Employee AI monitoring notices: what New York, Connecticut and Delaware require

Why this applies to AI usage monitoring

None of these statutes mentions artificial intelligence. They were written about employers reading email and watching web traffic, and they are drafted broadly. New York and Delaware cover monitoring or intercepting an employee's "telephone, e-mail or internet access or usage". Connecticut covers the collection of information about employees' activities or communications by any means other than direct observation.

A sensor that records which AI websites an employee opens and for how long collects information about internet usage. That is so even when, as with a metadata-only design, it records no content. We read all three statutes as reaching that kind of monitoring, and we think the prudent course is to treat them as applying. Whether they do in your circumstances is a question for your counsel.

What follows summarises each statute from its text. The official texts are linked under Sources.

New York: Civil Rights Law section 52-c

In effect since 7 May 2022.

Who. Any employer with a place of business in New York State. The state itself and its political subdivisions are excluded.

What triggers it. Monitoring or intercepting employees' telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage, by any electronic device or system.

What is required.

• Prior written notice upon hiring to all employees who are subject to electronic monitoring. The notice must be in writing or in an electronic record.
• Acknowledgment. The employee acknowledges the notice in writing or electronically.
• Posting. The notice is also posted in a conspicuous place that is readily available for viewing by the employees subject to monitoring.
• Content. Employees must be advised that their telephone, email and internet access or usage "may be subject to monitoring at any and all times and by any lawful means".

Exception. Processes that are designed to manage the type or volume of incoming or outgoing email, voicemail or internet usage, that are not targeted at a particular individual, and that are performed solely for computer system maintenance or protection.

Enforcement. The Attorney General. Maximum civil penalties are $500 for a first offense, $1,000 for a second and $3,000 for a third and each subsequent one.

In practice. The statute ties the acknowledged notice to hiring. An employer that introduces a new kind of monitoring for people it already employs is not told by the text what to do about them, beyond posting. The cautious approach, and the one we suggest you put to counsel, is to give existing employees the same notice and collect the same acknowledgment before the monitoring starts.

Connecticut: General Statutes section 31-48d

Connecticut has had this statute for many years. Public Act 26-73 repealed and replaced it with effect from 1 October 2026, and the new version is what follows.

Who. Any person, firm or corporation with employees, including the state and its political subdivisions.

What triggers it. "Electronic monitoring": the collection of information on an employer's premises concerning employees' activities or communications by any means other than direct observation, including by computer, telephone, wire, radio, camera or similar systems. Collection for security purposes in common areas held out for use by the public is excluded.

What is required.

• Prior written notice to all employees who may be affected, informing them of the types of monitoring that may occur and, since 1 October 2026, the specific locations on the employer's premises where it may occur.
• Posting of that notice in a conspicuous place readily available for viewing by employees, including in the specific location where the monitoring may occur. The statute says that such posting constitutes the prior written notice.
• A statement to new hires. Each employee hired on or after 1 October 2026 must receive, before starting work, a plain-language written statement advising which activities are prohibited and may be monitored without prior written notice.

Exceptions. An employer may monitor without prior notice when it has reasonable grounds to believe that employees are engaged in conduct that violates the law, violates the legal rights of the employer or other employees, or creates a hostile workplace environment, and monitoring may produce evidence of it. The duty to disclose specific locations does not apply to airports, or where the employer has reasonable grounds to conduct the monitoring for security and employee safety purposes. The section does not apply to a criminal investigation.

Enforcement. The Labor Commissioner may levy a civil penalty after a hearing: up to $500 for a first offense, $1,000 for a second and $3,000 for a third and each subsequent one.

In practice. Two features need thought for software-based monitoring. First, "specific locations": for a sensor that runs on laptops, the honest description is the devices and the sites where they are used, and your counsel should decide the wording. Second, the definition speaks of information collected on the employer's premises. How that reads for people who work from home is not settled by the text, and we do not offer a view on it. Give remote employees the notice regardless; nothing is lost by doing so.

Delaware: Code title 19, section 705

Who. Employers with a place of business in Delaware, including the State.

What triggers it. Monitoring or intercepting a Delaware employee's telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage.

What is required. The employer may not do so unless it does one of two things:

1. 01Daily electronic notice. Provides an electronic notice of its monitoring policies or activities to the employee at least once during each day the employee accesses the employer-provided email or internet access services; or
2. 02One-time acknowledged notice. Gives a one-time notice of the monitoring, in writing or in an electronic record, which the employee acknowledges in writing or electronically.

Exception. As in New York, processes designed to manage the type or volume of email, voicemail or internet usage, not targeted at a particular individual and performed solely for system maintenance or protection. The notice requirement also does not apply to law-enforcement activity carried out under a court order.

Enforcement. A civil penalty of $100 for each violation.

In practice. The second route is the practical one, and it is the same act as New York requires: a written notice, acknowledged.

The three side by side

One notice that covers the common core

An employer with people in all three states can meet the shared requirements with a single document and a consistent process:

1. 01Write one notice that describes the monitoring specifically.
2. 02Give it before monitoring starts, to everyone affected, and to every new hire before their first day.
3. 03Collect an acknowledgment, on paper or by a recorded click, and keep it.
4. 04Post it where affected employees will see it: on the intranet and, for Connecticut sites, at the locations concerned.
5. 05Add the state-specific pieces: the New York advisory wording, the Connecticut locations and new-hire statement.

What the notice should say

A notice that only repeats the statutory minimum tells employees nothing. A better one answers the questions people actually have:

• What is recorded. For AI usage monitoring: the name of the AI tool, the hostname or application name, the time and duration, and device details.
• What is never recorded. Prompts, responses, page content, keystrokes, screenshots, files and other websites, if that is true of your tooling. Say it only if you have verified it.
• How you are identified. By name, by a pseudonym, or not at all.
• Why. The purposes, and whether the records may or may not be used for performance evaluation or discipline.
• Whether anything is blocked or warned about.
• How long records are kept, and who can see them.
• How to see what is collected about you, and whom to ask.
• An acknowledgment block.

If the monitoring changes, for example from pseudonymous to named, or from recording to blocking, issue the notice again.

What this guide does not cover

These three are not the whole of US law on workplace monitoring: other state laws, wiretap laws and collective agreements may apply. Outside the United States the rules differ in kind. Under the GDPR and UK GDPR employers need a lawful basis, must inform employees under Articles 13 and 14, and may need a data protection impact assessment; our guide to monitoring AI use without surveillance covers that ground.

We have summarised statutes, not case law or regulator guidance, and statutes change: Connecticut's did only weeks before this guide was written. Read the texts linked below and take advice.

How GhostAudit approaches it

GhostAudit includes an employee AI monitoring notice among its document templates. It is filled from your actual sensor settings, ends with an acknowledgment block, and has a second part for the employer that summarises these three statutes and marks each decision that is yours. It is a template and not legal advice.

The sensors show employees what is collected, next to a notice in your own words, and our acceptable use policy prohibits covert deployment. The notice is also one of the deliverables of the AI Governance Starter.