Social Media Privacy Laws in Employment: 50-State Survey

As social media becomes more ubiquitous, employers have developed workplace social media policies to review and regulate what they can about an employee’s social media usage. There is no federal law preventing employers from asking for employees’ or applicants’ social media usernames and passwords, or requiring employees or applicants to share any social media information that is not publicly available. However, a little over half of the states have enacted laws to protect employees and applicants in this situation.

States with workplace social media privacy laws often prohibit employers from asking for any personal social media access information, such as usernames and passwords. They also often prohibit employers from using other tactics to gain access to private social media information or content, such as requesting that an employee or applicant access their personal social media in the employer’s presence or adding anyone, such as the employer, to the list of contacts associated with their account, such as a follower or friend list. Notably, some states explicitly mention that employers are not prohibited from viewing information about an employee or applicant that is publicly available online.

Defining “Social Media”

The term “social media” is used on this page to describe a broad range of internet accounts. States tend to use different terms, but generally their laws cover many forms of electronic accounts beyond traditional social media accounts like Facebook or Instagram, such as personal email accounts, podcast services, blogs, messaging apps, videos, photos, and more.

These laws generally protect employees and applicants from retaliation for adhering to or asking the employer to adhere to the protections in the law. Enforcement varies. Some states enforce their social media workplace privacy laws through their labor department or another state agency, while other states give employees and applicants a private right of action to sue the employer in civil court for a violation. Penalties also vary, ranging from flat civil penalties to actual damages, job reinstatement, and attorneys’ fees and costs.

Click on a state below to learn more about workplace social media privacy laws and procedures in that state.

Alabama

There is no Alabama workplace privacy law involving social media.

Alaska

There is no Alaska workplace privacy law involving social media.

Arizona

There is no Arizona workplace privacy law involving social media.

Arkansas

Arkansas law protects employees and applicants from being required to share private social media information and activity with employers.

The Arkansas workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Arkansas law prohibits employers from:

Requiring or coercing an employee or applicant to share their social media usernames or passwords
Requiring or coercing an employee or applicant to change any of their social media privacy settings
Requiring or coercing an employee or applicant to add another employee to the list of contacts associated with their social media account
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available on the internet, nor does it prohibit the mere act of issuing an invitation to connect or voluntarily connecting on social media. It also does not affect an employer’s existing right or obligation to ask for social media usernames and passwords if these are relevant to the employer’s investigation into the employee’s alleged violation of a law or regulation or the employer’s written policies.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to social media accounts opened by the employee at the employer’s request, provided to an employee by the employer (such as a company email), set up on behalf of the employer, or used by the employee to impersonate the employer.

The Arkansas Department of Labor and Licensing enforces this law. Penalties for violations include civil monetary penalties and injunctive relief.

California

California law protects employees and applicants from being required to share their social media and methods of access with employers.

The California workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. California law prohibits employers from:

Requesting or requiring that an employee or applicant share their social media usernames or passwords
Requesting or requiring that an employee or applicant access their social media in the employer’s presence
Requesting or requiring that an employee or applicant share any personal social media

However, the law does not affect an employer’s existing right or obligation to ask that an employee share personal social media reasonably believed to be relevant to an investigation of alleged employee misconduct or a violation of applicable laws and regulations. This law also does not prevent an employer from requesting usernames, passwords, or other access methods for an employer-issued electronic device. Employees and applicants are protected from retaliation for exercising their rights under this law.

Colorado

Colorado law protects employees and applicants from being required to share their social media and methods of access with employers.

The Colorado workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Colorado law prevents employers from:

Requesting or requiring that an employee or applicant share their social media usernames, passwords, or other methods of access
Compelling an employee or applicant to add anyone, including the employer, to the list of contacts associated with their social media account
Requesting or requiring that an employee or applicant change their social media privacy settings

However, the law does not prevent an employer from investigating compliance with securities law, financial law, or regulatory requirements based on information about an employee’s use of web-based accounts for business purposes. It also does not prevent an employer from investigating an employee’s electronic communications based on information about the unauthorized downloading of an employer’s proprietary information or financial data to a web-based account. The law does not prevent an employer from requiring an employee to disclose usernames, passwords, or other methods of accessing non-personal accounts or services that provide access to the employer’s internal computer or information systems.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to the department of corrections, county corrections departments, or any state or local law enforcement agency.

The Colorado Department of Labor and Employment enforces this law. Penalties for violations include fines up to $1,000 for the first violation and $5,000 for each subsequent violation.

Connecticut

Connecticut law protects employees and applicants from being required to share their social media and methods of access with employers.

The Connecticut workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Connecticut law prohibits employers from:

Requesting or requiring that employees or applicants share their social media usernames, passwords, or other methods of access
Requesting or requiring that employees or applicants access their social media in the employer’s presence
Requiring that an employee or applicant invite or accept an invitation from the employer to join a group affiliated with any personal social media account

However, an employer may require an employee or applicant to share usernames and passwords for accounts or services that are provided by the employer or by virtue of the employee’s relationship with the employer, or that are used for the employer’s business purposes. Employees may also be required to share usernames and passwords for electronic devices supplied or paid for by the employer.

Employers are not prevented from investigating compliance with applicable laws, regulations, or prohibitions against employee misconduct based on specific information about personal account activity. They are also not prohibited from investigating the unauthorized transfer of the employer’s proprietary information, confidential information, or financial data to a personal account. An employer conducting such an investigation may require an employee or applicant to allow them access to their personal online account, although they may not require the disclosure of usernames, passwords, or other authentication methods. The law does not prevent employers from monitoring, reviewing, accessing, or blocking electronic data that is stored on a device paid for by the employer, or that is traveling through or stored on the employer’s network.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to state or municipal law enforcement agencies conducting a pre-employment investigation. It also does not apply to accounts created, maintained, used, or accessed for the employer’s business purpose.

The Connecticut Department of Labor enforces this law. Penalties and remedies for violations include fines up to $500 for the first violation and up to $1,000 for each subsequent violation ($25 and $500 for applicants, respectively), job reinstatement, payment of back wages, reinstatement of employee benefits, attorneys’ fees and costs, and other appropriate remedies.

Delaware

Delaware law protects employees and applicants from being required to share private social media information and activity with employers.

The Delaware workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Delaware law prohibits employers from:

Requesting or requiring an employee or applicant to share their social media usernames or passwords
Requesting or requiring an employee or applicant to access their social media in the employer’s presence
Requesting or requiring an employee or applicant to use social media
Requesting or requiring an employee or applicant to share their social media
Requesting or requiring an employee or applicant to add any person, including the employer, to a list of contacts associated with their account
Requesting or requiring an employee or applicant to invite or accept an invitation to join a group associated with their personal social media
Requesting or requiring an employee or applicant to change their social media privacy settings

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available on the internet. The law also does not affect an employer’s existing right or obligation to ask that an employee share personal social media, usernames, or passwords reasonably believed to be relevant to an investigation of alleged employee misconduct or a violation of applicable laws and regulations. The law does not prevent an employer from requiring that an employee share a username, password, or other access method for an electronic device supplied or paid for by the employer or an account or service provided by the employer, obtained by virtue of the employment relationship, or used for the employer’s business purpose. Employers are also not prohibited from monitoring, reviewing, accessing, or blocking electronic data stored on an employer’s network or a device supplied or paid for by the employer. The law does not preclude an employer from complying with certain duties to screen employees or applicants or to monitor or retain employee communications.

Employees and applicants are protected from retaliation for not complying with a request that violates this law. This law does not apply to social media accounts created or operated by an employer and operated by an employee as part of their employment.

Florida

There is no Florida workplace privacy law involving social media.

Georgia

There is no Georgia workplace privacy law involving social media.

Hawaii

Hawaii law protects employees and applicants from being required to share private social media information and activity with employers.

The Hawaii workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Hawaii law prohibits employers from:

Requiring, coercing, or requesting an employee or applicant to share social media login information
Requiring, coercing, or requesting an employee or applicant to share their social media
Requiring, coercing, or requesting an employee or applicant to grant or continue to grant the employer access to their social media (unless voluntary)
Requiring, coercing, or requesting an employee or applicant to change their social media privacy settings
Requiring, coercing, or requesting an employee or applicant to access their social media in the employer’s presence
Requiring, coercing, or requesting an employee or applicant to give the employer an unlocked personal device to access their social media
Using or sharing employee login information obtained while monitoring the employer’s network or employer-provided devices to access an employee’s social media

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available on the internet. This law does not prevent an employer from requiring that an employee share specifically identified content, without sharing their login information, so that the employer may comply with its own legal and regulatory obligations, investigate allegations of non-compliance with a prohibition against employee misconduct based on specific facts, investigate the disclosure of information in which the employer has a proprietary interest or that the employer has a legal obligation to keep confidential, and investigate threats to safety.

Employees and applicants are protected from retaliation for not complying with a request that violates this law. This law does not apply to accounts opened on behalf of the employer or provided by the employer and intended to be used primarily under the employer’s direction.

The Hawaii Department of the Attorney General enforces this law. Individuals may also pursue private civil actions. Penalties and remedies for violations include civil penalties up to $1,000 for each violation ($100,000 total), actual and general damages, attorneys’ fees and costs, injunctive relief, and other equitable relief.

Idaho

There is no Idaho workplace privacy law involving social media.

Illinois

Illinois law protects employees and applicants from being required to share private social media information and activity with employers.

The Illinois workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Illinois law prohibits employers from:

Requesting, requiring, or coercing an employee or applicant to share their social media usernames, passwords, or other methods of access
Requesting, requiring, or coercing an employee or applicant to access their social media in the employer’s presence
Requiring or coercing an employee or applicant to invite the employer to join a group affiliated with the employee’s social media account
Requiring or coercing an employee or applicant to join the employer’s online account or add the employer to the list of contacts associated with their social media account
Using inadvertently acquired usernames, passwords, or other methods of access to access an employee or applicant’s social media

However, the law does not prevent employers from viewing information about an employee or applicant that is publicly available online. Employers are not prohibited from maintaining social media and internet use policies or from monitoring usage of the employer’s electronic equipment or mail without requesting passwords or access information. Nothing in the law prevents an employer from requesting that an employee or applicant share specific content reported to the employer (so long as they are not required to reveal usernames, passwords, or other authentication methods) to:

Ensure compliance with applicable laws or regulations
Investigate an alleged unauthorized transfer of the employer’s proprietary or confidential information or financial data to a personal account based on specific information
Investigate an alleged violation of applicable laws, regulations, or prohibitions against work-related misconduct based on specific information
Prohibit an employee from using their personal account for business purposes
Prohibit an employee or applicant from accessing their personal account during business hours, on business property, while using an electronic device supplied or paid for by the employer, or while using the employer’s network or resources

Employers are not restricted from complying with a duty to screen employees or applicants or monitor their communications as required by law, so long as the password, access, or account information sought relates to an account that the employer supplies or pays or an account created or maintained on behalf or under the direction of the employer. Employees and applicants are protected from retaliation for exercising their rights under this law.

The Illinois Department of Labor enforces this law. Penalties and remedies for violations include actual damages and costs, or $200 plus costs, attorneys’ fees, and actual damages for a willful and knowing violation.

Indiana

There is no Indiana workplace privacy law involving social media.

Iowa

There is no Iowa workplace privacy law involving social media.

Kansas

There is no Kansas workplace privacy law involving social media.

Kentucky

There is no Kentucky workplace privacy law involving social media.

Louisiana

Louisiana law protects employees and applicants from being required to share private social media information and activity with employers.

The Louisiana workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Louisiana law prohibits employers from:

Requesting or requiring an employee or applicant to share their social media usernames, passwords, or other methods of access
Using inadvertently acquired usernames, passwords, or other authentication methods to access an employee or applicant’s social media

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available on the internet. Employers are not prevented from requesting or requiring an employee or applicant to share access information for devices paid for or supplied by the employer or accounts or services provided by the employer, obtained by virtue of the employee’s relationship with the employer, or used for the employer’s business purposes. Employers are also not prevented from requiring an employee to cooperate in an investigation (without revealing their username or password), based on specific information, to ensure compliance with laws, regulations, or prohibitions against work-related misconduct or an unauthorized transfer of proprietary information, confidential information, or financial data to a personal account.

Employers are not prohibited from restricting an employee’s access to certain websites while using an employer’s device, network, or resources. The law also does not preclude an employer from complying with a duty to screen employees or applicants or to monitor or retain employee communications as required by law. Employers are not prohibited from requiring an employee to provide a personal email address in case the employer’s email system fails. Employees and applicants are not prohibited from voluntarily disclosing social media access information.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to accounts created, serviced, maintained, used, or accessed by an employee or applicant for an employer’s business purpose or to engage in business-related communications.

Maine

Maine law protects employees and applicants from being required to share private social media information and activity with employers.

The Maine workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Maine law prohibits employers from:

Requiring, coercing, or requesting an employee or applicant to share their social media passwords or other methods of access
Requiring, coercing, or requesting an employee or applicant to access their social media in the employer’s presence
Requiring or coercing an employee or applicant to share any social media information
Requiring or causing an employee or applicant to add anyone, including the employer, to the list of contacts associated with their account
Requiring, causing, or requesting an employee or applicant to change their social media privacy settings

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. The law also does not prevent an employer from complying with a duty to screen employees or applicants or to monitor or retain employee communications as required by law. The law does not prohibit an employer from requiring that an employee share personal social media information reasonably believed to be relevant to an investigation of alleged employee misconduct or a violation of applicable laws and regulations. Employers are not prevented from issuing a workplace policy regarding the use of their equipment, including a requirement that employees share usernames, passwords, or other methods of access for employer-issued electronic devices or employer-provided software or email accounts.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to social media accounts opened at the employer’s request, provided by the employer, or intended to be used on behalf of the employer.

The Maine Department of Labor enforces this law. Penalties for violations include fines of at least $100 for the first violation, at least $250 for the second, and at least $500 for each subsequent violation.

Maryland

Maryland law protects employees and applicants from being required to share their social media and methods of access with employers.

The Maryland workplace privacy law involving social media generally protects employees and applicants from being required to share any methods of accessing their personal social media with an employer. Maryland law prohibits employers from requesting or requiring an employee or applicant to share their social media usernames, passwords, or other methods of access.

Employers may require employees to share usernames, passwords, or other methods of access for non-personal accounts or services that provide access to the employer’s internal computer or information systems. Employees are prohibited from downloading unauthorized employer proprietary information or financial data to a personal account. The law does not prevent an employer from investigating compliance with applicable laws or regulations based on information about an employee’s use of a personal account for business purposes. It also does not prevent an employer from investigating an employee based on information about the employee’s unauthorized download of proprietary information or financial data to a personal account. Employees and applicants are protected from retaliation for their refusal to disclose private information protected under this law.

The Maryland Department of Labor, Division of Labor and Industry enforces this law. Penalties and remedies for violations include injunctive relief, damages, and other appropriate relief.

Massachusetts

There is no Massachusetts workplace privacy law involving social media.

Michigan

Michigan law protects employees and applicants from being required to share private social media information and activity with employers.

The Michigan workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Michigan law prohibits employers from:

Requesting an employee or applicant to share any information that allows access to or observation of their social media
Requesting an employee or applicant to grant access to their social media
Requesting an employee or applicant to allow observation of their social media

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prohibited from requiring an employee to share access information for an electronic device paid for by the employer or an account or service provided by the employer, obtained by virtue of the employment relationship, or used for the employer’s business purposes.

The law does not prevent an employer from investigating compliance with applicable laws, regulations, or prohibitions against work-related employee misconduct or the unauthorized transfer of proprietary or confidential information or financial data to a personal account based on specific information. Employers are not prevented from restricting access to certain websites while using an electronic device paid for by the employer or while using the employer’s network or resources. The law does not restrict an employer’s ability to monitor, review, or access electronic data stored on a device paid for by the employer or traveling through or stored on the employer’s network. The law also does not prevent an employer from complying with a legal duty to screen employees or applicants or to monitor or retain employee communications. Employees and applicants are protected from retaliation for exercising their rights under this law.

This law is enforced through criminal misdemeanor liability and private civil actions. Penalties and remedies for violations include fines of up to $1,000, damages up to $1,000, and attorneys’ fees and costs.

Minnesota

There is no Minnesota workplace privacy law involving social media.

Mississippi

There is no Mississippi workplace privacy law involving social media.

Missouri

There is no Missouri workplace privacy law involving social media.

Montana

Montana law protects employees and applicants from being required to share their social media and methods of access with employers.

The Montana workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Montana law prohibits employers from:

Requiring or requesting an employee or applicant to share their social media usernames or passwords
Requiring or requesting an employee or applicant to access their social media in the employer’s presence
Requiring or requesting an employee or applicant to share information contained in their social media account

However, an employer may request usernames and passwords to access personal social media when the employer has specific information about an activity that indicates work-related employee misconduct or criminal defamation, or an unauthorized transfer of the employer’s proprietary information, confidential information, or financial data to a personal account. An employer may also request usernames and passwords to access personal social media to ensure compliance with applicable laws or regulations, or when an investigation is underway and the information is necessary to make a factual determination in the investigation.

The law does not limit an employer’s right to issue workplace policies regarding the use of the employer’s equipment, including a requirement that employees share usernames, passwords, or other methods of access for employer-issued electronic devices or employer-provided software or email accounts. Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to social media accounts opened for or provided by an employer and intended solely for business purposes.

This law is enforced through private civil actions. Remedies for violations include $500 or actual damages up to $7,000 and legal costs for the prevailing party.

Nebraska

Nebraska law protects employees and applicants from being required to share private social media information and activity with employers.

The Nebraska workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Nebraska law prohibits employers from:

Requiring or requesting an employee or applicant to share their social media usernames, passwords, or other methods of access
Requiring or requesting an employee or applicant to access their social media in the employer’s presence or otherwise allow the employer to observe or access their social media
Requiring an employee or applicant to add anyone, including the employer, to the list of contacts associated with their account
Requiring or coercing an employee or applicant to change their social media privacy settings
Using inadvertently acquired usernames, passwords, or other methods of access to access an employee or applicant’s social media

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. The law prohibits employees from downloading or transferring an employer’s proprietary information or private financial data to a personal account without authorization unless the information is otherwise disclosed by the employer to the public. Nothing in the law limits an employer’s right to:

Maintain workplace policies governing the use of the employer’s electronic equipment, including internet use and personal account use
Require an employee or applicant to share access information for an electronic communication device supplied or paid for by the employer
Require an employee or applicant to share access information for an account or service provided by the employer, obtained by virtue of the employment relationship, or used for the employer’s business purposes
Restrict access to certain websites while using a device supplied or paid for by the employer or while using the employer’s network or resources
Monitor, review, access, or block electronic data stored on a device supplied or paid for by the employer or stored on the employer’s network
Investigate or require cooperation in an investigation concerning compliance with applicable laws, regulations, or prohibitions against work-related misconduct based on specific information
Investigate or require cooperation in an investigation concerning the unauthorized transfer of the employer’s proprietary information or financial data to a personal account based on specific information
Comply with a duty to screen employees or applicants or to monitor or retain communications as required by law
Comply with a law enforcement investigation

Employees and applicants are protected from retaliation for exercising their rights under this law. Employers cannot ask employees or applicants to waive or limit the protection of this law. The law does not apply to online accounts that the employer supplies or pays for, except when they pay only for additional features or enhancements, or an account used exclusively for the employer’s business purposes.

This law is enforced through private civil actions. Remedies for violations include injunctive relief, general and special damages, attorneys’ fees and costs, and other appropriate relief.

Nevada

Nevada law protects employees and applicants from being required to share their social media and methods of access with employers.

The Nevada workplace privacy law involving social media generally protects employees and applicants from being required to share methods of accessing their personal social media with an employer. Nevada law prohibits employers from requiring, requesting, suggesting, or causing an employee or applicant to share their social media usernames, passwords, or other methods of access.

An employer may require an employee or applicant to share access information for accounts or services other than a personal social media account used to access the employer’s own internal computer or information system. Employees and applicants are protected from retaliation for exercising their rights under this law.

New Hampshire

New Hampshire law protects employees and applicants from being required to share private social media information and activity with employers.

The New Hampshire workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. New Hampshire law prohibits employers from:

Requiring or requesting that an employee or applicant share their social media usernames, passwords, or other methods of access
Compelling an employee or applicant to add anyone, including the employer, to the list of contacts associated with their social media account
Requiring an employee or applicant to change their social media privacy settings
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. The law does not limit an employer’s right to adopt and enforce workplace policies regarding the employer’s electronic equipment and internet use. It also does not limit an employer’s right to monitor usage of its electronic equipment and mail or request or require an employee to share login information for an account or service provided by virtue of the employment relationship or for an electronic communications device or online account paid for or supplied by the employer.

The law does not prohibit employers from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct based on information about activity on an employee’s personal social media account, or from investigating an employee’s actions based on specific information about the unauthorized transfer of an employer’s proprietary information, confidential information, or financial data to a personal account. Employers may require an employee’s cooperation to share specific content during such an investigation to make a factual determination.

Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to accounts maintained, used, or accessed for the business purposes of the employer or to engage in business-related communications.

The New Hampshire Department of Labor enforces this law. Penalties for violations include civil penalties up to $2,500.

New Jersey

New Jersey law protects employees and applicants from being required to share private social media information and activity with employers.

The New Jersey workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. New Jersey law prohibits employers from requiring or requesting that an employee or applicant share their social media usernames, passwords, or other methods of access.

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prevented from implementing and enforcing policies regarding the use of employer-issued devices or accounts or services provided by the employer or used for business purposes.

Employers are also not prevented from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct based on specific information, or from investigating an employee’s actions based on specific information about the unauthorized transfer of an employer’s proprietary information, confidential information, or financial data to a personal account.

Employers cannot require employees or applicants to waive or limit the protections of this law. Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to the department of corrections, state parole board, county corrections departments, or any state or local law enforcement agency. It also does not apply to accounts created, maintained, used, or accessed by employees or applicants for the business purposes of the employer or to engage in business-related communications.

The New Jersey Department of Labor & Workforce Development enforces this law. Penalties for violations include civil penalties up to $1,000 for the first violation and $2,500 for each subsequent violation.

New Mexico

New Mexico law protects applicants from being required to share private social media information and activity with employers.

The New Mexico workplace privacy law involving social media generally protects applicants (but not current employees) from being required to share more of their social media information and activity than is publicly available. New Mexico law prohibits employers from requiring or requesting that an applicant share their social media passwords or other methods of access.

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prevented from implementing policies regarding workplace internet, social media, and email usage, or from monitoring usage of their electronic equipment or email without requesting or requiring that an applicant provide their social media password. The law does not apply to federal, state, or local law enforcement agencies.

New York

There is no New York workplace privacy law involving social media.

North Carolina

There is no North Carolina workplace privacy law involving social media.

North Dakota

There is no North Dakota workplace privacy law involving social media.

Ohio

There is no Ohio workplace privacy law involving social media.

Oklahoma

Oklahoma law protects employees and applicants from being required to share their social media and methods of access with employers.

The Oklahoma workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Oklahoma law prohibits employers from:

Requiring an employee or applicant to share their social media usernames, passwords, or other methods of access
Requiring an employee or applicant to access their social media in the employer’s presence
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

The law does not prohibit employers from requesting that an employee share usernames and passwords for computer systems, information technology networks, or electronic communications devices provided or subsidized by the employer, or accounts or services that are provided by the employer or by virtue of the employment relationship or that the employee uses for business purposes.

Employers are not prevented from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct based on specific information, or from investigating an employee’s actions based on specific information about the unauthorized transfer of an employer’s proprietary information, confidential information, or financial data to a personal account. An employer may require an employee’s cooperation in sharing reported content to make a factual determination. Employers are not prevented from reviewing or accessing personal social media accounts that an employee accesses with the employer’s computer system, information technology network, or electronic communication device. Employees and applicants are protected from retaliation for refusing to share private information protected under this law.

This law is enforced through private civil actions. Remedies include injunctive relief and $500 in damages.

Oregon

Oregon law protects employees and applicants from being required to share private social media information and activity with employers.

The Oregon workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Oregon law prohibits employers from:

Requiring or requesting that an employee or applicant establish or maintain a personal social media account
Requiring or requesting that an employee or applicant share their social media usernames, passwords, or other methods of access
Requiring an employee or applicant to allow the employer to advertise on their social media account
Compelling an employee or applicant to add the employer or an employment agency to the list of contacts associated with their account
Compelling an employee or applicant to access their social media in the employer’s presence
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available online. Employers may require employees to share usernames, passwords, and other methods of access for accounts provided by or used on behalf of the employer. The law does not prevent an employer from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct based on specific information so long as employees are not required to share usernames, passwords, or other methods of accessing their personal social media. The law also does not prevent an employer from requiring an employee to share reported content necessary for an employer to make a factual determination during an investigation. Employees and applicants are protected from retaliation for exercising their rights under this law. This law does not apply to some law enforcement units.

Pennsylvania

There is no Pennsylvania workplace privacy law involving social media.

Rhode Island

Rhode Island law protects employees and applicants from being required to share private social media information and activity with employers.

The Rhode Island workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Rhode Island law prohibits employers from:

Requiring, coercing, or requesting an employee or applicant to share their social media passwords or other methods of access
Requiring, coercing, or requesting an employee or applicant to access their social media in the employer’s presence
Requiring or coercing an employee or applicant to share any social media information, except when reasonably believed to be relevant to an investigation of misconduct or a workplace violation of applicable laws and regulations
Compelling an employee or applicant to add anyone, including the employer, to the list of contacts associated with their social media account
Requiring, requesting, or causing an employee or applicant to change their social media privacy settings

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prohibited from complying with a duty to screen employees or applicants or to monitor or retain employee communications as required by law. Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to social media accounts provided by, opened on behalf of, or intended to be used primarily on behalf of an employer.

This law is enforced through private civil actions. Remedies include injunctive relief, declaratory relief, damages, and attorneys’ fees and costs.

South Carolina

There is no South Carolina workplace privacy law involving social media.

South Dakota

There is no South Dakota workplace privacy law involving social media.

Tennessee

Tennessee law protects employees and applicants from being required to share private social media information and activity with employers.

The Tennessee workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Tennessee law prohibits employers from:

Requiring or requesting an employee or applicant to share their social media passwords
Compelling an employee or applicant to add the employer or an employment agency to the list of contacts associated with their social media account
Compelling an employee or applicant to access their social media in the employer’s presence

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prohibited from requesting or requiring an employee to share their usernames or passwords for electronic communications devices supplied or paid for by the employer, or accounts and services provided by the employer and obtained by virtue of the employment relationship or used for the employer’s business purposes.

Employers are not prohibited from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct, or the unauthorized transfer of proprietary information, confidential information, or financial data to a personal account based on specific information. Employers may require employees to cooperate in such an investigation, including sharing social media account information or content. The law does not prevent employers from restricting access to certain websites on an electronic device supplied or paid for by the employer, or while using an employer’s network or resources. It also does not prevent employers from monitoring, reviewing, accessing, or blocking electronic data stored on a device supplied or paid for by the employer or stored on the employer’s network. Employers are not prevented from complying with a duty to screen employees or applicants or to monitor communications as required by law.

Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to accounts created, maintained, or used for business-related communications or the employer’s business purpose.

Texas

There is no Texas workplace privacy law involving social media.

Utah

Utah law protects employees and applicants from being required to share private social media information and activity with employers.

The Utah workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Utah law prohibits employers from requesting an employee or applicant to share their social media usernames or passwords.

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prohibited from requiring an employee to share usernames or passwords for electronic communications devices supplied or paid for by the employer, or accounts or services provided by the employer, obtained by virtue of the employment relationship, and used for the employer’s business purposes.

Employers are not prevented from investigating compliance with applicable laws, regulations, or prohibitions against work-related misconduct, or the unauthorized transfer of proprietary information, confidential information, or financial data to a personal account based on specific information. Employers may require employees to share reported content in order to make a factual determination during such an investigation. Employers are not prevented from restricting access to certain websites while using a device supplied or paid for by the employer, or while using the employer’s network or resources. Employers are not prohibited from monitoring, reviewing, accessing, or blocking electronic data stored on an electronic communications device supplied or paid for by the employer or stored on the employer’s network. The law does not prevent an employer from complying with a duty to screen employees or applicants or to monitor or retain communications as required by law.

This law is enforced through private civil actions. Remedies for violations include up to $500 in damages.

Vermont

Vermont law protects employees and applicants from being required to share their social media and methods of access with employers.

The Vermont workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Vermont law prohibits employers from:

Requiring, requesting, or coercing an employee or applicant to share their social media usernames, passwords, or other methods of access
Requiring, requesting, or coercing an employee or applicant to access their social media in the employer’s presence
Requiring, requesting, or coercing an employee or applicant to share their social media
Requiring, requesting, or coercing an employee or applicant to change any of their social media privacy settings
Requiring or coercing an employee or applicant to add anyone, including the employer, to the list of contacts associated with their social media account

The law does not prevent employers from requiring an employee to share a username or password for an employer-issued electronic device. Employers are not prevented from requesting that an employee share specifically identified content (but not usernames, passwords, or other access methods) for the purposes of complying with the employer’s legal and regulatory obligations, investigating the unauthorized transfer or disclosure of the employer’s proprietary or confidential information or financial data to a personal account, or investigating unlawful harassment, threats of violence in the workplace, or discriminatory or disparaging content about another employee. Law enforcement agencies are not prohibited from requiring that an applicant or employee provide access to their social media as part of a screening or fitness determination or an investigation of misconduct, a violation of policy, or a violation of law.

Employees cannot waive their rights under this law. Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to social media accounts provided by an employer or intended to be used on behalf of the employer.

The Vermont Attorney General enforces this law. Individuals may also pursue private civil actions. Penalties and remedies for violations include injunctive relief, civil penalties up to $10,000, restitution of wages or other benefits, job reinstatement, attorneys’ fees and costs, and other appropriate relief.

Virginia

Virginia law protects employees and applicants from being required to share private social media information and activity with employers.

The Virginia workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Virginia law prohibits employers from:

Requiring an employee or applicant to share their social media usernames or passwords
Requiring an employee or applicant to add an employee, supervisor, or administrator to the list of contacts associated with their account
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. The law does not prevent employers from complying with existing laws or regulations, including their existing rights or obligations to request that an employee share their usernames and passwords if their social media activity is reasonably believed to be relevant to an investigation concerning an employee’s violation of the law, regulations, or the employer’s written policies.

Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to social media accounts opened at the request of an employer, provided by an employer, set up on behalf of an employer, or set up by an employee to impersonate an employer.

Washington

Washington law protects employees and applicants from being required to share their social media and methods of access with employers.

The Washington workplace privacy law involving social media generally protects employees and applicants from being required to share their personal social media or methods of accessing their personal social media with an employer. Washington law prohibits employers from:

Requiring, requesting, or coercing an employee or applicant to share their social media usernames, passwords, or other methods of access
Requiring, requesting, or coercing an employee or applicant to access their social media in the employer’s presence
Compelling or coercing an employee or applicant to add anyone, including the employer, to the list of contacts associated with their social media account
Requesting, requiring, or causing an employee or applicant to change their social media privacy settings
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

Employers are not prohibited from requiring an employee to share social media content (but not login information) to investigate and make a factual determination as to compliance with applicable laws, regulations, or prohibitions against work-related misconduct, or the unauthorized transfer of the employer’s proprietary information, confidential information, or financial data to a personal account based on specific information. Employers are not prohibited from requiring an employee to share login information for an account or service provided by virtue of the employment relationship or an electronic communications device or account paid for or supplied by the employer.

Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to accounts intended for work-related communications. The law also does not apply to certain peace and corrections officer background investigations so long as officers are not required to provide login information.

This law is enforced through private civil actions. Penalties and remedies for violations include injunctive relief, actual damages, a $500 penalty, attorneys’ fees and costs for the prevailing party, and other equitable relief.

Washington, D.C.

There is no Washington, D.C. workplace privacy law involving social media.

West Virginia

West Virginia law protects employees and applicants from being required to share private social media information and activity with employers.

The West Virginia workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. West Virginia law prohibits employers from:

Requesting, requiring, or coercing an employee or applicant to share their social media usernames, passwords, or other methods of access
Requesting, requiring, or coercing an employee or applicant to access their social media in the employer’s presence
Compelling an employee or applicant to add the employer or an employment agency to the list of contacts associated with their social media account
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts
Neglecting to delete inadvertently acquired login information after becoming aware of it

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prevented from requiring employees or applicants to share usernames, passwords, or other methods of access for an employer-issued electronic device or an account or service provided by the employer, obtained by virtue of the employment relationship, or used for the employer’s business purposes.

The law does not prohibit employers from conducting an investigation or requiring an employee to cooperate with an investigation. Employers may require employees to share reported content to make a factual determination regarding the unauthorized transfer of the employer’s proprietary information, confidential information, or financial data to a personal account based on specific information. Employers may request that employees share specific personal social media content to ensure compliance with applicable laws, regulations, or prohibitions against work-related misconduct. Employers are not prevented from prohibiting employees from using personal accounts during work hours, while on employer time, or for business purposes.

Wisconsin

Wisconsin law protects employees and applicants from being required to share private social media information and activity with employers.

The Wisconsin workplace privacy law involving social media generally protects employees and applicants from being required to share more of their social media information and activity than is publicly available. Wisconsin law prohibits employers from:

Requesting or requiring an employee or applicant to share their social media usernames, passwords, or other methods of access
Requesting or requiring an employee or applicant to grant access to or allow observation of their social media account
Using inadvertently acquired usernames, passwords, or other login information to access an employee’s social media accounts

However, the law does not prohibit employers from viewing information about an employee or applicant that is publicly available. Employers are not prohibited from requesting or requiring an employee to share access information for an electronic communications device supplied or paid for by the employer or an account or service provided by the employer, obtained by virtue of the employment relationship, or used for the employer’s business purposes. Employers are not prevented from requiring employees to share their personal email addresses.

Employers are not prevented from investigating or requiring an employee to cooperate in investigating the unauthorized transfer of the employer’s proprietary or confidential information or financial data to a personal account with reasonable cause, or investigating other alleged employee misconduct, violations of the law, or violations of the employer’s work rules with reasonable cause. Employers may require an employee to grant access to or allow observation of their social media account during an investigation, but an employer may not require an employee to share access information. Employers are not prohibited from restricting access to certain websites while using a device supplied or paid for by the employer or while using the employer’s network or other resources. Employers are not prohibited from complying with a duty to screen applicants or to monitor or retain employee communications as required by law.

Employees and applicants are protected from retaliation for exercising their rights under this law. The law does not apply to personal accounts or devices of employees engaged in providing financial services who use the account or device to conduct the business of an employer subject to the content, supervision, and retention requirements imposed by federal securities laws and regulations or the rules of certain self-regulatory organizations.

The Wisconsin Department of Workforce Development enforces this law. Penalties and remedies for violations include fines up to $1,000, back pay, job reinstatement, and other appropriate relief.

Wyoming

There is no Wyoming workplace privacy law involving social media.

Last reviewed September 2022

Employment Law Center Contents

Related Areas