Can a Connecticut employer ask for your social media password? Conn. Gen. Stat. 31-40x explained

Connecticut protects the personal online accounts of employees and job applicants in section 31-40x of the General Statutes, added by Public Act 15-6 and amended by Public Act 16-169 (Conn. Gen. Stat. 31-40x).

The short answer: a Connecticut employer may not request or require a worker or applicant to hand over a password or other login for a personal online account, may not request or require them to log in to it in front of the employer, and may not require them to invite it into, or accept its invitation to, a group linked to the account. It may not punish a worker or refuse to hire an applicant for refusing. Workers and applicants can complain to the Labor Commissioner, who can order reinstatement and back pay and levy civil penalties. Work accounts, employer devices and investigations based on specific information are exempt.

This page is based on the section as published by the Connecticut General Assembly. Its chapter page says readers should check the 2026 Supplement for changes made in the 2025 sessions.

Who is covered

• Employer: any person engaged in business who has employees, including the state and its political subdivisions. A state or municipal law enforcement agency doing a pre-employment investigation of law enforcement personnel is not an employer for this section (31-40x(a)(3)).
• Employees and applicants: anyone in service to an employer, and anyone actively seeking employment from one (31-40x(a)(1), (2)).
• Personal online account: any online account used exclusively for personal purposes and unrelated to any business purpose of the employer or prospective employer, including e-mail, social media and retail websites. Accounts created, maintained, used or accessed for the employer's business are not covered (31-40x(a)(5)).

What employers may not do

• Ask for the login: request or require a user name and password, password or any other authentication means for a personal online account (31-40x(b)(1)).
• Login in front of the employer: request or require that the worker or applicant authenticate or access a personal online account in the employer's presence (31-40x(b)(2)).
• Groups: require the worker or applicant to invite the employer, or accept the employer's invitation, to join a group affiliated with a personal online account (31-40x(b)(3)). This uses only the word "require", so our reading, not a court ruling, is that a request the worker is free to decline is not covered, although punishing a refusal still is.
• Punish a refusal: discharge, discipline, discriminate against, retaliate against or otherwise penalize an employee who refuses any of the above or who files a complaint about a violation with a public or private body or court (31-40x(b)(4)), or fail or refuse to hire an applicant for refusing (31-40x(b)(5)).

The section does not mention changing privacy settings.

What employers may still do

• Work accounts and devices: request or require the login for any account or service it provides, that comes with the job or that is used for its business, and for any electronic communications device it supplied or paid for in whole or in part (31-40x(c)(1)).
• Data taken without permission: discharge, discipline or otherwise penalize an employee or applicant who moved its proprietary or confidential information or financial data to or from a personal online account without permission (31-40x(c)(2)).
• Investigations: investigate, based on specific information about activity on the account, to ensure compliance with laws, regulatory requirements or bans on work-related misconduct, or based on specific information about an unauthorized transfer of its data. In such an investigation it may require the worker or applicant to let it access the personal online account, but it may not require them to disclose the login (31-40x(d)(1)).
• Work networks: monitor, review, access or block data on a device it paid for in whole or in part, or travelling through or stored on its network, in line with state and federal law (31-40x(d)(2)).
• Legal duties: comply with state or federal statutes, rules or regulations, case law or rules of self-regulatory organizations (31-40x(e)).

The section has no express clause on public information.

Enforcement

• Complaint: an employee or applicant may file a complaint with the Labor Commissioner, who must investigate and may hold a hearing. A worker or applicant who wins at the hearing is awarded reasonable attorney's fees and costs (31-40x(f)).
• Employees: the commissioner may levy a civil penalty of up to $500 for a first violation and $1,000 for each later one, and award reinstatement, back wages, restored benefits or other appropriate relief (31-40x(g)).
• Applicants: the commissioner may levy a civil penalty of up to $25 for a first violation and $500 for each later one (31-40x(h)).
• Appeal and collection: either side may appeal to the Superior Court, and the commissioner may ask the Attorney General to sue to recover penalties (31-40x(i), (j)).

What this means in practice

• Employers: do not ask for personal logins or for staff and candidates to log in while you watch. In an investigation based on specific information you may require access to the account, but never the password.
• Workers and applicants: you can refuse, and the employer may not punish you or refuse to hire you for it. A complaint goes to the Labor Commissioner.

Compare the New Jersey social media password law and the other states in social media password laws in the US. Maine goes further on privacy settings, which it bars an employer from requiring or requesting a worker to change, see the Maine social media password law.

This page covers Connecticut and is general information based on section 31-40x as published by the Connecticut General Assembly when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.