Updated on September 23, 2026 US states · EU GDPR · official sources linked
It depends on where your crews work. In the US the conditions come mostly from state law; in the European Union, from the GDPR plus national rules. Below: the official texts we read on September 23, 2026, what each one says and what it leaves open.
General information, not legal advice. Laws change and apply differently to each business: check the current text and ask an employment lawyer licensed where you operate.
There is no single national yes or no. The texts we checked set conditions state by state: New York and Delaware require notice before monitoring certain electronic activity, Connecticut has its own electronic-monitoring statute, and California makes it a misdemeanor to locate a person with a tracking device on a vehicle without the owner's consent.
Civil Rights Law section 52-c requires employers that monitor employees' phone calls, email or internet use to give written notice on hiring, have it acknowledged in writing or electronically, and post it where staff can see it. The Attorney General may enforce it: $500 for a first offense, $1,000 for a second, $3,000 after that.
The rule came from Senate bill S2628, signed on November 8, 2021 and in effect 180 days later, in May 2022. The text names telephone, email and internet use, not location data: whether a GPS clock-in on a phone falls under it is a question for a New York employment lawyer.
Delaware's 19 Del. C. § 705 covers monitoring of phone, email and internet use: the employer gives either an electronic notice each day or a one-time notice the employee acknowledges, and each violation carries a $100 civil penalty. Connecticut has a separate electronic-monitoring statute, section 31-48d.
Like New York's, the Delaware text is about communications, not location. For Connecticut, the state's Department of Labor lists section 31-48d among its workplace laws. We could not load the statute itself on the legislature's site today, so we don't summarize it: read the version in force before relying on any summary.
Penal Code 637.7 bars using an electronic tracking device, one attached to a vehicle or other movable thing, to find a person's location, unless the vehicle's registered owner, lessor or lessee consented; a violation is a misdemeanor. And the state's privacy law treats precise geolocation as sensitive information.
That privacy law is the CCPA. Its protections for employees and job applicants started on January 1, 2023, as the California Attorney General noted. It binds only businesses that pass set thresholds; one of them, per the California Privacy Protection Agency, is gross annual revenue of $26,625,000 or more, the figure in force since January 1, 2025. Whether a phone app counts as such a device under 637.7 is for counsel.
The Department of Labor's FLSA recordkeeping fact sheet requires employers to record, for non-exempt employees, the hours worked each day and the total for each workweek, and to keep time cards for two years. It also says employers may use any timekeeping method they choose: a phone time clock is one of them.
The GDPR applies to employee location data. Article 5 limits data to what is necessary for the purpose, Article 13 requires telling people who collects it and why, and Article 88 lets each member state add more specific rules for employment. An EU country can therefore be stricter than the regulation.
The European Commission adds that the employment relationship is unbalanced, so in most cases an employer can't rely on the employee's consent to use their data. In the EU, then, a signed consent form usually can't carry GPS clock-in on its own.
Seven texts from six jurisdictions, looked up on official sources on September 23, 2026; for Connecticut, only the Department of Labor's listing. Other states may have rules not shown here, and any text can change: use the table to prepare the talk with your lawyer.
| Where | Text | What it covers | Main condition |
|---|---|---|---|
| New York | Civil Rights Law § 52-c | Phone, email, internet use | Written notice on hiring, acknowledged and posted |
| Connecticut | Gen. Stat. § 31-48d | Electronic monitoring | Read the current text |
| Delaware | 19 Del. C. § 705 | Phone, email, internet use | Daily notice or one-time acknowledged notice; $100 per violation |
| California | Penal Code § 637.7 | Tracking devices on vehicles or movable things | Consent of the vehicle's owner, lessor or lessee |
| California | CCPA | Personal information, employees included | Covered businesses only; precise geolocation is sensitive |
| Federal | FLSA recordkeeping | Hours worked | Daily and weekly hours; any timekeeping method |
| European Union | GDPR, Art. 5, 13, 88 | All personal data, location included | Necessity, information, national employment rules |
Five practical steps work in any state: write down why you need the position, tell workers in writing what is recorded and when, collect only what that purpose needs, decide who can see it, and have a lawyer check the notice against local law. They are good practice, not a legal checklist.
"Confirm each punch was made on the job site" is a purpose. "Know where people are" is not.
One page: what is read, at which moments, who sees it, how long it is kept. Have each worker sign or acknowledge it.
A position at the punch serves that purpose; a trail of the day adds nothing a timesheet needs.
The foreman of that site and the office, not the whole company.
Ask counsel in each state or country where crews work, and look again before the first job in a new state.
GEOTT reads the phone's position at two moments only, the clock-in and the clock-out, and records nothing between them, so there is no trail of the day. The reading answers one question: was the punch made inside the job site's geofence? Each company's records are kept separate.
Questions about the law and GPS
The answer is local. The texts in this guide attach conditions: notice in New York and Delaware, the vehicle owner's consent for tracking devices in California, necessity and transparency under the GDPR in the EU. Check the state or country of each crew, and have a lawyer confirm how the rules apply to you.
New York's and Delaware's notice laws name phone, email and internet monitoring; whether they reach a GPS clock-in is for counsel. In the EU, GDPR Article 13 requires telling people what is collected and why. Telling the crew in writing before the first punch is sensible practice wherever you are.
Check the punch, not the person. A geofence around the job site plus an anti-spoofing test at clock-in and clock-out answers "was this worker on site?" without a record of the whole day. In GEOTT, an out-of-area punch is refused or flagged, and a recovered punch needs a manager's approval.
No. It is general information, checked on official sources on September 23, 2026. Laws change, and how they apply depends on your business, your workers and where they work. Before a decision, ask an employment lawyer licensed in the state or country concerned.
Write the one-page notice, hand it to one crew, then send them the invite link. The guided setup creates the first job site in about 2 minutes, the trial runs 15 days with no credit card, and afterwards it is $7 per active worker per month: see GEOTT pricing.