Can a Louisiana employer ask for your social media password? The Personal Online Account Privacy Protection Act explained

Louisiana bars employers from asking for the passwords to the personal online accounts of employees and job applicants. The rules are in the Personal Online Account Privacy Protection Act, La. R.S. 51:1951 to 51:1955, enacted by Act 165 of 2014 (La. R.S. 51:1951). The same Act also covers schools and colleges; this page covers the employer rules.

The short answer: a Louisiana employer may not request or require that an employee or applicant disclose a username, password or other authentication information for a personal online account, and may not discharge, discipline, refuse to hire or otherwise penalize someone for not disclosing it. It can still require logins for devices and accounts it supplies, investigate specific reports and view public information.

Who is covered

• Employer: a person, including a unit of state or local government, engaged in a business, industry, profession, trade or other enterprise in Louisiana, including an agent, representative or designee of the employer (La. R.S. 51:1952(3)).
• Employees and applicants: both are protected (51:1953(A)).
• Personal online account: an online account used exclusively for personal communications unrelated to any business purpose of the employer. It does not extend to any account or profile created, serviced, maintained, used or accessed for the employer's business purposes or for business-related communications (51:1952(4)).

The Act is not limited to social media: it covers any personal online account that fits this definition.

What employers may not do

• Ask for the login: request or require an employee or applicant to disclose any username, password or other authentication information that allows access to their personal online account (51:1953(A)(1)).
• Retaliate: discharge, discipline, fail to hire, or otherwise penalize or threaten to penalize an employee or applicant for not disclosing it (51:1953(A)(2)).
• Use logins picked up by accident: an employer that inadvertently receives an employee's or applicant's login through network monitoring or an employer-provided device is not liable for having it but may not use it to access the personal account (51:1953(C)).

The Act does not separately mention adding the employer as a contact, logging in in front of the employer or changing privacy settings.

What employers may still do

• Work devices and accounts: request or require login information to access or operate a device paid for or supplied in whole or in part by the employer, or an account or service provided by the employer, obtained through the employment relationship or used for its business purposes (51:1953(B)(1)).
• Data taken without permission: discipline or dismiss an employee for moving the employer's proprietary or confidential information or financial data to a personal account without authorization (51:1953(B)(2)).
• Investigations: investigate, and require cooperation, where there is specific information about activity on the employee's personal account (to ensure compliance with laws, regulatory requirements or bans on work-related misconduct) or about an unauthorized transfer of the employer's data. This includes requiring the employee or applicant to share the reported content to make a factual determination, without obtaining the username and password (51:1953(B)(3), (4)).
• Work networks: restrict access to certain websites on employer devices, networks or resources, in line with state and federal law (51:1953(B)(5)).
• Legal duties: comply with a duty to screen employees or applicants before hiring, or to monitor or retain employee communications, set by state or federal law, rules, regulations, case law or the rules of self-regulatory organizations (51:1953(D)).
• Public information: view, access or use information that can be obtained without the login or that is in the public domain (51:1953(E)).
• Backup email address: require an employee to provide a personal email address so the employer can reach them if its own email system fails (51:1953(F)).

The Act also states that employees and applicants may choose to self-disclose their own login information to the employer (51:1953(G)), that it creates no duty for an employer to search or monitor personal accounts, and that an employer is not liable for failing to ask for access (51:1955).

Enforcement

The sections of the Act do not themselves name a penalty, a fine or a right to sue. Other parts of Louisiana law may apply to a breach, which this page does not cover. A worker who thinks the Act was broken should get advice on the available routes.

What this means in practice

• Employers: a request alone is covered, so do not ask candidates or staff for personal account logins. Keep login requirements to devices and accounts you supply, and in investigations ask for the specific reported content, never the password.
• Workers and applicants: you can refuse, and the Act bars penalizing you or refusing to hire you for it. You can still be asked for a personal email address as a backup contact, and public posts can still be seen.

Compare the Arkansas social media password law and the other states in social media password laws in the US. Michigan's rule is in the Michigan social media password law.

This page covers Louisiana and is general information based on the Louisiana Revised Statutes published by the Louisiana State Legislature when checked on 3 November 2026, not legal advice. The legislature notes that its online text is not official, so check for later amendments before relying on it.