The question arrives in a specific form, usually from a founder or an ops lead: our contractors use their own laptops, can we put the agent on them?
The short answer is that you probably can in a narrow technical sense, should not in most cases, and are almost certainly trying to solve a problem that has a better solution. The longer answer is worth having because the reasoning generalises.
Why consent does not rescue this
The instinct is to solve the legal question with a signature. Have the employee agree, in writing, to monitoring on their personal device.
That is weaker than it looks. Across GDPR, UK GDPR, and most modern privacy frameworks, consent in the employment context is treated with suspicion precisely because the power imbalance makes it hard to refuse. An employee asked to consent to monitoring on their own laptop, by the person who decides their pay and promotion, is not making a free choice in the way the law means. Our GDPR checklist covers why legitimate interests is the usual basis and consent rarely is.
Even where consent is a valid basis, it can be withdrawn. A monitoring programme that collapses if three people change their minds is not a programme.
And the proportionality question survives the consent question. In jurisdictions applying a necessity test — the UK, Canada, Australia, the EU — the regulator asks whether a less intrusive route existed. When the less intrusive route is "issue a laptop", that is a difficult argument to win.
The practical problems are worse than the legal ones
Suppose the legal position were clear. The operational reality still does not work.
You cannot separate the work from the life. An activity agent on a personal machine sees the job applications, the therapy portal, the dating app, the union forum, the medical searches. You do not want that data. Holding it is a liability in a discrimination claim, a discovery order, or a breach. "We do not look at it" is not a control; the exposure is in the holding.
Household members appear. Personal devices get shared. A partner's browsing and a child's homework end up in your dataset, and neither of them has any relationship with your company at all.
Support becomes your problem. The moment your agent is on someone's machine, every performance complaint and crash is attributed to it, and you are debugging hardware you do not own and configurations you cannot standardise.
Offboarding is unresolved. When someone leaves, the device leaves with them, carrying whatever cached company data it holds. You have no clean way to reclaim it, which is the whole reason the offboarding process gets awkward in BYOD environments.
The data quality is poor anyway. People use personal devices intermittently for work. The resulting activity picture has holes in it, and holes in monitoring data do not read as "no data" — they read as "not working", which is worse than measuring nothing.
Worth separating from a related question that gets bundled in: whether the person is an employee or a contractor changes the legal analysis substantially, and monitoring a contractor the way you monitor staff is evidence they are not really a contractor. Monitoring contractors vs employees works through that.
What actually solves the problem
The visibility problem is real. The device is the wrong place to solve it.
Issue hardware. This is the boring answer and usually the right one. A company laptop costs less than a year of the risk management BYOD requires, and it resolves the legal question, the data quality question, the support question and the offboarding question at once. For a permanent employee whose primary workstation this is, there is rarely a good argument against it.
Use a work container. Mobile application management isolates company applications and data on a personal device, so you manage and can wipe the container without touching anything else. This is the mature answer for phones, and it is what most organisations should be doing for BYOD email and chat rather than enrolling the whole device.
Move the work to a virtual desktop. For contractors and short engagements, a VDI or cloud workstation means the work happens somewhere you control regardless of what hardware connects to it. Monitoring, if you need it, sits on the virtual environment where it belongs.
Or measure something other than the device. If the underlying question is whether a contractor is delivering, that is answered by delivery, not by activity telemetry. Milestones, review cadence and output are both more informative and considerably cheaper than the alternative.
If you genuinely cannot avoid it
Some situations resist all four options — short contracts in markets where hardware provisioning is impractical, or teams in regions where shipping a laptop takes months. If you are stuck with BYOD, these constraints make it survivable.
Scope collection to work applications only, never the device. A tool that can watch a defined set of work applications and nothing else is a fundamentally different proposition from one that watches everything and filters afterwards. Ask vendors which they do; the answer is often the latter.
Make it visibly time-bounded. Monitoring that runs only during agreed working hours, and that the person can see is not running otherwise, is both more proportionate and more trusted.
Give the individual full visibility of their own data as a hard requirement rather than a nice-to-have. On someone's own hardware, asymmetry is indefensible.
Write the exclusions down and mean them. What is not collected, what the data will never be used for, and what happens to it at the end of the engagement. Our policy template covers the shape, and the retention question matters more here than anywhere else, because the data you are holding is entangled with someone's private life.
And revisit it. BYOD is almost always a temporary constraint that becomes permanent through inattention. Put a date on the decision.
Where ProdView fits
ProdView is designed for company-managed devices, and that is the honest scope. It collects activity and application metadata rather than screen content or keystrokes, which makes it less invasive than most of this market on any device — but "less invasive" is not the same as "appropriate on hardware someone owns", and we would rather say so.
When not to pick us: you want to monitor personal devices broadly. We are not the right tool, and in most jurisdictions no tool is the right tool for that. If BYOD is genuinely unavoidable, look at mobile application management for the container problem first, and treat activity monitoring as a separate question you may not need to answer.
Try before you commit
If you are deciding between issuing hardware and monitoring personal machines, the useful experiment is to run three free ProdView seats on the company-managed devices you do have, and see whether the questions you wanted answered get answered without extending to anyone's own laptop. They usually do.
General information as of August 2026, not legal advice. BYOD monitoring obligations vary sharply by jurisdiction; take local advice before deploying.