Virginia limits what employers can demand from the personal social media accounts of employees and job applicants. The rule is section 40.1-28.7:5 of the Code of Virginia, added in 2015 (2015, c. 576) (Va. Code 40.1-28.7:5).
The short answer: an employer may not require a current or prospective employee to disclose the username and password to their personal social media account, or to add an employee, supervisor or administrator to the account's contacts, and may not punish or refuse to hire someone for exercising these rights. It can still look at public information and, in a formal investigation, ask for a login in limited cases.
Who is covered
- Employer: the general Virginia labor law definition, a person or business doing business or operating in Virginia that employs others for wages, salaries or commission (Va. Code 40.1-2), plus any unit of state or local government and any agent, representative or designee of an employer (40.1-28.7:5(A)).
- Employees and applicants: the section protects both current and prospective employees (40.1-28.7:5(B)).
- Social media account: a personal account with an electronic medium or service where users create, share or view user-generated content, such as videos, photos, blogs, podcasts, messages, emails or website profiles (40.1-28.7:5(A)).
Accounts that are not covered: those opened by an employee at the employer's request, provided by the employer (such as a work email account), set up by an employee on the employer's behalf, or set up to impersonate the employer with its name, logos or trademarks (40.1-28.7:5(A)).
What employers may not do
- Require the login: require a current or prospective employee to disclose the username and password to their social media account (40.1-28.7:5(B)(1)).
- Force contacts: require them to add an employee, supervisor or administrator to the list of contacts on their social media account (40.1-28.7:5(B)(2)).
- Use logins picked up by accident: if an employer inadvertently receives an employee's login through a work device or a program that monitors its network, it is not liable for having the information but may not use it to access the employee's account (40.1-28.7:5(C)).
- Retaliate: take action against, threaten to discharge, discipline or otherwise penalize an employee, or fail or refuse to hire an applicant, for exercising these rights (40.1-28.7:5(D)).
The text uses the word "require". Unlike the Illinois, Maryland, Washington and Colorado laws, it does not separately mention requests. Our reading, not a court ruling: a request that a worker feels unable to refuse may still be treated as a requirement, but the text does not settle this.
What employers may still do
- Public information: view information about a current or prospective employee that is publicly available (40.1-28.7:5(E)).
- Other laws: comply with federal, state or local laws, rules or regulations, or the rules of self-regulatory organizations (40.1-28.7:5(F)(1)).
- Formal investigations: the section does not affect an employer's existing rights or obligations to ask for a username and password where the account activity is reasonably believed to be relevant to a formal investigation or related proceeding into an employee's violation of the law or of the employer's written policies. A login obtained this way may only be used for that investigation or proceeding (40.1-28.7:5(F)(2)).
Enforcement
The section itself does not name a penalty, a fine or a right to sue. Other parts of Virginia law may apply to a breach, which this page does not cover. A worker who thinks the section was broken should get advice on the available routes.
What this means in practice
- Employers: do not make sharing a personal login or connecting with managers a condition of a job. Keep work accounts separate and employer-owned, and keep any login obtained in a formal investigation to that investigation.
- Workers and applicants: you can say no to handing over your personal social media password or adding your boss as a contact. Public posts can still be seen, so check your privacy settings.
Compare the Maryland social media password law and the state comparison table in social media password laws in the US.
This page covers Virginia and is general information based on the Code of Virginia published by the Virginia General Assembly when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.
Questions and answers
Can a Virginia employer require my social media password?
No. Va. Code 40.1-28.7:5 bars an employer from requiring a current or prospective employee to disclose the username and password to their personal social media account.
Can a Virginia employer make me add my boss on social media?
No. It may not require you to add an employee, supervisor or administrator to the contacts on your social media account.
Can a Virginia employer look at my public posts?
Yes. The section does not stop an employer from viewing information about you that is publicly available.
Are there exceptions?
Yes. Work accounts are not covered, employers may comply with other laws, and in a formal investigation an employer may ask for a login where the account activity is reasonably believed relevant, using it only for that investigation.