Several US states bar employers from asking for the passwords to workers' and job applicants' personal social media and online accounts. The details differ: what counts as a banned request, whether privacy settings are covered, what investigations are allowed, and whether a worker can sue. This page compares the twenty-five states we have covered from their statute text: Illinois (820 ILCS 55/10), Maryland (Lab. & Empl. 3-712), Washington (RCW 49.44.200), Colorado (C.R.S. 8-2-127), Virginia (Va. Code 40.1-28.7:5), Oregon (ORS 659A.330), Nevada (NRS 613.135), Utah (Utah Code 34-48), New Hampshire (RSA 275:74), Arkansas (Ark. Code 11-2-124), Louisiana (La. R.S. 51:1953), Michigan (MCL 37.273), Oklahoma (40 O.S. 173.2), Wisconsin (Wis. Stat. 995.55), Rhode Island (R.I. Gen. Laws 28-56-2), Delaware (19 Del. C. 709A), Montana (MCA 39-2-307), New Mexico (SB 371 of 2013), Tennessee (Public Chapter 826 of 2014), New Jersey (N.J.S.A. 34:6B-5 to 34:6B-10), Connecticut (Conn. Gen. Stat. 31-40x), Maine (26 M.R.S. 615 to 619), Vermont (21 V.S.A. 495l), Nebraska (Neb. Rev. Stat. 48-3501 to 48-3511) and West Virginia (W. Va. Code 21-5H-1). Other states have their own laws, so check where you work.
The short answer: in all twenty-five states, an employer may not demand a job applicant's personal account login, and in all but New Mexico, whose law covers applicants only, the same goes for current workers. Punishing someone for refusing is banned everywhere except New Mexico and West Virginia, whose texts have no retaliation clause. Employers can still require logins for their own systems or accounts. Illinois, Washington, Utah, Michigan, Oklahoma, Rhode Island, Montana, Vermont and Nebraska let workers sue directly. In Maryland, Colorado, Oregon, New Hampshire, Wisconsin, New Jersey, Connecticut and Maine, complaints go to state officials. The Virginia, Nevada, Arkansas, Louisiana, Delaware, New Mexico, Tennessee and West Virginia texts do not themselves name a penalty.
Side by side
| Illinois | Maryland | Washington | Colorado | Virginia | Oregon | Nevada | Utah | New Hampshire | Arkansas | Louisiana | Michigan | Oklahoma | Wisconsin | Rhode Island | Delaware | Montana | New Mexico | Tennessee | New Jersey | Connecticut | Maine | Vermont | Nebraska | West Virginia | |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Banned request | Request, require or coerce a login or demand access in any manner | Request or require a login | Request, require or coerce a login | Suggest, request or require a login | Require a login | Require or request a login, or require opening an account | Require, request, suggest or cause a login, directly or indirectly | Request a login to a personal Internet account | Request or require a login | Require, request, suggest or cause a login | Request or require a login to a personal online account | Request access to, observation of, or a login to a personal internet account | Require a login (the text does not say request) | Request or require a login, access or observation as a condition of employment | Require, coerce or request a password | Require or request a login | Require or request a login, a look or content | Request or require an applicant's password, or demand access in any manner | Request or require a password | Require or request a password or any access to a personal social networking account | Request or require a password or any other login to a personal online account | Require, coerce or request a password or other means of access | Require, request or coerce a login or an unlocked personal device, or any content | Require or request a username, password or other account information | Request, require or coerce a password or other login |
| Logging in in front of the employer | Banned | Not mentioned | Banned where it lets the employer see the contents | Not mentioned | Not mentioned | Banned where it lets the employer see private content | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Requesting observation of the account banned | Requiring it banned where the employer can see private contents | Requesting observation of the account banned | Banned (require, coerce or request) | Banned (require or request) | Banned (require or request) | Not spelled out (demanding access in any manner banned) | Compelling it banned where the employer can see the contents | Not spelled out (providing access in any way banned) | Requesting or requiring it banned | Requiring, coercing or requesting it banned | Requiring, requesting or coercing it banned | Requiring or requesting it banned where the employer can see or get access | Requesting, requiring or coercing it banned |
| Adding the employer as a contact | Banned | Not mentioned | Banned | Banned | Banned (employee, supervisor or administrator) | Banned (employer or employment agency) | Not mentioned | Not mentioned | Banned (anyone, including the employer) | Banned (employee, supervisor or administrator) | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Compelling it banned (anyone, including the employer) | Banned (anyone, including the employer; also groups) | Not mentioned | Not mentioned | Compelling it banned (employer or employment agency) | Not spelled out (providing access in any way banned) | Requiring a group invitation either way banned | Requiring or causing it banned (anyone, including the employer) | Requiring or coercing it banned (anyone, including the employer) | Requiring it banned (anyone, including the employer) | Compelling it banned (employer or employment agency) |
| Changing privacy settings | Not mentioned | Not mentioned | Banned | Banned | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Banned (reducing them) | Banned | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Banned | Banned | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Not mentioned | Banned, including requests | Banned, including requests | Requiring or coercing it banned | Not mentioned |
| Retaliation or refusal to hire for refusing | Banned | Banned | Banned | Banned | Banned | Banned | Banned, including denying a promotion | Banned | Discipline of employees banned; hiring not mentioned | Banned | Banned | Banned | Banned where solely for refusing | Banned, including for complaining or testifying | Banned, including threats | Banned, including threats | Banned, also for lawful posts within policy | Not mentioned; the law covers applicants only | Banned, including threats | Retaliation or discrimination banned; job-application waivers void | Banned, also for filing a complaint | Banned, including threats | Retaliation against employees banned; waivers invalid | Banned, also for complaints; waivers void | Not mentioned in the section |
| Employer's own systems and accounts | Policies and monitoring of employer equipment allowed | Logins for internal systems allowed | Logins for job-provided or employer-paid accounts and devices allowed | Logins for internal systems allowed | Employer-provided and employer-requested accounts not covered | Logins for employer-provided accounts allowed | Logins for internal systems allowed | Logins for employer-supplied devices and accounts allowed | Logins for employer-provided accounts and devices allowed | Employer-provided and employer-requested accounts not covered | Logins for employer-supplied devices and accounts allowed | Logins for employer-paid devices and employer accounts allowed | Logins for employer-provided or subsidized systems and devices, and work accounts, allowed | Logins for employer-supplied or paid devices and employer accounts allowed | Employer-opened, employer-provided and work accounts not covered | Logins for employer-supplied or paid devices and employer accounts allowed | Logins for employer-issued devices, software and e-mail allowed | Workplace policies and monitoring of employer equipment and e-mail allowed | Logins for employer-supplied or paid devices and employer accounts allowed | Policies on employer-issued devices and business accounts allowed | Logins for employer accounts and employer-supplied or paid devices allowed | Logins for employer-issued devices, software and e-mail allowed | Logins for employer-issued devices allowed | Logins for employer-supplied or paid devices and employer accounts allowed | Logins for employer-issued devices and employer accounts allowed |
| Investigations | May ask for specific reported content, not the login | Allowed for securities or financial compliance and data downloads | May ask for content in set investigations, not the login | Allowed for securities or financial compliance and data downloads | May ask for a login in a formal investigation, used only for it | May ask for reported content, not the login | Not mentioned | May require reported content where there is specific information | May require only the content received | May ask for a login in a formal investigation, used only for it | May ask for reported content, not the login | Allowed on specific information; method not spelled out | May require the employee to share the reported content | With reasonable cause, may require access or observation, not the login | May require account information relevant to the investigation | May require or request a login or social media relevant to the investigation | Employee must give the login in set investigations | Not mentioned | May require the employee to share the reported content | Allowed on specific information; what may be required not spelled out | May require access on specific information, not the login | May require relevant account information in misconduct investigations | May request specifically identified content in set cases, never the login | May investigate and require cooperation on specific information | May require reported content in data leak cases; may request specific content for compliance or misconduct |
| Who enforces | Worker lawsuit, Department of Labor, Attorney General, interested parties | Commissioner (mediation) or Attorney General | Worker lawsuit | Department of Labor and Employment | Not named in the section | Complaint to the Bureau of Labor and Industries | Not named in the section | Worker lawsuit | Labor commissioner | Not named in the section | Not named in the Act | Worker lawsuit; misdemeanor | Worker lawsuit within six months | Complaint to the Department of Workforce Development | Worker lawsuit | Not named in the section | Worker small claims action within 1 year | Not named in the Act | Not named in the Act | Commissioner of Labor and Workforce Development | Complaint to the Labor Commissioner; appeal to Superior Court | Department of Labor | Worker lawsuit; Attorney General or State's Attorney | Worker lawsuit in district court within 1 year | Not named in the section |
| Money at stake | $100 to $1,000 per violation; $10,000 plus back pay if a job was lost | Damages or other relief sought by the Attorney General | Actual damages, a $500 penalty and attorneys' fees | Fines up to $1,000, then up to $5,000 | Not named in the section | Not named in the section | Not named in the section | Up to $500 | Civil penalty up to $2,500, usually after a warning | Not named in the section | Not named in the Act | Up to $1,000 damages plus attorney fees; fine up to $1,000 | $500 per violation; no punitive or emotional damages | Forfeiture up to $1,000; remedies ordered by the department | Damages (no set amount), attorney fees and costs | Not named in the section | $500 or actual damages up to the small claims limit | Not named in the Act | Not named in the Act | Civil penalty up to $1,000, then up to $2,500 per violation | Up to $500, then $1,000 (employees) or $25, then $500 (applicants); reinstatement and back wages | Fines of at least $100, then $250, then $500 per violation | Compensatory and punitive damages, back pay, reinstatement and attorney fees; state civil penalties | Injunction, general and special damages, attorney fees and costs | Not named in the section |
The main differences
- How wide the ban is: Colorado's text covers even a suggestion (8-2-127(2)(a)), and Nevada's covers directly or indirectly requiring, requesting, suggesting or causing disclosure (613.135(1)(a)), as does Arkansas's (11-2-124(b)(1)). Illinois covers demanding access "in any manner" (55/10(b)(1)(A)). Maryland, Washington, Oregon, Utah, New Hampshire, Louisiana, Michigan, Wisconsin, Rhode Island, Delaware, Montana, New Mexico, Tennessee, New Jersey, Connecticut, Maine, Vermont, Nebraska and West Virginia cover requests (3-712(b)(1); 49.44.200(1)(a); 659A.330(1)(a); 34-48-201(1); 275:74, I; 51:1953(A)(1); 37.273(a); 995.55(2)(a)1.; 28-56-2(1); 709A(b)(1); 39-2-307(1); SB 371, Section 1(A); Tennessee Section 4(a)(1); 34:6B-6; 31-40x(b)(1); 26 M.R.S. 616(1); 21 V.S.A. 495l(b); Neb. Rev. Stat. 48-3503(1); W. Va. Code 21-5H-1(a)(1)). Virginia's and Oklahoma's texts use only the word "require" (40.1-28.7:5(B); 173.2(A)(1)).
- Privacy settings: only Washington (49.44.200(1)(d)), Colorado (8-2-127(2)(a)), New Hampshire (275:74, II), Arkansas (11-2-124(b)(1)(C)), Rhode Island (28-56-3), Delaware (709A(b)(6)), Maine (616(5)) and Vermont (495l(b)(4)) bar asking or requiring a worker to change who can see their account. Nebraska bars requiring or coercing such a change (48-3503(3)).
- Investigations: Illinois, Washington, Oregon and Louisiana spell out that an employer can ask for specific content in an investigation but not the login (55/10(b)(3)(C); 49.44.200(2); 659A.330(4)(b); 51:1953(B)(4)), Utah, Oklahoma and Tennessee let it require the reported content (34-48-202(2); 173.2(D)(2); Tennessee Section 4(c)), and New Hampshire only the content the employer has received (275:74, VII). Wisconsin lets it require the worker to grant access to or allow observation of the account where it has reasonable cause, but never the login (995.55(2)(b)3.). Rhode Island lets it require account information reasonably believed relevant to an investigation of misconduct, used only as far as needed for it (28-56-2(3)). Virginia, Arkansas and Delaware are the exceptions: their sections leave room for an employer to ask for a login in a formal investigation, to be used only for that investigation (40.1-28.7:5(F)(2); 11-2-124(e)(2); 709A(c)). Montana goes further: when the employer has specific information and an investigation is under way, the employee must provide the login if asked (39-2-307(2)). Maryland, Colorado and Michigan allow certain investigations without saying how content may be obtained (3-712(e); 8-2-127(4); 37.275(1)(c)).
- Passwords captured by accident: Illinois, Washington, Virginia, Oregon, New Hampshire, Arkansas, Louisiana, Oklahoma and Wisconsin all say an employer whose network monitoring picks up a login is not liable for having it but may not use it (55/10(b)(4); 49.44.200(4); 40.1-28.7:5(C); 659A.330(6); 275:74, V; 11-2-124(b)(2); 51:1953(C); 173.2(C); 995.55(2)(d)).
- Remedies: Illinois gives workers the strongest tools, including a $10,000 penalty where a job was lost (55/17). Washington gives a direct lawsuit with a $500 penalty (49.44.205), and Utah a lawsuit in which the court awards up to $500 (34-48-301). Michigan lets a worker sue for up to $1,000 plus attorney fees after a written demand, and also makes a violation a misdemeanor with a fine of up to $1,000 (37.278). Oklahoma lets a worker sue within six months for an injunction and $500 per violation, the only damages allowed (173.2(G)). Rhode Island lets a worker sue for damages with no set amount, attorney fees and an injunction (28-56-6). Montana sends claims to small claims court within 1 year, with damages of $500 or actual damages up to the small claims limit (39-2-307(7)). Maryland routes complaints to the Commissioner and the Attorney General (3-712(f)), Colorado to its labor department (8-2-127(5)) and Oregon to the Bureau of Labor and Industries (ORS 659A.820(2)). In New Hampshire the labor commissioner can impose a civil penalty (RSA 275:75). In Wisconsin a violator may have to forfeit up to $1,000, and a worker fired, treated worse or not hired for refusing can complain to the Department of Workforce Development (995.55(6)). New Jersey sets civil penalties of up to $1,000 for a first violation and $2,500 for each later one, collected by the Commissioner of Labor and Workforce Development (34:6B-9). In Connecticut the Labor Commissioner hears complaints and can levy civil penalties of up to $500, then $1,000 for employees, and order reinstatement and back wages (31-40x(f), (g)). Maine's Department of Labor can fine an employer at least $100, then $250, then $500 for each later violation (26 M.R.S. 619). Vermont lets an aggrieved person sue for compensatory and punitive damages, reinstatement and attorney fees, and lets the Attorney General or a State's Attorney enforce (21 V.S.A. 495b). Nebraska lets an employee or applicant sue in district court within one year for an injunction, general and special damages, attorney fees and costs (48-3511). The Virginia, Nevada, Arkansas, Louisiana, Delaware, New Mexico, Tennessee and West Virginia texts name no penalty or right to sue.
What this means in practice
- Employers with staff in several states: the simplest safe rule is the strictest one: never ask for, hint at or watch a login to a personal account, never ask to be added as a contact or for settings to change, and in investigations ask only for the specific content involved.
- Workers and applicants: in all twenty-five states you can refuse. Write down any request, then use the route your state provides.
Read each state in full: Illinois, Maryland, Washington, Colorado, Virginia, Oregon, Nevada, Utah, New Hampshire, Arkansas, Louisiana, Michigan, Oklahoma, Wisconsin, Rhode Island, Delaware, Montana, New Mexico, Tennessee, New Jersey, Connecticut, Maine, Vermont, Nebraska and West Virginia. For monitoring of work email, phones and internet use, see US employee monitoring laws.
This page is general information based on the statute texts published by the legislatures and courts of these twenty-five states when checked on 3 November 2026, not legal advice.
Questions and answers
Is it legal for an employer to ask for my social media password?
Not in Illinois, Maryland, Washington, Colorado, Virginia, Oregon, Nevada, Utah, New Hampshire, Arkansas, Louisiana, Michigan, Oklahoma, Wisconsin, Rhode Island, Delaware, Montana, New Mexico, Tennessee, New Jersey, Connecticut, Maine, Vermont, Nebraska or West Virginia, which all bar employers from demanding personal account logins. The Virginia and Oklahoma texts cover requiring a login. New Mexico's covers job applicants only. Other states have their own rules.
Can an employer ask me to make my social media public?
Washington, Colorado, New Hampshire, Arkansas, Rhode Island, Delaware, Maine and Vermont expressly bar asking or requiring a worker to change or reduce privacy settings. Nebraska bars requiring or coercing such a change. The other sixteen states covered here do not mention privacy settings.
Can I sue my employer for asking for my password?
In Illinois, Washington, Utah, Michigan, Oklahoma, Rhode Island, Montana, Vermont and Nebraska the law lets workers sue. In Maryland, Colorado, Oregon, New Hampshire, Wisconsin, New Jersey, Connecticut and Maine, complaints go to state officials. The Virginia, Nevada, Arkansas, Louisiana, Delaware, New Mexico, Tennessee and West Virginia texts do not themselves name a penalty or right to sue.
Can an employer still look at my public posts?
Illinois, Virginia, Oregon, Utah, New Hampshire, Arkansas, Louisiana, Michigan, Wisconsin, Rhode Island, Delaware, New Mexico, Tennessee, New Jersey, Maine, Nebraska and West Virginia state expressly that employers may view publicly available information. The other eight are written around logins, contacts, settings and access to personal accounts rather than public posts.
Sources
- ilga.gov
- mgaleg.maryland.gov
- app.leg.wa.gov
- app.leg.wa.gov
- leg.colorado.gov
- law.lis.virginia.gov
- oregonlegislature.gov
- leg.state.nv.us
- le.utah.gov
- gc.nh.gov
- gc.nh.gov
- gc.nh.gov
- arkleg.state.ar.us
- legis.la.gov
- legis.la.gov
- legislature.mi.gov
- legislature.mi.gov
- legislature.mi.gov
- oscn.net
- docs.legis.wisconsin.gov
- webserver.rilegislature.gov
- webserver.rilegislature.gov
- webserver.rilegislature.gov
- delcode.delaware.gov
- archive.legmt.gov
- nmlegis.gov
- publications.tnsosfiles.com
- pub.njleg.state.nj.us
- cga.ct.gov
- legislature.maine.gov
- legislature.maine.gov
- legislature.maine.gov
- legislature.maine.gov
- legislature.maine.gov
- legislature.vermont.gov
- legislature.vermont.gov
- nebraskalegislature.gov
- nebraskalegislature.gov
- nebraskalegislature.gov
- code.wvlegislature.gov