Can a Vermont employer ask for your social media password? 21 V.S.A. 495l explained

Vermont protects the social media accounts of employees and job applicants in section 495l of Title 21 of the Vermont Statutes, added by Act 37 of 2017 and in effect since 1 January 2018 (21 V.S.A. 495l). Its enforcement runs through section 495b, the penalty and enforcement section of Vermont's fair employment practices law (21 V.S.A. 495b).

The short answer: a Vermont employer may not require, request or coerce a worker or applicant to give a social media login, hand over an unlocked personal device to get into the account, log in in front of it, show any content from the account, or change privacy settings to let more people see it. It may not require or coerce them to add anyone as a contact, and may not retaliate against an employee who uses these rights. Waivers are invalid. A worker can sue in Superior Court, and the Attorney General or a State's Attorney can enforce. Employers may still request specifically identified content in set cases, and require logins to employer-issued devices.

This page is based on the Vermont Statutes Online, which the Legislature describes as an unofficial copy of the Vermont Statutes Annotated that includes the actions of the 2026 session.

Who is covered

• Employees and applicants: both are protected from the bans (495l(b), (c)).
• Social media account: an account with an electronic medium or service through which users create, share and interact with content, including videos, photographs, blogs, podcasts, instant or text messages, e-mail, online services or accounts and website profiles. It does not include an account provided by the employer or meant to be used mainly on its behalf (495l(a)(1)).

What employers may not do

An employer may not require, request or coerce a worker or applicant to (495l(b)):

• Login or unlocked phone: disclose a username, password or other means of authentication, or turn over an unlocked personal electronic device, to get into their social media account;
• Login in front of the employer: access the account in the employer's presence;
• Content: divulge or present any content from the account;
• Privacy settings: change the account or privacy settings to increase third-party access to its contents.

• Contacts: it may not require or coerce a worker or applicant to add anyone, including the employer, to their contacts (495l(c)). This ban does not use the word "request", so our reading, not a court ruling, is that a free request to connect is not itself banned.
• Waivers: no agreement by an employee to waive these rights is valid (495l(d)).
• Retaliation: an employer may not discharge or otherwise retaliate against an employee who exercises or tries to exercise these rights (495l(g)). The text names employees here; it does not separately mention refusing to hire an applicant.

What employers may still do

• Specifically identified content: request an employee to share specifically identified content to comply with its legal and regulatory duties, to investigate an allegation that its proprietary or confidential information or financial data was moved or disclosed through a social media account without authorization, or to investigate an allegation of unlawful harassment, threats of workplace violence, or discriminatory or disparaging content about another employee (495l(e)(1)). Specifically identified content must be described closely enough to tell it apart from everything else in the account, and never includes a username, password or other login (495l(a)(2)). The text says "request", not "require".
• Law enforcement agencies: request or require access to an applicant's account as part of a screening or fitness check, or an employee's account for continued fitness or misconduct, policy or legal violations, and keep the information as the law and agency policy allow (495l(e)(2), (3)).
• Legal duties: comply with State or federal law (495l(e)(4)).
• Work devices: request or require a username or password needed to access an employer-issued electronic device (495l(f)).

The section has no express clause on public information.

Enforcement

• Worker lawsuit: a person aggrieved by a violation may sue in Superior Court for compensatory and punitive damages or equitable relief, including restitution of wages or benefits, reinstatement, costs and reasonable attorney's fees (495b(b)).
• State enforcement: the Attorney General or a State's Attorney may enforce by restraining prohibited acts, seeking civil penalties, obtaining assurances of discontinuance and conducting civil investigations, using Vermont's consumer protection procedures (495b(a)(1)).

What this means in practice

• Employers: do not ask for logins, unlocked phones, a look at accounts, screenshots of content or settings changes. Where an exception applies, ask for specifically identified content, never the login.
• Workers and applicants: you can refuse, and an agreement to give up these rights is not valid. An employee who is punished for using them can sue.

Compare the Maine social media password law and the other states in social media password laws in the US. Nebraska also lets workers sue, and adds a one-year deadline, see the Nebraska social media password law.

This page covers Vermont and is general information based on 21 V.S.A. 495l and 495b as published by the Vermont General Assembly when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.