Can a Nebraska employer ask for your social media password? The Workplace Privacy Act explained

Nebraska protects the personal internet accounts of employees and job applicants in the Workplace Privacy Act, sections 48-3501 to 48-3511 of the Nebraska Revised Statutes, enacted by LB821 in 2016 (Neb. Rev. Stat. 48-3501).

The short answer: a Nebraska employer may not require or request a worker or applicant to give a username, password or other account information for a personal internet account, or to log in in front of it so it can see or get into the account. It may not require them to add anyone as a contact, or require or coerce them to change privacy settings. It may not take adverse action, refuse to hire or otherwise penalize them for refusing, and waivers are void. A worker or applicant can sue in district court within one year. Work devices and accounts, specific-information investigations and public information are exempt.

This page is based on the statutes as published by the Nebraska Legislature. Check for later amendments before relying on it.

Who is covered

• Employer: a public or nonpublic entity or an individual engaged in a business, industry, profession, trade or other enterprise in Nebraska, including any agent, representative or designee acting in its interest (48-3502(5)).
• Employees and applicants: individuals employed by an employer, and prospective employees applying for a job (48-3502(2), (4)).
• Personal internet account: an individual's online account that needs login information to access or control it. It does not include an account the employer or an educational institution supplies or pays for (unless it pays only for extra features), or an account used only for the employer's business (48-3502(6)).

What employers may not do

• Ask for the login: require or request that a worker or applicant provide or disclose any user name, password or other related account information to get into their personal internet account by way of an electronic communication device (48-3503(1)).
• Login in front of the employer: require or request that they log in in the employer's presence in a way that lets it see the contents or gives it access (48-3503(2)).
• Contacts: require them to add anyone, including the employer, to their contacts (48-3503(3)).
• Privacy settings: require or otherwise coerce them to change settings that affect who else can see the account (48-3503(3)).
• Punish a refusal: take adverse action against, fail to hire or otherwise penalize a worker or applicant for refusing any of the above (48-3503(4)). Adverse action includes discharge, threats and any other act that negatively affects the employee's job (48-3502(1)).
• Waivers: require a worker or applicant to waive or limit these protections to keep a job or to apply for or get an offer. Any waiver is void (48-3504).
• Retaliation for complaints: retaliate or discriminate against someone who files a complaint under the Act or takes part in an investigation or proceeding about a violation (48-3505).

The contact and settings bans do not use the word "request", so our reading, not a court ruling, is that a free request for those is not itself banned, although punishing a refusal is.

What employers may still do

The Act does not limit an employer's right to (48-3507):

• Policies: keep lawful workplace policies on its electronic equipment, including internet use and personal account use;
• Work devices and accounts: request or require access information for a device it supplied or paid for in whole or in part, or an account or service it provides, that comes with the job or that is used for its business;
• Work networks: restrict websites on its devices or network, and monitor, review, access or block data on its devices or network, as far as the law allows;
• Public information: access information that is in the public domain or obtained in line with the Act;
• Investigations: investigate, or require an employee to cooperate, where it has specific information about potentially wrongful activity on the employee's personal account (for legal compliance, regulatory requirements or bans on work-related misconduct), or about an unauthorized download or transfer of its confidential information or data to the account;
• Data taken without permission: take adverse action against an employee who downloads or transfers its private proprietary information or financial data to a personal account without authorization. The Act separately bars employees from doing this (48-3506);
• Legal duties: comply with screening or communication-retention duties under state or federal law or securities self-regulatory rules, and with a law enforcement investigation.

Law enforcement agencies keep their right to screen in connection with law enforcement hiring or officer conduct investigations (48-3508). The Act creates no duty for an employer to monitor personal accounts (48-3509). If an employer learns a login by accident through lawful network or device monitoring for service quality or security, it is not liable for that, but it may not use or share the login and must delete it as soon as practicable (48-3510).

Enforcement

An aggrieved employee or applicant may, in addition to any other remedy, sue in the district court of the county where the violation happened, within one year of the violation or of discovering it, whichever is later. A successful complainant is entitled to appropriate relief, including an injunction, general and special damages, reasonable attorney's fees and costs (48-3511).

What this means in practice

• Employers: do not ask for personal logins or for staff and candidates to log in while you watch, and do not press them to connect with you or change settings. Do not put a waiver of these rights in applications or contracts.
• Workers and applicants: you can refuse, and you have one year from the violation or its discovery to sue. Public information can still be seen.

Compare the Vermont social media password law and the other states in social media password laws in the US. West Virginia's law is narrower, with no retaliation clause or named penalty, see the West Virginia social media password law.

This page covers Nebraska and is general information based on Neb. Rev. Stat. 48-3501 to 48-3511 as published by the Nebraska Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.