Create an organizational video surveillance policy

The short answer

An organizational video surveillance policy should state why cameras are used, where they are and are not allowed, how people are notified, who may view footage, how long recordings are kept and how misuse is handled. For anyone concerned with speech capture, the most consequential clause is whether audio may be recorded at all. Many organizations make their policies video-only by default. In the United States, recording conversations falls under wiretap and eavesdropping laws that are separate from rules on silent video. Federal law generally allows recording when one party to the conversation consents. Several states, including California, require consent from all parties. A camera that quietly picks up nearby conversations can therefore create legal exposure that the same camera recording silent video would not. This guide is general information, not legal advice. State law varies, so the policy should be reviewed by counsel familiar with every jurisdiction where the organization operates.

Why audio needs its own section

Many network cameras, desktop webcams, conference-room cameras and laptops include built-in microphones. Depending on the device and its configuration, audio may be captured whenever video is recording, unless someone turns it off. A policy that only says "cameras" leaves it unclear whether those microphones are permitted, so the policy should address audio explicitly.

Three practical distinctions help:

• Security surveillance versus conferencing: a meeting-room webcam used for calls captures speech by design, and participants know it. A fixed security camera recording a hallway is a different situation. The policy should treat these as separate categories.
• Video-blocking measures versus audio-blocking measures: a lens shutter or privacy cover stops video but does not stop a microphone. Disabling audio requires a software, firmware or hardware control on the microphone itself.
• Recording versus live monitoring: some laws treat intercepting a conversation in real time much like recording it. A policy that allows live audio monitoring without recording does not avoid the consent question.

Core elements of the policy

Element | What to define | Audio consideration

Purpose | The specific goals, such as security, safety or protecting property | State whether any purpose actually requires audio. If none does, prohibit it.

Scope | Which sites, devices and people the policy covers | Include webcams, conference-room systems and company laptops, not only fixed security cameras.

Permitted and prohibited locations | Where cameras may and may not be installed | Exclude restrooms, locker rooms, lactation rooms and other private spaces entirely. Be especially cautious with microphones in break rooms and offices where private conversations are likely.

Notice | Signage, handbook language and employee acknowledgment | If audio is recorded anywhere, the notice must say so specifically. Notice of video alone does not cover audio.

Consent | How consent is obtained where the law requires it | Account for all-party consent states and for visitors who have not signed any acknowledgment.

Access control | Who may view, export or share footage, and under what approval | Restrict audio access at least as tightly as video, and log every access.

Retention | How long recordings are kept and how they are deleted | Set a defined retention period on legal advice. This guide supplies no specific figure.

Security | Encryption, account management, firmware updates | Make sure device defaults, including microphone settings, are reviewed at installation.

Employee rights | Limits on monitoring protected activity | US labor law restricts surveillance of employees' protected concerted activity, and listening to conversations raises this risk.

Enforcement and review | Consequences for misuse and a review schedule | Include periodic audits confirming microphones are disabled where the policy requires it.

Sample policy text

The template below is a starting structure. Bracketed items must be completed by the organization and reviewed by legal counsel before use.

[ORGANIZATION NAME] VIDEO SURVEILLANCE POLICY

1. Purpose
   [Organization] uses video cameras to [protect people and property /
   deter and investigate security incidents]. Cameras are not used to
   monitor employee productivity [unless stated otherwise here].

2. Scope
   This policy covers all video recording devices owned, leased or
   managed by [Organization], including fixed security cameras,
   conference-room cameras, and webcams on company-issued computers.

3. Audio
   Security cameras must not capture, transmit or record audio.
   Microphones on these devices must be disabled at installation and
   verified during each audit.
   Conference-room and computer webcams may capture audio only during
   meetings or calls that participants knowingly join.
   Any exception requires written approval from [Legal/Security] and
   compliance with all applicable consent laws.

4. Locations
   Cameras may be placed in [entrances, exits, parking areas, cash
   handling areas]. Cameras are prohibited in restrooms, locker rooms,
   lactation rooms and other areas where people have a reasonable
   expectation of privacy.

5. Notice
   Signs will be posted at monitored entrances. Employees will receive
   this policy and acknowledge it in writing.

6. Access and Disclosure
   Only [roles] may view recordings. Exports require approval from
   [role]. All access is logged. Recordings are disclosed outside the
   organization only as required by law or approved by [Legal].

7. Retention
   Recordings are kept for [period set on legal advice] and then
   deleted, unless preserved for an investigation or legal hold.

8. Security
   Devices are kept on current firmware, accessed only through
   individual accounts, and stored on encrypted systems.

9. Misuse
   Violations may result in discipline up to and including
   termination.

10. Review
   This policy is reviewed [frequency] and whenever relevant laws or
   equipment change.

Effective date: [date]   Policy owner: [role]

Enforcing microphone restrictions on enterprise devices

A written policy is only effective if device configuration matches it. Organizations commonly enforce camera and microphone restrictions through endpoint or mobile device management, operating system privacy settings, camera management software and firmware settings on network cameras. Exact menu paths and policy names differ by platform, product and version. Check the current vendor documentation for the specific versions in use rather than relying on generic instructions.

Confirm the restriction with an observable test, not only by reading the setting. On a security camera, make a short test recording while someone speaks nearby, then check whether the file contains an audio track or any audible sound. On a managed computer, open a recording or call application and check whether the restricted microphone appears as an available input and whether its level indicator responds to speech. Record the result in the audit log.

Remote and hybrid work

When employees work from home, a laptop webcam and its microphone are in a private residence that may include family members who have consented to nothing. If the organization monitors through employee webcams or microphones outside of calls the employee joins knowingly, the policy should say so plainly, and counsel should review it closely. Many organizations limit webcam and microphone use to meetings that employees start or join themselves.

What this guide cannot confirm

No specific source evidence was available for this article. It therefore gives no retention periods, statutory citations, complete list of all-party consent states, penalties or product-specific settings. Those details change and vary by jurisdiction and device. Verify them with legal counsel and current vendor documentation before finalizing the policy.