Can a Montana employer ask for your social media password? MCA 39-2-307 explained

Montana limits employer access to the personal social media of employees and job applicants in section 39-2-307 of the Montana Code Annotated, enacted in 2015 (Chapter 263, Laws of 2015) and amended in 2023 (Chapter 361, Laws of 2023) (MCA 39-2-307).

The short answer: a Montana employer or its agent may not require or request an employee or applicant to disclose a social media login, open personal social media in front of the employer, or divulge personal social media or its contents, and may not retaliate against someone for refusing. But in an investigation based on specific information, the law says an employee must provide the login if asked. Montana also protects legal free speech on personal social media, within limits, and lets workers sue in small claims court.

Who is covered

• Employers and their agents: the section applies to an employer or employer's agent (39-2-307(1)).
• Employees and applicants: both are protected (39-2-307(1)).
• Personal social media: a password-protected electronic service or account containing electronic content, including e-mail, videos, photographs, blogs, video blogs, podcasts, instant and text messages, website profiles or locations, and online services or accounts to which an employee may post information, data or pictures. It does not include an account opened for or provided by an employer and intended solely for business purposes, or one provided by a school solely for education (39-2-307(6)).

The definition reaches e-mail and other password-protected accounts, not only social networks.

What employers may not do

Except in the investigations described below, an employer or its agent may not require or request an employee or applicant to (39-2-307(1)):

• disclose a username or password so the employer can access their personal social media account;
• access personal social media in the presence of the employer or its agent;
• divulge any personal social media or information on it.

Retaliation: an employer may not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand that breaks the section, or for legal expressions of free speech, as protected in MCA 39-2-904, made on personal social media (39-2-307(4)). The free speech protection does not apply if the expression violates the employer's written policy or the terms of the employee's employment contract (39-2-307(5)).

The section does not mention adding the employer as a contact or changing privacy settings.

When a Montana worker must hand over a login

An employee must provide a username or password to personal social media if the employer asks and both of these apply (39-2-307(2)):

• the employer has specific information about activity indicating work-related misconduct or criminal defamation, or about the employee's unauthorized transfer of the employer's proprietary or confidential information, trade secrets or financial data to a personal online account, or the employer must ensure compliance with federal law, federal regulatory requirements or securities self-regulatory rules; and
• an investigation is under way and the information requested is necessary to make a factual determination in it.

The section also says nothing in it prevents an employee from seeking an injunction in response to these investigation requests (39-2-307(3)(b)). This is a sharper rule than in most states, where an investigation lets the employer ask for specific content but not the password.

What employers may still do

• Employer equipment: keep lawful workplace policies on the use of its electronic equipment, including requiring the username, password or other information needed to access employer-issued devices such as phones, computers and tablets, or employer-provided software or e-mail accounts (39-2-307(3)(a)).
• Work accounts: accounts opened for or provided by the employer and intended solely for business purposes are outside the definition (39-2-307(6)(b)).

Enforcement

• Small claims action: an employee or applicant may bring an action against the employer in small claims court within 1 year. They may also have a cause of action under MCA 45-8-213, the privacy in communications offense (39-2-307(7)(a)).
• Damages: limited to $500 or actual damages up to the small claims limit in MCA 3-10-1004, and legal costs may be awarded to whichever party wins (39-2-307(7)(b)). That limit is currently $7,000, exclusive of costs (MCA 3-10-1004(1)).
• Data breaches: an employer that gains information improperly under the section and later has a computer security breach is subject to penalties under MCA 30-14-142 (39-2-307(8)).

Note that legal costs can go either way: a worker who brings a claim and loses may be ordered to pay the employer's costs.

What this means in practice

• Employers: do not ask for logins, ask staff or candidates to open their accounts in front of you, or ask them to hand over content. Ask for a login only when you have specific information, an investigation is under way and the login is needed to establish the facts, and keep a record of why.
• Workers and applicants: outside those investigations you can refuse, and you are protected for lawful speech on your own accounts unless it breaks a written policy or your contract. Claims go to small claims court within a year.

Compare the Delaware social media password law and the other states in social media password laws in the US. New Mexico has its own law, which protects job applicants.

This page covers Montana and is general information based on the Montana Code Annotated 2025 published by the Montana Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.