Maryland bars employers from asking workers and job applicants for the user names and passwords to their personal accounts. The rule is section 3-712 of the Labor and Employment Article of the Maryland Code (Md. Code, Lab. & Empl. 3-712). It is short, and this page explains what it says.
The short answer: an employer may not request or require that an employee or applicant disclose any user name, password or other means of accessing a personal account or service through an electronic communications device, and may not punish an employee or refuse to hire an applicant who refuses. An employer may require access details for nonpersonal accounts that give access to its own internal systems (3-712(b)-(c)).
Who and what is covered
- Employer: a person engaged in a business, industry, profession, trade or other enterprise in Maryland, or a unit of state or local government, including its agents, representatives and designees (3-712(a)(4)).
- Applicant and employee: the protection covers both people already employed and applicants for employment (3-712(a)(2), (b)).
- Electronic communications device: any device that uses electronic signals to create, transmit and receive information, including computers, telephones and personal digital assistants (3-712(a)(3)).
The rules
- No requests for personal logins: the employer may not request or require a user name, password or other means of accessing a personal account or service (3-712(b)(1)).
- Work systems are different: the employer may require disclosure of access details for nonpersonal accounts or services that give access to its internal computer or information systems (3-712(b)(2)).
- No retaliation: the employer may not discharge, discipline or otherwise penalize, or threaten to, an employee who refuses, and may not fail or refuse to hire an applicant who refuses (3-712(c)).
- A duty on employees too: an employee may not download unauthorized employer proprietary information or financial data to a personal website, web-based account or similar account (3-712(d)).
- Investigations: the section does not stop an employer, after receiving information, from investigating an employee's business use of a personal account to ensure compliance with securities or financial law or regulatory requirements, or investigating unauthorized downloading of proprietary information or financial data (3-712(e)). The text does not say the employer may demand a password for those investigations.
Enforcement
When the Commissioner determines that the section has been violated, the Commissioner must either try to resolve the issue informally by mediation or ask the Attorney General to bring an action on behalf of the applicant or employee. The Attorney General may sue in the county where the violation allegedly occurred for injunctive relief, damages or other relief (3-712(f)). The section does not set a fixed penalty amount and does not mention a lawsuit by the worker, unlike Illinois, where workers can sue directly.
What this means in practice
- Employers: keep login requests to company systems and accounts. Remove any request for personal social media or email credentials from hiring forms and interviews, and write down how investigations into leaks or regulated business use will be handled without asking for passwords.
- Workers and applicants: you can refuse to give a password to a personal account. Do not move company confidential or financial data into personal accounts, since the section prohibits that too.
Compare the Illinois social media password law, which also bars logging in in front of the employer and lets workers sue. Maryland also requires consent before facial recognition is used in job interviews: see facial recognition in job interviews in Maryland. For all four states side by side, see social media password laws compared. Virginia's narrower rule is in the Virginia social media password law.
This page covers Maryland and is general information based on the statute text published by the Maryland General Assembly when checked on 3 November 2026, not legal advice.
Questions and answers
Can a Maryland employer ask for my social media password?
No. Section 3-712 bars employers from requesting or requiring a user name, password or other means of accessing a personal account or service.
Can a Maryland employer ask for passwords to work accounts?
Yes. An employer may require disclosure of access details for nonpersonal accounts or services that provide access to its internal computer or information systems.
Can I be fired for refusing to share my personal password in Maryland?
No. The employer may not discharge, discipline or penalize an employee, or refuse to hire an applicant, for refusing.
Who enforces the Maryland password law?
The Commissioner, who must try mediation or ask the Attorney General to bring an action for injunctive relief, damages or other relief on behalf of the worker.