Can a Tennessee employer ask for your social media password? The Employee Online Privacy Act of 2014 explained

Tennessee protects the personal internet accounts of employees and job applicants in the "Employee Online Privacy Act of 2014", Public Chapter 826 (Senate Bill 1808), which added a new part to Title 50, Chapter 1 of the Tennessee Code Annotated (Public Chapter 826 of 2014; bill history, Tennessee General Assembly). It took effect on 1 January 2015 (Section 6).

The short answer: a Tennessee employer may not request or require an employee or applicant to disclose the password to a personal internet account, may not compel them to add the employer as a contact or to open the account in front of the employer so it can see the contents, and may not take adverse action, refuse to hire or otherwise penalize them for refusing. It can still require logins for devices and accounts it supplies, and investigate based on specific information. The Act itself names no penalty or right to sue.

This page is based on the Act as passed and published by the Tennessee Secretary of State. Check the current Tennessee Code for any later amendments.

Who is covered

• Employer: a person or entity that employs one or more employees, including the state and its political subdivisions and an agent, representative or designee of the employer (Section 3(3)).
• Employees and applicants: both are protected. An applicant is an individual who has applied for employment with the employer (Section 3(2), 4(a)).
• Personal internet account: an online account used by the employee or applicant exclusively for personal communications unrelated to any business purpose of the employer, including any electronic medium or service where users create, share or view content such as e-mails, messages, texts, blogs, podcasts, photographs, videos or profiles. It does not include an account created, maintained, used or accessed for business-related communications or a business purpose of the employer (Section 3(5)).

What employers may not do

• Ask for the password: request or require an employee or applicant to disclose a password that allows access to their personal internet account (Section 4(a)(1)).
• Contacts: compel an employee or applicant to add the employer or an employment agency to their contacts on a personal internet account (Section 4(a)(2)).
• Login in front of the employer: compel an employee or applicant to access a personal internet account in the employer's presence in a way that lets the employer observe the contents (Section 4(a)(3)).
• Retaliate or refuse to hire: take adverse action, fail to hire or otherwise penalize an employee or applicant for refusing any of the above (Section 4(a)(4)). Adverse action means discharging, threatening or otherwise discriminating against an employee in a way that affects their employment, including pay, terms, location, promotions or privileges (Section 3(1)).

The password ban covers a request. The contact and login-in-front bans use the word "compel", so our reading, not a court ruling, is that a request the worker is free to decline is not covered by those two, although punishing a refusal still is. The Act does not mention privacy settings.

What employers may still do

Unless another law says otherwise, the Act does not stop an employer from (Section 4(b)):

• Work devices and accounts: requesting or requiring a username or password needed only to access an electronic communications device it supplied or paid for wholly or in part, or an account or service it provides through the employment relationship or that is used for its business;
• Data taken without permission: disciplining or discharging an employee for moving its proprietary or confidential information or financial data to a personal account without authorization;
• Investigations: investigating, or requiring an employee to cooperate, where there is specific information on the employee's personal account about compliance with laws, regulatory requirements or bans on work-related misconduct, or specific information about an unauthorized transfer of the employer's data. This includes requiring the employee to share the reported content or information to make a factual determination (Section 4(b)(3), 4(c));
• Work networks: restricting access to certain websites on employer-supplied devices or networks, and monitoring, reviewing, accessing or blocking data stored on its devices or network, in line with state and federal law;
• Legal duties: complying with a duty to screen employees or applicants or to monitor or retain communications set by federal law or a securities self-regulatory organization, or for law enforcement employment or investigations into law enforcement officer conduct;
• Public information: viewing, accessing or using information that can be obtained without breaking the Act or that is in the public domain.

The Act also says it creates no duty for an employer to search or monitor personal accounts, and that an employer is not liable for failing to ask for access (Section 4(d)). It did not apply to a contract made before 1 January 2015 that permitted a banned action until that contract was renewed (Section 6).

Enforcement

The Act as passed does not itself name a penalty, fine, enforcing agency or right to sue. Anyone who thinks it has been broken should ask a Tennessee employment lawyer what routes apply.

What this means in practice

• Employers: do not ask for personal passwords, and do not press staff or candidates to add you as a contact or open their accounts for you. Keep login requirements to devices and accounts you supply, and in investigations ask for the specific reported content.
• Workers and applicants: you can refuse, and the employer may not penalize you for it. Public information can still be seen.

Compare the New Mexico social media password law and the other states in social media password laws in the US. New Jersey's law goes further on requests: it bars asking for a password or any other access to a personal social networking account, see the New Jersey social media password law.

This page covers Tennessee and is general information based on Public Chapter 826 of 2014 as published by the Tennessee Secretary of State when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.