Last reviewed: September 14, 2026
In most countries, yes, under four conditions: the phone belongs to the company, there is a written policy that says what is monitored and why, the employee has been informed and has agreed to it, and the monitoring is proportionate to a legitimate business purpose — security, compliance, protecting client data. Monitoring an employee's personal phone, or a company phone without telling them, is unlawful almost everywhere, and reading their private accounts is unlawful even on a company device.
Companies hand out phones and want to know they are used safely; employees carry them home and use them for more than work. The law in most places reconciles both with one idea: transparency and proportion. This guide covers the common rules, the specifics for the United States, Mexico, Colombia, Argentina and the European Union, the difference between a company device and a personal one, and how to set up monitoring that would hold up in front of a labor inspector or a judge.
Ownership: the device is the company's, bought and managed by it. Policy: a written document states what is monitored (calls, messages, location, apps), when (working hours, or always if the device is work-only), why, who can see the data and for how long it is kept. Notice and consent: the employee receives the policy and signs it before the phone is handed over — in most of Latin America and the EU that signature is the legal basis, and in the US it is the safest one. Proportion: you monitor what the purpose requires. Location tracking of a delivery fleet is proportionate; reading a salesperson's private WhatsApp is not.
The federal Wiretap Act allows monitoring of communications on a company system in the ordinary course of business, and with the consent of one party (18 U.S.C. § 2511(2)(a)(i) and (2)(d)) — a signed policy is that consent. A growing number of states add a written-notice requirement: New York since 2022 (Civil Rights Law § 52-c), Connecticut (§ 31-48d) and Delaware require employers to tell employees, in writing, that their electronic communications may be monitored. Reading an employee's personal email or social accounts, even from a company phone, exposes the company under the Stored Communications Act. Practical rule: monitor company channels, not personal ones.
Mexico's data-protection law (LFPDPPP) requires a privacy notice (article 15) and consent for processing personal data, with the purpose stated (article 8); an employee-monitoring policy is that notice. Colombia's Ley 1581 works the same way — a stated purpose (article 4) and prior, informed authorization (article 9) — and the Constitutional Court has repeatedly held that employer controls must respect the worker's dignity and privacy. Argentina's labor law gives employers the power to organize and direct work (articles 64 and 65 of the Ley de Contrato de Trabajo) and allows personal controls if they are general, non-discriminatory and respect dignity (article 70), with Ley 25.326 governing the data. In all three, secret monitoring is the fastest way to lose a labor case.
Under the GDPR, employee monitoring needs a legal basis, a purpose, prior information and, in most cases, a data-protection impact assessment; consent from an employee is considered weak because of the power imbalance, so the basis is usually the employer's legitimate interest, documented (article 88 leaves detail to national law). Spain's Workers' Statute allows the employer to verify compliance with work duties (article 20.3), but the Constitutional Court and the European Court of Human Rights (Barbulescu v. Romania, 2017) require that employees be told in advance, that the monitoring be proportionate and that personal use be respected where it is tolerated. Geolocation outside working hours is off-limits.
On a personal phone the employee brings to work, monitoring the device is out of the question: it holds their private life, and no policy can authorize reading it. What a company can do with BYOD is limited to the work part — a separate work profile, mobile-device-management of company apps, the ability to wipe company data. On a company-owned phone the picture is the opposite: the company may monitor it, but if it tolerates personal use it should say so in the policy and either exclude personal channels from monitoring or make clear that they are not private on that device. Either way, the policy decides; silence decides against the employer.
Write the policy in plain language: which devices, what is monitored, why, when, who has access, retention period, and what happens with the data when the employee leaves. Have every employee sign it before receiving the phone; keep the signed copies. Limit monitoring to working hours unless the device is strictly work-only, and switch location off outside them. Restrict panel access to the people who need it and log who looks at what. Delete data on a schedule. Review the policy yearly and whenever the law changes. CatWatchful is used this way on company-owned Android phones with the employee's written consent; installing it on a personal phone, or without that consent, is illegal and violates the terms of service.
Only if the policy they signed covers messaging on that device and WhatsApp is used for work on it. Reading a personal WhatsApp account, even on a company phone, is where most employers cross the line. The safe rule: monitor work channels, not personal accounts.
On a company device, during working hours, with notice and a business reason — fleet management, field service — yes. Outside working hours, no, in every jurisdiction mentioned here.
In Mexico, Colombia, Argentina and the EU the written policy and the employee's informed acknowledgement are the legal basis. In the US, a signed policy is the consent the Wiretap Act asks for and the written notice New York, Connecticut and Delaware require. Have everyone sign.
Then do not hand over the monitored device. Monitoring without consent is not an option; offering an unmonitored role or device, or none, is a management decision, not a legal one.
No. Paying the plan does not make the device or its contents yours. Personal phones can only carry a separate, managed work profile.
Yes, on company-owned Android devices, with a written policy and the employee's informed consent, limited to work use. Any other use is illegal and violates the terms of service.
See all featuresThis guide is general information as of the review date, not legal advice. Employment and privacy law differs by country and, in the US, by state, and changes often. Before monitoring employees, have your policy reviewed by an employment lawyer where the company operates.
Related guides: Is it legal to monitor my child's phone in the US? · Is it illegal to check your child's phone without them knowing? · Is it legal to monitor my child?