GPS Tracking Employees: What's Legal?

GPS tracking of employees is a sensitive topic. On one hand, it offers companies real benefits for scheduling and time tracking; on the other, it touches on employees’ personal rights. In this article we explain what is allowed, what you need to consider for GPS time tracking and how to prove working time at the customer site properly.

Legal status: 29 October 2026

Short Answer

In our assessment, GPS time tracking in Germany is generally permissible if the location serves a clear purpose set in advance, such as proving working time at the customer site, and no more is recorded than that purpose needs. Data protection authorities such as the one in Rhineland-Palatinate consider continuous tracking that allows employees to be monitored permanently to be generally impermissible, and the Rhineland-Palatinate authority takes the same view of alerts when someone leaves a zone. That authority considers location tracking permissible only within very narrow limits; it does not explicitly address a single point at clock events. Your employees must know beforehand when and why their location is recorded, and an existing works council has a say. The approach that collects the least data is a single location point at the moment the employee clocks in or out themselves: the office then sees how far start and stop were from the site and can turn this into a proof for the client.

The Legal Basis

If a location can be linked to a specific person, it is personal data (Art. 4(1) GDPR). The General Data Protection Regulation (GDPR) then applies across the EU, in Germany together with the Federal Data Protection Act (BDSG). How to meet the GDPR requirements for time tracking as a whole is covered in our guide to GDPR-compliant time tracking. Employment law and personality rights also play a role, and the details differ from country to country; this guide covers Germany.

Art. 6 GDPR Instead of § 26 BDSG

For a long time, § 26(1) BDSG was seen as the legal basis for data in the employment relationship. On 30 March 2023 the Court of Justice of the EU (Case C-34/21) ruled on an almost identical rule in Hesse: a provision that merely repeats Art. 6 GDPR is not a “more specific rule” within the meaning of Art. 88 GDPR. On 8 May 2025 the Federal Labour Court (8 AZR 209/21) concluded that § 26(1) BDSG must not be applied. Employers are therefore best advised to base GPS data directly on Art. 6(1)(b) GDPR (performance of the employment relationship) or (f) (legitimate interest). In substance the test stays the same: is the tracking necessary and proportionate for the purpose?

Time Recording: Yes, GPS: No

On 13 September 2022 the Federal Labour Court ruled (1 ABR 22/21) that employers must record the start and end of daily working time (§ 3(2) no. 1 ArbSchG). According to the Federal Ministry of Labour (BMAS), the law currently prescribes no particular form; even a handwritten record is enough. According to the ministry, the federal government agreed in its coalition agreement to turn this into an electronic recording duty in the Working Hours Act. A draft bill from the ministry became public in June 2026, but a draft is not yet law. Electronic does not mean GPS, so the duty to record working time does not require location tracking. The Rhineland-Palatinate authority even stresses that, for time recording, location technology must not be preferred to employees recording their own time, for example with a time clock or a timesheet. GPS can at most supplement self-recording, for example as proof for the client, but cannot replace it. For more on the duty itself, see Mandatory time tracking in Germany.

Principle: Proportionality

GPS tracking is only permissible if:

1. There is a legal basis, usually: the tracking is necessary for the employment relationship (b), or the interests of the employees do not override your legitimate interest (f); consent carries it only in exceptional cases (see below)
2. A clear purpose has been set in advance
3. The measure is proportionate and there is no less intrusive means
4. The employees have been informed beforehand

Convenience alone is not enough: if the purpose can be achieved without tracking, for example with a quick phone call, that is the less intrusive way.

When Is GPS Tracking Allowed?

1. With the Employee’s Consent

One possible legal basis is the employee’s voluntary consent. In an employment relationship, however, it is the weakest: voluntariness is often doubted because of the dependency, and consent can be withdrawn at any time. The Rhineland-Palatinate authority considers the use of a location system by companies generally unsuitable for consent, because blanket monitoring leaves no free choice; it names an exception only for a logbook of private trips. Art. 6(1)(b) or (f) GDPR is usually the firmer basis (see below). If you still rely on consent, it must be:

• Voluntary (without pressure)
• Informed (the employee must know what is tracked)
• Revocable (at any time)
• Documented (in writing or electronically)

2. Employment Contract or Legitimate Interest

What the employment relationship itself requires can be based on Art. 6(1)(b) GDPR. Many GPS purposes, however, mainly serve your business and your contract with the client. For these, (f) applies (legitimate interest): you weigh your interest against that of your employees and check whether there is a less intrusive means. Examples:

• Supplementing self-recorded time for mobile employees
• Proof of presence at the site for clients (f)
• Route planning for vehicles, without linking the data to particular drivers (f)
• Safety on dangerous jobs or when working alone, if tracking is only triggered when needed

3. With a Works Council: Works Agreement

If there is a works council, it has a say in technical equipment suitable for monitoring employees’ behaviour or performance (§ 87(1) no. 6 BetrVG). This includes GPS tracking and, according to the BMAS, generally also electronic time recording, as far as there is still room in how it is set up. A works agreement is then the best way. It must itself comply with the GDPR, though, and creates no permission beyond it (CJEU, Case C-65/23, 19 December 2024). It sets clear rules for:

• Scope of data collection
• Retention period
• Access rights
• Purpose of use
• Excluding permanent monitoring of behaviour and performance

What Is Prohibited?

As a rule, GPS tracking is impermissible:

• For covert surveillance of employees
• Outside working hours (private sphere), also where private use of a company car or phone is allowed
• Without informing the employee
• As permanent surveillance that creates constant pressure (as the Bavarian data protection commissioner already said in 2016 for public bodies)
• For permanent, general monitoring of behaviour and performance

The Rhineland-Palatinate authority also considers a system that reports when employees leave a defined zone, or stay in it too long, to be impermissible, because it creates permanent pressure of being watched.

Checklist: GPS Time Tracking and the GDPR

1. Set and Document the Purpose

Write down why you need the location before you record it:

• ✅ Supplement time tracking at the work site
• ✅ Proof for clients
• ✅ Route planning (without linking the data to particular drivers)
• ❌ Performance monitoring
• ❌ Creating movement profiles

Use the data only for this purpose.

2. Choose the Legal Basis

Usually Art. 6(1)(b) or (f) GDPR, combined with a works agreement where there is a works council. Consent only if employees can genuinely choose.

3. Create Transparency

Inform your employees before you start, ideally in writing or electronically (Art. 13 GDPR):

• What is recorded?
• When is it recorded? (only during working hours)
• Who has access to the data?
• How long is the data kept?
• Are proofs passed on to clients?

Employees should also be able to tell when their location is being recorded. Otherwise, in the view of the Rhineland-Palatinate authority, it is covert surveillance, which is generally prohibited.

4. Data Minimization

Collect only the necessary data:

• Location only at clock events (start, break, stop)
• No permanent tracking during work
• No storage beyond the necessary period

5. Technical and Organizational Measures

Put data protection by design (privacy by design) and security of processing into practice (Art. 25 and 32 GDPR):

• Encrypted transmission
• Access controls
• Automatic deletion periods
• Separation of work and private use

6. Complete Your Records

• Add GPS recording to your record of processing activities, with purpose and retention period (Art. 30 GDPR)
• Sign a data processing agreement with the software provider (Art. 28 GDPR)
• Check whether a data protection impact assessment is needed (Art. 35 GDPR): the list of the German Data Protection Conference names, under no. 8, the geolocation of employees, for example GPS movement profiles to coordinate field assignments. The list is not exhaustive. In our assessment, saving only one point at clock events does not create a movement profile in the sense of this example, but you should still document the check.

GPS Time Tracking at the Customer Site: How It Works

Cleaning, caretaking and winter service companies have their staff spread over many sites. With a data-minimizing solution such as Crew Active, GPS-based time tracking works like this:

1. At the site, the employee opens their job in the app and taps Start.
2. By default, if the “GPS Required” setting is on and the phone has a connection, the app saves the last measured location point, usually fresh and at most a few minutes old, with its measurement time and accuracy, plus the other values the phone supplies (altitude, heading, speed and whether the location is simulated).
3. The same happens at Break, Resume and Stop. If a reading fails, for example without GPS reception inside a building, clocking still goes ahead by default, and the office sees the failed reading.
4. In the office, the software compares the start and stop points with the site’s stored address, if there is one, and shows the distance.

No location is recorded between clock events. Recording stays point-in-time, and the employee still records their own time. Keep the accuracy in mind: inside buildings and between tall buildings, a GPS point is often a few dozen metres off. A tolerance range therefore makes more sense than an exact point.

Proving Working Time and Location to Clients

Clients in building cleaning or winter service ask questions when a service allegedly was not provided. A proof per job should then contain:

• Date, start and end of the job
• Coordinates and accuracy of the location points
• The distance to the site
• A map the client understands without explanation

Such a proof covers the points measured at clock events, not the time in between. For data protection: give the client only what they need for the proof, and tell your employees beforehand that such proofs may be passed on. What a proof from Crew Active looks like is shown in our sample proof as a PDF (in German).

Geofencing and Data Protection

With geofencing, the software puts a virtual zone around a site. Some apps only check at clock events whether the phone is inside the zone, and only allow clocking there. Others clock in automatically or send an alert when the phone enters or leaves the zone. For that, the phone has to check its location continuously, also in the background. This second kind is far more sensitive under data protection law than a single point at clock events:

• Continuous checking comes close to permanent tracking.
• The Rhineland-Palatinate authority considers alerts on leaving a zone impermissible.
• Automatic clocking takes away the employee’s own time recording, which in the authority’s view comes first.

If you use geofencing anyway, limit it to working hours, do without alerts to the office and inform employees openly. For proof at the site, a point at clock events that the office compares with the site’s location is usually enough. Crew Active sets no zone at the site: the distance to the site address does not block the start; the office only sees it. According to their websites, geofencing is offered by timr, TimeTac and Jibble, for example.

How Crew Active Does It

At Crew Active, GPS time tracking in the mobile app is designed to collect as little data as possible:

Point-in-Time Capture Instead of Continuous Monitoring

For time tracking, the app sends a location point to Crew Active only when an employee changes the status of a job:

1. When starting the job
2. When taking a break and when resuming
3. When stopping the job

By default, this happens if the “GPS Required” setting is on and the phone is online. There is no continuous location tracking, no tracking in the background and no alert when someone leaves an area.

Proof for Your Client

In the office you see the points on a map for each job, and how far start and stop were from the site’s stored location. If start or stop was more than 200 metres away, it is flagged. If the phone reports a simulated location, the office sees that too. If a point is implausibly far from the previous one for the time in between, the software flags it as suspicious, and the GPS proof states how many points were flagged. For every finished job with GPS data, you can create a GPS proof as a PDF for your client.

Transparency for Employees

• For time tracking, Crew Active receives a location point only when the employee taps Start, Break, Resume or Stop themselves; time tracking records nothing in between or after work
• If the “GPS Required” setting is on and the phone is online, the app does not start the job without location permission on the phone, but asks for it first
• By default, the “GPS Required” setting is on; you can switch it off for the whole team

Technical Security

• Encrypted data transmission
• Servers in a data center in the EU
• The maps in the office view and in the GPS proof come from Google Maps. For the map in the GPS proof, Crew Active sends the coordinates of the measured points to Google; Google may also process this data outside the EU (see privacy policy)
• Deletion of your data on instruction and after contract end
• GDPR-compliant data processing on your behalf

Conclusion: GPS Tracking with a Sense of Proportion

In our assessment, a point-in-time location capture at clock events is not prohibited in principle, while continuous tracking generally is. Both are subject to strict conditions. With the right approach, companies can use the benefits without violating their employees’ rights:

1. Inform your employees openly
2. Document purpose and legal basis
3. Limit data collection to what is necessary
4. Protect the collected data appropriately
5. Respect privacy outside working hours

Sources

Most of these sources are in German.

• Data Protection Commissioner of Rhineland-Palatinate: GPS-Ortung
• Bavarian Data Protection Commissioner, 27th activity report 2016 (public bodies, before the GDPR): Location systems in official vehicles
• Federal Labour Court, decision of 13 September 2022: 1 ABR 22/21
• Federal Labour Court, judgment of 8 May 2025: 8 AZR 209/21
• Federal Ministry of Labour and Social Affairs: Questions and answers on recording working time
• Osborne Clarke: What the BMAS draft bill of 18 June 2026 means for HR practice
• Court of Justice of the EU, judgment of 30 March 2023: Case C-34/21
• Court of Justice of the EU, judgment of 19 December 2024: Case C-65/23
• German Data Protection Conference: List of processing operations that require a DPIA

---

Note: This article is for general information and does not replace legal advice. For specific questions, please consult a specialized attorney.

Frequently Asked Questions