Employers must limit electronic monitoring to six enumerated legitimate purposes, narrowly tailor the tool's type and capabilities to those purposes, use the least invasive implementation, collect the least data necessary from the fewest workers, delete data once the purpose is achieved, prohibit off-duty collection, and ensure unnecessary data is not disclosed to the employer and is promptly disposed of by the vendor.

Employers must not use electronic monitoring tools in a manner that violates labor, employment, or civil rights law; threatens employee health, welfare, or safety; monitors off-duty employees; collects protected-class information; targets protected labor activity; monitors private areas (bathrooms, locker rooms, breakrooms, prayer areas); monitors employee residences or personal vehicles; incorporates gait, voice analysis, or emotion recognition; or takes adverse action against employees based on continuous time-tracking data (except for egregious misconduct) or undisclosed performance standards. Facial recognition is prohibited unless necessary for security.

Employers must not use electronic monitoring tools in any manner that: violates labor, employment, or civil rights law; threatens employee health, welfare, safety, or legal rights; monitors off-duty employees not performing work tasks; obtains information about an employee's health status, race, color, religion, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy, ancestry, or veteran status; identifies, punishes, or gathers information about employees engaging in protected activity; monitors bathrooms, locker rooms, breakrooms, smoking areas, cafeterias, lounges, breast-milk expression areas, or prayer areas (including frequency-of-use data); monitors a workplace in an employee's residence, personal vehicle, or employee-owned property; uses facial recognition (unless necessary for worker or facility security); or uses gait, voice analysis, or emotion recognition technology. Employers must not take adverse action against employees who in good faith oppose or refuse to submit to a practice they believe violates this chapter. Employers must not take adverse employment action based on continuous incremental time-tracking data except for egregious misconduct. Employers must not take adverse action based on monitoring data measuring performance against a standard not previously and clearly disclosed.

Employers must not use electronic monitoring or automated decisions tools to collect worker data except for seven enumerated purposes: essential job functions, production or quality monitoring, periodic performance assessment, labor-law compliance, health and safety, location-based wage and benefit administration, and other department-approved business-operations purposes.

Employers using monitoring or automated decisions tools must (1) give affected workers written notice, (2) obtain written consent, (3) keep collected data accurate and allow correction, and (4) use the tool in a narrowly tailored, least-invasive manner touching the fewest workers, least data, and no off-duty collection.

Even when monitoring for a permitted purpose, employers must not collect health, wellness, protected-class, HR-file, productivity, communications, device, geolocation, sensor/biometric, tool-output, or online-identifier data, must not identify or punish protected labor activity, and must not monitor bathrooms, other private areas, employee residences, or personal vehicles.

Employers must not use any electronic monitoring or automated decisions tool equipped with facial, gait, voice, or emotion recognition technology.

Employers must not require workers to physically implant data-collection devices, install monitoring applications on personal devices, wear or embed data-collection devices, or carry location-tracking devices unless tracking is limited to work hours and strictly necessary for essential job functions.

Employers, public entities, and their vendors must not use an AEDS, ABSDS, EMT, or other surveillance in any way that violates labor law or a collective bargaining agreement, interferes with protected labor activity, or diminishes workers' or beneficiaries' health, safety, privacy, dignity, autonomy, or welfare.

Employers must not monitor employees in bathrooms or other private areas, surveil them off-duty or on breaks, require monitoring software on personal devices, require subcutaneous tracking implants, compel disclosure of personal device passwords or social media accounts, or surveil employees' homes, personal vehicles, or property; employees may refuse or disable such monitoring without retaliation.

Employers must not use an AEDS, ABSDS, EMT, or surveillance to set productivity quotas or performance standards likely to harm worker health and safety, and must not take adverse action based solely on continuous keystroke, idle-time, or mouse-movement tracking data.

Employers and public entities must not take an adverse employment action based in whole or part on a productivity quota or performance standard that was not previously disclosed to the employee.

Employers must not use electronic monitoring tools in a manner that violates labor, employment, civil rights, or any other state law. Employers must not use monitoring tools or data in a manner that threatens the health, welfare, safety, or legal rights of employees or the public. Employers must not use monitoring tools to monitor off-duty employees or those not performing work-related tasks. Employers must not use monitoring tools to obtain information about an employee's health, race, color, religious creed, national origin, sex, gender identity, sexual orientation, genetic information, pregnancy or related conditions, ancestry, veteran status, or membership in any group protected from employment discrimination. Employers must not use monitoring tools to identify, punish, or obtain information about employees engaging in activity protected under labor or employment law.

Employers must not use electronic monitoring: (1) in any manner violating state or federal labor, employment, civil rights, or human rights laws; (2) in relation to off-duty employees not performing work-related tasks; (3) to identify, punish, or gather information about employees exercising legal rights; (4) for audio-visual monitoring of bathrooms, locker rooms, breakrooms, changing areas, lactation rooms, cafeterias, lounges, or similarly private areas; (5) to determine employee usage frequency of such private areas; (6) to monitor any space within an employee's residence, personal vehicle, or owned/rented property (unless necessary for health/safety or employer/client data security); (7) to obtain information about protected characteristics including age, race, disability, sex, sexual orientation, gender identity, religion, national origin, immigration status, political affiliation, neurodiversity, veteran status, or other state/federally protected classifications; (8) to take adverse employment action based on data from continuous incremental time-tracking tools; or (9) in a manner that harms health, safety, or legal rights of any employee.

Employers must not incorporate any form of facial, gait, or emotion recognition technology in electronic monitoring of employees.