Camera-related state law

Michigan's audio-recording statutes are MCL 750.539a-c and 750.539d-j, the eavesdropping and surveillance provisions of the MI Penal Code. MCL 750.539c reads as an all-party consent statute on its face: it bars willful use of any device to eavesdrop upon a private conversation without the consent of all parties to the conversation. The statute defines "private conversation" and "eavesdrop" with reference to the parties' expectation that the communication is not subject to interception.

Michigan case law in Sullivan v. Gray (1981) has held that a party to a conversation is not eavesdropping on it for purposes of the statute. That has been treated by some courts as a functional one-party-consent reading. The result is a documented gray zone. The safer commercial practice is to assume all-party consent: default to video-only on cameras, route audio capture through a separate documented intercom or call-recording workflow, and obtain written all-party consent where audio capture is unavoidable.

MCL 750.539j makes installing or using a device to observe or photograph another person's private affairs in a place where the person has a reasonable expectation of privacy a felony. MCL 750.539d makes surveillance of an individual in a place where the individual has a reasonable expectation of privacy a felony. These provisions put hidden cameras in restrooms, dressing rooms, and hotel guest rooms in criminal territory.

Practical translation. Commercial MI camera installs default to video-only on the cameras. Hidden cameras in spaces where privacy is expected are off the table for the operator and the integrator.

Biometric data and breach notification

Michigan has no standalone biometric privacy statute on the BIPA model with a private right of action. Biometric data is regulated primarily through MCL 445.72, part of the Michigan Identity Theft Protection Act, which includes biometric data within personal information for data breach notification purposes. A breach affecting biometric records triggers MI AG notice obligations.

For commercial security buyers, the practical reach is fingerprint and facial-recognition access control, voice-print authentication, and any AI camera that builds a faceprint template. MI businesses using biometric capture document consent at enrollment, retention, and access controls as a matter of best practice. Michigan's automotive supply chain pulls heavily from Illinois and Indiana, which means BIPA reaches a meaningful portion of MI-employed remote workers and supply-chain partners. Most multi-state employers in MI default to BIPA-grade documentation (written informed consent + retention schedule + destruction process).

The practical retention rule for biometric records in MI is to retain only as long as reasonably necessary for the purpose and to destroy on employee separation or end of lawful purpose.

Privacy in the workplace

Michigan has no single workplace electronic-monitoring statute that requires written notice for general video surveillance. Pure video surveillance of common work areas with posted notice is the routine pattern. Cameras in employee-only spaces with a reasonable expectation of privacy (restrooms, locker rooms, lactation rooms) are off-limits and create exposure under MCL 750.539d and 750.539j.

Audio capture by an employer is regulated by MCL 750.539a et seq. Most MI employers issue a single workplace surveillance notice in the employee handbook covering cameras, badge access, computer monitoring, and call recording together. MI's heavy automotive, food-processing, and healthcare footprint means most plant-floor and warehouse installs default to NDAA-compliant cameras with badge-tied access control. Fingerprint or facial-recognition timeclocks are common on MI plant floors but should carry written informed-consent forms when any employee is a resident of an outside state with a stricter regime (Illinois BIPA in particular, given Detroit-Chicago and SW MI cross-border employment).

Public-place and common-area cameras

For commercial real estate, multi-tenant residential, retail, and hospitality, the practical rule set is consistent. Cameras in lobbies, hallways, exterior, parking, retail floor, and other non-private common areas are lawful with posted notice. Cameras in bathrooms, fitting rooms, hotel guest rooms, and any other space where privacy is reasonably expected are off-limits.

Multi-tenant residential operators in Michigan should review the bylaws and lease covenants. Hotel operators handle guest-room signage at the door and at the front desk and document any guest-area camera coverage in the property security plan. Detroit, Grand Rapids, Lansing, Ann Arbor, and Warren have municipal ordinances that can apply to alarm permits and certain license categories. Detroit's Project Green Light, a public-private camera-sharing program, has its own enrollment and retention requirements that participating businesses agree to as a condition of participation.

Video retention requirements

Michigan has no single statewide video retention statute that applies to all commercial cameras. Retention is set by the regime that governs the industry.

  • Cannabis. The Cannabis Regulatory Agency publishes camera coverage and retention rules for licensed marijuana establishments under MI Admin Code R 420. Pull the current rules before designing the install.
  • Healthcare. HIPAA Security Rule (45 CFR Part 164) governs PHI-touching footage. Retention is typically 30 to 90 days at the facility, longer when an investigation is open. MI has a large hospital-system footprint (Beaumont/Corewell, Henry Ford, Trinity, Spectrum) where camera retention is part of the facility security plan.
  • Retail and hospitality with card data. PCI-DSS Requirement 9 specifies camera coverage of the cardholder data environment with 90-day retention.
  • Banks and financial institutions. Federal banking regulators set surveillance and retention expectations through bank examination. MI Department of Insurance and Financial Services supervises state-chartered institutions.
  • Automotive supply chain. OEM customer requirements from Detroit Three and tier-one suppliers often impose camera coverage, retention, and access-control expectations through supplier security manuals.
  • Schools. FERPA reach for K-12 districts and higher education. MI district board policies typically set 14 to 30 days retention.
  • Federal contractors and grantees. NDAA Section 889 controls vendor selection. CMMC 2.0 reaches MI defense contractors. Retention is contractor-driven through the SSP or grant award terms.

Default retention for MI commercial systems with no specific industry rule is 30 days. Operators in higher-risk industries set longer retention with explicit written retention policies in the WISP, facility security plan, or CRA SOP.

Notable enforcement examples

MI enforcement against businesses for camera, biometric, and data-handling issues runs through several channels. The Michigan Attorney General brings consumer protection actions under the MI Consumer Protection Act and the Identity Theft Protection Act against businesses with documented data security failures. The MI Cannabis Regulatory Agency has issued sanctions against marijuana licensees for surveillance and retention failures.

Federal HIPAA settlements have reached MI-based defendants where physical safeguards (facility access control, camera coverage of PHI areas) were a documented part of the breach. PCI assessor findings have triggered card brand penalties at MI retailers where camera coverage of the cardholder data environment was inadequate or retention was below 90 days. Real settlements are searchable on the MI AG, CRA, and HHS OCR enforcement pages.

What Tec-Tel does to comply with Michigan regulations

Tec-Tel installs across Michigan for retail, manufacturing, automotive supply chain, healthcare, multi-tenant residential, financial, hospitality, and licensed cannabis customers. The default install pattern for an MI commercial site:

  • Video-only on cameras unless audio is documented with all-party consent. This is the safer reading of MCL 750.539a-c given the Sullivan v. Gray gray zone.
  • Posted surveillance notice at every public entrance.
  • No cameras in restrooms, locker rooms, fitting rooms, hotel guest rooms, or other spaces where privacy is reasonably expected (MCL 750.539d, 750.539j).
  • Written informed-consent forms with a documented retention schedule for any biometric capture (fingerprint timeclocks, facial-recognition access, voiceprint authentication), defaulted to BIPA-grade documentation given Illinois and Indiana cross-border employment.
  • Retention configured to the regime that governs the industry (HIPAA, PCI, CRA, OEM supplier manuals, NDAA, CMMC), with the facility's written retention policy attached.
  • NDAA Section 889-compliant vendor selection on any federal-touching install. No Hikvision, Dahua, Hytera, Huawei, ZTE, or covered OEM relabels.
  • Multi-vendor architecture so the customer is not locked into one camera or VMS line as state and federal rules evolve.

This is a buyer-facing reference, not legal advice. For a specific MI regulatory question, work with your privacy counsel.

Security service in Michigan

Tec-Tel deploys AI-era security across Michigan with one accountable project manager owning design, install, and service to one standard. The cities below have local service detail, deal sizing, and a free consultation. Don't see yours? We cover the whole state.

Or browse the full city directory and nationwide coverage map.