Tracking employee location: what the law asks
Location as sensitive data in California, notice rules in other states, and why checking only at the punch is enough.
Last reviewed October 30, 2026. This article explains the rules in plain words. It is not legal advice: your company and its counsel decide your policy.
A crew installing a time app on their own phones will ask one question first: does it follow me? The law has opinions too.
California treats location as sensitive#
Since January 1, 2023, the CCPA applies to employee data for businesses that meet its thresholds. Precise geolocation is "sensitive personal information". Employees are owed a notice at collection listing what is collected and how long it is kept, and the right to know, delete, correct, and limit the use of sensitive information. Fines run $2,500 per violation, or $7,500 if intentional, adjusted for inflation.
Notice states#
New York requires written notice at hire, acknowledged by the employee and posted, before monitoring phone, email or internet use (Civil Rights Law 52-c). Connecticut and Delaware require prior written notice of electronic monitoring.
Biometrics#
Face or fingerprint clock-ins bring Illinois' BIPA (a written release before collection, a retention policy, damages per person), Texas' CUBI and Washington's biometric law. A phone that checks Face ID itself, and never sends the face to the employer, avoids collecting biometrics at all.
Vehicles#
California's Penal Code 637.7 bars putting a tracking device on a vehicle without the owner's consent. A company-owned vehicle is the company's to track; an employee's own car is not.
A sensible default#
- Read location only while clocked in, and only when it is needed.
- Tell people in the app what is read and when.
- Never track anyone off the clock.
How Oh! Thyme does it#
Oh! Thyme reads the phone's location once, at clock-in, clock-out or a task switch, and saves it with that punch. It never reads it during the shift, on a break or after clocking out. The camera opens only to scan a code and no photo is kept. Face ID is checked by the phone and never reaches us. See security and privacy.
Sources#
- California Privacy Protection Agency, regulations: cppa.ca.gov
- Illinois BIPA, 740 ILCS 14: ilga.gov
- Texas CUBI, Bus. & Com. Code 503.001: statutes.capitol.texas.gov
- Washington, RCW 19.375: app.leg.wa.gov