Can an Oklahoma employer make you hand over your social media password? 40 O.S. 173.2 explained

Oklahoma limits what employers can demand from the personal social media accounts of employees and job applicants. The rules are in Title 40 of the Oklahoma Statutes, section 173.2, added by House Bill 2372 (Laws 2014, chapter 315) and in effect since 1 November 2014 (40 O.S. 173.2).

The short answer: an Oklahoma employer may not require an employee or applicant to disclose a username and password for a personal social media account, or to open a private account in front of the employer so it can see the contents, and may not retaliate or refuse to hire someone solely for refusing to give the login. The law uses the word "require" throughout, not "request". It can still require logins for its own systems, devices and accounts.

Who is covered

• Employer: an employer located in Oklahoma, as defined in 25 O.S. 1301(1) (40 O.S. 173.2(A)). That definition covers a legal entity, institution or organization that pays one or more individuals a salary or wages, or that contracts or subcontracts with the state or a governmental entity to furnish material or perform work. It does not include a Native American tribe or a tax-exempt bona fide membership club other than a labor organization (25 O.S. 1301(1)).
• Employees and prospective employees: both are protected (40 O.S. 173.2(A)).
• Personal online social media account: an online account used by the employee or applicant exclusively for personal communications, established and used through an electronic application, service or platform used to generate or store content such as videos, photographs, blogs, video blogs, instant messages, audio recordings or email that is not available to the general public (40 O.S. 173.2(H)(2)).

Because the definition is limited to accounts used exclusively for personal communications, an account also used for work falls outside it.

What employers may not do

• Require the login: require an employee or applicant to disclose a username and password or other means of authentication for accessing a personal online social media account through an electronic communications device (40 O.S. 173.2(A)(1)).
• Require a look in their presence: require the worker to access a personal account in the employer's presence in a way that lets the employer observe contents that are not available to the general public, except during an investigation described below (40 O.S. 173.2(A)(2)).
• Retaliate: take retaliatory personnel action that materially and negatively affects the terms and conditions of employment against an employee solely for refusing to give the username or password (40 O.S. 173.2(A)(3)).
• Refuse to hire: refuse to hire an applicant solely because they refused to give the username and password (40 O.S. 173.2(A)(4)).

The text bans requiring, not asking. Our reading, not a court ruling, is that a voluntary request is not itself a violation, but the retaliation and refusal-to-hire bans still apply if the worker says no. The law does not mention adding the employer as a contact or changing privacy settings.

What employers may still do

• Work systems and accounts: request or require a username and password for any computer system, information technology network or electronic communications device provided or subsidized by the employer, and for accounts or services provided by the employer, obtained through the employment relationship or used for business purposes (40 O.S. 173.2(B)).
• Logins picked up by monitoring: an employer that inadvertently receives a worker's login through monitoring its network or devices is not liable for having it, but may not use it to access the worker's personal social media account (40 O.S. 173.2(C)).
• Investigations: investigate, based on specific information, to ensure compliance with laws, regulatory requirements or bans on work-related misconduct, or about an unauthorized transfer of the employer's proprietary or confidential information or financial data to a personal account. This includes requiring the employee to cooperate by sharing the reported content (40 O.S. 173.2(D)).
• Legal duties: comply with state or federal statutes, rules or regulations, case law, or rules of self-regulatory organizations (40 O.S. 173.2(E)).
• Its own network: access its own computer systems and networks, including devices it owns, and review or access personal social media accounts an employee chooses to use on the employer's systems or devices (40 O.S. 173.2(F)).

A separate section says no business or employer can be held liable for not reviewing, requesting or accessing an employee's personal social media accounts, and that an employer's failure to access them is not admissible in any legal proceeding (40 O.S. 173.3).

Enforcement

• Worker lawsuit: an employee or applicant can bring a civil action in a court in the county where the violation occurred, within six months of the violation (40 O.S. 173.2(G)).
• Remedies: the worker can seek an injunction to stop the violation, but must show by clear and convincing evidence that the employer broke the law. The only damages recoverable are $500 per violation. Punitive and emotional damages are not recoverable, and the section cannot be the basis of a public policy tort claim (40 O.S. 173.2(G)).

The section does not mention a fine, a state agency that enforces it, or attorney fees.

What this means in practice

• Employers: do not make a social media login, or a look at private posts, a condition of a job or of keeping one. Keep login requirements to your own systems, devices and accounts, and keep investigations tied to specific information.
• Workers and applicants: you can refuse. If you want to sue, the clock is six months from the violation, and damages are capped at $500 per violation. Public posts can still be seen.

Compare the Michigan social media password law and the other states in social media password laws in the US. Wisconsin has its own law, which covers requests as well as requirements.

This page covers Oklahoma and is general information based on the Oklahoma Statutes published by the Oklahoma State Courts Network when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.