Yes, keylogging is illegal in most situations. Under federal law, installing a keylogger on someone else’s device without their knowledge can violate the Wiretap Act, the Computer Fraud and Abuse Act, or both, with prison exposure of up to five years and civil damages on top. The exceptions are narrower than people expect: employers monitoring company equipment under a clear policy, parents overseeing minor children, and law enforcement acting with proper authority. Marriage is not an exception. Suspicion of wrongdoing is not an exception.
The Two Federal Laws That Apply
The Wiretap Act, Title I of the Electronic Communications Privacy Act, makes it a federal crime to intentionally intercept any electronic communication.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Keylogging looks like a clean fit: the software records every keystroke, including emails, passwords, and private messages.
There is one wrinkle. Federal courts have generally defined “interception” as capturing a communication during transmission from sender to recipient. A keylogger grabs data locally, at the moment keys are pressed, before anything leaves the device. Several federal courts have held that this local capture doesn’t qualify as interception under the statute, which produces a gap that surprises people who assume any covert recording is automatically illegal. Some state courts have gone the other way.
The Computer Fraud and Abuse Act (CFAA) usually closes the gap. The CFAA criminalizes knowingly accessing a computer without authorization, or exceeding authorized access, and obtaining information as a result.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Secretly installing a keylogger on someone’s computer is a textbook unauthorized access.
The CFAA applies to “protected computers,” defined to include any computer used in or affecting interstate commerce or communication.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Any device connected to the internet qualifies: smartphones, laptops, tablets, desktops. The practical effect is that the CFAA can reach almost any keylogging scenario, even where the Wiretap Act cannot.
The Wiretap Act does carve out a one-party consent exception. You can intercept a communication if you are a party to it, or if a party consented, as long as the interception isn’t for a criminal or wrongful purpose.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited This almost never helps a keylogger installer, because the software captures the monitored person’s conversations with other people. One-party consent lets you record your own calls, not someone else’s.
When State Law Reaches Further
Every state has its own wiretapping or electronic surveillance statute, and these often go further than the federal law. The biggest difference is the definition of interception. Where federal courts have required capture during transmission, several state courts read their own statutes to cover keyloggers that record at the point of input. In those states, the federal ambiguity doesn’t exist, and keylogging is treated as interception.
Consent rules differ too. Most states follow a one-party rule like the federal standard, but roughly a dozen require all parties to a communication to consent before it is recorded. In an all-party state, keylogging is almost impossible to justify under any consent theory, because the captured messages involve people who never agreed.
Some states have also enacted dedicated anti-spyware or unauthorized access laws aimed squarely at software installed without the user’s knowledge. These can impose penalties even when the conduct doesn’t clearly fit a wiretapping framework, and some carry fines calculated per violation. The same keylogger can be more or less illegal depending on the state.
When Employers Can Legally Use Keyloggers
Employers have the strongest legal footing, but only on company-owned equipment and only when employees know. The reliable basis is consent. A written policy stating that all activity on company devices is subject to monitoring, acknowledged by employees, generally satisfies both federal and most state wiretapping laws. The policy should spell out what is monitored, what data is collected, how it is stored, and who can see it. Vague or buried disclosures invite challenges.
Most employer trouble comes from monitoring that creeps past the policy. A policy covering work email doesn’t necessarily cover a personal banking password typed on the same machine. If a keylogger sweeps up personal financial data, private account logins, or medical information, the employer faces liability even with a policy in place. The scope of the monitoring should match the business reason and be described that way in the policy.
Personal devices used for work are a different matter. Installing a keylogger on a device the employee owns strips away most of the legal justifications and can trigger both the Wiretap Act and the CFAA.
When Parents Can Legally Monitor a Child
Parents hold the most favorable position, grounded in a doctrine called vicarious consent: a parent or guardian can consent on behalf of a minor child to monitoring when the monitoring is motivated by genuine concern for the child’s welfare. The doctrine comes from court decisions interpreting the Wiretap Act’s consent exception and from the broader legal authority parents hold over minor children.
“Genuine” is the operative word. Courts look at whether the parent had a good-faith belief that monitoring served the child’s best interest, such as protection from online predators, drug activity, or cyberbullying. A parent who installs a keylogger to intercept a child’s communications with the other parent during a custody fight is acting for themselves, not the child, and vicarious consent won’t apply.
Device ownership matters as well. The ground is firmer when the keylogger sits on a computer or phone the parent owns and provides. Installing it on a device owned by the other parent, a school, or another household raises CFAA and wiretapping problems that parental authority alone may not solve. State laws can add restrictions, and the age at which a child acquires independent privacy rights varies.
Spying on a Spouse or Partner Is Not Legal
This is the setting where people most often assume they are in the clear and most often are not. Installing a keylogger on a spouse’s computer, phone, or shared device to monitor their communications is illegal under federal law in nearly all circumstances. Marriage creates no exception to the Wiretap Act. The statute limits its exceptions to those “specifically provided” in the chapter, and Congress never included a spousal exemption.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Federal courts have been nearly uniform in rejecting interspousal immunity as a wiretapping defense.
The CFAA stacks on top. Using passwords captured by a keylogger to open a spouse’s email, social media, or financial accounts is unauthorized access to a protected computer. Even on a shared home computer, each person’s password-protected accounts remain individually restricted. Suspicion of infidelity, gathering divorce evidence, or a belief in the right to know doesn’t change the analysis.
People going through divorces are the most frequent offenders. Evidence from a keylogger is often inadmissible and can also produce criminal charges against the spouse who installed the software and a civil lawsuit for damages. Family law attorneys consistently advise against this kind of self-help surveillance because the legal risk nearly always exceeds any evidentiary payoff.
Prison Time and Fines
Under the Wiretap Act, intentionally intercepting an electronic communication carries up to five years in federal prison, a fine, or both.1Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited There is no requirement that the defendant obtained especially sensitive information or caused a particular dollar amount of harm.
The CFAA uses a tiered structure keyed to the type of information and the defendant’s intent:2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
- Basic unauthorized access to obtain information: up to one year for a first offense.
- Aggravated unauthorized access: up to five years if the offense was committed for commercial advantage or financial gain, in furtherance of another crime, or if the information obtained was worth more than $5,000.
- Repeat offenders: up to ten years for a second or later CFAA conviction.
- National security information: up to ten years for a first offense involving information classified for national defense or foreign relations.
State charges can run alongside federal charges, because the same conduct frequently violates both. States with anti-spyware statutes sometimes impose per-violation penalties that pile up quickly when a keylogger ran for weeks or months.
Getting Sued by the Person You Monitored
Criminal exposure isn’t the only risk. A person whose communications were captured by an unauthorized keylogger can sue the installer directly. Both the Wiretap Act and the CFAA create private rights of action.
Under the Wiretap Act, a victim can recover the greater of actual damages plus any profits the violator earned, or statutory damages of $100 per day for each day of violation or $10,000, whichever is larger.3Office of the Law Revision Counsel. 18 US Code 2520 – Recovery of Civil Damages Authorized Punitive damages are available in appropriate cases, along with reasonable attorney’s fees and litigation costs. For a keylogger that ran undetected for months, the statutory figures alone can be large, and the fee-shifting provision makes it financially realistic for victims to sue even when actual losses are modest.
CFAA civil suits are harder. The victim must prove at least $5,000 in aggregate losses during a one-year period, and damages are limited to economic loss when that threshold is the only qualifying factor.2Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers Qualifying “loss” includes forensic examination to find and remove the software, lost work time, and the cost of changing compromised accounts, but those costs don’t always add up to the threshold for an individual victim. Where both claims are available, the Wiretap Act is usually the stronger vehicle for recovery.