GPS Privacy at Work: What Employers and Employees Need to Know

In the United States, employers can generally use GPS to track work activity, but no single federal rule governs it. State law, the device being tracked and the way you communicate the program decide whether it holds up. The safest approach is simple: track for a stated business purpose, only during work time, tell people first, and keep the data no longer than you need it.

This guide is written for managers, owners and HR leads who want location data for attendance, dispatch or safety without creating a privacy problem. It also helps employees understand what they can reasonably expect.

TL;DR

• There was no direct federal regulation of GPS surveillance as of Littler's analysis of the Supreme Court's GPS decision, so employers should follow the laws of each state where they operate.
• Written notice is the safest habit, and some states require it. Maine and New Jersey are examples.
• Limit tracking to working hours and a clear business purpose. Tracking people off the clock is where most risk sits.
• Personal phones need extra care: in Maine, employees can decline to install tracking apps on their own devices.
• A short written policy covering what you collect, why, who sees it, and how long you keep it does most of the work.

Table of Contents

• What the law says about employer GPS tracking
• How state laws differ
• Notice and consent: what to tell people and when
• Personal phones versus company devices
• Off-the-clock tracking is the biggest risk
• What your GPS tracking policy should say
• Attendance, not surveillance
• Put verified attendance to work with Heyhive
• A short checklist before you turn tracking on
• FAQ
• Sources

What the law says about employer GPS tracking

There is no federal statute that says "employers may" or "may not" use GPS on workers. Littler, a major employment law firm, noted that no direct federal regulation of GPS surveillance existed and advised employers to follow the legal requirements of the states where they operate. The same analysis said the Supreme Court's 2012 GPS decision could influence judges considering privacy claims and that employers should expect legislative activity.

Courts have historically leaned toward employers when the tracked property belongs to the employer. A 2010 academic review observed that courts generally favored employer interests in employer-owned property, while employees looked to state constitutional, statutory and common-law privacy rights for recourse.

The practical reading: a company vehicle or company device with a disclosed business purpose is the strongest position. A personal phone, a personal car or tracking outside work hours is where claims tend to start.

How state laws differ

The patchwork is the real compliance challenge. The National Conference of State Legislatures reports that at least 26 states and D.C. address tracking someone without their knowledge, and that some of those laws exempt employer use connected with an employee's work.

A few examples show how much the details vary:

Laws change, and these summaries are not legal advice. If you employ people in several states, have an employment attorney in your main state review your policy before you roll out tracking.

Notice and consent: what to tell people and when

Even where no statute demands it, notice is the single most protective step. Fisher Phillips, an employment law firm, recommends transparent, documented policies explaining what GPS data is collected, why, how long it is stored and who can access it. Zonar, a fleet technology provider, similarly advises communicating openly before a program begins: what the technology does, how the data will be used, and its practical benefits.

What good notice looks like in practice:

1. Give it before tracking starts. Not on day one of the rollout, and not buried in a handbook update nobody reads.
2. Put it in writing. A signed or electronically acknowledged copy is easy to find later.
3. Explain the "why" in business terms. Attendance verification, dispatch, safety, mileage and billing are clear purposes. "Because we can" is not.
4. Tell new hires during onboarding. In Maine, employers must also inform job applicants about surveillance during interviews and provide annual written notice to employees.
5. Repeat it when anything changes. A new data type, a new purpose or a new device means an updated notice.

Where you have union-represented staff, check the bargaining agreement first. A professional memo from a finishing trades association notes that employers can generally require GPS-enabled timekeeping apps, but the requirement must be reasonable and must not violate collective bargaining agreements.

Personal phones versus company devices

This is the question behind most employee searches on this topic: can my employer make me install a location app on my own phone?

There is no single national answer. In Maine, under the state's 2026 surveillance law, employees have the legal right to decline employer requests to install data collection or transmission applications, such as GPS, on their personal electronic devices. Elsewhere the rules depend on state law and the employment relationship, and on whether the requirement is reasonable.

For employers, the lower-risk design is clear:

• Prefer company-issued devices when you need continuous location data.
• If staff use personal phones, make the app collect location only at defined moments, such as clock-in, clock-out and arrival or departure at a job site, rather than all day.
• Get written acknowledgment of what the app does and does not collect. Fisher Phillips, writing in 2018, suggested considering written authorization from employees before installing GPS tracking on their cell phones, even where the law does not require it.
• Offer an alternative such as a shared device or kiosk where reasonable, so a refusal does not become a conflict.

For employees: read what the app asks permission for, ask your manager when location is collected, and ask for the policy in writing.

Off-the-clock tracking is the biggest risk

The point on which legal commentators agree most is time. Fisher Phillips advises limiting GPS tracking to work-related purposes and working hours, because monitoring outside work hours may be excessive and may violate privacy. McAfee & Taft-style commentary aside, a 2026 practical guide from a law firm recommends either disabling tracking outside work hours or clearly disclosing continuous tracking, getting acknowledgment, and asking whether the business purpose justifies it.

Following the 2012 Supreme Court decision in United States v. Jones, some legal experts argued that employers should limit tracking to working hours to avoid potential liability.

Company vehicles used for personal reasons

Take the common case: a technician takes the van home. If your policy permits personal use, decide in advance whether tracking continues. Options that hold up well:

• Track only during scheduled work hours, with a clear on/off method.
• Or disclose continuous tracking in writing, explain the purpose (theft recovery, for instance), and get acknowledgment.
• Keep off-hours location data out of performance reviews.

If you manage a fleet, a data-minimizing setup matters as much as the hardware. This overview of fleet vehicle GPS tracking covers the common uses such as mileage, geofence alerts and idle time, which are the kinds of business purposes your policy can name.

Using GPS in an investigation

Tracking someone to look into suspected misconduct is a different use from routine attendance. Law professor Marc Chase McAllister has suggested that GPS in misconduct investigations should be a measure of last resort, used only to corroborate evidence of a terminable offense and ended as soon as the investigation concludes. Involve HR and counsel before doing this.

What your GPS tracking policy should say

A good policy is short enough that people read it. Pull together what the legal sources recommend and it comes down to these elements:

• Business purpose. Why you collect location data. Zonar says a policy should explain the business purpose, when tracking is active, what data is collected, who can access it and how it may be used.
• Data categories. A 2026 law firm guide says a robust policy identifies the categories of data collected, monitoring purposes, data access and retention.
• Protected activity. The same guide advises stating that employees have no expectation of privacy in company-owned systems and devices, while carving out protected concerted activity under the National Labor Relations Act and communications with government agencies.
• Employee data rights. In California, the CCPA gives employees the right to access and correct data held about them, and employers must reflect that in their privacy notices.
• Retention. Decide how long location records live and who deletes them. This data retention policy guide walks through setting retention periods, access controls and privacy rights, and it applies to location data as much as customer records.

If you want ready-made structures, our own guides cover a 6 step GPS policy for US HR and GPS time tracking policy clauses in plain language.

A worked example

Imagine a 40-person landscaping company with crews on 12 job sites. The owner wants proof that crews arrive and leave when they report. A defensible setup looks like this:

1. Purpose: verify attendance and billable time at job sites. Nothing else.
2. Collection: location is captured at clock-in and clock-out, and at arrival and departure, not continuously.
3. Notice: each employee receives the policy in writing during onboarding and signs an acknowledgment.
4. Access: only the owner and the office manager can see location records.
5. Retention: records are kept for the payroll and dispute window the company's advisers recommend, then deleted.
6. Review: once a year, the owner checks whether the purpose still holds and updates the notice.

This is a design for minimal data, which also happens to be the easiest design to defend.

Attendance, not surveillance

The privacy question changes depending on what the data is for. Verifying that a person clocked in at the job site is a narrow, explainable purpose. A live map of everyone's movements all day is not. Employees tend to accept the first and resent the second, and legal commentators treat the second as riskier.

A few habits keep tracking on the right side of that line:

• Collect location at defined events, such as clock-in and out, rather than all the time.
• Use the data for attendance, dispatch and payroll accuracy, and say so.
• Do not use it for unrelated discipline without telling people that it may be used that way.
• Let managers review exceptions, not watch screens.

For a practical rollout, see our two week GPS pilot for field employees and our manager's guide to geofencing time tracking.

Our perspective on GPS privacy

We build workforce software, and we hear the same worry from managers and crews: "Are you watching me?" Our answer is that location data should serve attendance and payroll accuracy, and the people it covers should know exactly how.

That is why we think of GPS as verification, not surveillance. Heyhive's GPS time clock verifies clock-ins, and field check-in records arrival and departure for mobile and multi-site teams. The point is a clean record of when work started and ended, ready for payroll-ready hours export, without anyone chasing paper timesheets.

We also believe managers should stay in control. Schedules are approved by a person before they are published, and the same principle applies to policy: you decide what your team is told, what is collected and who sees it. A tool works best when your written policy and your software settings say the same thing.

If you are choosing a tool, pick one that matches the narrow purpose you can explain to your team in two sentences. If you cannot explain it that simply, collect less.

Heyhive

Put verified attendance to work with Heyhive

If your goal is accurate attendance without constant monitoring, Heyhive brings scheduling, a GPS time clock, field check-in and payroll-ready hours into one place. You generate and approve schedules, your crews clock in with GPS verification, and you export hours for payroll. It is a subscription product offered after a free trial.

See how Heyhive handles GPS time clocks and field check-in, or read our overview of GPS time clock software for attendance and payroll before you decide.

A short checklist before you turn tracking on

• Name the business purpose in one sentence.
• Check the laws of every state where employees work, including notice rules for vehicles and personal devices.
• Confirm any union agreement allows the requirement.
• Choose company devices where you can, or event-based collection on personal phones.
• Write the policy: data collected, purpose, access, retention, employee rights.
• Get written acknowledgment from each employee.
• Switch off or disclose any tracking outside work hours.
• Review the program every year.

For related setup details, our guides on GPS attendance verification, GPS clock-in compliance and employee attendance tracking for hourly teams go deeper on the operational side.

FAQ

Is it legal for my employer to track me with GPS?

In most US settings, employers can use GPS for legitimate business purposes, especially on company-owned vehicles and devices. There was no direct federal regulation of GPS surveillance as of Littler's 2012 analysis, so state law controls. Some states require notice, so check your state's rules or ask an employment attorney.

Can my employer make me install a tracking app on my personal phone?

It depends on your state. In Maine, employees have the right to decline installing GPS or similar apps on personal devices. Elsewhere, ask for the written policy, find out when location is collected, and raise concerns with HR or an employment attorney in your state.

Can I be tracked outside work hours?

Legal commentators advise against it. Fisher Phillips says monitoring outside work hours may be excessive and violate privacy. If continuous tracking is truly needed, such as for theft recovery on a vehicle, it should be disclosed in writing and acknowledged.

Does my employer have to tell me about GPS tracking?

In some states, yes. New Jersey requires written notice for tracking devices in vehicles used by employees, and Maine requires annual written notice of surveillance. Even where no law applies, giving written notice before tracking begins is the standard recommendation.

How long should GPS location data be kept?

Only as long as the stated business purpose needs it. Your policy should state how long data is stored and who has access. Set a retention period with your payroll and legal advisers, then delete on schedule.

Sources

• Littler: What Does The Supreme Court's "GPS Decision" Mean For Private Employers
• Location Surveillance by GPS: Balancing an Employer's Business Justification
• NCSL: Private Use of Location Tracking Devices, State Statutes
• New Jersey Chapter 449 (corrected copy)
• State of Maine, Public Law 2025, ch. 524
• Ogletree: Maine Enacts Law Requiring Employers to Notify Employees About Surveillance Tools
• EEOC: Written Testimony of Ifeoma Ajunwa
• Washington HB 2144 Bill Report
• Fisher Phillips: 7 Best Privacy Practices for Employers
• Employee Monitoring and Workplace Privacy: A Practical Guide
• Zonar: What to Include in a GPS Tracking Employee Policy
• Potential Union Challenges: Electronic Timekeeping memo
• GPS and Cell Phone Tracking of Employees, Florida Law Review
• Data retention policy guide

Recommended

• Turn GPS Into Attendance, Not Surveillance: A 6 Step Policy for US HR
• Set Geofences at 50–100m: GPS Attendance Verification for Managers
• HR Audit Grade GPS Clock Ins: 50–100m Geofences for Compliance
• HR Teams: GPS Time Tracking Policy in 5 Plain Language Clauses