Smile--Cell Phone Camera Privacy and the Law

Picture the scene. You are at a backyard barbecue, phone in hand, capturing your friend's spectacular failure to land a cannonball into the kiddie pool. You film the whole glorious arc--the leap, the splash, the indignant toddler--and post it that night with a winking caption. It racks up three thousand views. Harmless fun, right?

Now change three small details. The "friend" is a stranger sunbathing two yards over. The "pool" is a public locker room. The "caption" tags her employer. Suddenly the same swipe of the same camera app sits somewhere on a spectrum that runs from "completely lawful" to "federal felony." Nothing about the phone changed. What changed is where the person was, what they reasonably expected, whether you captured their voice, and what you did with the file afterward.

That, in a sentence, is the law of cell phone camera privacy. There is no single statute called the "Don't Be Creepy With Your Phone Act." Instead, the rules are scattered across constitutional doctrine, a thicket of state wiretap statutes layered over the federal Electronic Communications Privacy Act, a federal video-voyeurism crime, dozens of "revenge porn" laws, biometric-privacy statutes, the common-law privacy torts, and the right of publicity. The picture (forgive us) is genuinely confusing, and most of the confident advice you hear at parties--"it's legal to record anything in public," "you can't film someone without their consent," "you can always film the police"--is half right and half dangerously wrong.

This article is your map. We will start with the single most important concept in the whole field: the reasonable expectation of privacy. We will then work through the part that trips up the most well-meaning people--the audio rules, where your camera's microphone can turn an innocent video into a crime. From there we cover the federal video-voyeurism statute and state upskirting laws, the constitutionally protected right to record police, the special rules for landlords and employers and their hidden cameras, the explosion of nonconsensual-intimate-image ("revenge porn") laws, the biometric statutes that can attach to a face scan, the right of publicity that governs commercial use of someone's image, and the way drones fold all of this back together. We then turn to a question every litigator eventually asks--how does a lawfully made recording become evidence?--before closing with a practical do's-and-don'ts section and an FAQ.

One promise and one warning up front. The promise: by the end you will understand not just the rules but why they are the way they are, which is the only way to apply them to situations no article anticipated. The warning, stated plainly and repeated often: the audio-recording rules in particular vary enormously from state to state, and a perfectly legal recording in one state can be a crime a mile across the border. When in doubt, check the law of the place where the recording happens--and, where the parties are in different states, possibly more than one state's law.

The Master Key: Reasonable Expectation of Privacy

Almost every question in this area bends back to one idea borrowed from the Fourth Amendment and woven into privacy law generally: the reasonable expectation of privacy, often abbreviated REP. The phrase comes from Justice Harlan's famous concurrence in Katz v. United States, 389 U.S. 347, 361 (1967), which asked two questions: (1) did the person exhibit an actual, subjective expectation of privacy, and (2) is that expectation one society is prepared to recognize as reasonable? Katz was a Fourth Amendment case about the government bugging a phone booth, but its two-part test has migrated into the privacy torts, the wiretap statutes, and the voyeurism crimes that govern what private citizens may do with cameras. When you read a privacy statute and hit the phrase "circumstances in which a reasonable person would believe," you are reading Katz in a costume.

Here is the intuition. The law generally lets you photograph what is openly visible from a place you are lawfully allowed to be. A person walking down a public sidewalk has chosen to present themselves to the world; they cannot reasonably expect that no one will ever see--or photograph--them. By contrast, a person in a bathroom stall, a changing room, or their own bedroom has done the opposite: they have stepped behind a curtain society universally treats as private, and they reasonably expect not to be recorded.

So the foundational rule of street photography, journalism, and your barbecue cannonball video is roughly this: in a public place, you can generally take photographs and video of what is plainly visible, including of other people, without their consent. Courts have long recognized that there is, in general, no privacy interest in one's appearance while voluntarily out in public. This is why tourists can photograph crowds in Times Square, why news photographers can shoot a protest, and why the person on the next park bench cannot demand you delete the shot they wandered into.

But "generally" is carrying a lot of weight, and four big qualifiers immediately complicate the clean rule.

First, the place may be public but the subject's expectation may not be. A shopping mall is open to the public, but a department-store fitting room inside it is not. A beach is public, but a person changing inside a beach cabana has stepped behind a privacy curtain. The REP analysis is about the specific space and circumstance, not the broad category of "public." Courts apply the same instinct that animates the Supreme Court's "plain view" and "open fields" cases: what you knowingly expose to the public is fair game; what you take pains to keep private is not.

Second, the visual may be lawful while the audio is not. This is the single biggest trap, and it has its own long section below. Your eyes (and your camera's lens) and your ears (and your camera's microphone) are governed by different bodies of law. You can be perfectly entitled to film something and simultaneously commit a crime by capturing the accompanying conversation.

Third, how you obtain the image matters. Photographing what is openly visible is one thing; using a telephoto lens, a drone, or a camera poked through a fence to capture what is not visible to an ordinary passerby can cross into the privacy tort of "intrusion upon seclusion" even where the subject is technically on private property visible from afar. The Restatement (Second) of Torts § 652B recognizes liability for intentionally intruding, physically or otherwise, upon the solitude or seclusion of another in a manner highly offensive to a reasonable person. Technology that defeats ordinary human limits--zoom, thermal imaging, flight--is precisely what pushes lawful observation into actionable intrusion. The Supreme Court made the analogous Fourth Amendment point in Kyllo v. United States, 533 U.S. 27 (2001), holding that using a thermal imager to detect heat inside a home was a search; "sense-enhancing technology" that reveals what could not otherwise be known without physical intrusion changes the calculus.

Fourth, what you do with the image afterward matters as much as the capture. Taking a lawful photo is one analysis; publishing it commercially (right of publicity), publishing private intimate content (NDII laws), or publishing private facts in a highly offensive way (the public-disclosure tort) are separate analyses with separate liability. The shutter click and the "post" button are two distinct legal events, and the law frequently treats the second as more dangerous than the first.

Keep the master key in your pocket as we go. Nearly every rule below is a specific application of one question: what did this person reasonably expect, and did the recording defeat that expectation?

The Four Common-Law Privacy Torts

Because we will lean on them repeatedly, it helps to introduce the four privacy torts that Dean William Prosser distilled from the case law in his enormously influential 1960 article Privacy, 48 Cal. L. Rev. 383, and that the Restatement (Second) of Torts §§ 652A–652E adopted. They are recognized, in some form, in most states (with notable variation--some states reject one or more, and a few have codified them).

Intrusion upon seclusion (§ 652B): intentionally intruding on someone's private affairs or seclusion in a way highly offensive to a reasonable person. This is the tort for hidden cameras in bedrooms, peering through windows, and surveillance of private spaces. Crucially, it focuses on the act of intrusion, so liability can attach even if nothing is ever published. The voyeur who is caught before posting anything has still completed the tort.
Public disclosure of private facts (§ 652D): publicizing truthful but private information that is highly offensive and not of legitimate public concern. This is the tort for broadcasting someone's private medical condition or, in some cases, intimate images--though the First Amendment heavily limits it where the matter is newsworthy, as the Supreme Court signaled in The Florida Star v. B.J.F., 491 U.S. 524 (1989).
False light (§ 652E): publicizing a misleading depiction of a person that would be highly offensive. Think a deceptively cropped or captioned photo. Some states reject this tort as too close to defamation.
Appropriation of name or likeness (§ 652C): using someone's identity for commercial benefit without consent. This is the tort ancestor of the modern right of publicity, covered in its own section below.

With the master key and the toolbox in hand, let's turn to the part that surprises almost everyone.

The Audio Trap: Wiretap Statutes and the Microphone in Your Pocket

Here is the fact that should be tattooed on the inside of every smartphone case: your camera has a microphone, and the law treats audio recording far more strictly than image recording. A video is two recordings stacked together--a visual one and an audio one--and they march to different drummers. You can have a clear right to see and film a scene while simultaneously lacking the right to record the sound of a conversation within it.

The reason is historical. Long before anyone imagined a phone in every pocket, legislatures were worried about wiretapping--secretly listening in on private conversations. The federal Wiretap Act, originally Title III of the Omnibus Crime Control and Safe Streets Act of 1968 and substantially expanded by the Electronic Communications Privacy Act of 1986 (ECPA), is codified at 18 U.S.C. §§ 2510–2523. It is worth pausing on the ECPA's three-part architecture, because the labels recur constantly in privacy litigation:

Title I, the Wiretap Act (§§ 2510–2523), prohibits the intentional interception of wire, oral, and electronic communications in transit--the live conversation, the moment it is spoken. This is the part that governs your phone's microphone.
Title II, the Stored Communications Act (SCA) (§§ 2701–2713), protects communications at rest--emails sitting on a server, messages in cloud storage. It is why hacking into someone's stored voicemails or DMs is its own offense.
Title III, the Pen Register/Trap and Trace provisions (§§ 3121–3127), restricts devices that capture dialing and routing information rather than content.

The Wiretap Act provides not just criminal penalties but a private right of action against anyone who intentionally intercepts a communication or uses or discloses an intercepted communication (18 U.S.C. §§ 2511(1), 2520). An "oral communication" is defined, in 18 U.S.C. § 2510(2), as one uttered by a person exhibiting an expectation that it is not subject to interception under circumstances justifying that expectation--there is our reasonable-expectation-of-privacy idea again, now wearing a statutory hat. That definitional limit matters: a conversation with no reasonable expectation of privacy is not a protected "oral communication" at all.

One-Party Versus All-Party Consent--The Most Important Distinction in This Article

The federal Wiretap Act, and the statutes of a majority of states, follow a one-party consent rule: it is lawful to record a conversation as long as at least one party to the conversation consents. Since you are a party to a conversation you are participating in, you can record your own conversations under the federal statute and under one-party-consent state law--even secretly, even without telling the other person. See 18 U.S.C. § 2511(2)(d), which permits interception where one of the parties has given prior consent, unless the recording is made for the purpose of committing a criminal or tortious act. That tortious-purpose proviso is a real and underappreciated limit: recording your own call is fine, but recording it as a step toward, say, blackmail or fraud strips away the consent defense even in a one-party state.

A substantial minority of states, however, follow a two-party consent rule--more accurately called all-party consent, because the rule actually requires the consent of every party to the conversation, not merely two. In these states, secretly recording a conversation can be a crime even if you are one of the people talking. The all-party-consent states are commonly listed as California, Connecticut (with nuances), Florida, Illinois, Maryland, Massachusetts, Michigan (with nuances), Montana, Nevada (interpreted as all-party by its courts), New Hampshire, Oregon (for in-person oral communications, with a specific notice exception), Pennsylvania, and Washington. This list is not stable--courts reinterpret these statutes and legislatures amend them, and several "all-party" states have important exceptions--so treat any such list as a starting point for research, not gospel. (Illinois is a cautionary tale: its eavesdropping statute was struck down as unconstitutionally overbroad by the Illinois Supreme Court in People v. Clark, 2014 IL 115776, and People v. Melongo, 2014 IL 114852, prompting the legislature to rewrite it--so even within a single all-party state the rule has moved within the last decade.)

The consequences of the difference are dramatic. Consider an invented but realistic example. Dana, working from a home office in Texas (a one-party state), records a phone call with a client to make sure she captures the details of an order. That is lawful in Texas. Now run the identical facts in California (an all-party state) under Penal Code § 632, which makes it a crime to record a "confidential communication" without the consent of all parties: Dana's secret recording could be a misdemeanor and expose her to civil liability--California's wiretap statute carries statutory damages of $5,000 per violation or three times actual damages, whichever is greater (Cal. Penal Code § 637.2). Same call, same purpose, opposite legal result, all because of where she sat.

It gets thornier when the two parties are in different states. If Dana in Texas records a call with a client in California, which state's law applies? The answer is genuinely unsettled and litigated. Some courts apply the law of the state where the recording device is located; others apply the law of each party's location; California courts have shown a willingness to apply California's protective law to protect Californians on the other end of the line (see Kearney v. Salomon Smith Barney, Inc., 39 Cal. 4th 95 (2006), applying California's all-party rule to recordings made by out-of-state callers of California residents). The safe, lawyerly answer is the conservative one: when any party to a conversation is in an all-party-consent state, get everyone's consent. This is exactly why customer-service calls begin with "this call may be recorded"--that announcement, followed by the caller's continued participation, is treated as consent.

Why the Microphone Matters for Your Camera

Now connect this back to the cell phone camera. When you shoot video, you are usually recording audio too. If that audio captures an "oral communication"--a conversation where the speakers reasonably expect privacy--you may be "intercepting" it under the Wiretap Act and state analogs, even if your video footage is perfectly lawful.

Worked example (hypothetical): Marcus, in Massachusetts (an all-party-consent state with one of the strictest wiretap laws in the country, Mass. Gen. Laws ch. 272, § 99), uses his phone to secretly record a tense conversation with his landlord in the landlord's office. The video might be fine; the audio could violate the Massachusetts wiretap statute, which famously prohibits secret recording of oral communications. Note the wrinkle that makes Massachusetts distinctive: its statute turns on secrecy, not consent--if the recording is not secret (the other party can see you are recording), it is generally permitted even without explicit consent. The Supreme Judicial Court and the First Circuit have wrestled with this repeatedly, including in the police-recording context discussed below (and in Project Veritas Action Fund v. Rollins, 982 F.3d 813 (1st Cir. 2020), which held the secrecy rule unconstitutional as applied to secret recording of government officials performing their duties in public). The lesson: read the actual statute, because "two-party consent" is a loose label hiding meaningful differences.

A few practical implications flow from the audio trap.

First, muting or not capturing audio can change the analysis entirely. If you film a public scene with the microphone off, the wiretap statutes--which govern oral communications--generally do not apply, because you have not intercepted any conversation. The image-privacy rules still apply, but you have removed one whole layer of risk.

Second, the expectation-of-privacy element still matters even in all-party states. Most wiretap statutes only protect conversations carrying a reasonable expectation of privacy or that are "confidential." A loud argument shouted across a public plaza, audible to everyone, is usually not a protected "oral communication" because no one could reasonably expect that exchange to be private. Recording a whispered private conversation at the next restaurant table is a very different story.

Third, visible recording can defeat the privacy expectation. If you are openly holding up a phone that is obviously recording, parties who keep talking may be found to have no reasonable expectation that the conversation is private, or to have consented by continuing. This is the principle that protects open recording of public officials, discussed next.

If you take one thing from this section, take this: before you secretly record a conversation--any conversation, anywhere--find out whether you are in a one-party or all-party state, and when in doubt, ask for consent or record openly. For more on the overlapping world of online speech and the platforms where such recordings often end up, see our guide to social media law basics.

When the Camera Crosses the Line: Video Voyeurism and "Upskirting"

The rise of tiny, discreet cameras created a genuine new menace of secret recording in private spaces--gyms, dressing rooms, bathrooms, hotel rooms--and the law responded. Today that response has two layers: a federal crime that applies on federal property and a near-universal blanket of state statutes.

The Federal Video Voyeurism Statute: 18 U.S.C. § 1801

The Video Voyeurism Prevention Act of 2004 created a federal crime now codified at 18 U.S.C. § 1801. It makes it a crime, in the special maritime and territorial jurisdiction of the United States (essentially federal lands, military bases, national parks, and similar federal enclaves), to knowingly videotape, photograph, film, record by any means, or broadcast an image of a "private area of an individual without their consent, under circumstances in which the individual has a reasonable expectation of privacy."

Parse the key defined terms, because they do the work.

A "private area" means the naked or undergarment-clad genitals, pubic area, buttocks, or female breast of an individual. § 1801(b)(3).

"A reasonable expectation of privacy" is defined two ways: circumstances in which a reasonable person would believe they could disrobe in privacy without being recorded, or circumstances in which a reasonable person would believe that a private area would not be visible to the public, regardless of whether the person is in a public or private place. § 1801(b)(5). That second clause is the upskirting clause--it captures the predator who photographs under a skirt on a public subway, where the victim is in public but the "private area" was never meant to be seen. It is a deliberate statutory fix for the gap that the master-key analysis alone would leave: a person riding the train is in public, yet plainly retains a reasonable expectation that what is under their clothing stays private.

Violation carries a fine and up to one year in prison. § 1801(a). Note the jurisdictional limit: § 1801 reaches conduct only within federal jurisdiction. It is not a general-purpose national ban on hidden cameras; for the vast bulk of everyday situations--your local gym, a state-licensed tanning salon, an apartment bathroom--the operative law is state law.

The State-Law Layer

Essentially every state now has a video-voyeurism, "unlawful surveillance," "criminal invasion of privacy," or similar statute criminalizing the secret recording of people in places and circumstances carrying a reasonable expectation of privacy--bathrooms, locker rooms, bedrooms, dressing rooms--and most reach "upskirt" and "downblouse" recording too. The penalties vary from misdemeanors to serious felonies, with enhancements where the victim is a minor (and, where the subject is a minor, the conduct can also implicate federal and state child-exploitation statutes that carry far graver consequences).

These statutes were not always adequate to the problem, and a notorious gap drove a wave of reform. In Commonwealth v. Robertson, 467 Mass. 371 (2014), the Massachusetts high court held that the state's then-existing "Peeping Tom" statute did not cover a man who took upskirt photos of clothed women on the MBTA, because the statute protected only persons who were "nude or partially nude"--and the victims were fully clothed. The decision was legally correct on the statute's text but produced public outrage, and the Massachusetts legislature amended the law within days to close the loophole. The episode is a useful reminder that these criminal statutes are construed narrowly (as criminal statutes must be, under the rule of lenity), so their precise wording matters enormously, and the law has had to chase technology to keep up.

The practical takeaways are blunt. Secretly recording a person's intimate areas--anywhere, in public or private--without consent is a crime under federal law on federal land and under state law nearly everywhere else. There is no "but I was technically allowed to be there" defense for the locker-room voyeur. And the offense is complete at the moment of recording; the offender need not publish or even keep the image.

Recording the Police: A First Amendment Right (With Limits)

Few corners of this field generate more confusion, more confrontation, and more viral video than the question: can I film the police? The short answer, in most of the country, is yes--openly recording police officers performing their duties in public is protected by the First Amendment. But the right has contours, and ignoring them can get your phone confiscated or land you facing (often dubious) charges.

Glik v. Cunniffe and the Right to Record

The landmark case is Glik v. Cunniffe, 655 F.3d 78 (1st Cir. 2011). Simon Glik used his cell phone to record Boston police officers arresting a man on the Common, because he thought they were using excessive force. The officers arrested him--charging him under the Massachusetts wiretap statute (there is our audio trap again), plus disturbing the peace. Glik sued under 42 U.S.C. § 1983 for violation of his civil rights, and the officers asserted qualified immunity.

The First Circuit ruled decisively for Glik. It held that "a citizen's right to film government officials, including law enforcement officers, in the discharge of their duties in a public space is a basic, vital, and well-established liberty safeguarded by the First Amendment." Glik, 655 F.3d at 85. The court grounded the right in the First Amendment's protection of the gathering and dissemination of information about government, noting that the right to record is "coextensive with the right to disseminate" what is recorded. It also rejected the wiretap charge because Glik's recording was open, not secret--the officers plainly could see him holding up his phone--so it fell outside the Massachusetts statute's prohibition on secret recording. And it denied the officers qualified immunity, holding the right was clearly established. That last point is what made Glik matter beyond Boston: it meant officers in the First Circuit could be held personally liable for arresting people who openly record them.

A wave of federal appellate decisions has since reinforced the right to record police in public, including ACLU v. Alvarez, 679 F.3d 583 (7th Cir. 2012) (enjoining enforcement of the Illinois eavesdropping statute against open recording of police); Fields v. City of Philadelphia, 862 F.3d 353 (3d Cir. 2017); Turner v. Lieutenant Driver, 848 F.3d 678 (5th Cir. 2017); and Smith v. City of Cumming, 212 F.3d 1332 (11th Cir. 2000). The clear weight of authority now recognizes a First Amendment right to record police carrying out their public duties. (The right is not yet universally "clearly established" in every circuit for qualified-immunity purposes, which is why officers in some jurisdictions have escaped personal liability even where the underlying right was recognized.)

The Limits--Because There Are Always Limits

The right to record is not a right to interfere. Several real constraints apply.

Reasonable time, place, and manner restrictions. The right is subject to limits that serve a legitimate governmental interest. You can record, but you cannot physically obstruct officers, ignore lawful orders to step back to a safe distance, cross a police line, or enter an active crime scene. The right protects recording, not obstructing--a distinction officers and bystanders both blur in the heat of the moment.

"Stand-back" laws are an emerging battleground. Several states have recently enacted statutes requiring bystanders to maintain a buffer (for example, eight or twenty-five feet) from officers while recording. These laws are being challenged on First Amendment grounds; Arizona's eight-foot law was blocked by a federal court in Arizona Broadcasters Ass'n v. Brnovich (D. Ariz. 2022) before the statute was repealed. This is unsettled, evolving law--check current authority in your state.

Open, not secret. The protection in Glik turned partly on the recording being open. In all-party-consent states, secretly recording officers' conversations can still raise wiretap issues; openly recording does not. Hold the phone where it can be seen.

You must lawfully be where you are. The right covers recording from a place you have a right to be--a public sidewalk, your own porch. It does not authorize trespassing into a secured area to get the shot.

Police generally may not delete your footage or seize your phone without a warrant. Officers ordering you to stop recording, demanding you unlock your phone, or deleting footage are on shaky constitutional ground. Riley v. California, 573 U.S. 373 (2014), held that police generally need a warrant to search the digital contents of a cell phone seized incident to arrest--the Court memorably observed that modern phones hold "the privacies of life" and are not analogous to a wallet or a pack of cigarettes. Deleting a citizen's footage can independently violate due process as destruction of property and may constitute a separate constitutional injury. That said, the practical advice when confronted is to keep recording, stay calm, comply with lawful orders to step back, and litigate later rather than escalate on the street.

The bottom line: in public, openly, without interfering, you have a strong and well-established right to record the police. It is one of the most important civic uses of the device in your pocket--and, fittingly, one where the law has come down clearly on the side of the citizen with the camera.

Hidden Cameras at Home and Work: Landlords and Employers

Move the camera off the street and into the spaces where people live and work, and the analysis shifts again. Two recurring scenarios deserve attention: landlords and employers.

Landlords and Rental Cameras

A landlord generally may install security cameras in the common, public areas of a rental property--lobbies, parking lots, exterior entrances, hallways--because tenants have a reduced expectation of privacy in shared spaces visible to all. What a landlord absolutely may not do is place cameras inside a tenant's unit, or in any space where the tenant has a reasonable expectation of privacy--bathrooms, bedrooms, and the interior living space. A hidden camera in a leased bedroom is the paradigm case of both the intrusion-upon-seclusion tort and a video-voyeurism crime.

Two gray areas recur. First, short-term rentals (think a vacation home you booked online): hosts are generally permitted to have disclosed exterior or common-area cameras but are broadly prohibited--by platform policy and by law--from placing cameras in bedrooms, bathrooms, or any interior private space. Several states require affirmative disclosure of any recording device on the premises. The wave of "hidden camera in the Airbnb" stories has prompted both platform crackdowns (most major platforms now ban indoor cameras outright) and legislation. Second, audio: even a lawful exterior security camera that records sound can run headlong into the wiretap statutes discussed above, especially in all-party-consent states. Many security-camera owners do not realize their doorbell camera's microphone may be the legally sensitive component--a video-only doorbell camera pointed at a shared walkway is one thing; one that records the audio of a neighbor's private conversation on their own porch is another.

Employers and Workplace Surveillance

Employers have somewhat broader latitude to monitor the workplace they own, and the law generally permits video surveillance of open work areas for legitimate business reasons--security, safety, theft prevention, productivity. The federal Wiretap Act even contains an "ordinary course of business" exception (18 U.S.C. § 2510(5)(a)) that has long been used to defend certain employer monitoring of business communications conducted on equipment the employer provides and the employee uses in the ordinary course of business; courts construe it narrowly and distinguish business calls from personal ones (see, e.g., United States v. Murdock, 63 F.3d 1391 (6th Cir. 1995)). But the limits are real and intuitive once you apply the master key.

No cameras in restrooms, locker rooms, changing areas, or other spaces with a high expectation of privacy. This is near-universally prohibited and is the kind of conduct that triggers both privacy-tort liability and criminal voyeurism statutes. Several states (California among them) flatly ban surveillance in these spaces by statute.
Audio recording of employees implicates the wiretap statutes; many employers who video-monitor lawfully would violate state law if they also captured employee conversations without the required consent. The "ordinary course of business" exception does not save indiscriminate audio recording of the breakroom.
Notice requirements vary by state. Some states (for example, Connecticut, under Conn. Gen. Stat. § 31-48d) require employers to give prior written notice of electronic monitoring; others do not. New York and Delaware impose analogous notice obligations.
Union and concerted-activity issues. Electronic monitoring can be a mandatory subject of bargaining under the National Labor Relations Act, and the National Labor Relations Board has signaled heightened scrutiny of intrusive surveillance that could chill protected concerted activity--meaning even a non-union workplace can run afoul of federal labor law if surveillance deters employees from discussing wages and working conditions.
Off-duty and personal devices raise distinct issues. Monitoring an employee's personal social media or recording them off the clock is a different and more dangerous proposition; see our overview of social media law basics for the employee-speech dimension, and note that biometric timekeeping systems add yet another layer, addressed below.

The unifying theme is the same one we keep returning to: surveillance is broadly permissible in spaces where people do not reasonably expect privacy and sharply restricted in spaces where they do--with the audio layer adding its own independent constraint everywhere.

The Aftermath Problem: Revenge Porn and Nonconsensual Intimate Images

So far we have mostly discussed the capture of images. But for one category of content, the law's deepest concern is the distribution. Intimate images--sometimes recorded consensually within a relationship--can become weapons when shared without consent after the relationship ends. The colloquial term is "revenge porn," though the more precise and increasingly preferred legal term is nonconsensual distribution of intimate images (NDII) or nonconsensual intimate imagery.

The State-Law Wave

A decade ago only a handful of states criminalized NDII. Today the overwhelming majority do, though the statutes vary in their elements--some require proof that the distributor intended to cause harm, others do not; some require the victim to have had a reasonable expectation that the image would remain private; most cover images that were originally taken consensually but shared without consent. These laws sit alongside the public-disclosure-of-private-facts tort and, increasingly, statutory civil causes of action that let victims sue for damages and obtain takedown orders.

A First Amendment caveat hovers over this whole area: because these statutes restrict the distribution of (sometimes truthful) images, they must be carefully drawn to survive free-speech scrutiny. Courts have generally upheld narrowly tailored NDII statutes--for example, the Illinois Supreme Court sustained that state's law in People v. Austin, 2019 IL 123910, reasoning that nonconsensual dissemination of private sexual images is a content-neutral regulation that survives intermediate scrutiny--while striking or narrowing overbroad ones. The doctrinal tension is real and ongoing, and it explains why so many of these statutes are studded with intent and expectation-of-privacy elements: those elements are the constitutional shock absorbers.

The Federal Response and Deepfakes

For years there was no federal NDII statute, and victims relied on a patchwork of state laws and copyright takedowns (if the victim took the photo, they often hold the copyright and can use a DMCA takedown notice). That gap has been closing. The federal landscape now includes a civil remedy added by the reauthorization of the Violence Against Women Act, codified at 15 U.S.C. § 6851, allowing victims to sue those who knowingly disclose intimate images without consent, with statutory damages and attorney's fees available. And in 2025, Congress enacted the TAKE IT DOWN Act, which criminalizes the nonconsensual publication of intimate images--including AI-generated "deepfake" intimate images--and requires covered online platforms to establish a notice-and-removal process and to remove such content (and identifiable copies) promptly upon a valid request from a victim. This is significant because the rise of generative AI means the "image" need not even be a real photograph: a synthetic but realistic depiction can inflict the same harm, and the law is racing to keep up. For the broader implications of synthetic likenesses, see our discussion of right of publicity basics and the deeper treatment in the right of publicity meets digital doubles.

The practical lesson for the person with the phone is stark: even where the original recording of intimate content was entirely consensual, sharing it without the depicted person's consent can be a crime and a tort. Consent to be photographed is not consent to be published. That single sentence resolves a startling number of real disputes.

Your Face Is Data: Biometric Privacy and BIPA

There is a newer dimension to camera law that the 2004-era thinking about hidden cameras could not have imagined: a photograph of a face is not just an image--it can be a source of biometric data. Modern systems can extract a "faceprint," a mathematical map of facial geometry as unique as a fingerprint, and use it to identify, track, and catalog people. Because you cannot change your face the way you can change a compromised password, a growing body of law treats that faceprint as sensitive personal data in its own right.

The flagship statute is Illinois's Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq. BIPA requires private entities that collect biometric identifiers (including scans of face geometry) to obtain informed written consent, to publish a written retention-and-destruction policy, and to refrain from selling or profiting from the data. Crucially, BIPA provides a private right of action with liquidated statutory damages--$1,000 per negligent violation and $5,000 per intentional or reckless violation--which has produced enormous class-action exposure. In Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, the Illinois Supreme Court held that a plaintiff need not allege actual injury beyond the statutory violation itself to qualify as an "aggrieved" person entitled to sue, supercharging BIPA litigation. The exposure climbed further in Cothron v. White Castle System, Inc., 2023 IL 128004, where the court held that a separate BIPA claim accrues with each unconsented scan--so a years-long course of fingerprint timeclock punches can multiply into staggering aggregate damages. (The U.S. Supreme Court, in Spokeo, Inc. v. Robins, 578 U.S. 330 (2016), set the federal Article III standing backdrop for whether such "bare procedural violation" claims can proceed in federal court; Rosenbach governs the state-court analysis, and the gap between the two has driven much BIPA forum-selection strategy.)

Illinois is not alone. Texas's Capture or Use of Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code Ann. § 503.001, and Washington's biometric law, RCW §§ 19.375.010–.040, impose comparable obligations--but, unlike BIPA, both are enforced by the state attorney general rather than by private plaintiffs, which is why the marquee class actions cluster in Illinois. Beyond these dedicated statutes, a growing number of comprehensive state privacy laws--California's CPRA, and the consumer-privacy statutes proliferating across the states--treat biometric information as a protected "sensitive" category requiring heightened handling. Several cities have gone further and restricted government or commercial facial-recognition use outright.

Why does this matter for the person holding a phone? For casual personal photography, BIPA-style liability is usually not your concern--these laws target systematic collection of biometric identifiers by businesses and other private entities, not your vacation photos. But the moment a business deploys cameras with facial-recognition or face-tagging features, scans faces to identify customers, or builds a faceprint database, it has entered heavily regulated territory. The most prominent example is the litigation against companies that scraped billions of online photos to build facial-recognition databases sold to law enforcement--conduct that drew BIPA suits and regulatory action worldwide. For a deeper treatment of how these statutes shape technology development, see our article on biometric data privacy laws and their impact on AI development.

The trend line is unmistakable: the law increasingly distinguishes between taking a picture and extracting biometric identity from a picture, and it regulates the latter far more aggressively.

Commercial Use: The Right of Publicity

Suppose you lawfully photograph a stranger on a public street--clean, no privacy violation. Can you then put that photo on a billboard advertising your company? Now you have left the world of capture and entered the world of commercial use, governed by the right of publicity.

The right of publicity protects a person's right to control the commercial use of their name, image, likeness, voice, and persona. It descends from the appropriation privacy tort (Restatement § 652C) and was first christened a distinct "right of publicity" in Haelan Laboratories, Inc. v. Topps Chewing Gum, Inc., 202 F.2d 866 (2d Cir. 1953). There is no federal right-of-publicity statute; it is a creature of state law, recognized by statute in some states (California's Civil Code § 3344 and New York's Civil Rights Law §§ 50–51 are leading examples) and by common law in others, with significant variation in scope and in whether the right survives death.

The key distinction is commercial versus editorial or expressive use. Using someone's likeness to sell a product or service--an advertisement, an endorsement, merchandise--generally requires consent (a model release). Using the same image for news, commentary, art, or other expressive purposes is generally protected by the First Amendment, even without consent. This is why a newspaper can publish a photo of a public figure without permission but a soda company cannot slap that same photo on its cans. Courts mediate the tension with doctrines like the "transformative use" test and the "newsworthiness" privilege--and the line has only grown harder to police as AI tools make it trivial to generate a synthetic but convincing likeness.

For the everyday photographer, the practical rule is: taking the photo is one thing; using it to sell something is another. If your captured image is destined for an advertisement, marketing, or merchandise featuring an identifiable person, get a signed release. For the full treatment--including the explosion of deepfakes, AI avatars, and post-mortem rights--see right of publicity basics and our deeper dive on the right of publicity meets digital doubles. If you are thinking about protecting your own name or persona as a brand, see trademarking your own name.

From Phones to the Sky: Drones and Aerial Cameras

Every issue above gets a new altitude when the camera is bolted to a drone. A drone can hover, peer over fences, and capture angles no street photographer could reach--which is exactly why drone photography stresses the privacy framework.

Two backdrops collide here. On the Fourth Amendment / expectation-of-privacy side, the Supreme Court historically held that aerial observation of a backyard from navigable airspace did not violate a reasonable expectation of privacy: see California v. Ciraolo, 476 U.S. 207 (1986) (warrantless naked-eye observation from a fixed-wing aircraft at 1,000 feet) and Florida v. Riley, 488 U.S. 445 (1989) (helicopter at 400 feet). Those cases predate cheap, hovering, high-zoom drones, and many commentators question whether their logic survives the new technology. The Court's later decision in Carpenter v. United States, 585 U.S. 296 (2018), holding that long-term cell-site location tracking is a search, signaled that pervasive technological surveillance can implicate privacy in ways the old aerial cases did not anticipate--and Kyllo, discussed earlier, is squarely on point for sense-enhancing drone cameras that reveal what the naked eye could not. This is contested ground, and several state supreme courts have already declined to extend Ciraolo and Riley to persistent drone surveillance.

On the regulatory side, the Federal Aviation Administration governs the airspace and the operation of drones--registration, Remote ID, Part 107 for commercial operators, and the recreational rules--but the FAA does not regulate privacy. There is no comprehensive federal drone-privacy statute. Instead, privacy is left to a patchwork of state and local laws--many states have enacted statutes specifically prohibiting drone surveillance over private property, "drone voyeurism," and aerial recording in circumstances carrying a reasonable expectation of privacy--plus the general privacy torts (intrusion upon seclusion is exquisitely well-suited to a drone hovering outside a bedroom window) and the video-voyeurism statutes. The result is that a drone operator can be fully FAA-compliant and still commit a privacy tort or crime by what they record and where they point the camera. For the full operational and regulatory picture--including the federal preemption questions that complicate state drone-privacy laws--see regulation of drones.

The unifying point: putting the camera in the air does not suspend the privacy rules; it intensifies them, because drones make it so much easier to defeat the reasonable expectation of privacy that the whole field is built to protect.

From Footage to Evidence: Using Recordings in Court

People rarely make a recording purely for posterity. Often the point is leverage--to document a threat, a confrontation, a defective product, or a broken promise. Which raises the question that follows naturally from everything above: if you lawfully captured it, can you use it?

Two hurdles stand between a phone video and a courtroom. The first is legality of acquisition. A recording made in violation of a wiretap statute is not just a crime; under the federal Wiretap Act's exclusionary provision (18 U.S.C. § 2515) and many state analogs, the illegally intercepted communication--and evidence derived from it--may be barred from use in court entirely. So the very all-party-consent rule that can make a recording a crime can also make it useless as evidence, a double penalty for getting it wrong. This is a powerful practical reason to record openly or with consent: a clean recording is an admissible recording.

The second hurdle is authentication. Before a court will admit a photo, video, or audio file, the proponent must show it is what they claim--that it has not been altered, mislabeled, or fabricated, a concern that grows sharper as AI-generated media becomes more convincing. Under Federal Rule of Evidence 901, a witness with knowledge can authenticate a recording by testifying that it fairly and accurately depicts what it purports to show; metadata, chain-of-custody, and the device itself can corroborate. The same principles apply to digital captures generally, including screenshots and webpages--a subject we treat in depth in capturing the web: authenticating website screenshots as evidence. The lesson for the person with the phone: if you may ever need the footage, preserve the original file and its metadata, do not crop or edit the working copy, and note the time, place, and circumstances while they are fresh.

A related point on the device itself: your phone is not just a camera but a vault. As Riley v. California recognized, its contents are constitutionally protected, and what you can be compelled to disclose--passcodes, biometric unlocks--is its own evolving area of law. For the regulatory and contractual dimension of who controls your phone and its software, see unlocking cell phones: the law and the DMCA exemption.

Putting It Together: A Practical Do's and Don'ts

Let's distill the doctrine into field-ready guidance. As always, these are general principles--your state's specifics control, and the audio rules in particular vary widely.

For the person holding the phone (the photographer):

DO feel free to photograph and film what is plainly visible in genuinely public places--streets, parks, public events. The general rule favors the photographer in public.
DO record the police openly when they are performing their public duties in public, without interfering, obstructing, or ignoring lawful orders to step back. This is protected First Amendment activity under Glik and its progeny.
DON'T secretly record conversations without first knowing whether you are in a one-party or all-party-consent state. When in doubt, ask for consent or record openly. Remember: your camera's microphone is the legally dangerous part, and an illegal recording may be both a crime and inadmissible.
DON'T ever record anyone's intimate areas without consent--anywhere, public or private. That is a crime under 18 U.S.C. § 1801 on federal land and under state law nearly everywhere.
DON'T point a camera (or a telephoto lens, or a drone) into spaces where people reasonably expect privacy--bedrooms, bathrooms, changing rooms, fenced yards. Capture from where an ordinary passerby could see, not from an intrusive vantage.
DON'T publish intimate images of another person without their consent, even if you took them consensually. NDII laws, the federal civil remedy at 15 U.S.C. § 6851, and the TAKE IT DOWN Act make nonconsensual distribution a serious matter.
DON'T use someone's identifiable image to sell a product or service without a release. That is the right of publicity, and it is separate from the capture.
DO be especially careful with hidden cameras, audio-enabled security cameras, and any system that scans or identifies faces--each carries its own statutory regime.
DO, if the footage might matter legally, preserve the original file and metadata unaltered.

For the person on the other side of the lens (the subject):

DO recognize that in genuinely public places, you generally cannot stop others from photographing you, however uncomfortable it feels.
DO trust your reasonable expectation of privacy in private spaces. If someone is filming you in a restroom, locker room, dressing room, or your home, that is very likely a crime--call the police.
DO assert your right to ask someone to stop recording you, and to leave a private establishment that permits it. Private property owners can set their own rules.
DO act quickly if intimate images of you are shared without consent: NDII statutes, the federal civil remedy, copyright takedowns (if you took the photo), and the new platform-takedown obligations all offer paths to removal and recourse. Preserve evidence first.
DON'T assume a recording is illegal just because you didn't consent. In one-party-consent states and in public, it often is not.

Key Takeaways

The law of cell phone camera privacy is not one rule but a constellation of them, each orbiting the same gravitational center: the reasonable expectation of privacy. Internalize that center and the rest follows.

In public, the photographer generally wins. You can usually photograph and film what is plainly visible from where you are lawfully entitled to be. There is no general right not to be seen in public.
The microphone is the trap. Audio recording is governed by the federal Wiretap Act (part of ECPA) and state analogs that vary between one-party consent (majority and federal rule) and all-party consent (a strict minority). The same video can be lawful for its images and unlawful for its sound. When any party is in an all-party state, get everyone's consent or record openly.
Intimate-area recording is criminal. Federal law (18 U.S.C. § 1801) on federal land, and state video-voyeurism and upskirting statutes nearly everywhere, criminalize secretly recording private areas where privacy is reasonably expected.
You can record the police. Glik v. Cunniffe and a wave of appellate decisions establish a First Amendment right to record officers performing public duties in public--open, non-interfering recording, subject to reasonable limits.
Landlords and employers may surveil shared and open spaces for legitimate reasons but not private spaces, and audio adds an independent constraint.
Distribution is its own offense. Nonconsensual sharing of intimate images is increasingly criminal and tortious under state NDII laws and the new federal framework, even when the capture was consensual.
Faces are becoming data. Biometric statutes like Illinois's BIPA, Texas's CUBI, and Washington's biometric law regulate the extraction of faceprints, with steep statutory damages where a private right of action exists.
Commercial use needs consent. The right of publicity governs using someone's likeness to sell something--separate from the right to take the picture.
Drones intensify everything. FAA compliance does not equal privacy compliance; the privacy torts and state drone statutes still apply.
An illegal recording can be inadmissible. Getting the consent rules wrong can both expose you to liability and destroy the evidentiary value of the very footage you wanted.

Above all, remember the refrain: recording-consent rules vary dramatically by state, and they change. Treat any general statement here--including our lists of all-party states--as the beginning of your research, not the end. When the stakes are real, confirm the law of the specific place where the recording happens, and where parties span multiple states, of every relevant state.

Frequently Asked Questions

Is it legal to take a photo of a stranger in public without their permission? Generally, yes. In genuinely public places, people typically have no reasonable expectation of privacy in their visible appearance, so you can photograph what is plainly visible--including other people--without consent. The big exceptions: you cannot record someone's intimate areas (even in public, an "upskirt" shot is criminal), you cannot use the image commercially without a release (right of publicity), and capturing audio of a private conversation may trigger wiretap laws. Private property owners can also impose their own no-photography rules.

Can I secretly record a conversation I'm part of? It depends entirely on the state. Under federal law and in the majority of states (one-party consent), you can record a conversation you are a party to, even secretly--so long as you are not doing it to commit a crime or tort. But in all-party-consent states--California, Florida, Illinois, Massachusetts, Pennsylvania, Washington, and others--secretly recording a private conversation can be a crime even though you are a participant. Because the rules differ and can apply across state lines, the safe practice is to get everyone's consent or record openly. Note that some "two-party" states (like Massachusetts) actually turn on secrecy rather than consent.

Does my video's audio really change the legal analysis? Yes, and this surprises people constantly. Image recording and audio recording are governed by different bodies of law. You can have a clear right to film a scene while simultaneously violating a wiretap statute by capturing the sound of a private conversation. If you are unsure about the audio rules where you are, consider muting the microphone--the wiretap statutes govern oral communications, so capturing video without sound generally avoids them.

Can I legally record the police? In most of the country, yes. Glik v. Cunniffe, 655 F.3d 78 (1st Cir. 2011), and a wave of later federal appellate decisions recognize a First Amendment right to record police officers performing their duties in public. But you must record openly (not interfere or secretly capture in an all-party state), you cannot obstruct officers or ignore lawful orders to step back, and you must be somewhere you have a right to be. "Stand-back" buffer laws are a newer, contested development--check your state's current law.

Someone shared intimate images of me without my consent. What can I do? You likely have several remedies. Most states criminalize nonconsensual distribution of intimate images (NDII / "revenge porn"), and the federal civil remedy at 15 U.S.C. § 6851 plus the 2025 TAKE IT DOWN Act provide additional recourse, including platform notice-and-takedown obligations--even for AI-generated "deepfake" images. If you took the photo yourself, you likely hold the copyright and can file a DMCA takedown notice. Move quickly, preserve evidence, and consult a lawyer; some statutes have intent or expectation-of-privacy elements that affect your options.

Can my landlord or employer put cameras where I am? For shared and open areas (lobbies, parking lots, open work floors) and for legitimate purposes, generally yes. For private spaces--inside your rented unit, bathrooms, locker rooms, changing areas--almost never; that crosses into the intrusion-upon-seclusion tort and video-voyeurism crimes. Audio recording adds a separate wiretap constraint, some states require notice of monitoring, and union or concerted-activity rules can apply under the NLRA. Short-term-rental hosts face especially strict rules and platform bans on interior cameras.

Is scanning faces with a camera different from just photographing them? Legally, yes--increasingly so. Extracting biometric identifiers (a "faceprint" mapping facial geometry) is regulated by statutes like Illinois's Biometric Information Privacy Act (BIPA), 740 ILCS 14/, which requires informed written consent and carries steep statutory damages with a private right of action, as well as Texas's CUBI and Washington's biometric law (enforced by their attorneys general). Casual personal photos generally are not the target; the laws focus on businesses systematically collecting and using biometric data. See our article on biometric data privacy laws.

Can I fly a drone over my neighbor's yard and film it? Be careful. Even if you comply with all FAA airspace and operational rules, the FAA does not regulate privacy. State drone-surveillance statutes, the intrusion-upon-seclusion tort, and video-voyeurism laws can all apply to what and where you record. A drone hovering to capture a private, fenced backyard or peering into windows is the kind of conduct these laws target. See regulation of drones.

Can I actually use my recording in court? Sometimes--but two conditions matter. First, a recording made illegally (in violation of a wiretap statute) may be barred from evidence under 18 U.S.C. § 2515 or its state equivalents, so an unlawful recording can be worthless as proof. Second, you must be able to authenticate it under Rule 901 by showing it accurately depicts what you claim. Preserve the original file and metadata, and avoid editing the working copy. See capturing the web for the authentication principles applied to digital evidence.

This article provides general information about the law and is not legal advice. The rules governing photography, recording, and privacy vary significantly by state and change over time; nothing here substitutes for advice from a qualified attorney about your specific situation. Consult licensed counsel before acting.