Can an Illinois employer ask for your social media password? The Right to Privacy in the Workplace Act explained

Illinois bars employers from demanding access to workers' and applicants' personal social media and other online accounts. The rule sits in section 10 of the Right to Privacy in the Workplace Act, 820 ILCS 55, and the Act's enforcement sections were amended by Public Act 104-455, effective 12 December 2025 (820 ILCS 55). This page explains what employers may and may not do, and what a worker can do about a violation.

The short answer: an employer or prospective employer may not request, require or coerce a password or other access to a personal online account, make someone log in in front of them, or make them add the employer to a group or contact list. It may not punish an employee or refuse to hire an applicant who says no (55/10(b)(1)). Employers can still set policies for their own equipment, monitor their own devices and email, and look at public information (55/10(b)(2)-(3)). A worker can sue for a civil penalty of $100 to $1,000 per violation, or $10,000 plus back pay and reinstatement where a job was lost (55/17).

What employers may not do

• Request, require or coerce a user name and password, or other account information, to gain access to an employee's or applicant's personal online account, or demand access to it in any manner.
• Request, require or coerce an employee or applicant to log in to a personal account in the employer's presence.
• Require or coerce them to invite the employer into a group linked to a personal account.
• Require or coerce them to join an online account the employer set up, or to add the employer or an employment agency to the contacts that can see their personal account.
• Discharge, discipline, discriminate, retaliate or otherwise penalize an employee for refusing any of these or for filing a complaint, or fail or refuse to hire an applicant who refuses (55/10(b)(1)(A)-(F)).

A personal online account is one used primarily for personal purposes. An account created, maintained, used or accessed for a business purpose of the employer is not one (55/10(b)(6)(B)).

What employers may still do

• Own equipment: keep lawful policies on the use of the employer's electronic equipment, including internet, social networking and email use, and monitor that equipment and the employer's email, as long as they do not ask for personal account credentials (55/10(b)(2)).
• Public information: obtain information about an employee or applicant that is in the public domain (55/10(b)(3)(A)).
• Reported content: ask an employee or applicant to share specific content that has been reported to the employer, without asking for a password, to ensure legal compliance, investigate specific allegations of leaked confidential data or misconduct, or stop the use of personal accounts for business or during work time, on work devices or on the employer's network (55/10(b)(3)(C)).
• Passwords picked up by accident: an employer whose lawful network security monitoring captures a personal account password is not liable for having it, unless it uses it to access the account or fails to delete it as soon as reasonably practicable, outside an ongoing security breach investigation (55/10(b)(4)).
• Regulated industries: meet screening or communications retention duties under Illinois insurance law, federal law or securities self-regulatory rules, but only for accounts the employer supplies or pays for, or that the employee runs for the employer (55/10(b)(5)).

Enforcement

• Private lawsuit: a person aggrieved by a violation may sue in circuit court without first using the administrative route, alone or on behalf of similarly situated workers. Relief is a civil penalty of $100 to $1,000 per violation, or, where the violation relates to the denial or loss of a job, reinstatement, back pay with interest and a $10,000 civil penalty, plus damages, costs, expert fees and reasonable attorney's fees. The limit is 3 years (55/17).
• Department of Labor and Attorney General: a worker can instead complain to the Illinois Department of Labor, which can investigate and go to court, and the Attorney General can bring a civil action (55/15). Penalties are $100 to $1,000 per violation, and $1,000 to $5,000 for repeat violations within 3 years (55/18(a)).
• Interested parties: a nonprofit or labor organization that monitors worker privacy compliance can bring an action in the name of the State, with the Attorney General able to take it over (55/16).
• One route only: a worker can recover under the private action, the Department route or an interested party action, but not more than one (55/17(a)).

The rest of the Act

The same Act also bars employers from refusing to hire or penalizing someone for using lawful products off premises outside working and on-call hours, with exceptions (55/5), bars asking applicants about past workers' compensation claims (55/10(a)), and sets notice rules when an employer is told an employee's identity documents do not match (55/14).

What this means in practice

• Employers: remove any request for social media logins or "friend us" steps from hiring and onboarding, keep monitoring to company accounts and devices, and when content is reported, ask for that content only.
• Workers and applicants: you can refuse to hand over a password or log in in front of a manager. Keep a record of any request, and note the 3-year limit for a lawsuit.

For the Maryland rule, which has no direct worker lawsuit, see the Maryland social media password law, and for Washington, which also bars requests to change privacy settings, see the Washington social media password law. For Illinois biometric rules, see Illinois BIPA at work, and for monitoring notice laws in other states, US employee monitoring laws. For all four states side by side, see social media password laws compared.

This page covers Illinois and is general information based on the statute text published by the Illinois General Assembly when checked on 3 November 2026, not legal advice.