Can an Arkansas employer ask for your social media password? Ark. Code 11-2-124 explained

Arkansas bars employers from seeking access to the personal social media accounts of employees and job applicants. The rule is section 11-2-124 of the Arkansas Code, added by Act 1480 of 2013 (House Bill 1901), approved on 22 April 2013 (Act 1480 of 2013, Arkansas General Assembly).

The short answer: an Arkansas employer may not require, request, suggest or cause a current or prospective employee to disclose their social media username and password, add an employee, supervisor or administrator to their contacts, or change their privacy settings. It may not punish an employee or refuse to hire an applicant for exercising these rights. It can still view public information and, in a formal investigation, ask for a login in limited cases.

Who is covered

• Employer: a person or entity engaged in a business, industry, profession, trade or other enterprise in the state, or a unit of state or local government, including an agent, representative or designee of the employer (11-2-124(a)(2)).
• Employee: an individual who provides services or labor for wages or other remuneration for an employer. The rules protect both current and prospective employees (11-2-124(a)(1), (b)(1)).
• Social media account: a personal account with an electronic medium or service where users create, share or view user-generated content, such as videos, photos, blogs, podcasts, messages, emails or website profiles. The text names Facebook, Twitter, LinkedIn, MySpace and Instagram as examples (11-2-124(a)(3)(A), (C)).

Accounts that are not covered: those opened by an employee at the employer's request, provided by the employer (such as a company email account), set up by an employee on the employer's behalf, or set up to impersonate the employer with its name, logos or trademarks (11-2-124(a)(3)(B)).

What employers may not do

• Seek the login, even by suggestion: require, request, suggest or cause a current or prospective employee to disclose the username and password to their social media account (11-2-124(b)(1)(A)).
• Force contacts: require, request, suggest or cause them to add an employee, supervisor or administrator to their social media contacts (11-2-124(b)(1)(B)).
• Change privacy settings: require, request, suggest or cause them to change the privacy settings of their social media account (11-2-124(b)(1)(C)).
• Use logins picked up by accident: an employer that inadvertently receives an employee's login through a device it provided or a program that monitors its network is not liable for having it but may not use it to access the employee's account (11-2-124(b)(2)).
• Retaliate: take action against, or threaten to discharge, discipline or otherwise penalize, a current employee, or fail or refuse to hire a prospective employee, for exercising these rights (11-2-124(c)).

What employers may still do

• Public information: view information about a current or prospective employee that is publicly available on the Internet (11-2-124(d)).
• Other laws: comply with federal, state or local laws, rules or regulations or the rules of self-regulatory organizations (11-2-124(e)(1)).
• Formal investigations: the section does not affect an employer's existing rights or obligations to ask an employee for a username and password where the account activity is reasonably believed to be relevant to a formal investigation or related proceeding into the employee's violation of the law or of the employer's written policies. A login obtained this way may only be used for that investigation or proceeding (11-2-124(e)(2)).

Enforcement

The section does not itself name a penalty, a fine or a right to sue. Other parts of Arkansas law may apply to a breach, which this page does not cover. A worker who thinks the section was broken should get advice on the available routes.

What this means in practice

• Employers: because even a suggestion is covered, train recruiters and managers not to hint that sharing a login, connecting with a supervisor or opening up privacy settings would help. Keep work accounts employer-owned, and keep any login obtained in a formal investigation to that investigation.
• Workers and applicants: you can say no, and the law bars punishing you or refusing to hire you for it. Public posts can still be seen.

Compare the New Hampshire social media password law and the other states in social media password laws in the US. Louisiana's rule is in the Louisiana social media password law.

This page covers Arkansas and is general information based on the text of Act 1480 of 2013 as enacted, published by the Arkansas General Assembly, checked on 3 November 2026. It is not legal advice. We read the act, not a current consolidated code, so check for later amendments before relying on it.