Can an Oregon employer ask for your social media password? ORS 659A.330 explained

Oregon makes it an unlawful employment practice for an employer to demand access to the personal social media accounts of employees and job applicants. The rule is section 659A.330 of the Oregon Revised Statutes, added in 2013 and amended in 2015 and 2021 (ORS 659A.330, Oregon Revised Statutes chapter 659A).

The short answer: an Oregon employer may not require or request that an employee or applicant hand over a personal social media login, open or keep a personal account, add the employer as a contact, let the employer advertise on the account, or log in so the employer can see private content. It may not punish or refuse to hire someone for refusing. It can still require logins for accounts it provides and can ask for specific reported content in an investigation.

Who is covered

• Employer: any person who in Oregon, directly or through an agent, engages or uses the personal service of one or more employees and reserves the right to control how the work is done (ORS 659A.001(4)). The section does not apply to an employer that is a law enforcement unit (659A.330(7)).
• Employees and applicants: both are protected (659A.330(1)).
• Personal social media account: an account used by the employee or applicant only for personal purposes unrelated to any business purpose of the employer, and not provided by or paid for by the employer (659A.330(8)(a)). Social media means an electronic medium where users create, share and view user-generated content such as videos, photos, blogs, podcasts, instant messages, email or website profiles (659A.330(8)(b)).

What employers may not do

• Ask for logins: require or request that an employee or applicant disclose, or give access through, the username and password or other authentication for a personal social media account (659A.330(1)(a)).
• Make you open an account: require or request that an employee or applicant establish or maintain a personal social media account (659A.330(1)(a)).
• Advertise on your account: require an employee or applicant to authorize the employer to advertise on their personal account (659A.330(1)(b)).
• Force contacts: compel them to add the employer or an employment agency to their contacts on a social media website (659A.330(1)(c)).
• Shoulder surfing: compel them to log in to a personal account in the employer's presence in a way that lets the employer see content visible only to the account holder (659A.330(1)(d)).
• Retaliate: take or threaten action to discharge, discipline or penalize an employee, or fail or refuse to hire an applicant, for refusing any of the above (659A.330(1)(e), (f)).
• Use logins picked up by accident: an employer that inadvertently receives an employee's login through a device or program that monitors its network or employer-provided devices is not liable for having it but may not use it to access the account (659A.330(6)).

What employers may still do

• Work accounts: require an employee to disclose logins for an account provided by or on behalf of the employer, or to be used on the employer's behalf (659A.330(2)).
• Investigations: investigate compliance with laws, regulatory requirements or bans on work-related misconduct after receiving specific information about the employee's activity on a personal account, without requiring the login. As part of such an investigation it may require the employee to share content reported to the employer that it needs to make a factual determination, again without the login (659A.330(4)(a), (b)).
• Other laws: comply with state and federal laws, rules and regulations and the rules of self-regulatory organizations (659A.330(4)(c)).
• Public information: access information about the employee or applicant that is available to the public through an online account (659A.330(5)).

Enforcement

A breach is an unlawful employment practice. A person claiming to be aggrieved by an unlawful practice may file a verified written complaint with the Commissioner of the Bureau of Labor and Industries (BOLI), generally within one year of the practice (ORS 659A.820(2)). Section 659A.330 is not among the sections listed in ORS 659A.885(2), the provision that sets out direct civil actions in circuit court for listed unlawful practices (ORS 659A.885(2)). Our reading, not a court ruling: the main route for a worker is a BOLI complaint, so check with BOLI or a lawyer about other options.

What this means in practice

• Employers: Oregon covers requests, not only requirements, so recruiters and managers should not ask for personal logins, ask candidates to open accounts or connect, or ask anyone to log in in front of them. In investigations, ask for the specific reported content, never the password.
• Workers and applicants: you can refuse, and you can complain to BOLI. Anything you post publicly can still be seen.

Oregon's neighbor has a similar rule: see the Washington social media password law, and compare all states covered here in social media password laws in the US. Nevada's rule is in the Nevada social media password law.

This page covers Oregon and is general information based on the Oregon Revised Statutes chapter 659A published by the Oregon Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.