/7 trails.
Issue state-required notices. CT posting; NY hire acknowledgment + posting; DE daily or one-time acknowledgment; ME interview + annual written notice when effective.
Get documented consent where the statute or the device ownership demands it — vehicle owner/lessee consent for hardware trackers; written policy acknowledgment for apps.
Separate location logs from content monitoring. If you also read email or record calls, ECPA and the CT/DE/NY notice statutes are in play.
Retain location evidence with the punch. Punch time, geofence ID, GPS point or in/out flag, device ID, edit reason, and approver — the same secondary-evidence stack that helps when buddy punching is disputed.
Do not bolt biometrics onto GPS as an afterthought. Fingerprint and face-geometry rules are a different statute family — see buddy punching and biometric privacy.

Multi-state and remote field crews

Work location of the employee drives which notice and tracking statute applies — not the state printed on the company letterhead.

A Texas-headquartered contractor with a California-resident tech in a personal truck faces California §637.7 and CCPA analysis for that worker’s California work.
A New York shop that only monitors email still needs §52-c*2 notice for New York employees even if GPS is limited to New Jersey jobs.
Maine’s personal-device refusal right will matter for remote installers asked to put a surveillance app on their own phones once §620-A is effective.

Practical multi-state rule: one national policy that meets the strictest notice + ownership + purpose rules you actually touch, with state addenda for CT posting language, NY acknowledgment forms, DE daily banners (if used), ME annual notices, and CA privacy notices.

Recent changes (last 18 months)

Maine L.D. 61 / P.L. 2025, ch. 524 (signed into law without governor’s signature January 11, 2026): new employer-surveillance notice statute with employer-vehicle GPS carve-out, personal-device refusal right, and summer 2026 effective date.
Florida §934.425 amendments (2024–2025 legislative updates): continued refinement of tracking-device/application prohibitions, consent-revocation rules, and penalty structure (third-degree felony baseline for individual violations under the current text).
California CCPA employee coverage continues in force (employee exemption sunset January 1, 2023); precise geolocation remains sensitive personal information under §1798.140.
No new federal private-employer GPS act enacted in this window; Jones (2012) remains the leading Supreme Court GPS search case for government actors.

FAQ

Can I put GPS on a company truck without telling the driver?

Usually yes under criminal tracking statutes when the company is the registered owner — California’s owner-consent exception and Illinois’s business-vehicle exception are the textbook paths. Best practice and notice-state law still favor written policies and, where electronic systems are monitored, the CT/NY/DE/ME notices. Secret after-hours use of data for non-business purposes still creates privacy risk.

Can I put GPS on an employee’s personal car?

Not safely without the registered owner’s (or lessee’s) consent under California §637.7 and Texas §16.06-type statutes. Prefer a company vehicle, mileage logs, or a transparent work-hours app with documented consent.

Connecticut requires notice of the types of electronic monitoring that may occur (posting can satisfy). New York’s statutory text targets telephone, email, and internet monitoring with hire notice, acknowledgment, and posting. Neither statute is only a “GPS form,” but GPS programs that share devices with email/phone monitoring inherit those notice duties.

Is geofenced clock-in “electronic monitoring”?

In Connecticut, monitoring is defined around collection of information on the employer’s premises by electronic means. A geofence at a customer site may or may not fit that premises definition, depending on facts. In Maine, electronic system monitoring is broadly “employer surveillance,” with an employer-vehicle GPS carve-out. Treat geofenced clock-in as something you disclose in policy even when a statute’s fit is imperfect.

Does the CCPA stop California employers from using GPS time clocks?

No. Covered businesses can collect personal information for business purposes with proper notice and rights handling. Precise geolocation is sensitive personal information, so the notice and “limit use” architecture must match what you actually collect.

What about biometric timeclocks plus GPS?

Two regimes. Location rules are in this research. Biometric notice, consent, retention, and private-lawsuit exposure — especially Illinois BIPA — are covered in buddy punching and time clock fraud research.

Do federal wiretap laws ban GPS?

Not as a general GPS ban. ECPA targets interception of communications contents. If your stack records calls or reads message contents, analyze ECPA separately from pure location pings.

What penalties apply for missing New York’s notice?

Attorney General civil penalties up to $500 / $1,000 / $3,000 for first / second / subsequent offenses under CVR §52-c*2. The statute does not create a private right of action.

If you discover you've been doing this wrong

Inventory devices and ownership. List every tracker, telematics unit, phone MDM profile, and time-clock geofence. Tag each as company vehicle, personal vehicle, company phone, or personal phone.
Map employees to states. Apply CT/DE/NY/ME notice rules and CA/IL/TX/FL tracking statutes by work location, not HQ.
Stop high-risk collection immediately. Remove hardware from personal vehicles that lack owner/lessee consent. Turn off after-hours personal-phone tracking that has no business purpose.
Issue or re-issue notices. CT posting; NY acknowledgments for new hires and conspicuous posting for all covered employees; DE one-time acknowledgment or daily notice; ME interview + annual notice when effective; CA employee notice-at-collection naming location categories.
Rewrite the retention and access rules. Who can see live maps? How long are coordinates kept? When can location data support discipline? Document the answers next to the timekeeping policy.
Align time records with location evidence. Ensure punches, geofence events, edits, and approvals stay exportable for wage disputes — the FLSA §516.2 discipline.

The bottom line

Federal law does not hand small employers a single GPS rulebook. State criminal tracking statutes police secret devices on other people’s property, workplace notice statutes police undisclosed electronic monitoring of systems, and California privacy law treats precise geolocation as sensitive personal information for covered businesses.

The failure modes recur:

Personal vehicles tracked like company trucks without owner consent.
Notice states ignored while the GPS vendor is configured.
Always-on personal-phone trails sold as timekeeping.
Location logs used for discipline without a clean punch-and-approval record.
Biometric add-ons treated as “just another punch method” without reading the biometric statutes.

The operational discipline is simple: track employer assets for work purposes during work windows, tell people in the form each state requires, and keep location evidence tied to the time record you would defend in a wage case.

Sources

New York

N.Y. Civil Rights Law §52-c*2 (electronic monitoring notice): https://www.nysenate.gov/legislation/laws/CVR/52-C*2

Maine

L.D. 61 / H.P. 25, P.L. 2025, ch. 524 (26 M.R.S.A. §620-A): https://legislature.maine.gov/backend/App/services/getDocument.aspx?documentId=121771
Maine Legislature bill display: https://legislature.maine.gov/legis/bills/display_ps.asp?LD=61&snum=132

Illinois

720 ILCS 5/21-2.5: https://www.ilga.gov/documents/legislation/ilcs/documents/072000050K21-2.5.htm

Texas

Texas Penal Code §16.06: https://statutes.capitol.texas.gov/Docs/PE/htm/PE.16.htm#16.06

Florida

Florida Statutes §934.425: https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0900-0999/0934/Sections/0934.425.html

Buddy punching and time clock fraud (biometrics / BIPA)