Clock-meVisit Website →
← Back to blog

Employee GPS Privacy: Use Events, Not Streams to Cut Legal Risk

October 5, 2026
Employee GPS Privacy: Use Events, Not Streams to Cut Legal Risk

Yes, we can confirm that employers can use GPS tracking for legitimate business purposes, but only within narrow, documented limits. Authorities like Fisher Phillips, the FTC, and the EDPB all point the same way: tracking tied to a clear work purpose is defensible, tracking that sweeps up personal time is not. Before turning on any location feature, document why you need it and give notice or get consent when personal devices or vehicles are involved.

TL;DR:

  • GPS tracking during work hours is acceptable if it serves a clear business purpose, with personal use only tracked with explicit notice or consent.
  • Employers must define narrow, documented reasons for tracking and avoid continuous location streams to prevent privacy violations.
  • Data collection should be limited to events like clock-ins or geofence crossings, with retention schedules and restricted access to protect employee privacy.
  • Laws vary by state and jurisdiction, with the EU requiring proportional data collection and impact assessments for systematic monitoring.
  • Notable enforcement shows fines and legal scrutiny for tracking practices that lack transparency, disclosure, or exceed necessary scope.
Clock-me
Track Work Hours With Less Intrusion
Clock-Me records verified GPS clock-ins and geofence events, helping field teams improve accountability without continuous location streams.
Visit Clock-Me

Table of Contents

Where the rules on employee location tracking come from

There's no single federal law in the United States that bans GPS tracking of employees, but that doesn't mean anything goes. Rules vary by state, and some require employers to give notice or obtain consent before tracking, especially when a personal device or personal vehicle is involved. The patchwork means a policy that's fine in one state can create liability in another.

Beyond state law, the NLRB scrutinizes surveillance that could chill employees from organizing or discussing working conditions, which is protected activity under Section 7. The FTC, meanwhile, treats precise location data as sensitive, and has brought enforcement actions against companies that collected or shared it without real consent.

In the European Union, the bar sits higher. GDPR and EDPB guidance require proportionality, meaning you only collect what's necessary, and call for a Data Protection Impact Assessment whenever monitoring is systematic. The difference between a company-issued device and a personal one matters just as much on that side of the Atlantic: tracking a company vehicle during work hours is one thing, tracking a worker's own phone around the clock is another.

What continuous tracking can cost employees and employers

Location data reveals more than where someone clocked in. A continuous feed can expose a medical clinic visit, a place of worship, a union meeting, or a custody exchange, details that have nothing to do with work but everything to do with someone's private life. Once that pattern exists in a database, re-identification becomes easier than most employers assume.

Illustration of location data revealing private patterns

The FTC has brought multiple enforcement actions against companies that collected or sold location data without adequate safeguards, a signal that regulators now treat location feeds as sensitive by default rather than as an afterthought. Vendor resale is a related risk: once location data leaves your system, you lose control over how it's used downstream. Tracking someone off-duty, even unintentionally through a device that never powers down, invites both legal exposure and a morale problem that's hard to undo.

Building a GPS tracking policy that holds up

A defensible policy starts with scope, not technology. Write down the specific business reason for tracking, whether it's verifying timecards, protecting company vehicles, or supporting field safety, and state plainly that off-duty or personal use is excluded.

  • Define a narrow, documented purpose for tracking and prohibit monitoring outside work hours.
  • Give clear notice before tracking starts, and get written consent for personal devices or personally owned vehicles.
  • Collect events, not streams: log clock-ins, clock-outs, and geofence crossings instead of a continuous location trail.
  • Set a retention schedule, restrict who can view the data, limit vendor access, and train managers on proper use.

Pro Tip: Write the policy before you buy the tool, not after. It's far easier to configure software around a clear purpose than to justify a purpose after the data already exists.

Fisher Phillips lists transparency as the single most important control: documented notice of purpose, access, and retention is what makes monitoring look reasonable rather than invasive.

Configuring your system to limit what it collects

The technical setup you choose does as much for your privacy posture as the written policy. A few configuration choices make the biggest difference.

  1. Turn off continuous background tracking by default, and rely on geofence-based visibility that only logs entry and exit at a job site.
  2. Record events tied to work, such as a shift start or a geofence crossing, rather than a constant stream of coordinates.
  3. Reserve raw location access for emergencies, and give managers aggregated attendance scores instead of a live map in normal operation.
  4. Process location data locally where the platform allows it, encrypt what you do store, and automate deletion once the retention window closes.

EDPB guidance on connected vehicles makes a similar point: local processing and privacy-conscious defaults reduce exposure far more effectively than adding safeguards after the fact.

A short playbook for rolling out GPS monitoring

Deploying location tracking defensibly follows a sequence, not a single decision.

  • Run a Data Protection Impact Assessment before systematic monitoring begins, documenting necessity, proportionality, and mitigation steps, a practice European data protection authorities treat as standard for vehicle and location monitoring.
  • Map which jurisdictions your employees work in and update contracts and notices to match each one's requirements.
  • Pilot the system with a small group first, keeping written records of why tracking is necessary and proportionate.
  • Vet your vendor's security practices and data-sharing terms before rolling out company-wide.

Save the completed DPIA with your compliance records and revisit it whenever you change vendors or expand the program.

Keeping employee relations steady during rollout

Transparency does more for labor relations than any legal memo. Tell employees plainly what you're tracking, why, who can see it, and how long you keep it, and give them a real channel to ask questions before the system goes live.

Where a union or employee representative body exists, bring them into the conversation early and keep a record of that engagement. It protects you if the rollout is ever challenged. Visible indicators that tracking is active, along with an easy way to pause location collection during personal use, go a long way toward keeping trust intact and avoiding the kind of chilling effect the NLRB watches for.

Diagram of privacy-conscious GPS rollout safeguards

Lessons from real enforcement actions

A few cases illustrate what happens when tracking programs skip these steps.

  • An Italian supervisory authority fined a company €120,000 for tracking five employees' company cars without disclosure, including during private use.
  • The NLRB has warned that surveillance interfering with protected organizing activity can draw unfair labor practice charges, even when the underlying technology is otherwise legal.

How Clock-Me supports privacy-conscious tracking

Our GPS features focus on events rather than continuous streams: clock-ins, clock-outs, and geofence crossings instead of a running trail of coordinates. Access controls and retention settings help limit who sees location data and how long it is kept. Our data safety summary and setup guide lay out exactly what we collect and how to configure the system around a documented purpose.

Our take: default to less, not more

Field operations genuinely need location data for safety and accurate timekeeping, but that need never justifies collecting more than the job requires. The employers who stay out of trouble are the ones who document their purpose, limit collection to events, and tell employees exactly what's happening before the tracking starts.

— Clock-me

A privacy-aware way to track field hours

We know the appeal of GPS tracking is accuracy, not surveillance, and that's exactly what we built around. The platform logs GPS-verified clock-ins and geofence events instead of continuous location streams, pairs this with identity verification measures to reduce buddy punching, and provides admins with control over retention and access from a dashboard.

Clock-me

If you're drafting or auditing a tracking policy, our setup guide walks through configuring geofences and event-based clock-ins in minutes. For a closer look at plans built for field teams, from a free tier for small crews up to enterprise-level support, visit our solutions page and see which fits your team.

This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.

FAQ

It depends on the device and jurisdiction: tracking a company-owned vehicle or device during work hours is generally permitted, while tracking a personal device typically requires notice or consent. Several states and the EU's GDPR framework specifically require disclosure before personal-device tracking begins.

There's no blanket federal ban in the United States, but legality depends on purpose, scope, and state law, and monitoring must be tied to a legitimate business reason. In the EU, GDPR requires proportionality and often a Data Protection Impact Assessment for systematic location monitoring.

Can my employer watch me on camera all day?

Continuous monitoring, whether by camera or GPS, faces more legal scrutiny the broader and more constant it becomes, particularly if it extends into break time or off-duty hours. Employers generally need to show the monitoring serves a specific, documented purpose rather than blanket surveillance.

How can you tell if your employer is tracking you?

Check your employee handbook, device management settings, and any consent forms you signed when you received a work device or installed a work app. Employers following best practice disclose what's tracked, why, and for how long, so a documented policy is the clearest sign either way.

Sources