Privacy, CCTV and Recording Laws Course (US): Lessons 2026

Lesson 1: Why privacy law matters on the job

Security officers see and record a lot: video, visitor logs, incident reports, license plates and sometimes phone calls. Several layers of law control how that information is collected and used.

There is no single national law that covers every privacy question. Rules differ by state, and a stricter state law can limit what federal law allows. When in doubt, ask your supervisor before you record.

Lesson 2: Recording conversations

The federal Wiretap Act makes it a crime to intentionally intercept a wire, oral or electronic communication. A violation can bring a fine and up to 5 years in prison.

An oral communication is protected when the speaker expects it is not being recorded and the situation justifies that expectation. A loud argument in a busy lobby is different from a quiet talk behind a closed office door.

One-party consent under federal law

Under federal law, a private person may record a conversation if they are a party to it, or if one party has agreed in advance. This exception does not apply if the recording is made to commit a crime or a tortious (wrongful) act.

All-party consent states

Some states require that everyone in a private conversation agree. Examples:

Lesson 3: Cameras and workplace monitoring

Wiretap laws are about the content of conversations. Adding microphones to cameras can bring those laws into play, so sound should be turned on only with approval.

Video has limits too. A federal law (18 U.S.C. 1801) makes it a crime, in places under special federal jurisdiction (such as some federal property), to capture images of a person's private areas without consent where they reasonably expect privacy. Many states have their own laws on hidden cameras and voyeurism.

Connecticut is one example of a state limit. Its section 31-48b says employers may not use electronic surveillance, including sound recording and closed-circuit TV, in areas meant for employees' health or comfort or for keeping their belongings safe, such as restrooms, locker rooms and lounges.

Notice of monitoring

• New York (Civil Rights Law 52-c): employers that monitor employee phone, email or internet use must give written notice on hiring, have it acknowledged, and post it where employees can see it.
• Connecticut (section 31-48d): employers must give prior written notice of the types of electronic monitoring. Posting the notice in a visible place counts.

Good CCTV habits

• Watch only the areas you are assigned to watch.
• Never use cameras to follow a person for personal reasons.
• Do not copy, photograph or share footage unless your procedure allows it.
• Log any footage you save or export, with the date, time and reason.

Lesson 4: Biometrics and vehicle records

Biometric data identifies a person by their body. Illinois' Biometric Information Privacy Act (BIPA) lists a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Signatures, ordinary photographs and descriptions like height or eye color are not biometric identifiers under the act.

Before a private company collects biometrics, BIPA says it must:

• tell the person in writing that the data is being collected or stored
• tell them the purpose and how long it will be kept
• get a written release from the person

The company must also publish a retention policy and destroy the data when the purpose is met or within 3 years of the person's last interaction, whichever comes first. It may not sell or profit from the data. A person can sue for $1,000 per negligent violation or $5,000 per intentional or reckless one, or actual damages if higher.

License plates and the DPPA

The Driver's Privacy Protection Act limits the release of personal information from state motor vehicle records, such as an owner's name and address. It is unlawful to knowingly get or share that information for a use the act does not allow, or to lie to get it. Allowed uses include government and police work, court cases and insurance. A licensed security service may use it only for one of the allowed purposes.

Lesson 5: Handling footage, notes and personal information

The Federal Trade Commission (FTC) gives five key principles for protecting personal information. They work well for notebooks, visitor logs and video:

• Give access only to people with a need to know.
• Do not use Social Security numbers as ID numbers or write them down unless it is required.
• Lock logs and notebooks away when you leave your post.

When information is lost or stolen

All states, plus DC, Puerto Rico and the Virgin Islands, have laws requiring notice when certain personal information is breached. Each state's rules differ. Report a lost notebook, phone, laptop or USB drive right away so your company can secure its systems, call police if needed and decide who must be told.

Requests for footage

Pass requests for video or reports, including requests from police, to your supervisor or the person your procedure names. Record who asked, what was given and when.