Today probably most companies disallow any private web surfing.

Inofficially it is often tolerated if you don't overdo it.

> and if that would be legal.

It is.

> But it is certainly not the norm.

Believe me, it is.

The reason is simple: As soon as you're allowing private surfing you have to respect your employees' privacy. That means that you must not use software or equipment to track web use (apart from special agreements with the works council).

Same goes for private email. If you allow that, you cannot have your admins look into emails anymore. You cannot easily backup mails without telling your employees all the details. You cannot simply reject mails. And so on.

It's a huge hassle.