Can a Rhode Island employer ask for your social media password? R.I. Gen. Laws 28-56 explained

Rhode Island protects the personal social media accounts of employees and job applicants in chapter 28-56 of the General Laws, "Employee Social Media Privacy", enacted by Public Laws 2014, chapters 188 and 207 (R.I. Gen. Laws chapter 28-56).

The short answer: a Rhode Island employer may not require, coerce or request an employee or applicant to disclose the password to a personal social media account or to open it in front of the employer, may not make them add anyone as a contact, may not require or request privacy setting changes, and may not punish or refuse to hire someone for refusing. Workers can sue for damages and attorney fees.

Who is covered

• Employer: the state, all its political subdivisions and any person in Rhode Island employing individuals, including any person acting directly or indirectly in the interest of an employer (28-56-1(3)).
• Employees and applicants: an employee is an individual who provides services or labor for an employer for wages or other remuneration, and applicants for employment are covered too (28-56-1(1), (2)).
• Social media account: an electronic service or account, or electronic content, including videos, photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, and website profiles or locations. It does not include an account opened at the employer's behest, provided by the employer, or intended to be used primarily on behalf of the employer (28-56-1(4)).

The definition is broad: it reaches email and other online accounts, not only social networks. Work accounts are left out by the definition itself rather than by a separate exception.

What employers may not do

• Ask for the password: require, coerce or request an employee or applicant to disclose the password or any other means of accessing a personal social media account (28-56-2(1)).
• Ask for a login in front of them: require, coerce or request an employee or applicant to access a personal social media account in the presence of the employer or its representative (28-56-2(2)).
• Demand account information: require or coerce an employee or applicant to divulge any personal social media account information, except in an investigation described below (28-56-2(3)).
• Contacts: compel an employee or applicant to add anyone, including the employer or its agent, to their contacts on a personal social media account (28-56-3).
• Privacy settings: require, request or cause an employee or applicant to change settings that affect who else can view the account (28-56-3).
• Retaliate or refuse to hire: discharge, discipline or otherwise penalize, or threaten to, an employee who refuses any of the above, or fail or refuse to hire an applicant for refusing (28-56-4).

What employers may still do

• Investigations: require an employee or applicant to divulge personal social media account information when it is reasonably believed to be relevant to an investigation of alleged employee misconduct or a workplace-related violation of laws and regulations, and not otherwise prohibited by law or the constitution. The information may be accessed and used only to the extent necessary for that investigation or a related proceeding (28-56-2(3)). The investigation wording sits only in the account information rule: the bans on asking for the password or a login in the employer's presence carry no investigation exception.
• Public information: the chapter does not apply to information about an applicant or employee that is publicly available (28-56-5(a)).
• Regulated industries: an employer can comply with a duty to screen employees or applicants before hiring, or to monitor or retain employee communications, set by a securities self-regulatory organization or by state or federal law or regulation, to the extent necessary to supervise communications of regulated financial institutions or insurance or securities licensees (28-56-5(b)).
• Work accounts: accounts opened at the employer's behest, provided by the employer or used primarily on its behalf are outside the definition of a social media account, so the chapter does not cover them (28-56-1(4)).

Unlike several other states, the chapter has no separate clause on logins picked up by network monitoring or on employer-supplied devices.

Enforcement

• Worker lawsuit: in a civil action, the court may award a prevailing applicant or employee declaratory relief, damages, and reasonable attorney's fees and costs, and may award an injunction against an employer or its agent that commits or proposes to commit a violation (28-56-6).

The chapter sets no fixed amount or cap on damages and names no state agency or fine.

What this means in practice

• Employers: do not ask for passwords, ask staff or candidates to log in in front of you, push them to add you as a contact or change their settings. Use accounts you open or provide for work, and in an investigation ask only for information relevant to it.
• Workers and applicants: you can refuse, and you can sue for damages and attorney fees if you are punished or not hired for refusing. Public information can still be seen.

Compare the Wisconsin social media password law and the other states in social media password laws in the US. Delaware has its own law, which also covers contacts, groups and privacy settings.

This page covers Rhode Island and is general information based on the General Laws published by the Rhode Island General Assembly when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.