AI Monitoring Self-Check
Tick everything you have observed at work. You will see the likely monitoring type, its legal standing in the US, EU/UK and China, and concrete steps to respond.
How it works
- Tick every behavior you have actually observed — even small signs like a policy email or an attendance-anomaly alert.
- Read the matched monitoring types and the three-column legal judgment: usually lawful, questionable, or needs further verification.
- Use the response steps to decide what to ask HR in writing and what to keep off company devices.
It depends. In the US, the ECPA generally allows monitoring on company equipment under the business-purpose exception, especially if you consented in a written policy. In the EU/UK, GDPR requires a lawful basis, proportionality and transparency. In China, workplace processing must follow PIPL Art. 13 and the principle of necessity.
If you use a company-provided ChatGPT seat or work account, your employer usually can. If you log into your own personal account on a personal device, the picture changes and monitoring may be unlawful.
No. Your ticks are processed entirely in your browser and never uploaded. Your checkbox state may be kept in your browser's local storage only so the page remembers it when you come back.
Ask HR in writing what is monitored, how long data is kept and who can see it. Preserve dated screenshots of policy notices and screenshots. If the issue remains unresolved, consult a labor lawyer or your local labor authority.
No. Most US states follow one-party-consent rules for recordings, but about a dozen (including California, Pennsylvania and Florida) require all-party consent before a conversation can be recorded. State statutes and your employer's written policy decide the edge cases.
Who this tool is for
This self-check is for remote and hybrid workers who have noticed something small and slightly unsettling: a screen-recording icon, a browser extension they did not install, a dashboard ranking AI usage by team, or a clock-in app that insists on GPS. It is also for the person who has only received a policy email and wants to understand what it may mean in practice before replying.
It is written for employees, not for employers designing a monitoring program, and it covers common workplace signals rather than every product on the market. If you are already in a dispute, use it to organise questions, not to reach a verdict.
How to read your result
The 13 checkboxes map onto seven monitoring types: activity, screen, AI usage, network, endpoint or extension, camera and location. Ticking an item adds its type to your result; a type does not need every box ticked to appear. The table then shows that type against three regions — the United States, the EU and UK, and mainland China — with a tier label: usually lawful, questionable, or needs verification.
Read those labels as sorting tools, not conclusions. "Usually lawful" still depends on notice, business purpose and proportionality; "questionable" means the facts and the paperwork matter; "needs verification" means the page cannot responsibly answer without more detail. The response steps below the table are the practical part: ask in writing, keep personal activity off company devices, and preserve dated records. A single tick is enough to justify the written question; you do not need to prove a pattern before asking what data exists.
A worked example
Suppose a worker ticks three boxes: screen-recording software on the work laptop, reports on ChatGPT or work AI tool usage, and phone GPS required to clock in. The matched types are screen, AI usage and location, which produce nine region-and-type judgments in the table.
Count the tiers across those nine cells: two read as usually lawful (AI usage in the US and in China), four read as questionable (screen recording in all three regions, plus location in China), and three read as needs verification (AI usage in the EU and UK, plus location in the US and in the EU and UK). That distribution is the useful output: the AI reporting is the least ambiguous item, screen recording is the item most likely to need a documented justification, and GPS clock-in is the item where the details of when and how location is collected decide the answer. The next move is not to confront anyone, but to send one written question asking what is collected, how long it is kept and who can access it.
Common mistakes
- Assuming a work laptop is private because it has a password. Access rights follow ownership and policy, not convenience.
- Treating a policy email as proof that every practice inside it is lawful. The policy is evidence of notice, not a legal clearance.
- Recording a meeting secretly in a state that requires all-party consent, which can create a bigger problem than the one being documented.
- Deleting alerts or screenshots because they feel incriminating. Dated records are usually the most valuable thing you have.
- Raising the issue only in a verbal conversation with a manager, where nothing is traceable.
- Reading "usually lawful" as "no limits", or "questionable" as "automatically illegal".
This checklist is educational and intended for planning, not legal advice, and it does not cover every country, state or monitoring product. Monitoring law and enforcement differ by jurisdiction and change over time. For a concrete concern, a contract question or any important decision, consult a licensed attorney or your local labor authority.
Sources and further reading
Employee-monitoring rules referenced here are checked against the sources below. Obligations differ by country and, within the US, by state.