Utah bars employers from asking for the passwords to the personal online accounts of employees and job applicants. The rule is the Internet Employment Privacy Act, chapter 48 of title 34 of the Utah Code, enacted in 2013 and amended in 2015 (Utah Code Title 34, Chapter 48, Internet Employment Privacy Act).
The short answer: a Utah employer may not request that an employee or applicant disclose the username and password to a personal Internet account, and may not take adverse action, refuse to hire or otherwise penalize someone for not disclosing it. It can still require logins for devices and accounts it supplies and investigate specific reports. A worker can sue, and the court awards up to $500.
Who is covered
- Employer: a person, including the state or a political subdivision of the state, that has one or more workers employed in the same business or establishment under any contract of hire (34-48-102(2)).
- Employees and applicants: both are protected (34-48-201).
- Personal Internet account: an online account used by the employee or applicant exclusively for personal communications unrelated to any business purpose of the employer. Accounts created, maintained, used or accessed for business communications or a business purpose of the employer are not included (34-48-102(4)).
The Act is not limited to social media: it covers any personal online account that fits this definition.
What employers may not do
- Ask for the login: request an employee or applicant to disclose a username and password, or a password, that allows access to their personal Internet account (34-48-201(1)).
- Retaliate: take adverse action, fail to hire, or otherwise penalize an employee or applicant for not disclosing it (34-48-201(2)). Adverse action means to discharge, threaten or otherwise discriminate against an employee in any way that affects their employment, including pay, terms, conditions, location and promotions (34-48-102(1)).
The Act does not separately mention adding the employer as a contact, logging in in front of the employer or changing privacy settings.
What employers may still do
- Work devices and accounts: request or require a username or password needed only to access a device supplied or paid for, in whole or in part, by the employer, or an account or service it provides for its business purposes (34-48-202(1)(a)).
- Data taken without permission: discipline or dismiss an employee for moving the employer's proprietary or confidential information or financial data to a personal account without authorization (34-48-202(1)(b)).
- Investigations: investigate, and require the employee to cooperate, where there is specific information about activity on the personal account (to ensure compliance with laws, regulatory requirements or bans on work-related misconduct) or about an unauthorized transfer of the employer's data. This includes requiring the employee to share the reported content so the employer can establish the facts (34-48-202(1)(c), (2)).
- Work networks: restrict access to websites on employer devices or networks, and monitor, review, access or block data stored on employer devices or networks, in line with state and federal law (34-48-202(1)(d), (e)).
- Other duties: comply with screening or monitoring duties under federal law or set by a securities self-regulatory organization, and carry out law enforcement hiring and conduct investigations (34-48-202(3)).
- Public information: view, access or use information that can be obtained without the login or that is in the public domain (34-48-202(4)).
The Act also states that it does not create a duty for an employer to search or monitor personal accounts, and that an employer is not liable for failing to ask for access (34-48-203).
Enforcement
A person aggrieved by a violation may bring a civil action against the employer. If the court finds a violation, it awards the aggrieved person not more than $500 (34-48-301).
What this means in practice
- Employers: a request alone is covered, so do not ask candidates or staff for personal account passwords. Keep login requirements to devices and accounts you supply, and in investigations ask for the specific reported content.
- Workers and applicants: you can refuse, and you can bring a claim in court, although the award is capped at $500. Public posts can still be seen and used.
Compare the Nevada social media password law and the other states in social media password laws in the US. New Hampshire's rule is in the New Hampshire social media password law.
This page covers Utah and is general information based on the Utah Code published by the Utah Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.
Questions and answers
Can a Utah employer ask for my social media password?
No. The Internet Employment Privacy Act bars an employer from requesting that an employee or applicant disclose the username and password to a personal Internet account.
Does the Utah law cover email and other accounts?
Yes, if the account is used exclusively for personal communications unrelated to the employer's business. Accounts used for the employer's business are not covered.
Can a Utah employer see my posts in an investigation?
Where it has specific information, it may investigate and require you to share the reported content so it can establish the facts.
What can I get if a Utah employer breaks the law?
You can bring a civil action. If the court finds a violation, it awards not more than $500.