Clocking in with geolocation: how to stop people clocking in from home

Published on 14 May 2026

One of the big questions about mobile time tracking is: what if they clock in from the sofa?. The answer is clocking in with geolocation. We explain how it works, what the law allows and how to set it up properly so that it is useful without intruding on your team's privacy.

What clocking in with geolocation is

It is clocking in from a phone that, as well as the time, records the location at the moment of clocking. That way you can verify that the employee really is at the workplace (or on the site, or at the client's) and not clocking in from home.

How it works

When the employee presses "clock in", the app asks for access to GPS and checks whether they are inside the radius you have defined for the workplace (for example, 100 metres around the office). If they are inside, the clocking is validated; if not, it is flagged as "out of area" or blocked, depending on your settings.

What the law says about GPS at work

Geolocation at work is legal, but on specific conditions. The rule is article 90 of Ley Orgánica 3/2018, to which article 20 bis of the Estatuto de los Trabajadores refers. It says two things:

• The company may process geolocation data «para el ejercicio de las funciones de control» — for the exercise of its monitoring functions — under article 20.3 of the Workers' Statute, and only within its legal framework and with the limits inherent in it.
• Beforehand, workers and, where applicable, their representatives have to be informed «de forma expresa, clara e inequívoca» — expressly, clearly and unambiguously — about the existence and characteristics of the device, and also about how to exercise their rights of access, rectification, restriction of processing and erasure.

Three points that head off the commonest mistake:

• Consent is not asked for. In an employment relationship consent is not considered freely given, so the legal basis is not article 6.1.a of the GDPR but performance of the contract and the employer's legitimate interest in monitoring, within article 20.3 of the Workers' Statute. Asking for an «I accept» and keeping it as an alibi provides no cover.
• Minimisation. The GDPR requires you to use the least intrusive means that will do the job. Capturing the location only at the instant of clocking in is defensible; continuous tracking, to check someone's hours, is not.
• Recording working hours is not locating anybody. Article 34.9 only requires you to know when the working day starts and ends. Everything else is a decision of yours about attendance monitoring, with its own burden of justification.

And a warning about the alternative many terminals offer: fingerprints and facial recognition. The Agencia Española de Protección de Datos, in its guide on attendance monitoring using biometric systems, concludes that for working time records there is today no rule with the rank of a statute in Spain that lifts the prohibition on processing special categories of data, and that the worker's consent cannot lift it either, because of the imbalance between the parties. In practice, clocking in with a fingerprint or a face is the method carrying the greatest risk of a penalty of them all.

How to set it up properly

• Set a sensible radius (50-150 m) around each site.
• Inform your team and their representatives in writing and before switching it on: what is collected, what for, on what legal basis, how long it is kept and how to exercise their rights. That is what article 90 of the LOPDGDD requires.
• If there is a collective agreement or a company agreement on working time records, the system has to fit within it; if there is not and there is legal representation, you have to consult it first (article 34.9).
• Do not turn on continuous tracking: only at the clocking.
• Do not block clocking in from outside the zone. Flag it as an exception and review it. If you prevent someone from recording a day they really worked, the breach of article 34.9 becomes yours.
• It allows exceptions for anyone working on the move or at home.
• Record all of this in your record of processing activities and consider whether you need an impact assessment.

And what about remote work?

For anyone working remotely, geolocation is hard to justify: there is a less intrusive means — having the person clock in — and the minimisation principle requires you to use it. The sensible approach is for the employee to mark «remote work» when clocking in and for that marking to be kept distinct. That way you comply with article 34.9 without asking for a location. We go into it in time tracking and remote work.