Colorado bars employers from asking for access to the personal online accounts of employees and job applicants. The rule is section 8-2-127 of the Colorado Revised Statutes, added in 2013 by House Bill 13-1046 (C.R.S. 8-2-127, Colorado Revised Statutes 2024, Title 8). This page explains what the text says, based on the 2024 edition of the statutes published by the legislature's Office of Legislative Legal Services.
The short answer: an employer may not suggest, request or require that an employee or applicant disclose a username, password or other means of accessing a personal account or service through their personal device, may not make them add anyone as a social media contact, and may not ask them to change privacy settings. It may not punish an employee or refuse to hire an applicant who refuses (8-2-127(2)-(3)). Complaints go to the Colorado Department of Labor and Employment, which may set fines of up to $1,000 for a first offense and up to $5,000 for each later one (8-2-127(5)).
Who is covered
- Employer: a person engaged in a business, industry, profession, trade or other enterprise in Colorado, or a unit of state or local government, including agents, representatives and designees. The department of corrections, county corrections departments and state or local law enforcement agencies are excluded (8-2-127(1)(c)).
- Employees and applicants: both are protected (8-2-127(1)(a), (2)(a)).
What employers may not do
- Ask for logins, even by suggestion: suggest, request or require that an employee or applicant disclose, or cause them to disclose, a username, password or other means of accessing their personal account or service through their personal electronic communications device (8-2-127(2)(a)). The word "suggest" makes this wording wider than Maryland's, which covers requests and requirements.
- Force contacts: compel an employee or applicant to add anyone, including the employer, to their social media contacts (8-2-127(2)(a)).
- Change privacy settings: require, request, suggest or cause a change to the privacy settings of a social networking account (8-2-127(2)(a)).
- Retaliate: discharge, discipline or penalize an employee, or threaten to, or fail or refuse to hire an applicant, for refusing any of these (8-2-127(3)).
What employers may still do
- Work systems: require logins for nonpersonal accounts or services that give access to the employer's internal computer or information systems (8-2-127(2)(b)).
- Investigations: investigate compliance with securities or financial law or regulatory requirements after receiving information about an employee's business use of a personal account, and investigate an employee's electronic communications after receiving information about unauthorized downloading of proprietary information or financial data to a personal account (8-2-127(4)). The text does not say the employer may demand a password for these.
- Existing policies: enforce personnel policies that do not conflict with the section (8-2-127(6)).
The section also states that it does not permit an employee to disclose information that is confidential under federal or state law or under a contract with the employer (8-2-127(7)).
Enforcement
A person injured by a violation may file a complaint with the Department of Labor and Employment, which must investigate and issue findings thirty days after a hearing. The department may adopt rules on penalties that include a fine of up to $1,000 for a first offense and up to $5,000 for each later offense (8-2-127(5)). The section does not mention a private lawsuit, unlike Washington and Illinois.
What this means in practice
- Employers: because even a suggestion is covered, train recruiters and managers not to hint that sharing a profile, connecting or going public would help. Keep login requests to company systems.
- Workers and applicants: you can refuse, and a complaint goes to the Colorado Department of Labor and Employment.
Compare the Washington social media password law, the Illinois law and the Maryland law. Colorado's biometric rules for employers are covered in Colorado biometric data at work. For all four states side by side, see social media password laws compared.
This page covers Colorado and is general information based on the Colorado Revised Statutes 2024 printout published by the Colorado General Assembly when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.
Questions and answers
Can a Colorado employer ask for my social media password?
No. C.R.S. 8-2-127 bars an employer from suggesting, requesting or requiring that an employee or applicant disclose login details for a personal account through their personal device.
Can a Colorado employer ask me to connect with them on social media?
The employer may not compel you to add anyone, including the employer, to your social media contacts, or punish you for refusing.
Can a Colorado employer ask me to make my profile public?
No. It may not require, request, suggest or cause a change to the privacy settings of a social networking account.
What happens if a Colorado employer breaks the law?
You can file a complaint with the Colorado Department of Labor and Employment. Its penalty rules may include fines of up to $1,000 for a first offense and up to $5,000 for each later one.