Can a Michigan employer ask for your social media password? The Internet Privacy Protection Act explained

Michigan bars employers from asking for access to the personal online accounts of employees and job applicants. The rules are in the Internet Privacy Protection Act, Public Act 478 of 2012, MCL 37.271 to 37.278, in effect since 28 December 2012 (Internet Privacy Protection Act, Act 478 of 2012). The same Act also covers schools and colleges; this page covers the employer rules.

The short answer: a Michigan employer may not request that an employee or applicant grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account, and may not discharge, discipline, refuse to hire or otherwise penalize someone for refusing. It can still require logins for devices and accounts it pays for or provides, investigate specific reports and view public information. A breach is a misdemeanor, and the worker can sue for up to $1,000 plus attorney fees.

Who is covered

• Employer: a person, including a unit of state or local government, engaged in a business, industry, profession, trade or other enterprise in Michigan, including an agent, representative or designee of the employer (MCL 37.272(c)).
• Employees and applicants: both are protected (MCL 37.273).
• Personal internet account: an account created through a bounded system set up by an internet-based service that requires the user to enter or store access information on an electronic device to view, create, use or edit the account's information, profile, display, communications or stored data (MCL 37.272(d)). Access information means a username, password, login information or other security information that protects access to such an account (MCL 37.272(a)).

The Act is not limited to social media: its definition reaches any password-protected online account. Unlike some other states, the definition itself does not exclude accounts used for the employer's business; the employer's own accounts are dealt with in the exceptions below.

What employers may not do

• Ask for access or to watch: request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of their personal internet account (MCL 37.273(a)).
• Retaliate: discharge, discipline, fail to hire or otherwise penalize an employee or applicant for not granting access, allowing observation or disclosing that information (MCL 37.273(b)).

Because the ban covers requests to "allow observation of" an account, our reading, not a court ruling, is that asking a worker to log in and show their account is covered as well as asking for the password. The Act does not separately mention adding the employer as a contact or changing privacy settings.

What employers may still do

• Work devices and accounts: request or require an employee to disclose access information to access or operate a device paid for in whole or in part by the employer, or an account or service provided by the employer, obtained through the employment relationship or used for its business purposes (MCL 37.275(1)(a)).
• Data taken without permission: discipline or dismiss an employee for moving the employer's proprietary or confidential information or financial data to a personal account without authorization (MCL 37.275(1)(b)).
• Investigations: investigate, and require an employee to cooperate, where there is specific information about activity on the employee's personal account (to ensure compliance with laws, regulatory requirements or bans on work-related misconduct) or about an unauthorized transfer of the employer's data to a personal account (MCL 37.275(1)(c)).
• Work networks: restrict access to certain websites on employer-paid devices or the employer's network, and monitor, review or access data stored on employer-paid devices or traveling through or stored on its network, in line with state and federal law (MCL 37.275(1)(d), (e)).
• Legal duties: comply with a duty to screen employees or applicants before hiring, or to monitor or retain employee communications, set by federal law or a securities self-regulatory organization (MCL 37.275(2)).
• Public information: view, access or use information that can be obtained without access information or that is in the public domain (MCL 37.275(3)).

The Act also states that it creates no duty for an employer to search or monitor personal accounts, and that an employer is not liable for failing to ask for access (MCL 37.277).

Enforcement

• Misdemeanor: a person who violates the employer rules is guilty of a misdemeanor punishable by a fine of not more than $1,000 (MCL 37.278(1)).
• Worker lawsuit: the individual can bring a civil action to stop the violation and recover not more than $1,000 in damages plus reasonable attorney fees and court costs. At least 60 days before suing for damages, the individual must make a written demand of the alleged violator for not more than $1,000, with reasonable documentation, served as civil process or sent by certified mail. The case can be brought in the district court for the county where the violation happened or where the defendant lives or has its principal place of business (MCL 37.278(2)).
• Defense: it is an affirmative defense that the employer acted to comply with a federal law or a Michigan law (MCL 37.278(3)).

What this means in practice

• Employers: a request alone is covered, and so is asking to see an account, so do not ask staff or candidates to log in and show you their profiles or messages. Keep login requirements to devices and accounts you pay for or provide.
• Workers and applicants: you can refuse. To claim damages, send a written demand with documentation at least 60 days before going to court. Public posts can still be seen.

Compare the Louisiana social media password law and the other states in social media password laws in the US. Oklahoma has its own social media password law, which bans requiring a login.

This page covers Michigan and is general information based on the Michigan Compiled Laws published by the Michigan Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.