CONDUCT
Is it legal to monitor employee WhatsApp in the US?
- By Charindu Edirisuriya
- Published 2026-09-15
- Updated 2026-10-31
- 5 min read
Generally yes, on company-owned numbers, with notice. Federal law's workable path for employers is employee consent plus monitoring that is routine and serves a legitimate business purpose. Several states add a written notice requirement with civil penalties. Monitoring a rep's personal phone is a different and far riskier question.
The short answer
On numbers your company owns, with notice your staff have acknowledged, keeping a record of business conversations is ordinary record-keeping. Most of the legal risk in this area comes from 2 things: doing it on a device you do not own, and doing it without telling anyone.
This is not legal advice, and a lawyer in your state is worth the hour. What follows is the shape of the question so that hour is not spent on the basics.
The pivot nobody makes
Almost every page ranking for this question answers a different one. They answer “can my employer wiretap me”, and they answer it with the recording-consent statutes.
Those statutes were written about eavesdropping. The scenario they describe is a third party listening to a conversation the participants believe is private between them.
A company WhatsApp number is not that scenario. The conversation runs between your customer and your employee, on a line the business owns, about the business’s own commitments. Your employee is a participant in every one of those conversations, not a target of interception in them.
That distinction does most of the work here. It also disappears entirely the moment the number is personal, which is why the ownership question comes first and everything else second.
What federal law asks
The Electronic Communications Privacy Act of 1986 is the federal frame. It prohibits intercepting electronic communications, then carves out situations where an employer can.
Two of those carve-outs matter in practice. The first is consent: monitoring the employee has agreed to, which in practice means an acknowledgment collected at hire or before a change takes effect.
The second is monitoring in the ordinary course of business. The Sixth Circuit gave this a usable 3-part test in Adams v. City of Battle Creek, 250 F.3d 980 (2001): the monitoring must serve a legitimate business purpose, be routine, and come with notice.
Read that test again and notice what it rewards. Consistent, disclosed, boring record-keeping of business conversations passes comfortably. A one-off dig into 1 person’s messages because you have a suspicion is the fact pattern it was written to catch.
The states that want it in writing
Four are worth knowing about. Each adds a notice obligation on top of the federal position, and each is satisfied by paperwork rather than by a different product.
| State | What it requires | Penalty |
|---|---|---|
| New York | Written or electronic notice, acknowledged by the employee, plus a notice posted conspicuously | Up to $500, then $1,000, then $3,000 per offense, enforced by the attorney general |
| Connecticut | Prior written notice to affected employees of the types of monitoring that may occur | $500, then $1,000, then $3,000, levied by the Labor Commissioner |
| Delaware | Either a daily electronic notice, or a 1-time written or electronic notice acknowledged by the employee | $100 per violation, claimable in court |
| California | No monitoring-notice statute of this kind; the relevant law is the eavesdropping rule in Penal Code § 632 | Up to $2,500 per violation, rising to $10,000 after a prior conviction |
California is the one people get wrong in both directions. Section 632 reaches a person who records a confidential communication without the consent of all parties, and it expressly does not reach someone “known by all parties to a confidential communication to be overhearing or recording” it. Disclosure is the mechanism that keeps you outside it, which is the same answer as everywhere else.
Connecticut has an exception for monitoring without prior notice where the employer has reasonable grounds to suspect unlawful conduct. Treat it as an emergency provision your counsel invokes, not as a way to skip the notice.
What this means for linking a number
The practical sequence is short, and the order matters more than the content.
Write the notice first. Say which numbers are covered, what is captured, who can look, and how long it is kept. Get it acknowledged in writing or electronically, and keep the acknowledgment.
Then link. A company number is added as a companion device by scanning a QR code, which takes about a minute and installs nothing on anyone’s phone. The archive covers only the numbers you link.
Then tell the team before it happens, not after. Reps are told the archive exists before their number is linked, and the for employees page exists so they can read the specifics themselves rather than take a manager’s summary of them.
The fairness argument sits in the access log. Every view, search and export is written down before the data appears on screen, no row can be edited or deleted, the log cannot be switched off, and records are kept for 3 years. Your workspace owner and any auditor you bring in read it. That is what makes the answer to “who is watching the watchers” a document rather than a promise.
Where the answer flips to no
If the numbers are personal, stop. Installing anything on a phone you do not own, or reading an account that is not the company’s, is the fact pattern the computer-misuse and wiretapping statutes were built for, and no notice fixes it.
If you are a regulated broker-dealer or investment adviser, the question you are asking is not really legality but adequacy. WAOversight is not FINRA or SEC-grade archiving; Smarsh and its peers are built for that obligation and you should buy one of them.
If you operate in the EU or UK, this post does not cover you. Those regimes start from a lawful-basis and proportionality analysis rather than a notice requirement, and the conclusions differ enough that guessing is worse than asking.
What to do this week
Answer 1 question before you evaluate any product: are the numbers company-owned. Everything in this post depends on it and nothing in it survives a no.
If the answer is yes, draft the notice and send it to your employment counsel. It is a short document and it is the single highest-value thing you will do in this process.
The security page covers where the archive sits, who can reach it and the retention default of 12 months set by you. If you would rather see the thing before writing policy about it, the demo runs on sample data.
Find out what happened last week.
Fifteen minutes, your own numbers, no slides. If you don't see something that surprises you, we'll say so.
WAOversight is an independent product and is not affiliated with or endorsed by WhatsApp or Meta.