New Hampshire limits what employers can demand from the personal social media accounts of employees and job applicants. The rules are in RSA 275:73 to 275:75, under the heading "Use of Social Media and Electronic Mail", in force since 30 September 2014 (RSA 275:74).
The short answer: a New Hampshire employer may not request or require that an employee or prospective employee disclose login information for a personal account, may not compel them to add anyone as a contact or require them to reduce privacy settings, and may not discipline an employee for refusing. It can still require logins for accounts and devices it provides, monitor its own equipment and investigate specific reports. The labor commissioner can impose a civil penalty.
Who is covered
- Employees and applicants: the login ban protects employees and prospective employees, and the contacts and privacy-settings ban protects employees and applicants (RSA 275:74, I and II).
- Personal account: an account, service or profile on a social networking website used by a current or prospective employee primarily for personal communications unrelated to any business purpose of the employer. Accounts created, maintained, used or accessed for the employer's business purposes or business-related communications are not included (RSA 275:73).
What employers may not do
- Ask for logins: request or require that an employee or prospective employee disclose login information for accessing any personal account or service through an electronic communication device (RSA 275:74, I).
- Force contacts: compel an employee or applicant to add anyone, including the employer or its agent, to the contacts of an email account or personal account (RSA 275:74, II).
- Lower privacy settings: require an employee or applicant to reduce the privacy settings of an email or personal account in a way that would affect a third party's ability to view its contents (RSA 275:74, II).
- Discipline for refusing: take or threaten disciplinary action against an employee for refusing a request or demand that breaks these rules (RSA 275:74, III).
- Use logins picked up by accident: an employer that inadvertently receives an employee's password or other authentication information through network monitoring or employer-provided devices is not liable for having it but may not use it to access the employee's personal accounts (RSA 275:74, V).
The retaliation paragraph speaks of disciplinary action against an employee. Unlike several other states, it does not separately mention refusing to hire an applicant.
What employers may still do
- Workplace policies and monitoring: adopt and enforce lawful policies on the use of the employer's electronic equipment, including Internet, social networking and email use, and monitor use of its equipment and email (RSA 275:74, IV(a), (b)).
- Work accounts and devices: request or require login information for an account or service provided because of the employment relationship, or a device or online account paid for or supplied by the employer (RSA 275:74, IV(c)).
- Public information: obtain information about an employee or prospective employee that is in the public domain (RSA 275:74, VI(a)).
- Investigations: investigate compliance with laws, regulatory requirements or bans on work-related misconduct based on information about activity on an employee's personal account, or an unauthorized transfer of the employer's proprietary, confidential or financial data to a personal account. In such an investigation the employer may require the employee to share only the content it has received, to make a factual determination (RSA 275:74, VI(b) and VII).
- Other laws: comply with state or federal statutes, rules, regulations, case law or the rules of self-regulatory organizations (RSA 275:74, VIII).
Enforcement
An employer that violates RSA 275:74 is subject to a civil penalty imposed by the labor commissioner under the procedures in RSA 273:11-a, and an employer can appeal the assessment (RSA 275:75). Under RSA 273:11-a, the commissioner may, after a hearing, impose a civil penalty of up to $2,500 for any violation unless another law authorizes more, and generally first issues one written warning giving the employer 30 days to cure the problem, except in listed cases such as where the employer intends to cause harm (RSA 273:11-a). The sections do not mention a right for the worker to sue.
What this means in practice
- Employers: requests are covered as well as requirements, so do not ask staff or candidates for personal logins, to connect with managers, or to open up their privacy settings. In investigations, ask only for the content you have received.
- Workers and applicants: you can refuse, and a complaint goes to the New Hampshire labor commissioner. Public posts can still be seen.
Compare the Utah social media password law and the other states in social media password laws in the US. Arkansas's rule is in the Arkansas social media password law.
This page covers New Hampshire and is general information based on the Revised Statutes Annotated published by the New Hampshire General Court when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.
Questions and answers
Can a New Hampshire employer ask for my social media password?
No. RSA 275:74 bars an employer from requesting or requiring that an employee or prospective employee disclose login information for a personal account.
Can a New Hampshire employer make me lower my privacy settings?
No. It may not require an employee or applicant to reduce the privacy settings of an email or personal account in a way that lets third parties see more.
Can a New Hampshire employer require my work account password?
Yes. It may request or require logins for accounts provided because of your job and for devices or online accounts it pays for or supplies.
What is the penalty in New Hampshire?
The labor commissioner can impose a civil penalty under RSA 273:11-a, up to $2,500 for any violation after a hearing, usually after one written warning with 30 days to fix the problem.