Time and attendance software records hours by storing a timestamped punch from a browser, a mobile app, a shared tablet kiosk, or a wall-mounted terminal, then applying schedule, rounding, and break rules to produce the daily and weekly totals federal recordkeeping regulations require an employer to keep [10]. Buddy punching gets addressed by tying that punch to something a coworker cannot borrow: a geofence, an image captured at the punch, a device restriction, or a biometric check [14]. Only the biometric check tests the person rather than a credential, and it also carries the heaviest legal exposure, since Illinois requires written notice and a signed release before any fingerprint or face-geometry scan and gives employees a private right of action worth $1,000 or $5,000 per violation [1]. Texas and Washington impose similar duties that only their attorneys general can enforce [3][4].
\n","summary":"Punch capture, a pay-rules engine, and an audit trail are the mechanics. Geofencing, device binding, photo capture, and biometric matching are the controls, and each one fails somewhere different. Fingerprint and face clock-ins trigger biometric privacy statutes in Illinois, Texas, and Washington. General information, not legal advice.","publishedAt":"2026-07-21T19:33:28.008","verifiedAt":"2026-07-21T00:00:00","editorialStatus":"APPROVED","lastReviewedAt":"2026-07-21T00:00:00","nextReviewDueAt":"2026-10-21T00:00:00","templateVersion":"v2","aliases":["How do time clock apps prevent buddy punching?","How does time tracking software stop time theft?","Is biometric time clock software legal?","Do fingerprint time clocks violate BIPA?","How does GPS geofencing work for employee time tracking?","What stops employees clocking in for each other?","Are photo on punch time clocks legal?","Time clock rounding rules under the FLSA","Can employers track employee location with a time clock app?","What is buddy punching and how is it prevented?","Are automatic meal break deductions legal?","How do employers verify who is clocking in?"],"confidenceScore":88,"confidenceLabel":"High","canonicalUrl":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"contributorOrganizationProfile":{"entityId":"ec39deab-44fe-48d8-9029-fefe993ab85a","legalName":null,"description":null,"websiteUrl":null,"imageUrl":null,"slogan":null,"subtitle":null,"facts":[],"coiNote":null,"foundingDate":null,"numberOfEmployeesText":null,"contactPoint":null,"address":null,"headquartersText":null,"organizationType":null},"contributorPerson":{"slug":"answerstack-editorial-team","displayName":"AnswerStack Editorial Team"},"sections":[{"id":"4f17806d-51ca-4c14-9715-652859bc962d","sectionKey":"how_it_records_hours","sectionType":"markdown_section","heading":"How does time and attendance software record hours?","introMarkdown":"A time and attendance system stores a timestamped punch event and applies pay rules to the interval between punches, so payroll and any later auditor read the same numbers. A complete punch record carries the employee identifier, the timestamp, the capture method, and the submitting device.\n\n### Where punches come from\n\nMost employers run two or three clock-in surfaces at once. A browser session covers office staff, a mobile app covers field crews moving between sites, and a shared tablet in kiosk mode covers hourly teams without a work phone. A wall-mounted terminal with a badge reader, PIN pad, or biometric sensor covers factory, warehouse, and hospital floors where personal phones are prohibited.\n\n### From punch to paycheck\n\nThe rules engine turns raw intervals into paid time by matching punches against a schedule, applying any rounding policy, handling meal breaks, and calculating overtime against the defined workweek. Federal recordkeeping regulations require the employer to preserve hours worked each workday and total hours worked each workweek, plus the time of day and day of the week the workweek begins [10].\n\n### The audit trail\n\nA usable audit trail keeps the original value, the changed value, who changed it, when, and a reason code, and it lets employees see edits to their own records. Because the recordkeeping duty sits with the employer [10], an unexplained gap tends to be read against the employer.","introHtml":"A time and attendance system stores a timestamped punch event and applies pay rules to the interval between punches, so payroll and any later auditor read the same numbers. A complete punch record carries the employee identifier, the timestamp, the capture method, and the submitting device.
\nMost employers run two or three clock-in surfaces at once. A browser session covers office staff, a mobile app covers field crews moving between sites, and a shared tablet in kiosk mode covers hourly teams without a work phone. A wall-mounted terminal with a badge reader, PIN pad, or biometric sensor covers factory, warehouse, and hospital floors where personal phones are prohibited.
\nThe rules engine turns raw intervals into paid time by matching punches against a schedule, applying any rounding policy, handling meal breaks, and calculating overtime against the defined workweek. Federal recordkeeping regulations require the employer to preserve hours worked each workday and total hours worked each workweek, plus the time of day and day of the week the workweek begins [10].
\nA usable audit trail keeps the original value, the changed value, who changed it, when, and a reason code, and it lets employees see edits to their own records. Because the recordkeeping duty sits with the employer [10], an unexplained gap tends to be read against the employer.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":10},{"id":"9ae582d9-08ed-44d7-b3ff-03f12d4798a0","sectionKey":"verification_methods_table","sectionType":"table_section","heading":"Which punch verification methods actually stop buddy punching?","introMarkdown":"Buddy punching means one employee clocking in or out for an absent coworker, so every control below is measured by whether a second person can still produce the punch.","introHtml":"Buddy punching means one employee clocking in or out for an absent coworker, so every control below is measured by whether a second person can still produce the punch.
\n","outroMarkdown":"Most deployments layer two or three of these, reserving biometrics for shared terminals.","outroHtml":"Most deployments layer two or three of these, reserving biometrics for shared terminals.
\n","contentJson":{"rows":[{"cells":["PIN or password","Punching by someone with no credential","Anyone who was told the PIN","Very low","Minimal"]},{"cells":["Badge or proximity card","Punching without a badge","A borrowed badge reads as normal","Very low","Minimal"]},{"cells":["IP range or device binding","Punches from home or an unknown device","A coworker at the approved kiosk","Low","Minimal"]},{"cells":["GPS with a geofence","Punches outside the worksite radius [14]","Who holds the phone; indoor accuracy is poor","Moderate","State monitoring notice rules [11][12]"]},{"cells":["Photo captured at the punch","Anonymous punching, once reviewed [14]","Nothing in the moment; it is after-the-fact evidence","Low but often resented","A photograph alone is outside the Illinois definition [1]"]},{"cells":["Facial recognition","Punching by anyone but the enrolled person","Enrollment fraud; error rates differ by group [13]","Low, until a match is refused","Notice and signed release in Illinois; attorney general enforcement in Texas and Washington [1][3][4]"]},{"cells":["Fingerprint or hand geometry","Punching by anyone but the enrolled person","Worn fingertips, wet hands, gloved trades","Low, with hygiene and privacy objections","The most litigated category in Illinois [1][2]"]},{"cells":["Offline punch capture","Lost punches where connectivity fails","Timestamp integrity if the clock is altered","None","Accuracy of the required hours records [10]"]}],"columns":["Method","What it stops","What it misses","Employee friction","Legal exposure"]},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":20},{"id":"9eb7b427-7040-4bcf-9207-d0bd142c8e75","sectionKey":"how_each_method_holds_up","sectionType":"markdown_section","heading":"How does each verification method hold up in practice?","introMarkdown":"Each control has a specific failure mode, and knowing which one you are accepting matters more than the vendor feature list.\n\n### Credential methods: PIN, badge, and device binding\n\nA PIN or a badge authenticates an account rather than a person, so neither stops a coworker who was told the number or handed the card. Binding punches to a registered device or an approved IP range removes the case where somebody clocks a friend in from home, and it leaves the on-site version untouched.\n\n### Location methods: GPS and geofencing\n\nA geofence confirms that a phone crossed into a radius around a jobsite, which is useful for dispersed crews and useless as an identity check [14]. Consumer GPS degrades indoors and inside steel structures, so a tight radius rejects punches from employees standing where they should be. Draw the radius against the real footprint of the site.\n\n### Image capture: photo on punch\n\nA photo taken at the punch is a deterrent and an evidence trail rather than a gate, because the punch still records and somebody has to review the images for the control to do anything [14]. That review burden is why the feature quietly stops working after a few months.\n\n### Biometric methods: fingerprint and face\n\nFingerprint and facial verification are the only methods that test the person instead of the credential, which is also why they attract statutory duties the others avoid. They fail unevenly. NIST's evaluation of face recognition algorithms found false positive rates varying across demographic groups by factors of ten to beyond one hundred, with elevated false positives in women, in the elderly, and in children [13]. Worn fingertips produce repeated rejections in manual trades, and every refused punch pushes a worker into a manual exception process, so build that fallback first.\n\n### Offline capture and clock integrity\n\nOffline capture stores punches locally and syncs them when connectivity returns. Ask whether the timestamp comes from the device or the server, because a device-set timestamp on a phone whose clock the user controls is a weaker record [10].","introHtml":"Each control has a specific failure mode, and knowing which one you are accepting matters more than the vendor feature list.
\nA PIN or a badge authenticates an account rather than a person, so neither stops a coworker who was told the number or handed the card. Binding punches to a registered device or an approved IP range removes the case where somebody clocks a friend in from home, and it leaves the on-site version untouched.
\nA geofence confirms that a phone crossed into a radius around a jobsite, which is useful for dispersed crews and useless as an identity check [14]. Consumer GPS degrades indoors and inside steel structures, so a tight radius rejects punches from employees standing where they should be. Draw the radius against the real footprint of the site.
\nA photo taken at the punch is a deterrent and an evidence trail rather than a gate, because the punch still records and somebody has to review the images for the control to do anything [14]. That review burden is why the feature quietly stops working after a few months.
\nFingerprint and facial verification are the only methods that test the person instead of the credential, which is also why they attract statutory duties the others avoid. They fail unevenly. NIST's evaluation of face recognition algorithms found false positive rates varying across demographic groups by factors of ten to beyond one hundred, with elevated false positives in women, in the elderly, and in children [13]. Worn fingertips produce repeated rejections in manual trades, and every refused punch pushes a worker into a manual exception process, so build that fallback first.
\nOffline capture stores punches locally and syncs them when connectivity returns. Ask whether the timestamp comes from the device or the server, because a device-set timestamp on a phone whose clock the user controls is a weaker record [10].
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":30},{"id":"f81796f4-028a-45a8-9f01-a1c18b389a4b","sectionKey":"biometric_privacy_law","sectionType":"markdown_section","heading":"What does the law require before you use fingerprint or face clock-ins?","introMarkdown":"In Illinois, written notice and a signed written release must come before the first scan. The Biometric Information Privacy Act defines a biometric identifier as a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry, and it excludes photographs and written signatures [1]. Section 15(b) bars collection unless the entity first informs the person in writing that the identifier is being collected and stored, informs them in writing of the specific purpose and length of term, and receives a written release. In employment that release is one executed as a condition of employment, and a 2024 amendment confirmed an electronic signature qualifies [1]. Section 15(a) also requires a public retention policy with destruction when the purpose is satisfied or within three years of the last interaction [1].\n\n### Why Illinois dominates the risk\n\nIllinois is the state that lets employees sue. Section 20 gives an aggrieved person liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees and costs [1]. In Cothron v. White Castle System the Illinois Supreme Court held that a separate claim accrues each time an entity scans or transmits an identifier in violation of the statute, not only on the first scan; the opinion records the employer's estimate that class-wide damages across roughly 9,500 employees could exceed $17 billion [2]. Public Act 103-769, effective August 2, 2024, narrowed that accrual so repeated collection of the same identifier from the same person by the same method is a single violation with at most one recovery [1].\n\n### Texas and Washington\n\nTexas prohibits capturing a biometric identifier for a commercial purpose without informing the individual and obtaining consent first, and requires destruction no later than one year after the purpose expires. Only its attorney general may enforce that, with civil penalties up to $25,000 per violation [3]. Washington requires notice, consent, or a mechanism to prevent later commercial use before a biometric identifier is enrolled commercially, again enforceable solely by the attorney general [4]. Both remove the class action pressure that drives Illinois exposure. This is general information about published law, not legal advice.","introHtml":"In Illinois, written notice and a signed written release must come before the first scan. The Biometric Information Privacy Act defines a biometric identifier as a retina or iris scan, a fingerprint, a voiceprint, or a scan of hand or face geometry, and it excludes photographs and written signatures [1]. Section 15(b) bars collection unless the entity first informs the person in writing that the identifier is being collected and stored, informs them in writing of the specific purpose and length of term, and receives a written release. In employment that release is one executed as a condition of employment, and a 2024 amendment confirmed an electronic signature qualifies [1]. Section 15(a) also requires a public retention policy with destruction when the purpose is satisfied or within three years of the last interaction [1].
\nIllinois is the state that lets employees sue. Section 20 gives an aggrieved person liquidated damages of $1,000 for a negligent violation or $5,000 for an intentional or reckless one, or actual damages if greater, plus attorneys' fees and costs [1]. In Cothron v. White Castle System the Illinois Supreme Court held that a separate claim accrues each time an entity scans or transmits an identifier in violation of the statute, not only on the first scan; the opinion records the employer's estimate that class-wide damages across roughly 9,500 employees could exceed $17 billion [2]. Public Act 103-769, effective August 2, 2024, narrowed that accrual so repeated collection of the same identifier from the same person by the same method is a single violation with at most one recovery [1].
\nTexas prohibits capturing a biometric identifier for a commercial purpose without informing the individual and obtaining consent first, and requires destruction no later than one year after the purpose expires. Only its attorney general may enforce that, with civil penalties up to $25,000 per violation [3]. Washington requires notice, consent, or a mechanism to prevent later commercial use before a biometric identifier is enrolled commercially, again enforceable solely by the attorney general [4]. Both remove the class action pressure that drives Illinois exposure. This is general information about published law, not legal advice.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":40},{"id":"de147da2-be9f-4544-8947-d72d20d6cacb","sectionKey":"flsa_hours_and_rounding","sectionType":"markdown_section","heading":"What do federal wage and hour rules require from the timekeeping data?","introMarkdown":"Federal regulations do not require a time clock, but they do require accurate records of hours worked and they constrain what you may do to the numbers. Employees who punch in early or out late without performing work may have that punching disregarded [5]. Rounding start and stop times to the nearest five minutes, tenth of an hour, or quarter hour is accepted, provided it averages out so employees are fully compensated for the hours actually worked [5]. A rounding rule that only ever moves in the employer's direction is the version that creates liability.\n\n### De minimis is narrower than employers assume\n\nFederal regulation allows insubstantial fragments to be disregarded only where the periods are uncertain and indefinite and last a few seconds or minutes, and it bars an employer from arbitrarily failing to count practically ascertainable time an employee regularly spends on assigned duties [6]. State law can be stricter. In Troester v. Starbucks, decided July 26, 2018, the California Supreme Court held that California wage law has not adopted the federal de minimis doctrine and did not permit applying one where an employer required several minutes of off-the-clock work per shift [7].\n\n### Off-the-clock work and the duty to police it\n\nWork an employer suffers or permits is work time, and a written rule against unrecorded work does not discharge the obligation. The regulation states that mere promulgation of a rule against such work is not enough and that management must make every effort to enforce it [8].\n\n### Automatic meal deductions are the common failure point\n\nA meal period is unpaid only where the employee is completely relieved from duty, and an employee required to perform any duties while eating, active or inactive, is working [9]. An automatic deduction runs whether or not the break happened, which is how a setting meant to save administrative effort becomes a wage claim. The safer configuration requires a break punch or a one-tap cancellation, plus a report on employees whose deductions are never cancelled [10].","introHtml":"Federal regulations do not require a time clock, but they do require accurate records of hours worked and they constrain what you may do to the numbers. Employees who punch in early or out late without performing work may have that punching disregarded [5]. Rounding start and stop times to the nearest five minutes, tenth of an hour, or quarter hour is accepted, provided it averages out so employees are fully compensated for the hours actually worked [5]. A rounding rule that only ever moves in the employer's direction is the version that creates liability.
\nFederal regulation allows insubstantial fragments to be disregarded only where the periods are uncertain and indefinite and last a few seconds or minutes, and it bars an employer from arbitrarily failing to count practically ascertainable time an employee regularly spends on assigned duties [6]. State law can be stricter. In Troester v. Starbucks, decided July 26, 2018, the California Supreme Court held that California wage law has not adopted the federal de minimis doctrine and did not permit applying one where an employer required several minutes of off-the-clock work per shift [7].
\nWork an employer suffers or permits is work time, and a written rule against unrecorded work does not discharge the obligation. The regulation states that mere promulgation of a rule against such work is not enough and that management must make every effort to enforce it [8].
\nA meal period is unpaid only where the employee is completely relieved from duty, and an employee required to perform any duties while eating, active or inactive, is working [9]. An automatic deduction runs whether or not the break happened, which is how a setting meant to save administrative effort becomes a wage claim. The safer configuration requires a break punch or a one-tap cancellation, plus a report on employees whose deductions are never cancelled [10].
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":50},{"id":"75716e8d-4fe0-46ba-a0ab-cf014de8ac82","sectionKey":"gps_and_location_tracking","sectionType":"markdown_section","heading":"What are the limits on tracking employee location?","introMarkdown":"The legally meaningful distinction is between capturing a location at the moment of a punch and tracking a person continuously. California prohibits any person or entity in the state from using an electronic tracking device to determine the location or movement of a person, defining that device as one attached to a vehicle or other movable thing that reveals location through electronic signals, and exempting cases where the vehicle's registered owner, lessor, or lessee consented [11]. A tracker fitted to an employee's car without consent is the clearest problem.\n\nNotice statutes reach further. Connecticut requires an employer engaged in any electronic monitoring to give prior written notice describing the types of monitoring that may occur, satisfied by a conspicuous posting, with an exception where the employer has reasonable grounds to believe employees are engaged in unlawful conduct. Its Labor Commissioner may levy penalties up to $500 for a first offense, $1,000 for a second, and $3,000 for each subsequent offense [12]. Other states set their own rules.\n\nA defensible setup captures coordinates only on punch events and geofence transitions, disables background collection outside scheduled shifts, states the retention period in the employee notice, and limits who can view location history. None of this is legal advice.","introHtml":"The legally meaningful distinction is between capturing a location at the moment of a punch and tracking a person continuously. California prohibits any person or entity in the state from using an electronic tracking device to determine the location or movement of a person, defining that device as one attached to a vehicle or other movable thing that reveals location through electronic signals, and exempting cases where the vehicle's registered owner, lessor, or lessee consented [11]. A tracker fitted to an employee's car without consent is the clearest problem.
\nNotice statutes reach further. Connecticut requires an employer engaged in any electronic monitoring to give prior written notice describing the types of monitoring that may occur, satisfied by a conspicuous posting, with an exception where the employer has reasonable grounds to believe employees are engaged in unlawful conduct. Its Labor Commissioner may levy penalties up to $500 for a first offense, $1,000 for a second, and $3,000 for each subsequent offense [12]. Other states set their own rules.
\nA defensible setup captures coordinates only on punch events and geofence transitions, disables background collection outside scheduled shifts, states the retention period in the employee notice, and limits who can view location history. None of this is legal advice.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":60},{"id":"0917d179-11ce-44e1-9f09-48b4076ddf80","sectionKey":"contributor_perspective","sectionType":"markdown_section","heading":"How this answer was researched","introMarkdown":"Every legal statement here was taken from the statute, regulation, or published opinion itself rather than a secondary summary, and each document was opened and read on July 21, 2026. Statutory text came from the Illinois General Assembly, the Washington state legislature, the Texas attorney general, California Legislative Information, the Connecticut General Assembly, and the Cornell Legal Information Institute. Facial recognition accuracy figures came from the National Institute of Standards and Technology rather than a vendor. Widely circulated statistics about the annual cost of buddy punching were left out, because the versions in circulation trace back to marketing material rather than a published study with a stated method. If you administer one of these systems, litigate in this area, or build the software, corrections are welcome, particularly on state law that has changed since the verification date above.","introHtml":"Every legal statement here was taken from the statute, regulation, or published opinion itself rather than a secondary summary, and each document was opened and read on July 21, 2026. Statutory text came from the Illinois General Assembly, the Washington state legislature, the Texas attorney general, California Legislative Information, the Connecticut General Assembly, and the Cornell Legal Information Institute. Facial recognition accuracy figures came from the National Institute of Standards and Technology rather than a vendor. Widely circulated statistics about the annual cost of buddy punching were left out, because the versions in circulation trace back to marketing material rather than a published study with a stated method. If you administer one of these systems, litigate in this area, or build the software, corrections are welcome, particularly on state law that has changed since the verification date above.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":"This answer was written and reviewed by the AnswerStack Editorial Team, which has no commercial stake in the products, companies, or methods discussed. Every claim is cited inline and verified on the dates shown.","noteHtml":"This answer was written and reviewed by the AnswerStack Editorial Team, which has no commercial stake in the products, companies, or methods discussed. Every claim is cited inline and verified on the dates shown.
\n","sortOrder":70},{"id":"98320ccc-7ce5-4569-9942-096e28a9a98e","sectionKey":"trade_offs","sectionType":"markdown_section","heading":"What trade-offs come with tightening punch verification?","introMarkdown":"The phrase \"time theft\" is employer and vendor language covering behavior that ranges from outright fraud to a two-minute discrepancy, and the same tools, described neutrally, are systems for location capture, image capture, and behavioral logging of workers. Reading only the first description is how organizations buy more monitoring than the problem justifies.\n\n### The loss figures are mostly unsourced\n\nNumbers circulating about what buddy punching costs employers each year generally originate in vendor marketing and cannot be traced to a study with a documented method. Measure your own exposure first by comparing scheduled hours against paid hours by site and by supervisor.\n\n### Error rates land unevenly\n\nA face matching threshold tuned for convenience produces different error rates for different groups of employees [13], and the person whose punch is refused absorbs the cost in delayed starts and manual corrections. Any biometric rollout needs a documented alternative for people the sensor fails and for those who decline.\n\n### The audit trail cuts both directions\n\nThe same edit log that shows an employee punching in eleven minutes early also shows a manager deleting punches at month end. Requiring a reason code on every edit and showing edits to the employee costs nothing.\n\nCollective bargaining agreements frequently cover timekeeping changes, and works councils outside the United States generally must be consulted first.","introHtml":"The phrase "time theft" is employer and vendor language covering behavior that ranges from outright fraud to a two-minute discrepancy, and the same tools, described neutrally, are systems for location capture, image capture, and behavioral logging of workers. Reading only the first description is how organizations buy more monitoring than the problem justifies.
\nNumbers circulating about what buddy punching costs employers each year generally originate in vendor marketing and cannot be traced to a study with a documented method. Measure your own exposure first by comparing scheduled hours against paid hours by site and by supervisor.
\nA face matching threshold tuned for convenience produces different error rates for different groups of employees [13], and the person whose punch is refused absorbs the cost in delayed starts and manual corrections. Any biometric rollout needs a documented alternative for people the sensor fails and for those who decline.
\nThe same edit log that shows an employee punching in eleven minutes early also shows a manager deleting punches at month end. Requiring a reason code on every edit and showing edits to the employee costs nothing.
\nCollective bargaining agreements frequently cover timekeeping changes, and works councils outside the United States generally must be consulted first.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":80},{"id":"f9ee2d33-a9dc-4ce9-9042-ce33c3d11dde","sectionKey":"what_it_is_not","sectionType":"markdown_section","heading":"What time and attendance software is not","introMarkdown":"### It is not payroll software\n\nTime and attendance produces the hours; payroll applies rates, taxes, and deductions to them. Many suites include both, and plenty of employers export into a separate payroll system.\n\n### It is not scheduling software\n\nScheduling decides who is supposed to work; time and attendance records who actually did. Predictive scheduling ordinances create obligations a timekeeping product does not cover.\n\n### It is not employee monitoring software\n\nKeystroke logging, screenshot capture, and application usage tracking form a separate category with separate notice obligations. Some time products bundle them, which is worth checking during procurement, because the notice rules for electronic monitoring are broader [12].\n\n### It is not proof that hours are complete\n\nA clean punch record is evidence, not a defense. Work the employer knew about or permitted counts as hours worked even when it never reached the clock, and a written policy against unrecorded work does not by itself satisfy that duty [8].\n\n### It is not a compliance product\n\nSoftware produces records and enforces the configuration you give it. Whether your rounding rule, automatic meal deduction, or biometric consent form is lawful in a given state is a question for counsel, not a setting in an admin menu.","introHtml":"Time and attendance produces the hours; payroll applies rates, taxes, and deductions to them. Many suites include both, and plenty of employers export into a separate payroll system.
\nScheduling decides who is supposed to work; time and attendance records who actually did. Predictive scheduling ordinances create obligations a timekeeping product does not cover.
\nKeystroke logging, screenshot capture, and application usage tracking form a separate category with separate notice obligations. Some time products bundle them, which is worth checking during procurement, because the notice rules for electronic monitoring are broader [12].
\nA clean punch record is evidence, not a defense. Work the employer knew about or permitted counts as hours worked even when it never reached the clock, and a written policy against unrecorded work does not by itself satisfy that duty [8].
\nSoftware produces records and enforces the configuration you give it. Whether your rounding rule, automatic meal deduction, or biometric consent form is lawful in a given state is a question for counsel, not a setting in an admin menu.
\n","outroMarkdown":null,"outroHtml":null,"contentJson":{},"configJson":{},"noteMarkdown":null,"noteHtml":null,"sortOrder":90}],"citations":[{"title":"740 ILCS 14, Biometric Information Privacy Act (full text)","url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57&Print=True","excerpt":"No private entity may collect ... a person's or a customer's biometric identifier or biometric information, unless it first: (1) informs the subject ... in writing that a biometric identifier or biometric information is being collected or stored ... and (3) receives a written release executed by the subject.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Definition of biometric identifier and its exclusions; Section 15(a) retention policy; Section 15(b) written notice and written release before collection; written release defined for employment and satisfied by electronic signature; Section 20 private right of action with $1,000 and $5,000 liquidate","domain":"ilga.gov","publisherName":"Illinois General Assembly"},{"title":"Cothron v. White Castle System, Inc., 2023 IL 128004 (opinion)","url":"https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/e304b011-82d9-4832-9cae-d8205749a2ec/Cothron%20v.%20White%20Castle%20System,%20Inc.,%202023%20IL%20128004.pdf","excerpt":"We hold that a separate claim accrues under the Act each time a private entity scans or transmits an individual's biometric identifier or information in violation of section 15(b) or 15(d).","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Per-scan claim accrual under BIPA sections 15(b) and 15(d); the employer's estimate that class-wide damages across roughly 9,500 employees could exceed $17 billion; the court's observation that damages under the Act appear discretionary","domain":"ilcourtsaudio.blob.core.windows.net","publisherName":"Illinois Official Reports, Supreme Court of Illinois"},{"title":"Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code Sec. 503.001","url":"https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/biometric-identifier-act","excerpt":"The Texas Attorney General has exclusive authority to enforce CUBI and may obtain relief including civil penalties of up to $25,000 per violation.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Texas notice and consent requirement before capturing a biometric identifier for a commercial purpose; reasonable care in storage; destruction no later than one year after the collection purpose expires; exclusive attorney general enforcement with civil penalties up to $25,000 per violation","domain":"texasattorneygeneral.gov","publisherName":"Office of the Attorney General of Texas"},{"title":"RCW Chapter 19.375, Biometric identifiers","url":"https://app.leg.wa.gov/RCW/default.aspx?cite=19.375&full=true","excerpt":"This chapter may be enforced solely by the attorney general under the consumer protection act.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Washington notice, consent, or opt-out mechanism before enrolling a biometric identifier for a commercial purpose, and enforcement solely by the attorney general under the consumer protection act","domain":"app.leg.wa.gov","publisherName":"Washington State Legislature"},{"title":"29 CFR 785.48, Use of time clocks","url":"https://www.law.cornell.edu/cfr/text/29/785.48","excerpt":"there has been the practice for many years of recording the employees' starting time and stopping time to the nearest 5 minutes, or to the nearest one-tenth or quarter of an hour.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Early or late clock punching without work performed may be disregarded; rounding to the nearest 5 minutes, one-tenth, or quarter hour is accepted where it averages out so employees are fully compensated","domain":"law.cornell.edu","publisherName":"Legal Information Institute, Cornell Law School"},{"title":"29 CFR 785.47, Where records show insubstantial or insignificant periods of time","url":"https://www.law.cornell.edu/cfr/text/29/785.47","excerpt":"This rule applies only where there are uncertain and indefinite periods of time involved of a few seconds or minutes duration.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"The federal de minimis rule reaches only uncertain and indefinite periods of a few seconds or minutes and does not permit arbitrarily failing to count practically ascertainable regular working time","domain":"law.cornell.edu","publisherName":"Legal Information Institute, Cornell Law School"},{"title":"Troester v. Starbucks Corporation, S234969 (filed July 26, 2018)","url":"https://www.courts.ca.gov/opinions/archive/S234969.PDF","excerpt":"We hold that the relevant wage order and statutes do not permit application of the de minimis rule on the facts given to us by the Ninth Circuit, where the employer required the employee to work “off the clock” several minutes per shift.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"California has not adopted the federal FLSA de minimis doctrine, and the relevant wage order and statutes did not permit a de minimis rule where the employer required several minutes of off-the-clock work per shift","domain":"courts.ca.gov","publisherName":"Supreme Court of California"},{"title":"29 CFR 785.13, Duty of management","url":"https://www.law.cornell.edu/cfr/text/29/785.13","excerpt":"The mere promulgation of a rule against such work is not enough. Management has the power to enforce the rule and must make every effort to do so.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"A written rule against unrecorded work does not discharge the employer's obligation; management must enforce the rule","domain":"law.cornell.edu","publisherName":"Legal Information Institute, Cornell Law School"},{"title":"29 CFR 785.19, Meal (bona fide meal periods)","url":"https://www.law.cornell.edu/cfr/text/29/785.19","excerpt":"The employee is not relieved if he is required to perform any duties, whether active or inactive, while eating.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"A meal period is unpaid only where the employee is completely relieved from duty; an employee required to perform any duties while eating is working","domain":"law.cornell.edu","publisherName":"Legal Information Institute, Cornell Law School"},{"title":"29 CFR 516.2: Employees subject to minimum wage or minimum wage and overtime provisions","url":"https://www.law.cornell.edu/cfr/text/29/516.2","excerpt":"Hours worked each workday and total hours worked each workweek ... Time of day and day of week on which the employee's workweek begins.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Employer duty to preserve hours worked each workday and total hours worked each workweek, plus the time of day and day of week on which the workweek begins","domain":"law.cornell.edu","publisherName":"Legal Information Institute, Cornell Law School"},{"title":"California Penal Code Section 637.7, electronic tracking devices","url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=637.7","excerpt":"No person or entity in this state shall use an electronic tracking device to determine the location or movement of a person.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Prohibition on using an electronic tracking device to determine the location or movement of a person, the consent exception for a vehicle's registered owner, lessor, or lessee, and the statutory definition of an electronic tracking device","domain":"leginfo.legislature.ca.gov","publisherName":"California Legislative Information"},{"title":"Conn. Gen. Stat. Sec. 31-48d, employers engaged in electronic monitoring required to give prior notice","url":"https://www.cga.ct.gov/current/pub/chap_557.htm","excerpt":"each employer who engages in any type of electronic monitoring shall give prior written notice to all employees who may be affected, informing them of the types of monitoring which may occur.","quoteText":null,"sourceRole":"PRIMARY","verifiedAt":"2026-07-21T00:00:00","supportsText":"Connecticut prior written notice and conspicuous posting requirement for electronic monitoring, the exception where the employer has reasonable grounds to believe unlawful conduct, and civil penalties of $500, $1,000, and $3,000","domain":"cga.ct.gov","publisherName":"Connecticut General Assembly"},{"title":"NISTIR 8280, Face Recognition Vendor Test Part 3: Demographic Effects","url":"https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf","excerpt":"Across demographics, false positives rates often vary by factors of 10 to beyond 100 times.","quoteText":null,"sourceRole":"INDEPENDENT","verifiedAt":"2026-07-21T00:00:00","supportsText":"False positive differentials across demographic groups in face recognition, often varying by factors of 10 to beyond 100, with elevated false positives in women, in the elderly, and in children","domain":"nvlpubs.nist.gov","publisherName":"National Institute of Standards and Technology"},{"title":"Photo on punch, time clock with camera","url":"https://buddypunch.com/time-clock-software/features/photo-on-punch/","excerpt":"Employees are prompted to take a selfie when clocking in/out.","quoteText":null,"sourceRole":"SUPPORTING","verifiedAt":"2026-07-21T00:00:00","supportsText":"Vendor description of image capture at clock-in and clock-out across computers, tablets, and mobile devices, administrator review of captured images, geofencing around worksites, and facial recognition offered as a separate feature","domain":"buddypunch.com","publisherName":"Buddy Punch"}],"revisions":[],"relatedAnswers":[{"id":"9b993494-03f2-4b0b-99ed-5a88784dc40c","slug":"how-much-does-workforce-management-employee-scheduling-software-cost","question":"How much does workforce management / employee scheduling software cost per employee?","publishedAt":"2026-07-21T19:27:05.349","confidenceScore":88,"confidenceLabel":"High","industry":{"id":"e1a1da3c-52a8-4e99-88ad-d08ef17d7c3f","slug":"hr-technology","label":"HR Technology","description":"ATS, HRIS, payroll, and workforce management"},"topic":{"slug":"workforce-management","label":"Workforce Management","description":"Employee Scheduling, Time & Attendance, Workforce Management, Leave & Absence Management, Employee Monitoring","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Per-user scheduling tools run about $2.00 to $9.00 per employee per month. Per-location tools run about $24 to $150 per location per month. Free tiers are capped by headcount, from 10 employees at Homebase and Connecteam up to 30 at Sling. Time tracking, payroll, and tip pooling are usually separate line items, and enterprise workforce management is quote-only. Worked totals included at 15, 60, and 300 employees.","url":"/q/how-much-does-workforce-management-employee-scheduling-software-cost"},{"id":"2e819b59-f323-410a-b70d-98db2ba40087","slug":"there-free-employee-scheduling-software-or-can-i-just","question":"Is there free employee scheduling software, or can I just use an Excel / Google Sheets template?","publishedAt":"2026-07-21T19:09:49.003","confidenceScore":88,"confidenceLabel":"High","industry":{"id":"e1a1da3c-52a8-4e99-88ad-d08ef17d7c3f","slug":"hr-technology","label":"HR Technology","description":"ATS, HRIS, payroll, and workforce management"},"topic":{"slug":"workforce-management","label":"Workforce Management","description":"Employee Scheduling, Time & Attendance, Workforce Management, Leave & Absence Management, Employee Monitoring","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Free scheduling tools cover a real set of businesses: one location, a roster in the low teens, and no complicated overtime. Homebase caps its free plan at 10 employees and 90 days of timesheet storage, Connecteam at 10 users, ZoomShift at 20, and Sling at 30 without a time clock. A spreadsheet stays legal and workable for a stable roster. Both routes get costly once headcount, shift swapping, overtime exposure, or predictive scheduling rules enter the picture.","url":"/q/there-free-employee-scheduling-software-or-can-i-just"},{"id":"c30bae55-729e-4379-a393-1d4fcb0d0fb9","slug":"whats-the-best-employee-scheduling-wfm-software","question":"What's the best employee scheduling / WFM software for a small business (or my industry)?","publishedAt":"2026-07-21T19:09:46.718","confidenceScore":84,"confidenceLabel":"High","industry":{"id":"e1a1da3c-52a8-4e99-88ad-d08ef17d7c3f","slug":"hr-technology","label":"HR Technology","description":"ATS, HRIS, payroll, and workforce management"},"topic":{"slug":"workforce-management","label":"Workforce Management","description":"Employee Scheduling, Time & Attendance, Workforce Management, Leave & Absence Management, Employee Monitoring","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Scheduling software fit is set by your operating model, not your headcount. Restaurants need a POS connection for labor forecasting, retail needs demand forecasting and cross-location staffing, care settings need license checks and census-driven ratios, and construction needs GPS with job costing. Free tiers from Homebase and Connecteam cap at 10 people. The enterprise tier from Legion, Workday, and UKG is a different class of purchase with no published pricing.","url":"/q/whats-the-best-employee-scheduling-wfm-software"},{"id":"bec6eefc-d558-4900-8ae2-342cbf2c196a","slug":"what-is-workforce-management-software","question":"What is workforce management software and what does it actually do?","publishedAt":"2026-07-21T19:09:44.176","confidenceScore":90,"confidenceLabel":"High","industry":{"id":"e1a1da3c-52a8-4e99-88ad-d08ef17d7c3f","slug":"hr-technology","label":"HR Technology","description":"ATS, HRIS, payroll, and workforce management"},"topic":{"slug":"workforce-management","label":"Workforce Management","description":"Employee Scheduling, Time & Attendance, Workforce Management, Leave & Absence Management, Employee Monitoring","schemaKind":null},"contributor":{"id":"ec39deab-44fe-48d8-9029-fefe993ab85a","slug":"answer-stack","displayName":"AnswerStack","websiteUrl":null},"snippet":"Workforce management software runs hourly and shift-based labor: demand forecasting, schedule building and publishing, shift swaps and open shifts, time and attendance capture, break and overtime rules, and the export of approved hours to payroll. It sits apart from payroll and from an HRIS because hours are a legal record, not only a payroll input. This answer walks the schedule-to-payroll workflow, the compliance rules the software has to encode, and the parts that still rest on manager judgment and accurate demand data.","url":"/q/what-is-workforce-management-software"}],"contributorStats":{"verifiedAnswers":224,"openDisputes":0},"schemaJson":{"@context":"https://schema.org","@type":"Question","name":"How does time and attendance software track hours and stop time theft / buddy punching?","text":"How does time and attendance software track hours and stop time theft / buddy punching?","url":"https://www.answerstack.io/q/how-does-time-and-attendance-software-track-hours","answerCount":1,"datePublished":"2026-07-21T19:33:28.008","author":{"@type":"Person","name":"AnswerStack Editorial Team","worksFor":{"@type":"Organization","name":"AnswerStack"},"url":"https://www.answerstack.io/contributors/answer-stack"},"about":[{"@type":"Thing","name":"Workforce Management"},{"@type":"Thing","name":"HR Technology"}],"acceptedAnswer":{"@type":"Answer","text":"Time and attendance software records hours by storing a timestamped punch from a browser, a mobile app, a shared tablet kiosk, or a wall-mounted terminal, then applying schedule, rounding, and break rules to produce the daily and weekly totals federal recordkeeping regulations require an employer to keep [10]. Buddy punching gets addressed by tying that punch to something a coworker cannot borrow: a geofence, an image captured at the punch, a device restriction, or a biometric check [14]. Only the biometric check tests the person rather than a credential, and it also carries the heaviest legal exposure, since Illinois requires written notice and a signed release before any fingerprint or face-geometry scan and gives employees a private right of action worth $1,000 or $5,000 per violation [1]. Texas and Washington impose similar duties that only their attorneys general can enforce [3][4].","url":"https://www.answerstack.io/q/how-does-time-and-attendance-software-track-hours","upvoteCount":0,"datePublished":"2026-07-21T19:33:28.008","dateModified":"2026-07-21T00:00:00","author":{"@type":"Person","name":"AnswerStack Editorial Team","worksFor":{"@type":"Organization","name":"AnswerStack"},"url":"https://www.answerstack.io/contributors/answer-stack"},"citation":[{"@type":"CreativeWork","name":"740 ILCS 14, Biometric Information Privacy Act (full text)","url":"https://www.ilga.gov/Legislation/ILCS/Articles?ActID=3004&ChapterID=57&Print=True"},{"@type":"CreativeWork","name":"Cothron v. White Castle System, Inc., 2023 IL 128004 (opinion)","url":"https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/e304b011-82d9-4832-9cae-d8205749a2ec/Cothron%20v.%20White%20Castle%20System,%20Inc.,%202023%20IL%20128004.pdf"},{"@type":"CreativeWork","name":"Biometric Identifier Act (CUBI), Tex. Bus. & Com. Code Sec. 503.001","url":"https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/biometric-identifier-act"},{"@type":"CreativeWork","name":"RCW Chapter 19.375, Biometric identifiers","url":"https://app.leg.wa.gov/RCW/default.aspx?cite=19.375&full=true"},{"@type":"CreativeWork","name":"29 CFR 785.48, Use of time clocks","url":"https://www.law.cornell.edu/cfr/text/29/785.48"},{"@type":"CreativeWork","name":"29 CFR 785.47, Where records show insubstantial or insignificant periods of time","url":"https://www.law.cornell.edu/cfr/text/29/785.47"},{"@type":"CreativeWork","name":"Troester v. Starbucks Corporation, S234969 (filed July 26, 2018)","url":"https://www.courts.ca.gov/opinions/archive/S234969.PDF"},{"@type":"CreativeWork","name":"29 CFR 785.13, Duty of management","url":"https://www.law.cornell.edu/cfr/text/29/785.13"},{"@type":"CreativeWork","name":"29 CFR 785.19, Meal (bona fide meal periods)","url":"https://www.law.cornell.edu/cfr/text/29/785.19"},{"@type":"CreativeWork","name":"29 CFR 516.2: Employees subject to minimum wage or minimum wage and overtime provisions","url":"https://www.law.cornell.edu/cfr/text/29/516.2"},{"@type":"CreativeWork","name":"California Penal Code Section 637.7, electronic tracking devices","url":"https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=637.7"},{"@type":"CreativeWork","name":"Conn. Gen. Stat. Sec. 31-48d, employers engaged in electronic monitoring required to give prior notice","url":"https://www.cga.ct.gov/current/pub/chap_557.htm"},{"@type":"CreativeWork","name":"NISTIR 8280, Face Recognition Vendor Test Part 3: Demographic Effects","url":"https://nvlpubs.nist.gov/nistpubs/ir/2019/nist.ir.8280.pdf"},{"@type":"CreativeWork","name":"Photo on punch, time clock with camera","url":"https://buddypunch.com/time-clock-software/features/photo-on-punch/"}]}}}