GPS at work: what you can ask for, and what employees will accept

Ask a small employer why they want GPS on the time clock and the answer is almost always the same: somebody once clocked in from a car park, or from bed, and the whole system stopped meaning anything. It is a reasonable thing to want to fix. What follows the decision is usually more than was needed.

Start with the legal shape, because it is narrower than the anxiety around it. Location data collected from employees is personal information, and California employees have had the full set of consumer privacy rights over their workplace data since the CPRA exemption lapsed — access, deletion, correction, and the right to know what is collected and why. That does not make workplace location tracking unlawful. It makes it a thing you have to disclose specifically, collect for a stated purpose, keep only as long as that purpose needs, and be able to hand back when somebody asks.

The practical consequence is that "we track location" is not a disclosure. A notice has to say what is collected, when, for what purpose, how long it is kept and who it is shared with. And the purpose has to be real, because a purpose written broadly enough to cover anything is also broad enough to make every later use look pretextual.

The legal question is not whether you may collect location. It is whether you disclosed precisely what you collect, and stayed inside it.

Then there is the part nobody writes into the policy, which is what continuous tracking does to a team. Being locatable at all times is qualitatively different from being accountable for hours, and people read it as an accusation whether or not one was intended. In practice the cost is not resignations — it is that the highest-performing people, who had no reason to be watched, are the ones who notice most. That is a strange trade for a control aimed at a problem two people were causing.

Which is why the design question matters more than the legal one. The thing an employer actually needs is not a track of where somebody was all day; it is confidence that a punch happened where it was supposed to. Those are wildly different amounts of data. A single coordinate captured at the moment the employee taps Start Work answers the question completely, and answers nothing else — there is no trail to subpoena, no history to leak, and nothing to explain in a privacy notice beyond the punch itself.

Geofencing is the same idea expressed as a boundary: define the worksite, and let the clock tell the employee whether they are inside it. Done this way the employee sees the same information the employer does, at the same moment, which is what stops it feeling like surveillance. Done the other way — collected silently, reviewed later, raised in a meeting weeks afterwards — the identical data becomes the thing people describe as being spied on.

Capture a location at the punch, not between punches. It answers the only question you actually had.

Two practical notes. First, GPS fails: indoors, in basements, in metal buildings, on old phones. A system that treats a failed fix as a failed employee will manufacture disputes, so there has to be an exception path that lets somebody report the punch and a manager approve it — and that path has to be normal, not an admission of guilt. Second, if you use a shared device at the site instead of personal phones, most of this problem disappears: the tablet is at the worksite by definition, and no personal location is collected at all.

If you are deciding today, the honest test is to write down the sentence you would say to the team. "We record where you are when you clock in and out, so the hours match the worksite" is a sentence most people accept without much argument. "We can see where you are during the workday" is a different sentence, and if that is the one your system requires you to say, the question worth asking is which of the two problems you were actually trying to solve.