Video Surveillance Laws by State: What Businesses Can and Cannot Record
The most common belief about workplace cameras is that one national rule covers them and a sign on the door satisfies it. Neither half is true. There is no federal statute governing where a business may point a camera, the state rules that do exist are scattered across labor codes rather than any "surveillance law," and in a handful of states putting a camera in the wrong room is a crime rather than a civil risk.
This guide covers video surveillance laws by state the way a security director actually needs them: organized by the four separate bodies of law that reach a single camera, with the governing citation for each, verified against the primary sources in August 2026.
Featured image: a synthetic illustration created to depict the scenario described here. It is not a real detection capture.
The short version.
Federal wiretap law reaches your microphones, not your lenses. A small group of states criminally bar employer cameras in restrooms, locker rooms and lounges. A separate group requires notice before any electronic monitoring, satisfied in Connecticut by a posted sign. And biometric privacy statutes in Illinois and Texas attach consent duties and per-violation damages to any system that scans face geometry, which is the layer that turns an ordinary camera upgrade into an expensive one.
What "video surveillance laws by state" actually means
There is no single state video surveillance statute in most of the country; the rules live in four separate bodies of law that each reach a different part of the same camera. That is why so many of the state-by-state tables circulating online feel unsatisfying. They tend to reproduce a wiretap consent map, which describes audio recording, and then attach a vague sentence about cameras that cites nothing.
The four layers, in the order they usually matter to a business:
Layer one: federal law governs the audio, not the video
The federal Wiretap Act regulates the interception of conversations, and it has almost nothing to say about a camera that does not record sound. Under 18 U.S.C. 2511(2)(d), it is not unlawful for a person not acting under color of law to intercept a communication "where such person is a party to the communication or where one of the parties to the communication has given prior consent," unless the interception is for a criminal or tortious purpose. That is the one-party consent baseline, and roughly a dozen states raise it to all-party consent by statute.
The practical consequence is the single cheapest compliance decision in physical security: leave the microphones off. A video-only system sidesteps the entire federal wiretap question and the state consent map layered on top of it. Most commercial cameras ship with audio capture available, and most organizations never make a deliberate decision about it either way.
Connecticut goes one step further and applies an all-party consent rule to a specific workplace conversation. Under Conn. Gen. Stat. 31-48b(d), no employer or employee representative may intentionally overhear or record a discussion "pertaining to employment contract negotiations between the two parties" without the consent of all parties, with a penalty of a one thousand dollar fine or a year of imprisonment.
Layer two: the states that ban cameras in specific rooms
A small number of states prohibit employer cameras outright in areas set aside for employee rest, hygiene and personal belongings, and treat a violation as a criminal offense rather than a civil one. This is the layer most likely to be missed, because it is written into labor codes rather than anything labeled surveillance.
West Virginia has the broadest version. W. Va. Code 21-3-20 makes it "unlawful for any employer or the agent or representative of an employer, whether public or private, to operate any electronic surveillance device or system, including, but not limited to, the use of a closed circuit television system, a video-recording device," to record or monitor employee activity "in areas designed for the health or personal comfort of the employees or for safeguarding of their possessions, such as rest rooms, shower rooms, locker rooms, dressing rooms and employee lounges." Violation is a misdemeanor carrying a five hundred dollar fine, rising to one thousand for a second offense and two thousand thereafter.
| State | Citation | What it bars | Consequence |
|---|---|---|---|
| West Virginia | W. Va. Code 21-3-20 | Employer electronic surveillance in rest rooms, shower rooms, locker rooms, dressing rooms and employee lounges | Misdemeanor; 500 dollars, then 1,000, then 2,000 |
| Connecticut | Conn. Gen. Stat. 31-48b(b) | Employer surveillance devices in areas "designed for the health or personal comfort of the employees," such as rest rooms, locker rooms or lounges | 500 dollars, then 1,000, then 1,000 plus 30 days |
| New York | N.Y. Lab. Law 203-c | Any employer video recording of an employee in a restroom, locker room or designated changing room, absent a court order | Private suit; damages, attorney fees and injunction |
New York adds an evidentiary consequence that most policies overlook. Labor Law 203-c(2) provides that "no video recording made in violation of this section may be used by an employer for any purpose." Footage captured from a prohibited camera is not merely a liability, it is unusable for the investigation that motivated installing it. Section 203-c(3) then allows a court to award damages, reasonable attorney fees and injunctive relief, and section 203-c(5) exempts only law enforcement personnel performing authorized duties.
Other states restrict the same spaces through criminal invasion-of-privacy or unlawful-surveillance provisions of general application rather than employer-specific labor statutes. The safe operating rule is the same everywhere: cameras never enter restrooms, locker rooms, changing areas, showers or dedicated employee lounges, regardless of what any state permits.
Layer three: the states that require notice before you monitor
Two states require employers to notify employees before conducting electronic monitoring, and only one of them clearly covers cameras. Connecticut's Conn. Gen. Stat. 31-48d defines electronic monitoring as collection of information about employee activities or communications by any means other than direct observation, expressly including a camera. Each covered employer "shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur," and a notice posted "in a conspicuous place which is readily available for viewing by its employees" satisfies that requirement.
Two carve-outs in that statute do most of the work in practice. Section 31-48d(a)(3)(A) excludes information collected "for security purposes in common areas of the employer's premises which are held out for use by the public," which is precisely where most business cameras sit: lobbies, entrances, sales floors and parking areas. And section 31-48d(b)(2) allows monitoring without prior notice where the employer has reasonable grounds to believe employees are engaged in conduct that violates the law, violates legal rights, or creates a hostile work environment, and monitoring may produce evidence of it. The Labor Commissioner may levy civil penalties of five hundred, one thousand, and three thousand dollars for successive offenses.
Delaware is the state most often misdescribed. 19 Del. C. 705 is titled "Notice of monitoring of telephone transmissions, electronic mail and Internet usage," and its operative text reaches exactly those three things. It does not impose a video-camera notice duty, and the hundred dollar per-violation penalty attaches to phone, email and internet monitoring. Any state table that lists Delaware as requiring written notice for cameras is describing a statute that does not say that.
Layer four: biometric privacy laws are where AI video gets expensive
Biometric privacy statutes are the fastest-growing legal exposure in video surveillance, and they turn on one question: does the system identify a specific person, or does it only detect an event? Illinois and Texas draw that line explicitly, and the distinction determines whether a camera upgrade carries per-violation liability or none at all.
Illinois' Biometric Information Privacy Act defines a biometric identifier at 740 ILCS 14/10 as "a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry," while expressly excluding photographs. Section 14/15(b) bars a private entity from capturing a biometric identifier unless it first informs the subject in writing that one is being collected, informs them in writing of the specific purpose and length of term, and receives a written release. Section 14/20 sets liquidated damages of one thousand dollars for a negligent violation and five thousand for an intentional or reckless one, plus attorney fees and costs. A 2024 amendment, Public Act 103-769, limited repeat collections by the same method from the same person to a single recovery, which trimmed the ceiling on class exposure without touching the underlying duty.
| Illinois BIPA | Texas CUBI | |
|---|---|---|
| Citation | 740 ILCS 14 | Tex. Bus. & Com. Code 503.001 |
| Covered identifier | Scan of hand or face geometry; photographs excluded | Record of hand or face geometry |
| Consent form | Written notice of purpose and term, plus a written release | Notice before capture, plus consent |
| Who sues | Any aggrieved person, private right of action | Attorney general only |
| Exposure | 1,000 dollars negligent, 5,000 intentional, plus fees | Up to 25,000 dollars per violation |
| Destruction | Per published schedule, or 3 years after last interaction | Within a year of the purpose expiring |
Texas reaches the same conduct through a different door. Tex. Bus. & Com. Code 503.001(b) bars capturing a biometric identifier for a commercial purpose without informing the individual first and obtaining consent, and subsection (b-1) forecloses the argument that a publicly available image implies consent. Subsection (d) sets a civil penalty of up to twenty-five thousand dollars per violation, recoverable only by the attorney general. Notably for employers, where an identifier was collected for security purposes, the statute presumes the purpose expires when the employment relationship ends, which starts the destruction clock automatically.
The Texas statute also now speaks directly to artificial intelligence. Section 503.001(e)(2) exempts biometric identifiers involved in developing or deploying AI models "unless a system is used or deployed for the purpose of uniquely identifying a specific individual," and section 503.001(e)(3)(A) separately exempts AI systems deployed for "preventing, detecting, protecting against, or responding to security incidents." A detection system that flags an event without resolving an identity sits inside both exemptions. A face-matching system does not.
Above: a synthetic illustration created to depict the scenario described here. It is not a real detection capture. The system flags an unauthorized approach at a service entrance without determining who the person is.
This is the architectural reason IntelliSee runs weapon detection without facial recognition. The platform analyzes live feeds from existing cameras for events, weapons, falls, unauthorized access, loitering, crowd conditions, vehicles, smoke and fire, and sends an alert within seconds. It does not build a faceprint, does not match a person against a watchlist, and does not record or retain video, which stays the job of whatever video management system a facility already runs. If you are weighing the privacy question specifically, our explainer on whether AI security cameras use facial recognition goes through what each approach collects.
What the state-by-state tables get wrong
Three errors recur across almost every online table of video surveillance laws by state, and each one can send a compliance program in the wrong direction.
Conflating audio consent with camera rules. A column labeled "one-party" or "all-party" describes the wiretap statute. It says nothing about where a camera may be mounted. California is an all-party consent state and still permits ordinary workplace cameras in common areas; West Virginia is a one-party consent state and still criminalizes a camera in an employee lounge. Reading the consent map as a camera map inverts the answer in both directions.
Reporting a statute that covers something else. The Delaware entry above is the clearest example, but the pattern is general. A monitoring-notice law that names telephone, email and internet is not a camera law, and citing it as one produces policies that solve a problem the organization does not have while leaving the real duty unaddressed.
Blurring "required" into "recommended." Tables frequently render an unenforced best practice and a criminal prohibition in the same voice. Employee notice is a recommendation in most states and a statutory duty in Connecticut. A camera in a locker room is inadvisable everywhere and a misdemeanor in West Virginia. Those are not the same fact and should not be planned against as though they were.
A compliance checklist for an AI video deployment
Legal review of a camera project comes down to seven concrete decisions, and all of them are cheaper to make before installation than after.
- Turn audio off unless you have a documented reason to keep it. This removes federal wiretap exposure and every state consent variation at once.
- Map every camera against the prohibited-room list. Restrooms, locker rooms, showers, changing areas and dedicated employee lounges are out, and so are camera angles that see into them through an open door. Our guide to security camera placement covers the coverage side of the same question.
- Post monitoring notice in a conspicuous place. It satisfies the Connecticut statute outright and helps everywhere else.
- Ask your vendor, in writing, whether the system creates a biometric identifier. The answer determines whether BIPA and CUBI attach at all. "AI-powered" is not an answer; "does it scan face geometry" is the question.
- Write the retention and destruction schedule before go-live. Both biometric statutes impose destruction duties on a clock, and general footage retention carries its own operational and evidentiary tradeoffs.
- Check whether the deployment triggers a bargaining obligation. Where employees are represented, camera installation and monitoring practices are frequently a mandatory subject of bargaining.
- Secure the system itself. A camera network is an attack surface, and a breach of stored footage creates notification duties under separate state data-breach law. We covered this in detail in why your security cameras are a cyber attack surface.
None of this requires replacing hardware. Analytics can be layered onto the cameras already installed, which keeps the legal review scoped to the software behavior rather than a fresh physical deployment. Our overview of running AI video analytics on existing cameras walks through what that involves, and cameras only deliver on any of it when they are actually working, which is the argument for a real security camera maintenance cadence.
Frequently asked questions
Is it legal to put security cameras in the workplace?
Yes, in every state, in areas where employees do not have a reasonable expectation of privacy. Lobbies, entrances, hallways, sales floors, warehouses, loading docks and parking areas are all standard. The restrictions apply to specific private spaces and, in a few states, to whether you gave notice first.
Do I have to tell employees about security cameras?
Connecticut requires prior written notice of electronic monitoring, satisfied by a conspicuously posted notice, with carve-outs for public common areas and for suspected misconduct. Most other states do not compel notice for video, but posting it is the recommended practice everywhere because it reduces privacy expectations and supports deterrence.
Can security cameras record audio?
Audio is regulated far more tightly than video. Federal law permits recording with one party's consent, but roughly a dozen states require all parties to consent, and Connecticut separately bars recording employment contract negotiations without consent from everyone involved. Disabling audio is the simplest way to remove the issue.
Are AI security cameras legal under biometric privacy laws?
It depends on whether the system identifies people or only detects events. Illinois BIPA and Texas CUBI attach consent, retention and destruction duties to a scan or record of face geometry. A system that detects a weapon, a fall or an unauthorized entry without resolving who the person is does not create a biometric identifier, and Texas expressly exempts AI deployed for detecting and responding to security incidents.
Where can you never put a security camera?
Restrooms, shower rooms, locker rooms, dressing and changing areas, and dedicated employee lounges. West Virginia, Connecticut and New York bar these by statute, several other states reach them through criminal privacy provisions, and no legitimate security purpose requires them.
The camera is not the compliance problem
Almost every legal risk described above attaches to what a system does with a person's identity, not to the fact that a camera exists. Audio interception, biometric capture, monitoring in private spaces: these are all questions about collecting more than the security purpose requires. A system that watches for events and stays uninterested in identities sits on the safe side of all four layers by design rather than by policy.
That is the whole idea behind turning passive cameras into proactive protectors. The cameras are already installed and already recording to somebody's video management system. Adding detection to them changes what the organization can respond to, within seconds, without adding a single new category of personal data.
If you are scoping an AI video project and want to work through what the platform does and does not collect before legal review, talk with our team. We will walk you through the detection capabilities, the data architecture, and how the system layers onto the cameras you already own.