Internet and Email Usage Policy

An Internet and Email Usage Policy in the United States sets out the rules and standards the organisation expects those it covers to follow.

The Electronic Communications Privacy Act (ECPA), 18 U.S.C. §§ 2510-2523, generally prohibits the interception and disclosure of electronic communications without consent. However, ECPA's 'business extension' exception (18 U.S.C. § 2510(5)(a)) permits employers to monitor communications over equipment they provide and operate in the ordinary course of business. ECPA's consent exception (18 U.S.C. § 2511(2)(d)) provides an independent legal basis for monitoring where employees have been notified of and consented to monitoring — which a signed Internet and Email Usage Policy accomplishes. Federal courts including the Sixth Circuit in Haun v. Retail Credit Co. and numerous district courts have upheld employer monitoring of employee email and internet activity where a written monitoring policy existed.

The Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030, creates civil and criminal liability for unauthorized access to computer systems. An Internet and Email Usage Policy that defines the scope of authorized use helps employers establish that former employees who access company systems after termination — or employees who exceed their authorized access — have acted without authorization under the CFAA, as clarified by the Supreme Court in Van Buren v. United States, 593 U.S. 374 (2021).

The National Labor Relations Act (NLRA), 29 U.S.C. § 157, protects employees' Section 7 rights to engage in concerted activity — including discussing wages, working conditions, and workplace issues with coworkers, whether in person or through electronic communications including email and social media. The National Labor Relations Board (NLRB) has held that overly broad email and internet usage policies that could reasonably be interpreted to prohibit protected concerted activity are unlawful. Internet and Email Usage Policies must be carefully drafted to avoid chilling NLRA-protected communications.

A US Internet and Email Usage Policy is needed by any employer — from a small business to a Fortune 500 corporation — that provides employees with access to company-owned computer systems, email infrastructure, or internet connectivity as part of their work.

Technology companies, financial services firms, healthcare organisations, and law firms whose employees handle sensitive customer data, protected health information (PHI) under HIPAA, or confidential client information require an Internet and Email Usage Policy to establish the legal basis for monitoring, to define data handling obligations, and to provide a written framework for disciplining employees who misuse company systems. A written policy signed by employees is the first line of defense in IT security incidents, HIPAA breach investigations, and data theft claims against former employees.

Employers seeking to enforce the Computer Fraud and Abuse Act (18 U.S.C. § 1030) against employees or former employees who accessed company systems without authorization — to steal confidential data, sabotage systems, or conduct competitive intelligence — benefit from an Internet and Email Usage Policy that clearly defines the scope of authorized access. Following Van Buren v. United States (2021), the CFAA's 'exceeds authorized access' prong requires the employer to have established what access was authorized, which a written policy accomplishes.

Organisations with remote workers and bring-your-own-device (BYOD) programmes need an Internet and Email Usage Policy that addresses the use of personal devices for company email access, the required security configurations (MDM enrollment, screen lock, remote wipe capability), and the boundaries between personal and company data on personal devices.

Publicly traded companies subject to Securities and Exchange Commission Regulation FD (Fair Disclosure) and Sarbanes-Oxley Act (SOX) document retention requirements need an Internet and Email Usage Policy that addresses the prohibition on disclosing material non-public information through email or social media, and the obligation to retain business emails for the periods required by SEC Rule 17a-4 and the SOX records retention rules.

In states with additional monitoring requirements — Connecticut General Statutes § 31-48d requires advance written notice to employees before monitoring; Delaware Code Title 19 § 705 requires advance notice of electronic monitoring — the Internet and Email Usage Policy serves as the written notice required by state law.

A legally effective US Internet and Email Usage Policy must address the following essential provisions to comply with the ECPA consent exception, avoid NLRA violations, protect company data, and create enforceable disciplinary standards.

The scope and applicability section must define which systems and employees the policy covers — all company-owned computers, servers, networks, email systems, mobile devices, and any personal devices used to access company systems. The policy should state that it applies to all employees, contractors, and temporary workers with access to company technology resources.

The monitoring notification is the most legally critical provision. To establish the ECPA consent exception, the policy must clearly state: that the employer has the right to monitor, access, review, audit, and disclose all electronic communications, files, and internet activity transmitted over or stored on company systems; that employees have no expectation of privacy in their use of company systems; and that by using company systems, employees consent to monitoring. This consent language must be acknowledged in writing by each employee.

The acceptable use section must define permitted uses — including work-related communications, research, and de minimis personal use during non-work time — and the prohibited use categories: illegal content, harassment or discrimination, unauthorized software installation, circumventing security controls, disclosing confidential company information, and any use that violates company policy or applicable law.

The email security requirements must specify that employees must not share email passwords, must not use personal email for company business, must report suspected phishing emails to IT immediately, must not auto-forward company email to personal accounts, and must apply encryption when transmitting sensitive information. The policy should reference the company's data classification standards to help employees identify what constitutes sensitive information.

The social media clause must address NLRA Section 7 rights carefully. The policy may prohibit disclosing confidential company information, making false or defamatory statements about the company, and using company logos or trademarks on personal social media without authorization — but must not prohibit employees from discussing wages, working conditions, or other terms of employment with coworkers, as such restrictions would violate NLRA Section 7.

The records retention clause should explain that all emails sent or received on company systems are company property and subject to the company's records retention schedule, legal hold obligations in anticipated litigation, and discovery obligations in legal proceedings. Employees must not delete emails subject to a legal hold.

The consequences of violation section must describe the range of disciplinary actions — verbal warning, written warning, suspension, termination — for different categories of violations, reserving the right to refer serious violations (data theft, harassment, criminal conduct) to law enforcement. The policy should state that the list of disciplinary actions is illustrative and that management retains discretion to impose appropriate discipline based on the circumstances.