An employer can monitor a personal device only through what is installed on it or enrolled from it: a work app, a monitoring agent or device management. Without one of those, your employer sees what passes through its own systems, such as work email and the company network, and nothing else on the device. Monitoring of personal devices is the kind people object to most, so the fair arrangement is a firm boundary around work.
Key takeaways
- No software or enrollment means no view into the device itself.
- What an agent or device management can see depends on how it is configured.
- 83% of UK adults rate monitoring of personal devices as intrusive.
- A written BYOD policy should say what is collected, when and what is off limits.
What does BYOD mean?
Bring your own device. An employee uses a phone, tablet or computer they own for work. It saves the employer hardware and suits contractors and part-time staff. It also puts work data and private life on the same machine, which is where the monitoring question starts.
What can an employer see on a personal device?
It depends on the route. These are typical capabilities, and each can be narrowed by configuration.
| Route | What the employer can usually see | What stays private |
|---|---|---|
| Work email or a work app only | Activity inside that app and sign-in records | Everything else on the device |
| Device management enrollment | Device model and system version, compliance with security settings and, in some setups, the list of installed apps | Content of personal apps, photos and messages |
| A monitoring or time tracking agent | Whatever the agent records while it runs: applications, websites, screenshots | Activity while the agent is paused or outside its schedule |
| Company network or VPN | Traffic that passes through it while you are connected | Traffic sent outside it |
The row to read carefully is the agent. A screenshot of a personal computer captures whatever is on the screen, including a private chat in the corner.
How do people feel about it?
- 83%
of UK adults rate monitoring of personal devices as intrusive, the highest of any method tested
ICO, 2023 - 47%
say the same of timekeeping and access monitoring, the lowest
ICO, 2023
What does the law say?
There is no single rule, and this is not legal advice. Three reference points help.
- New York. The notice law covers monitoring by any electronic device or system. It is not limited to equipment the company owns.
- Ontario. The written policy on electronic monitoring covers personal devices used for work as well as company equipment.
- United Kingdom. The regulator says expectations of privacy are significantly greater at home than in the workplace, which raises the bar for monitoring anything personal.
The common thread is notice plus proportion. Tell people, and collect less on a device that is theirs.
What are an employer's options?
Company device
Issue a work computer and monitor that. The boundary is physical and easy to explain.
ClearestWork apps only
Keep work in a managed app or browser profile and collect nothing outside it.
Low intrusionAgent with firm limits
Install a time tracking agent that runs only in working hours, shows its rules and can be paused.
Needs a clear policy
Do
- Write down exactly what is collected on personal devices
- Limit tracking to scheduled working hours
- Let people pause tracking for private tasks
- Blur screenshots on personal computers
- Offer a company device to anyone who prefers one
Do not
- Enroll a personal phone in full device management for convenience
- Capture screens around the clock
- Collect location from a personal phone without a specific need
- Treat installation as consent to everything
What should a BYOD monitoring policy say?
Clauses to include
- Which devices are covered and whether BYOD is optional
- What is installed, by name, and what it records
- When it runs, with working hours and days
- What is never collected: personal files, personal accounts, activity outside working hours
- Who can see the data and how long it is kept
- How to pause tracking, and how to remove the software when employment ends
A base policy to adapt is in the employee monitoring policy template.
What should an employee check before installing work software?
Read the policy
Find the list of what the software records. If there is no list, ask for one.
Check the schedule
Confirm that tracking stops outside working hours.
Look for a pause
Find out how to pause tracking for private tasks during the day.
Separate your accounts
Use a different browser profile or user account for work if you can.
Ask about removal
Know how the software is removed when you leave.
How does BirdsEye behave on a personal computer?
BirdsEye is a desktop agent, and it records only on the computer where it is installed and only while tracking is on.
- Tracking runs inside the working hours and working days the company sets, and stops outside them.
- The agent shows the rules: hours, screenshot interval, blur level and idle threshold.
- Anyone can pause for a set time or until they resume.
- Website tracking records the domain only, and an administrator can switch it off.
- Screenshots can be blurred lightly or heavily, and employees can view their own.
BirdsEye does not track employees' phones. Its Android app is an admin app for managers. See security and privacy.
Frequently asked questions
Can my employer monitor my personal phone?
Only through something on it, such as a work app or device management, or through its own systems, such as work email and the office network. It cannot see into a personal phone that has no work software and is not enrolled.
Can my employer see my personal browsing on my own computer?
If a monitoring agent is running, it can record what it is configured to record while it runs. Outside its schedule, or with tracking paused, it should record nothing. Check the policy.
Can I refuse to install monitoring software on my own device?
That depends on your contract and local law. A reasonable employer offers a company device as the alternative. Ask before you refuse.
Does a VPN let my employer see everything I do?
A company VPN lets the company see traffic that passes through it. Traffic outside the VPN is not visible to it.