Employee GPS Tracking Laws in Colorado: When Is It Legal?

Federal law does not specifically regulate employee GPS tracking. The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, permits employers to monitor business communications on company equipment, but prohibits wiretapping and interception of private communications without consent. The Wiretap Act's business use exception allows monitoring of company-owned devices during ordinary business use, but employees may retain privacy expectations in personal communications even on company devices. The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, addresses unauthorized computer access.

Federal law does not require employers to disclose monitoring in advance, though some states impose notification requirements. The National Labor Relations Act (NLRA), 29 U.S.C. § 151 et seq., protects employee organizing activities; excessive surveillance may constitute an unfair labor practice if it restrains protected conduct. OSHA does not regulate GPS tracking. The Fair Labor Standards Act (FLSA) does not address monitoring, though it governs compensable time. Federal transportation law requires compliance with state wiretapping statutes for vehicle tracking. The Society for Human Resource Management (SHRM) advises employers to balance legitimate business interests with employee privacy expectations.

Employees in states without specific GPS tracking laws may rely on federal wiretapping statutes and state tort law (intrusion upon seclusion, invasion of privacy). Federal law enforcement requires a warrant or court order for GPS tracking of personal vehicles, even employer-owned ones, under United States v. Jones, 565 U.S. 400 (2012). Employers should consult ECPA and state wiretapping statutes before implementing any monitoring program.

Colorado imposes stronger privacy protections than federal baseline. Colorado Revised Statutes § 24-72-204 explicitly protects employee privacy rights during work hours and mandates employer disclosure of electronic monitoring. Employers must provide written notice to employees before monitoring commences, including the type, extent, and frequency of monitoring.

Under C.R.S. § 18-9-304, employers cannot engage in wiretapping, eavesdropping, or secret electronic surveillance. This prohibition applies even to company devices and property if the employee has a reasonable expectation of privacy. Colorado interprets privacy expectations broadly: personal email accounts, text messages, and private communications retain protection even on company networks. Tracking personal devices—smartphones, personal vehicles, smartwatches, or fitness trackers—without explicit written consent is illegal under Colorado law.

Colorado law covers all employers with employees working in the state. There is no employer size threshold; even small businesses must comply. C.R.S. § 8-2-127 requires employers to notify employees in writing of electronic monitoring policies before implementation. This notice must specifically identify GPS tracking if used. Consent must be affirmative and documented; implied consent is insufficient.

Colorado provides remedies beyond federal law. Employees may bring civil actions for invasion of privacy under state tort law (C.R.S. § 13-21-202), seek injunctive relief to stop tracking, recover actual damages (lost wages, emotional distress), and pursue punitive damages in cases of willful violations. The Colorado Department of Labor and Employment (CDLE) enforces violations. Criminal penalties apply for secret wiretapping: violations of C.R.S. § 18-9-304 are Class 2 misdemeanors (4-8 months imprisonment, $250-$500 fines).

Colorado law is substantially stronger than federal baseline because it requires advance disclosure, restricts tracking of personal devices absolutely without consent, and provides state tort remedies. Federal law relies on consent within the business use exception; Colorado requires explicit, documented consent even for company devices.

Colorado law provides several exceptions to GPS tracking restrictions. Tracking is permitted on company-owned devices (phones, laptops, vehicles, tablets) during business hours if proper written notice is provided in advance. Employers may track location on work premises (office buildings, job sites, warehouses) using security systems without written notice, provided the system is not covert. GPS tracking of company vehicles during work hours is legal if disclosed; drivers understand the company owns the vehicle and business use is anticipated.

Tracking does not require consent in specific contexts. Security cameras and badge readers monitoring entry/exit are not considered GPS tracking and face lower disclosure requirements. Delivery drivers, field service technicians, and sales representatives operating in mobile roles can be tracked on company devices without additional consent beyond the employment agreement. Public safety positions (law enforcement, emergency services) have different expectations of privacy. Commercial fleet tracking for vehicle maintenance and fuel efficiency is permitted if properly disclosed.

The disclosure exception is critical: if an employer provides clear, written notice that "all company devices will be tracked via GPS," employees cannot later claim reasonable privacy expectations. However, the notice must be specific and given before monitoring. Retroactive tracking is prohibited. Employees retain privacy rights in personal devices even if carried for work (personal smartphone brought to the office). Off-duty tracking is never permitted, regardless of disclosure.

Common employer defences include: (1) explicit advance written consent, (2) tracking only during work hours, (3) tracking only company-owned devices, (4) legitimate business purposes (fleet safety, security, theft prevention). Defences fail if the employer did not disclose, tracked personal devices, or tracked off-duty conduct. Union representation does not exempt tracking; collective bargaining agreements must address monitoring explicitly. At-will employment does not override privacy rights. Colorado does not recognize a "business necessity" defence that permits secret tracking.

Step 1 — Document the tracking. Keep records of when you discovered the GPS tracking (dates, times, screenshots of location data, notifications, or app evidence). Document what was tracked: your personal phone, personal vehicle, smartwatch, or company device. Note whether you received advance written notice of the tracking program. Preserve emails, employee handbooks, policy documents, and any communications about monitoring. Take screenshots of any tracking app or location history visible to your employer. Document your work schedule and distinguish work hours from off-duty time. Keep a timeline of when tracking began relative to when you were hired or when policies were distributed.

Step 2 — Internal complaint process. Review your employee handbook for the tracking policy and complaint procedures. If no written disclosure exists, that is evidence of a violation. File a written complaint with your HR department or manager, stating: "I have discovered GPS tracking of [device/vehicle] without my advance written consent, which violates C.R.S. § 24-72-204." Request immediate cessation of tracking. Ask for written confirmation of when tracking began and what data was collected. Keep a copy of your complaint and any response. Request a meeting with HR to discuss the company's monitoring policy and your privacy concerns. Request written clarification of which devices and times your location is tracked. Document the employer's response, delay, or refusal to address the complaint. If the company claims they notified you, request the original written notice; absence of documentation supports your claim.

Step 3 — File with the Colorado Department of Labor and Employment (CDLE). Contact the CDLE Wage and Hour Section at 303-318-8700 (no filing fee). Submit a written complaint describing the tracking violation, dates, devices involved, and employer response. For criminal violations of C.R.S. § 18-9-304 (wiretapping), file with your local police department or county sheriff's office. You can file both a civil complaint and criminal report simultaneously. Include all documentation: screenshots, company policies (or absence thereof), your written complaint, and HR responses. The CDLE will investigate within 30-60 days. Alternatively, file a civil lawsuit directly in Colorado district court under C.R.S. § 13-21-202 (invasion of privacy tort). No administrative requirement to exhaust CDLE remedies before suing.

Step 4 — Investigation process. CDLE investigators will contact the employer and request monitoring records, policies, and evidence of your consent. Investigation typically takes 30-90 days. The employer must provide the tracking software agreements, device management records, and any written consent forms signed by you. You will be interviewed about the tracking, your knowledge of policies, and impact on you. If CDLE finds a violation, they will issue a determination letter and may impose penalties or require the employer to cease tracking and delete data collected without consent. Criminal investigation by local law enforcement takes longer (60-180 days) and requires evidence of knowing, intentional secret surveillance.

Step 5 — Consult an employment attorney. Contact a Colorado employment law attorney immediately if: (1) tracking was secret and ongoing, (2) your employer retaliated after the complaint, (3) the CDLE finds a violation but does not award adequate damages, or (4) you suffered job loss, harassment, or privacy invasion. An attorney can pursue a civil invasion of privacy lawsuit seeking compensatory damages (lost wages, emotional distress) and punitive damages (often 2-3x actual damages in willful violations). Many employment attorneys in Colorado work on contingency (no upfront fee). Initial consultation typically costs $150-$300. File civil suit within three years of discovering the violation (statute of limitations under C.R.S. § 13-80-101). Your attorney will negotiate a settlement or litigate through discovery, where the employer must produce all tracking data and communications.