State Laws Ban Access to Workers' Social Media Accounts

ARLINGTON, Va.—Social media has transformed the workplace and, in some cases, given employers unprecedented access to their employees’ off-duty activities, Douglas Towns, an attorney with Sherman & Howard in Atlanta, told attendees July 24, 2015, at an employment law conference presented by the National Employment Law Institute.

Some employers take advantage of this by screening potential employees through social media and other web-based research, he noted. On the other hand, social media has also created opportunities for current or former employees to harm a company’s public image, disclose confidential information or trade secrets, violate noncompete agreements, and expose the company’s networks to malware—a host of situations that can justifiably concern employers.

But companies must be aware of the limits on an employer’s ability to monitor employees, Towns cautioned. In addition to limitations under federal law imposed by the federal Electronic Communications Privacy Act, several states have enacted statutes that limit the interception and monitoring of social media.

Employers, particularly those that do business in multiple jurisdictions, need to stay up-to-date on all the developments in this area, Towns said.

The states listed below have passed legislation banning employer access to workers’ social media accounts. The year that the law went into effect is shown in parentheses.

Arkansas: Prohibits employers from suggesting that an employee should disclose his or her social media username and password, add the employer as a social media contact, or change his or her social media privacy settings (2013).

California: Prohibits employers from requiring or requesting employees or applicants to disclose their username or password for their social media account, and also prohibits employers from requiring the employee or applicant access his or her social media account in the presence of the employer. However, employers may make a reasonable request that an employee divulge personal social media account information, as is relevant to an investigation of employee misconduct (2012).

Colorado: Prohibits employers from requiring an employee or applicant to disclose a username, password or other means of accessing a personal account, unless an employer is conducting an investigation for legal compliance purposes (2013).

Connecticut: Prohibits an employer from requiring or requesting an employee or applicant to provide it with a username and password or to access a personal online account in the presence of the employer (effective Oct. 1, 2015).

Illinois: Bars employers from demanding employees or applicants reveal their usernames or passwords linked to social networking sites; also prohibits employers from forcing employees to display their social networking profiles for review (2012).

Louisiana: Employers cannot require prospective or current employees to disclose their username, password, or other login information that allows access to or observation of personal social media accounts (2014).

Maryland: Prohibits employers from requesting or requiring the disclosure of usernames or passwords to personal social media accounts, and prohibits employers from taking or threatening to take any disciplinary action against employees or applicants who refuse to disclose such information (2012).

Michigan: Prohibits employers from asking for an employee’s or applicant’s personal Internet account information; does not prohibit an employer from conducting a work-related investigation into activity on an employee’s personal Internet account (2012).

Montana: Prohibits an employer from requiring or requesting an employee or applicant to disclose a username or password, access social media in the presence of the employer, or divulge information in a social media account as a condition of employment (2015).

Nevada: Prohibits employers from requiring access to an employee’s social media account as a condition of employment (2013).

New Hampshire: Employers cannot require prospective or current employees to disclose their username, password or other login information for personal social media accounts (2014).

New Jersey: Employers cannot require prospective or current employees to disclose their username, password or other means for accessing an electronic account or service (2013).

New Mexico: Employers are prohibited from requesting or requiring that prospective employees provide passwords or access to their social networking accounts (2013).

Oklahoma: Employers cannot require prospective or current employees to disclose their username, password or other login information to personal social media accounts, or require prospective or current employees to log in to personal social media accounts in the presence of the employer (2014).

Oregon: It is unlawful for an employer to request that an employee or applicant disclose his or her username and password or add the employer to his or her list of contacts (2013).

Rhode Island: Employers cannot require or request prospective or current employees to disclose personal social media account information (2014).

Tennessee: Employers cannot require or request prospective or current employees to disclose login information to personal social media accounts, or require prospective or current employees to log in to personal social media accounts in the presence of the employer (2015).

Utah: Generally prohibits employers from requesting information related to personal Internet accounts, including usernames and passwords; allows employers to investigate specific information on the employee’s personal Internet account to ensure compliance with certain laws (2013).

Virginia: Prohibits employers from requiring prospective or current employees to disclose the username and password to their social media accounts (effective July 1, 2015).

Washington: Prohibits employers from requesting personal social networking account login information from employees or applicants; allows employers to require disclosure of employees’ social media content in situations where necessary to comply with a federal law (2013).

Wisconsin: Employers cannot require or request prospective or current employees to disclose login information to personal social media accounts, or require prospective or current employees to allow employers to observe their personal social media account in the employer’s presence (2014).

Joanne Deschenaux, J.D., is SHRM’s senior legal editor.