Can a Washington employer ask for your social media login? RCW 49.44.200 explained

Washington bars employers from demanding access to the personal social networking accounts of employees and job applicants. The rule is RCW 49.44.200, first enacted in 2013 (RCW 49.44.200), and workers can enforce it themselves in court under RCW 49.44.205 (RCW 49.44.205). This page explains what the text says.

The short answer: an employer may not request, require or coerce a worker or applicant to hand over login information, open the account in front of the employer, add the employer or anyone else as a contact, or change privacy settings so others can see the account, and may not take adverse action against anyone who refuses (49.44.200(1)). A worker who wins in court can get actual damages, a $500 penalty, attorneys' fees and costs, and injunctive relief (49.44.205(1)).

What employers may not do

• Request, require or otherwise coerce an employee or applicant to disclose login information for a personal social networking account (49.44.200(1)(a)).
• Make them access the account in the employer's presence in a way that lets the employer see its contents (49.44.200(1)(b)).
• Compel or coerce them to add a person, including the employer, to the account's contacts (49.44.200(1)(c)).
• Request, require or cause them to change settings that affect whether third parties can see the account (49.44.200(1)(d)). This goes further than the Illinois and Maryland rules, which do not mention privacy settings.
• Take adverse action, meaning discharging, disciplining or penalizing an employee, threatening to, or failing or refusing to hire an applicant, because they refused any of the above (49.44.200(1)(e), (5)(a)).

Login information means a user name and password, a password, or other means of authentication that protects access to a personal social networking account (49.44.200(5)(e)). Employer covers any business with one or more employees in Washington and the state and local governments (49.44.200(5)(d)).

What employers may still do

• Investigations: require an employee to share content from a personal account, but only to make a factual determination in an investigation started after receiving information about the employee's activity on the account, for the purpose of legal or regulatory compliance, work-related misconduct, or an alleged transfer of the employer's proprietary, confidential or financial data to the account, and without asking for login information (49.44.200(2)).
• Work platforms and accounts: the section does not apply to social networks, intranets or other platforms intended primarily for work-related communication, and does not stop employers requiring logins for accounts provided through the job or devices and accounts the employer pays for or supplies (49.44.200(3)(a)-(b)).
• Policies and legal duties: enforce personnel policies that do not conflict with the section, and comply with statutes, regulations, case law or self-regulatory organization rules (49.44.200(3)(c)-(d)). Police officer background investigations under RCW 43.101.095 are excluded, but the officer must not be required to give login information (49.44.200(3)(e)).
• Accidental capture: an employer that inadvertently receives login information through its own devices or network monitoring is not liable for possessing it, but may not use it to access the personal account (49.44.200(4)).

Enforcement

An employee or applicant aggrieved by a violation may bring a civil action. The court may award a prevailing worker injunctive or other equitable relief, actual damages, a $500 penalty, and reasonable attorneys' fees and costs (49.44.205(1)). If the court finds in writing that a worker's action was frivolous and advanced without reasonable cause, it may award the employer its reasonable expenses and attorneys' fees (49.44.205(2)).

What this means in practice

• Employers: keep social media out of hiring steps except for what is public, never ask an applicant to "friend" a recruiter or unlock a profile, and when an investigation needs content, ask only for the specific content, never the login.
• Workers and applicants: you can refuse to share a login, open your account in front of a manager, add a contact or change your privacy settings. If you are penalized for refusing, the law lets you sue.

Compare the Illinois social media password law, the Maryland social media password law and the Colorado social media password law, which also covers privacy settings. Washington's biometric rules are covered in Washington biometric law at work. For all four states side by side, see social media password laws compared. Oregon has a similar rule, covered in the Oregon social media password law.

This page covers Washington and is general information based on the statute text published by the Washington State Legislature when checked on 3 November 2026, not legal advice.