Employee GPS Tracking Laws: Employers Can Skip 50 State Summaries

Employers may be able to track employees with GPS for legitimate business reasons like timekeeping or fleet management, but the right to track is not unlimited. State notice and consent rules vary, and tracking should avoid collecting off-duty location data. Federal regulators and courts have drawn sharper lines around location privacy in recent years, which raises the stakes for getting this wrong.

TL;DR:

• States differ: some require advance written notice or affirmative consent, while others rely on privacy and trespass law; document each jurisdiction’s review before rollout.
• Installing hardware on a vehicle owned by an employee without clear written authorization carries high risk; favor vehicles and devices owned by the business.
• For routine timekeeping, use geofenced clock ins during scheduled shifts instead of continuous GPS tracking, and automatically disable collection when shifts end.
• Keep location traces only as long as payroll or audit needs require, restrict access by role, and record authorization, rationale, and end dates for investigations.

Table of Contents

• Federal Baseline and Regulator Priorities You Should Assume
• State Rules Grouped by What Employers Must Actually Do
• Personal Vehicles, Employee-Owned Devices, and Company Assets
• Building a Compliant GPS Policy: A Checklist for HR
• Data Security, Retention, and Enforcement Risk
• Running One Program Across Multiple States
• Why Geofence-First Design Matters for Compliance
• What the Research Actually Supports
• Try Geofenced GPS Timekeeping Built Around These Limits
• FAQ
• Sources

Federal Baseline and Regulator Priorities You Should Assume

There is no single federal GPS tracking statute for employers. Instead, the federal baseline comes from a mix of constitutional reasoning in criminal cases, electronic communications law, and Federal Trade Commission enforcement, and all three shape how much risk you carry.

Legal scholarship on GPS and cell phone tracking of employees recommends limiting investigatory GPS tracking to narrow, corroborative uses after less intrusive methods fail, and avoiding collection of off-duty location data.

The FTC has also sharpened its posture on location data generally. The agency’s order against Kochava bans the company from selling sensitive precise location data and requires transparency and data minimization going forward. A separate finalized order against General Motors and OnStar requires affirmative express consent before collecting or sharing connected-vehicle geolocation data, along with a consumer option to turn off precise-location collection.

Federal statutes that intersect with employer tracking include:

• The Electronic Communications Privacy Act, which governs interception and disclosure of electronic communications and sets a baseline for how location-adjacent data gets treated.
• Common-law privacy torts, including intrusion upon seclusion, which employees can raise independent of any specific GPS statute.
• State consumer protection and anti-stalking statutes that regulators and plaintiffs’ attorneys increasingly use to challenge overbroad monitoring.

The FTC has emphasized transparency and affirmative consent for selling or sharing sensitive location data in its Kochava enforcement action. Employers handling such data should consider these priorities when designing their practices.

State Rules Grouped by What Employers Must Actually Do

Fifty separate statute summaries will not help you make a decision on Monday morning. What matters is which bucket your operating states fall into and what that bucket requires of you in practice.

Group A: States requiring written notice or consent. A number of states require employers to provide advance written notice before deploying GPS tracking on an employee, and some require something closer to affirmative consent rather than a passive disclosure buried in a handbook. In practice, this means:

1. Draft a standalone GPS notice document separate from your general handbook language.
2. Have the employee sign and date it before tracking begins, not after.
3. State the specific purpose (timekeeping, routing, theft prevention) rather than a blanket “monitoring may occur” clause.
4. Store the signed notice with HR records and refresh it whenever the tracking scope changes.

Group B: States with vehicle-tracking or device-installation statutes. Several states have statutes aimed specifically at physically installing a tracking device on a vehicle, often written in the context of anti-stalking or anti-trespass law. These statutes do not usually distinguish between a jealous ex-partner and an employer, which means physically affixing a GPS unit to a vehicle you do not own can expose you to the same liability as any other unauthorized installation. If the vehicle is titled to the employee rather than the company, installing hardware without clear written authorization is one of the highest-risk moves on this entire list.

Group C: States relying on general privacy, anti-stalking, or trespass law. Many states have no GPS-specific statute at all. That does not mean tracking is unregulated. Courts in these states fall back on intrusion-upon-seclusion claims, general trespass law, or state consumer protection acts, and the analysis turns on whether your tracking was reasonable, proportionate, and disclosed. Employers in this group should default to the same least-intrusive-means discipline they would use in a notice state, because the absence of a specific statute is not legal cover.

Here is how to use the grouping:

• If your state sits in Group A, treat written notice as a hard prerequisite before any device or app goes live.
• If you operate company vehicles in a Group B state, keep tracking limited to vehicles your business titles and owns.
• If your state sits in Group C, document your purpose and your decision to use the least invasive method available, since that record is your best defense if a claim arises.
• Regardless of group, any state flagged as requiring consent should trigger an immediate legal check before rollout, not after an employee complains.

A quick way to document the legal review: keep a short memo for each operating state noting the statute or case law you checked, the date, who reviewed it, and the conclusion. If your workforce spans several states, a partner employment law resource like Serendib Law Firm can help confirm jurisdiction-specific obligations before you finalize a multi-state policy, particularly where state guidance conflicts or has recently changed.

Personal Vehicles, Employee-Owned Devices, and Company Assets

Ownership changes everything about your legal exposure. Physically installing a tracker on a personal vehicle without clear authorization can trigger the same device-installation statutes written for anti-stalking cases, because most of those laws care who owns the vehicle, not who employs the driver. Tracking a company-owned vehicle or company-issued phone carries far less risk, since the business has a direct property interest in the asset being monitored.

App-based tracking on an employee’s personal phone sits in a middle zone. Enrollment in a time-tracking app can function as a form of consent, but that consent is weaker when the app runs around the clock rather than only during scheduled shifts, and weaker still if declining to install it threatens the employee’s job.

• Limit tracking to company-owned vehicles and devices wherever feasible.
• Use geofenced clock-ins on personal phones instead of continuous background tracking.
• Disable location collection automatically outside scheduled work hours.
• Document app-enrollment consent in writing, separate from the general employment agreement.

Pro Tip: If a role requires tracking a personal vehicle, lease or provide a company device instead of installing hardware on equipment you don’t own.

Building a Compliant GPS Policy: A Checklist for HR

A defensible policy starts with purpose, not technology. Write down why you need tracking before you choose how to implement it.

1. Define the business purpose narrowly. Name the specific reason (payroll accuracy, fleet routing, theft deterrence) and keep a short written rationale on file, since a vague “operational efficiency” justification will not hold up if challenged.
2. Apply the least-intrusive-means test. Choose geofence-only clock-ins tied to scheduled shifts over continuous GPS pings whenever timekeeping is the actual goal.
3. Set notice and consent language. Spell out what is tracked, when, and why in plain language; require signed written consent in any state where that is expected, and keep app-enrollment consent as a separate, documented step.
4. Limit retention and access. Store raw location traces for the shortest period that still serves payroll or audit needs, restrict access by role, and vet any third-party vendor that touches the data.
5. Train and audit. Walk managers through what the policy allows and does not allow, keep audit logs of who accessed location data and why, and schedule periodic legal review as state laws change.

Where tracking is tied to a specific misconduct investigation rather than routine timekeeping, treat it as its own category. Note who authorized the investigatory tracking, why a less invasive method would not have worked, and the exact date it ended. A standing, open-ended tracking order with no end date is one of the easiest things for an employee’s attorney to challenge.

Pro Tip: Run a short data protection impact review before expanding tracking scope, even informally, since a documented risk assessment is often the difference between a defensible program and an exposed one.

For a deeper technical walkthrough of how clock-in geofencing and shift-based tracking work in practice, our guide on GPS employee time tracking covers the implementation side in more detail, and our legal steps checklist for employee geofencing walks through notice language HR teams can adapt.

Data Security, Retention, and Enforcement Risk

The FTC’s recent orders make clear that regulators expect affirmative express consent before sensitive location data gets collected, shared, or sold, and that transparency failures carry real consequences even outside the employment context.

• Encrypt location data both at rest and in transit.
• Restrict access by role so only the people who need location data for payroll or dispatch can see it.
• Audit any vendor or payroll processor that stores or transmits GPS traces.
• Set a retention schedule that deletes raw location traces once their payroll or compliance purpose is served.

The FTC’s Kochava press release describes an order barring Kochava from selling sensitive precise location data and emphasizes transparency and data minimization. Separately, intrusion-upon-seclusion claims can arise from off-duty or overbroad tracking regardless of whether any data was ever sold, which is why minimization and documentation matter even when sharing data was never the plan.

Running One Program Across Multiple States

A multi-state employer rarely wants fifty different tracking policies, and you usually do not need one. The simpler path is to default to the most protective state rule across your whole footprint, or to build geo-based variances into your policy where the cost of a single standard is too high.

• Default to written notice and signed consent everywhere, even in states that do not strictly require it.
• Route any new tracking feature through a central legal review before rollout, rather than letting individual site managers turn it on.
• Automate the shutoff of tracking outside scheduled hours so compliance does not depend on someone remembering to toggle a setting.
• Keep a single investigatory-tracking log across all locations, noting who authorized it, the justification, and the end date.

Why Geofence-First Design Matters for Compliance

Geofencing clock-ins to a job site, rather than tracking continuously, is one of the more direct ways to put the least-intrusive-means principle into practice. Our GPS time clock features include geofenced punches and photo verification at clock-in. Our payroll exports are available to support documentation. None of this replaces legal counsel for your specific state mix, but it narrows the scope of what you need counsel to review.

What the Research Actually Supports

The loudest conventional advice on this topic treats GPS tracking law as a 50-state statute lookup problem, and that framing misses the point. Most of the real legal risk in employer GPS tracking comes from scope and duration, not from the existence of a device. Courts and regulators keep circling back to the same question: did the tracking continue past the point any legitimate business purpose required?

A key risk is tracking that continues beyond a legitimate business purpose, storing raw traces without a defined need, or collecting off-duty location data. Written notice alone does not address overly broad collection.

If you take one thing from this, prioritize narrowing scope before you worry about perfecting your consent language. A tightly scoped, well-documented program with imperfect notice language is a smaller target than a broad, continuous program with a flawless disclosure form.

Saad

Try Geofenced GPS Timekeeping Built Around These Limits

We built our time tracking platform around the same principle this guide keeps coming back to: track only what the job requires, and nothing more. Our platform offers geofenced clock-ins for time tracking.

• Start on our Free plan with unlimited employees, payroll-ready timesheets, and photo verification included at no cost.
• Review our GPS time clock and geofencing features for details about geofenced time tracking.
• Compare Free, Pro, and Premium if your team also needs scheduling or PTO tracking alongside time tracking.

Upgrades to Pro run $29 per month per location and Premium runs $59 per month per location, both listed on our pricing page, with no obligation to move beyond the free tier if it covers what you need.

FAQ

Is it legal for an employer to track an employee using GPS?

Yes, employers can generally use GPS tracking for legitimate business purposes like timekeeping or fleet management, provided they follow applicable state notice or consent rules and avoid continuous off-duty tracking. The exact requirement depends on your state and on whether the device or vehicle is company-owned.

Can I refuse to be tracked at work?

Employees generally cannot refuse reasonable GPS tracking tied to a company-owned vehicle or device used for work, since employers have a legitimate interest in monitoring business assets. Refusal rights are stronger when tracking involves a personal device or extends into off-duty hours, where consent and scope limits carry more weight.

Can my employer track my location without my consent?

It depends on the state and the device involved: several states require written notice or consent before GPS tracking begins, while others rely on general privacy and anti-stalking law rather than a specific statute. Tracking a personal vehicle or phone without clear authorization carries the highest legal risk for employers.

Does my employer have the right to track my location?

Employers typically have the right to track location on company-owned vehicles and devices during work hours for legitimate business reasons. That right narrows significantly for personal property and for any tracking that continues after a shift ends, where courts increasingly scrutinize continuous location collection as a privacy concern.

Recommended

• Employee Geofencing for US HR: 6 Legal Steps to Avoi
• 6 Legal Steps Small Employers Must Take for Geofencing
• GPS Employee Time Tracking: How It Works and Best Apps