In the last few years, a flurry of state privacy legislation has bolstered protections for everything from biometric data to rights of deletion. Location data is no exception. The latest statute, New Jersey’s Assembly Bill No. 3950, goes into effect on April 18, 2022 and requires employers to provide notice to employees for certain types of geotracking. This law continues the steady advance in protections—both in state legislatures and in the courts—for the privacy of an employee’s location. Employers in every state should examine their geotracking programs to address the risks created by these developments.   

What does New Jersey’s new law require?

Assembly Bill No. 3950 requires that employers provide written notice to employees if the employer “knowingly makes use of a tracking device in a vehicle used by an employee” when that device is “designed or intended to be used for the sole purpose of tracking the movement of a vehicle, person, or device.”¹ The law’s definition of “tracking device” supports a narrow reading that excludes devices capable of tracking location but that are not designed or intended to be used solely for that purpose. It is not yet clear, however, how narrowly courts will interpret the law’s “tracking device” definition.

What does a tracking device include?

Reading the law narrowly, a tracking device would exclude many common forms of geotracking. For example, it would not cover GPS tracking apps in company-issued smartphones because of the wide array of other functions performed by a smartphone. Similarly, tracking devices would not include combined devices often used in a fleet of trucks that capture vehicle movement as well as perform audio and video surveillance. The law’s definition of “tracking device,” furthermore, excludes devices “used for the purpose of documenting employee expense reimbursement,” one of the most common reasons that employers track location.²

On the other hand, a tracking device likely includes telematics devices that track movement, e.g., hard braking, swerving, and speeding, because this information includes “movement” if not location. Other equipment that might be covered include devices issued by insurance carriers to monitor safe driving and GPS locators that track drivers’ routes.

What are the penalties for not complying?

New Jersey’s law does not provide a private right of action. Rather, the law is enforced by New Jersey’s Commissioner of Labor and Workforce Development pursuant to New Jersey’s Penalty Enforcement Law of 1999. Failure to provide the required written notice can result in a penalty of up to $1,000 for the first violation and up to $2,500 for subsequent violations.³

How is New Jersey’s law different from other tracking laws?

Narrow definition of tracking

In passing this statute, New Jersey joins over a dozen other states with location tracking laws. The unique language of New Jersey’s law, however, makes its application both narrower and wider than the other laws. As explained above, New Jersey’s law defines a tracking device as “an electronic or mechanical device which is designed or intended to be used for the sole purpose of tracking the movement of a vehicle, person or device.”⁴ This narrow definition stands in contrast to other states’ laws. For example, California’s tracking law broadly defines an “electronic tracking device” as “any device attached to a vehicle or other movable thing that reveals its location or movement by the transmission of electronic signals.”⁵ On the other hand, Florida’s tracking law defines a “tracking device” as “any device whose primary purpose is to reveal its location or movement by the transmission of electronic signals.”⁶ Florida’s definition is clearly more expansive than New Jersey’s but not as broad as California’s.  

Application to both company and personal vehicles

Alternatively, some provisions of New Jersey’s tracking law are broader than other states’ laws. Notably, New Jersey’s law requires notice to employees regardless of whether they are driving a company or personal vehicle.  State laws typically exempt a company from compliance obligations if the company owns the vehicle being tracked. For example, Illinois and Michigan require the employee’s consent to track the location of the employee’s vehicle, but do not require the employee’s consent if the company owns or leases the vehicle being tracked.⁷

Requirement of notice but not consent

Furthermore, unlike tracking laws in many states, the New Jersey’s law requires only notice, not consent, for location tracking. Wisconsin, for example, requires consent for individual GPS tracking, except in a few circumstances. Notably, Wisconsin does not require employee consent for the employer’s tracking of a company vehicle.⁸

Relevant case law regarding tracking

Even in states without legislation on geotracking, recent developments in case law provide greater protection for the privacy of an individual’s whereabouts. This trend has been led by the Supreme Court. In Carpenter v. United States, the Supreme Court held that the warrantless collection for 127 days of cell-site data for mobile devices violated the Fourth Amendment.⁹ The Court reasoned that the continuous real-time tracking of an individual’s location violates a legitimate expectation of privacy.¹⁰ Chief Justice Roberts explained, “As with GPS information, the time-stamped [cell-site] data provides an intimate window into a person’s life, revealing not only his particular movements, but through them his ‘familial, political, professional, religious, and sexual associations.’ These location records hold for many Americans the ‘privacies of life.’”¹¹

Although Carpenter considered whether the government’s warrantless search violated the Fourth Amendment, the case is relevant to private employers because the “reasonable expectation of privacy” standard is effectively the same for the common law invasion of privacy tort. In fact, a growing number of state courts have followed the Supreme Court’s reasoning to hold that real-time continuous location tracking violates an individual’s reasonable expectation of privacy and can serve as a basis for privacy torts. For example, in a Nevada district court case, an employer surreptitiously placed a tracking device on an employee’s car.¹² The employee brought a claim for the common law privacy tort, intrusion upon seclusion, which survived summary judgment.¹³ Citing to Carpenter, the court found that the plaintiff had a reasonable expectation of privacy in his daily movements in the car.¹⁴

What steps can employers take given the recent case law?

In light of the growing case law protecting a privacy interest in location, employers can consider giving notice of location tracking even in states where not required by statute.  Employers should consider notice in particular when conducting real-time, highly accurate, continuous tracking of an individual’s location.  This applies to the tracking of any individual—not just employees, but also applicants, independent contractors, interns, and others. By providing a clear and explicit notice about tracking, the employer undermines expectations of privacy in the individual’s location.  

Second, employers should safeguard location tracking data within the organization and provide access on a need-to-know basis only. 

Third, if the employer implements a tracking program, it should consider other laws in the employment context as well as the risks of over-collecting personal information about employees. In particular, employers should try to avoid tracking employees after working hours because the employer risks gathering a wide spectrum of intimate details.  Some of these details may reveal the employees’ membership in a protected category. An employer could learn, for example, that an employee regularly visits a dialysis clinic after work or that an employee goes to the mosque every Friday. If the employee is then terminated or subject to some other adverse employment action, the employee may suspect that the adverse action resulted from discrimination based on the employee’s disability or religion. This potentially could lead to claims against the company, even if the company had a legitimate reason for the adverse action.

Employer takeaways

Given the growing protections for location tracking, employers should consider the following:

1. Providing notice regarding continuous real-time location tracking;
2. Determining whether the company’s location tracking program requires consent in any state and obtaining consent if needed;
3. Avoiding tracking employees’ location when off duty; and
4. Safeguarding location tracking information and restricting access to those who need the information to perform their job responsibilities.