Employee Monitoring, Recording, and BYOD

Texas law on workplace monitoring comes from three sources: Penal Code §16.02, Civil Practice and Remedies Code chapter 123, and federal wiretap law. This guide explains how to tell ordinary security monitoring from risky surveillance, and how to manage employees' personal devices (BYOD).

What the law requires

Interception. Texas is a one-party-consent state. Intercepting a wire, oral, or electronic communication is a crime unless the person intercepting is a party to it or a party consented in advance, and even then not if the interception is for the purpose of committing an unlawful act (Penal Code §16.02(c)(4)). Federal law has a similar rule, which excludes interceptions made to commit a crime or tort (18 U.S.C. 2511(2)(d)).

Civil liability. A party to an intercepted communication may sue anyone who intercepts it, has someone else intercept it, or uses or discloses what was intercepted (Civ. Prac. & Rem. Code §123.002). Remedies include an injunction, statutory damages of $10,000 for each occurrence, actual damages above $10,000, punitive damages, and attorney's fees and costs (§123.004). Chapter 123 reaches only the aural acquisition of a communication's contents (§123.001), so silent video is generally outside it; recording audio is where the risk lies.

Stored messages. Messages stored on a company's own email or messaging system are governed by the federal Stored Communications Act, which generally lets the provider of the service, often the employer, access them (18 U.S.C. 2701(c)(1)).

Private spaces. Recording a person in a bathroom or changing room without consent and with intent to invade privacy is a state jail felony, and a posted sign does not by itself supply consent (Penal Code §21.15). Cameras and microphones should never cover these areas.

Policy is not a cure. A written monitoring policy sets expectations and supports consent, but it does not make every collection lawful. Common-law privacy claims and the design of the tool also matter. Treat security logs differently from message content, live monitoring differently from stored access, audio differently from video, and company devices differently from personal ones.

Personal devices

For BYOD, mobile device management should separate business and personal data into distinct containers and, where technically possible, limit remote wipe to business data. Test selective wipe before deployment.

Related topics

• Employee Information and Workplace Monitoring
• Social Media Screening and the FCRA
• Biometric Timeclocks in Texas

Sources and legal update

• Texas Penal Code §16.02
• Texas Penal Code §21.15
• Texas Civil Practice & Remedies Code §§123.001 to 123.004
• 18 U.S.C. 2511(2)(d)
• 18 U.S.C. 2701(c)(1)

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.