Time Tracking Privacy Laws: What US Employers Must Know

No single federal law governs privacy in time tracking. The rules come from three places: federal wage law, which tells you what records to keep, a handful of state laws on notice and biometrics, and general federal rules on discrimination and employee organizing. For a small employer, the practical answer is simple. Track only what you need to pay people correctly, tell your team in writing what you collect and why, and get written consent before you touch fingerprints, face scans or similar data.

This guide walks through each layer for the tools small businesses actually use: punch clocks, photo verification, GPS and geofencing, and kiosks. It is general information, not legal advice. If you operate in Illinois, Texas, New York or California, or you plan to collect biometrics, have an employment attorney review your policy.

TL;DR

• Federal law (the FLSA) requires accurate hours records but does not dictate the tool, and it does not ban time tracking or GPS. The Department of Labor leaves the method up to you.
• State law is where privacy risk lives: biometric consent in Illinois and Texas, written notice of electronic monitoring in New York.
• Photo punches and geofences are safer when they are limited to clock-in moments and job sites, disclosed in writing, and never used off the clock.
• Never use tracking to discourage union talk or wage discussions. That is an unfair labor practice, even if it only looks like surveillance.
• Write a one-page policy, collect signed acknowledgments, and keep data only as long as the law and your payroll require.

Table of Contents

• What federal law actually says about time tracking
• Where privacy risk starts: the data you collect
• Biometrics: the strictest rules in time tracking
• GPS and geofencing: legal, but only when it is bounded
• Notice and consent: what to tell your team
• Limits that apply everywhere
• Our perspective
• A short checklist before you switch on any tracking feature
• Putting this into practice with Kloqk
• FAQ
• Sources

What federal law actually says about time tracking

Start with what the law requires of you. Under the Fair Labor Standards Act, covered employers must keep accurate records of hours worked for non-exempt employees. The DOL’s recordkeeping fact sheet says the Act requires no particular form for those records, and that you must pay for all hours actually worked. Manual timesheets and electronic clocks are both acceptable.

Two points follow from that for privacy:

1. You have a legitimate, legal reason to record start and stop times. That purpose is the foundation of everything else. Data that supports it (punch times, breaks, job location at the moment of punching) is easy to defend. Data that goes beyond it (continuous location trails, keystroke logs, health readings) is harder.
2. Federal law does not require you to announce every instance of monitoring. Commentary on employee monitoring lawsuits notes that federal law has no such blanket duty, while certain state laws do require notice or consent. That gap is why a state-by-state check matters.

If you are unsure how rounding and recordkeeping fit together, our guide to FLSA time rounding rules covers the pay side, and timesheet retention requirements explains how long to keep records.

Where privacy risk starts: the data you collect

A basic punch is a name and a timestamp. Risk grows as you add data types. Here is how the common features compare.

The pattern is consistent: the narrower the data and the closer it sits to the moment of the punch, the lower the risk.

Biometrics: the strictest rules in time tracking

Biometric data is where lawsuits come from. If your time clock scans fingerprints, faces, hands or irises, state biometric laws can apply.

Illinois BIPA

Illinois’s Biometric Information Privacy Act requires private entities to obtain a written release before collecting a biometric identifier and to publish a written retention and destruction policy. The text of a 2025 bill, HB 3667, proposes to exempt data from biometric time clocks that is converted into a mathematical representation that cannot recreate the original identifier. It was introduced in the 104th General Assembly. Check its current status with counsel before relying on it, because a bill is not a law until it passes.

Damages exposure has also shifted. After the Illinois Supreme Court held in Cothron v. White Castle that a violation could accrue each time biometrics were scanned, the legislature amended the statute in August 2024. A law firm’s update reports that the Seventh Circuit later held the amendment applies retroactively to pending cases. The lesson for a small employer: the exposure is smaller than it was, but the consent requirement is unchanged.

Texas CUBI

Texas’s Capture or Use of Biometric Identifier Act requires you to inform a person and receive consent before capturing a fingerprint, face geometry or similar identifier for a commercial purpose. One legal reference reports that only the Attorney General can enforce it, with civil penalties up to $25,000 per violation. There is no private lawsuit, but enforcement is real.

Other states

Washington and several other states have biometric or consumer privacy statutes, and the list keeps changing. We maintain a longer breakdown in Are biometric time clocks legal? A state-by-state guide. If you hire in more than one state, apply the strictest standard to everyone. It is cheaper than running separate processes.

A practical way around the problem

Many small employers avoid biometric exposure entirely by using a PIN, a badge or a phone login, plus a photo taken at the punch that a manager can glance at if a punch looks wrong. If you do use a photo, say so in your policy and keep the use limited to verifying that the right person punched in. Do not run it through face matching without legal review. Our page on photo capture at clock-in explains how that check works in practice.

GPS and geofencing: legal, but only when it is bounded

No federal law specifically prohibits GPS tracking of employees, and the common legal advice is to obtain written consent anyway. One state-by-state GPS guide is not needed to see the principle: track work, not people.

The FTC has warned that invasive workplace surveillance, including tracking precise location, can harm worker autonomy and privacy, and that excessive collection of sensitive geolocation data carries regulatory risk. That does not make a geofence illegal. It means the design should be proportionate.

A defensible setup looks like this:

• Check location only when someone punches in or out. A geofence that confirms you are at the job site at clock-in is different from a map showing where a person is all day.
• Turn tracking off outside work hours. Never collect location from a personal phone when the employee is off the clock.
• Use it for a stated purpose: confirming job-site attendance, preventing time theft, or documenting hours on a prevailing wage job.
• Tell people in writing, and have them acknowledge it.

We go deeper in Employee geofencing for US HR: 6 legal steps. For field crews, GPS time clock features and remote time tracking show how location checks can be limited to the punch.

Notice and consent: what to tell your team

Whether a state requires it or not, written notice is your best protection. It is also the part employers most often get wrong.

New York is the clearest rule

Since May 2022, New York employers who monitor phone, email or internet use must give written notice at hiring, have employees acknowledge it, and post the notice conspicuously. The statute is Civil Rights Law section 52-c. It targets phone, email and internet monitoring rather than time clocks as such, but it shows the direction the law is heading and is a good template for any monitoring notice.

Banners and signs are not enough

Government IT policies often rely on a log-on banner. New York State’s acceptable use policy says users have no legitimate expectation of privacy on state IT resources, but that is a state agency’s rule for its own systems. A private small business should not copy it. Direct, clear written notice that says exactly what is monitored and why is a safer approach.

What the notice should say

1. What you collect: punch times, photos at punch, location at punch, device type.
2. Why: to record hours accurately, to prevent buddy punching, to verify job-site attendance.
3. When: only during clock-in and clock-out, or only during shifts.
4. Who sees it: owner, manager, payroll provider.
5. How long you keep it, and how it is deleted.
6. That the data will not be used for anything unrelated to payroll and attendance.
7. A signature line or an electronic acknowledgment.

Keep the signed copies. They are also part of the paper trail described in our guide to the timesheet audit trail.

Limits that apply everywhere

Union and wage talk

The National Labor Relations Act protects employees who discuss pay or organize. The NLRB says that policies chilling wage discussion are unlawful, and surveillance meant to monitor or discourage this activity is prohibited. Even creating the impression of surveillance can be an unfair labor practice. In practice: never review time data, photos or location to find out who is talking to whom, and do not hint that you can.

Health and wearables

The EEOC has issued a fact sheet on wearables. It explains that wearables can track movement, biometric information and location, and that mandatory collection of health-related data can raise Americans with Disabilities Act issues. If your time tracking relies on a phone or kiosk, you have no reason to go near health data. Keep it that way.

Private spaces

Employers have wide latitude over company equipment, but not over private areas. The California Attorney General’s workplace privacy page notes that California law prohibits audio or video recording in restrooms and locker rooms. If a kiosk with a camera sits near a break room or changing area, move it.

Productivity quotas

Time tracking is not productivity monitoring, and the second carries separate rules. New York’s Warehouse Worker Protection Act requires distribution centers to disclose work-speed data to employees. If you set speed targets, make sure they leave time for hygiene and breaks.

Our perspective

We build time clocks for small U.S. businesses, and we see the same mistake repeatedly: owners ask which law applies before they ask what they actually need to know. We start from the opposite end. Payroll needs a start time, a stop time, breaks, and proof the right person was at the right place. Everything beyond that is risk without a payroll benefit.

That is why we think photo verification and GPS geofencing should be bounded to the punch, disclosed in plain words, and used only to settle questions about hours. A restaurant manager checking a suspicious clock-in photo is doing payroll. A manager scrolling through where a cook went on a day off is not, and no tool should make that easy.

We also believe compliance should not cost extra. Overtime and break calculations, photo verification and payroll exports are part of our free plan, because a small employer who cannot afford a lawyer should still be able to keep clean records. Write the policy, get it signed, and keep the data narrow.

Saad

A short checklist before you switch on any tracking feature

1. List what you will collect and tie each item to a payroll purpose.
2. Check your state for biometric, monitoring-notice or GPS rules. If you employ people in more than one state, follow the strictest.
3. Avoid biometric templates unless you have a signed release and a retention schedule.
4. Limit location to the punch and switch it off after hours.
5. Write a one-page notice and collect signatures or electronic acknowledgments at hiring and whenever you add a feature.
6. Set retention. Keep payroll records for the periods the law requires (see our retention guide) and delete extras like punch photos on a shorter, stated schedule.
7. Restrict access to owner, manager and payroll.
8. Review yearly. State privacy law is moving fast.

Putting this into practice with Kloqk

If you want a time clock that fits these principles, Kloqk’s free employee time tracking gives you payroll-ready hours, overtime and break calculations, photo verification at clock-in and payroll exports for an unlimited number of employees. If you are fighting buddy punching, see how photo and GPS checks work together. Optional upgrades are Pro at $29 per month per location and Premium at $59 per month per location, and you can compare what each plan includes on the pricing page.

A tool does not make you compliant on its own. You still need the notice, the consent and the policy. But a clock that limits data to what payroll needs makes the policy much easier to write.

FAQ

Can I require employees to use a GPS time clock?

Generally yes, because no federal law specifically prohibits GPS tracking of employees. Get written consent anyway, limit location checks to clock-in and clock-out, and never track personal devices off the clock. Check your state’s rules first.

Do I need written consent for photo clock-ins?

If the photo is only a visual check, state biometric laws may not apply, but written notice is still the safest course. If you use face matching, treat it as biometric data: in Illinois and Texas, consent is required before collection. When in doubt, ask an employment attorney.

Is it legal to monitor employees without telling them?

Federal law does not require disclosure of every instance of monitoring, but some states do. New York, for example, requires written notice of electronic monitoring of phone, email and internet use. Telling your team is also good practice, and secret monitoring can create trust and legal problems.

How long should I keep time records and punch data?

Payroll and timesheet records have federal retention periods, which we cover in our retention guide. Extras such as punch photos and location logs are not part of what the law requires you to keep, so set a shorter schedule and put it in your policy.

Does time tracking privacy law apply to salaried employees?

Privacy and monitoring rules apply to employees broadly, whether hourly or salaried. Recordkeeping duties differ, though: see whether exempt employees need to track hours.

Sources

• U.S. Department of Labor, Fact Sheet #21: FLSA recordkeeping
• Illinois General Assembly, HB 3667
• Davis Wright Tremaine, BIPA amendment update
• Texas biometric privacy laws overview
• FTC, Jolt remarks on workplace surveillance
• New York Civil Rights Law section 52-c
• New York State acceptable use of IT resources policy
• NLRB, your right to discuss wages
• California Attorney General, workplace privacy
• New York Department of Labor, Warehouse Worker Protection Act

Recommended

• Employee Geofencing for US HR: 6 Legal Steps to Avoid
• Photo Clock-In Policy: U.S. Employers Need Privacy Rules
• Employee GPS Tracking Laws: Employers Can Skip 50 State
• Are Biometric Time Clocks Legal? A State-by-State Ru