PunchIs It Legal to Track Employees' Location? GPS, Consent, and Notice Rules for 2026
Is It Legal to Track Employees' Location? GPS, Consent, and Notice Rules for 2026
The short answer: Confirming that an employee is at the job site when they punch in is legal almost everywhere. Following that same person around all day, or through the evening, is where employers get sued. The legal exposure is not created by GPS. It is created by how much you collect, how long you keep it, and whether anyone told the crew. Punch is built at the narrow end of that line: a location point at the punch, and nothing in between.
The Law Cares About Tracking a Person, Not Verifying a Punch
There is no single federal statute that governs employer GPS tracking of employees. The rules come from three places: state monitoring statutes that require notice, state vehicle tracking statutes that restrict devices on cars, and state biometric statutes that carry real money damages when a time clock reads a body part.
All three point at the same distinction. A one-time location reading, tied to a work event the employee chose to perform, is a business record. A continuous stream of a person's whereabouts, collected whether or not they are working, is surveillance. Legislatures treat those very differently, and so should your timekeeping setup. Continuous breadcrumb tracking demos well. It also creates a record you will have to explain later.
State Notice Laws: Connecticut, Delaware, New York
Three states require private employers to tell employees about electronic monitoring in writing.
New York. Civil Rights Law section 52-c took effect May 7, 2022. Every private employer in the state, regardless of size, must give notice of electronic monitoring practices to employees upon hiring, with written or electronic acknowledgment, and must post the notice in a conspicuous place. The attorney general enforces it with civil penalties of up to $500 for a first offense, $1,000 for a second, and $3,000 for each one after that. There is no private right of action.
Connecticut. Conn. Gen. Stat. section 31-48d requires prior written notice of the types of monitoring that may occur, posted conspicuously, and defines electronic monitoring broadly as information collected about employee activities or communications by any means other than direct observation. The labor commissioner can levy civil penalties from $500 to $3,000.
Delaware. Del. Code tit. 19, section 705 lets an employer choose one of two paths: daily notice when the employee accesses employer systems, or one-time written notice with a documented acknowledgment. Violations carry a $100 civil penalty each.
These statutes were written with email and internet monitoring in mind, and they read that way. The lesson generalizes anyway. Notice first, in writing, acknowledged, before you collect anything. Doing that in every state costs one paragraph in the handbook and removes the argument entirely.
Vehicle Tracking: California Set the Template
California Penal Code section 637.7 prohibits using an electronic tracking device to determine the location or movement of a person. It exempts the registered owner of a vehicle who consents, which is why a company-owned truck has generally been trackable on the employer's own consent.
The Motor Vehicle Digital Number Plates Act, AB 984, narrowed that. Where an employer uses an approved alternative device on a vehicle to monitor an employee, monitoring is permitted only during work hours and only where strictly necessary to the performance of the employee's duties. Before it starts, the employer has to give notice describing what is monitored, what data is collected, whether the data will inform employment decisions such as discipline or termination, which vendors receive it, who inside the company may access it, the dates, times, and frequency of monitoring, where the data is stored and for how long, and the employee's right to disable monitoring outside work hours. Retaliating against an employee who disables it off hours is prohibited. The labor commissioner can assess $250 per employee for a first violation and $1,000 per employee for each subsequent violation, per day.
Read that notice list again. It is a fair checklist for any location feature, in any state, whether or not a vehicle is involved. If you cannot answer all eight items about your time clock, you are collecting more than you can explain. Note also the right to disable outside work hours. The legislature drew the line at the workday. So should your software.
Biometrics Are a Different Category of Risk
Fingerprint and face scan time clocks are sold as the cure for buddy punching. In several states they are the most expensive thing you can put in a break room.
Illinois' Biometric Information Privacy Act, 740 ILCS 14, requires a private entity to inform the subject in writing that a biometric identifier is being collected or stored, inform them in writing of the specific purpose and the length of term of collection and use, and obtain a written release before collecting anything. It also requires a publicly available written retention and destruction policy. Statutory damages run $1,000 per negligent violation and $5,000 per reckless or intentional violation, and BIPA carries a private right of action, which is why plaintiffs' firms built a practice around it.
The scale is not theoretical. A federal jury in Chicago found 45,600 BIPA violations against a railroad that collected worker biometrics without proper notice and returned a $228 million verdict. Illinois amended the statute in August 2024 through Public Act 103-0769, so collecting the same biometric identifier from the same person by the same method is now a single violation with a single recovery rather than one per scan, and the Seventh Circuit held that the limit applies retroactively to pending cases. The amendment caps the arithmetic. It does nothing about the notice and written release obligations that trip employers in the first place.
Texas gets to the same place differently. Its Capture or Use of Biometric Identifier Act requires notice and consent before capture and destruction no later than one year after the collection purpose expires. There is no private right of action, but the attorney general can seek civil penalties of up to $25,000 per violation.
The cleanest way to comply with all of it is to not collect biometrics. That is a product decision, and Punch already made it.
How Punch Is Built for This
Punch verifies a job-site punch in the narrowest way that still works.
Location is read at a punch event, not continuously. There is no background trail, no breadcrumb map of the day, and no collection while the app is closed. Punch requests location only while in use. Geofencing applies to punch-in at a job site, the one moment where being on site is the fact in question. Punch out and lunch are never gated on a location fix, because a crew member ending a shift in a parking garage with no signal still needs to punch out.
There is no facial recognition and no photo at a punch, on any device, including the shared iPad. A kiosk verifies an employee with a PIN they enter themselves. Neither that nor a geofence creates a biometric identifier, so BIPA and CUBI never attach. Trust beats surveillance, and it is cheaper to defend.
Web punches are not geofenced, by design. Browser location is unreliable on a desktop and easy to spoof, so enforcing it would be theater. Owners who want to restrict punching to iOS can turn web punching off at the organization level, which is an honest control instead of a false one.
What the geofence produces is a record you can hand to an auditor: which job site, which minute, which employee, and whether the punch was inside the radius. Managers review the week and approve or reject in bulk. Weekly and bi-weekly pay periods roll up into Reports and export to Excel or a QuickBooks CSV, or push straight into QuickBooks Online.
Why Punch Beats the Per-Seat Alternatives
ClockShark, Connecteam, Buddy Punch, QuickBooks Time, and Homebase all bill per user, so the crew you add for a busy season raises your software bill every month it lasts. Several of them lead with continuous location trails or photo verification, which is exactly the collection that the notice statutes above make you disclose in detail and defend later.
Punch charges a flat price per organization. Every plan includes every feature, from geofenced punch-in to kiosk mode to bulk approvals to QuickBooks Online export, and owners are always free. You get the verification without the surveillance record, and adding four people for storm season does not move the invoice.
Frequently Asked Questions
Can an employer legally track an employee's phone location?
Generally yes, for work purposes and with notice. Restrict collection to work time, tell employees in writing what is collected and why, and do not collect on personal devices outside working hours. Connecticut, Delaware, and New York have written notice requirements, and California restricts employer monitoring through an approved vehicle device to work hours where strictly necessary.
Do I need written consent to use a GPS time clock?
Written notice is required in Connecticut, Delaware, and New York, and it is the cheapest protection everywhere else. Put it in the timekeeping policy, have employees acknowledge it, and keep the acknowledgment.
Is tracking an employee after hours illegal?
It is the fastest way to create liability. California's rules for monitoring through an approved vehicle device permit it only during work hours and protect the employee's right to disable it outside them. Off-hours tracking also invites invasion of privacy claims in states with no specific statute. Collect at punch events only and the question never comes up.
Are fingerprint time clocks legal?
They are legal in most states, but Illinois and Texas impose specific notice, consent, and destruction duties, and Illinois allows employees to sue with statutory damages of $1,000 or $5,000 per violation. A PIN on a shared device verifies the same person without creating the record those statutes govern.
Does a geofence prove an employee worked the hours?
No. A geofence proves where a punch happened. Hours worked are proved by the punch record itself, which is what the FLSA requires you to keep. Use the geofence to confirm the location, then approve the shift on the hours.
Verify the Punch. Do Not Follow the Person.
Every rule in this article moves in the same direction. Collect less, say what you collect, stop at the end of the workday, and stay away from bodies.
A time clock that reads location once, at a punch the employee chose to make, satisfies all four without a policy rewrite. A tracker that runs all day does not, and it hands a plaintiff a map.
Start with Punch. Confirm the crew is on site, keep the record clean, and leave the surveillance to somebody else.
This article is general information, not legal advice. Employee monitoring, location tracking, and biometric privacy rules vary by state and change often. Confirm your obligations with the enforcing agency in your state, or with qualified counsel, before rolling out any location or biometric feature.