Can a West Virginia employer ask for your social media password? W. Va. Code 21-5H-1 explained

West Virginia protects the personal social media accounts of employees and job applicants in section 21-5H-1 of the West Virginia Code, the only section of Article 5H, "Employee Personal Social Media". The Legislature's code site lists it as coming from House Bill 4364 of the 2016 regular session (W. Va. Code 21-5H-1).

The short answer: a West Virginia employer may not request, require or coerce an employee or potential employee to disclose a password or other login to a personal account, or to log in in front of it, and may not compel them to add it or an employment agency as a contact. It can still see public information, require logins for its own devices and accounts, and in some investigations require or request specific content. The section itself has no retaliation clause and names no penalty or right to sue.

This page is based on the section as published by the West Virginia Legislature. Check for later amendments before relying on it.

Who is covered

• Employees and potential employees: both are protected (21-5H-1(a)). The section does not define "employer".
• Personal account: an account, service or profile on a social networking website used by the employee or potential employee exclusively for personal communications unrelated to any business purpose of the employer (21-5H-1(e)). Our reading, not a court ruling, is that this is narrower than laws covering any personal online account, so a personal e-mail account may fall outside it.

What employers may not do

• Ask for the login: request, require or coerce an employee or potential employee to disclose a username and password, password or any other authentication information that allows access to their personal account (21-5H-1(a)(1)).
• Login in front of the employer: request, require or coerce them to access the personal account in the employer's presence (21-5H-1(a)(2)).
• Contacts: compel them to add the employer or an employment agency to the contacts that can access the personal account (21-5H-1(a)(3)). This uses the word "compel", so our reading, not a court ruling, is that a request the worker is free to decline is not covered.

The section does not mention privacy settings, and it does not separately bar punishing a worker or refusing to hire an applicant who says no.

What employers may still do

The section does not prevent an employer from (21-5H-1(b)):

• Public information: accessing publicly available information about an employee or potential employee;
• Legal duties: complying with applicable laws, rules or regulations;
• Work devices and accounts: requiring an employee to disclose a login for an employer-issued electronic device, or for an account or service the employer provides, that comes with the job or that is used for its business;
• Data leak investigations: investigating or requiring an employee to cooperate in an investigation. Where it has specific information about an unauthorized transfer of its proprietary or confidential information or financial data to an employee's personal account, it may require the employee to share the reported content to make a factual determination;
• Work time: banning use of personal accounts during working hours, on employer time or for business purposes;
• Compliance and misconduct: requesting an employee to share specific content from a personal account to ensure compliance with laws, regulatory requirements or bans on work-related misconduct.

The section also keeps the employer's authority and duty to investigate complaints of sexual, racial or other harassment (21-5H-1(d)). If an employer accidentally receives a login through lawful monitoring of its network or devices for security or data confidentiality, it is not liable for having it unless it uses it, lets a third party use it, or fails to delete it as soon as reasonably practicable (unless it is kept for an ongoing security breach investigation). An employer that knows its monitoring is likely to pick up logins must make reasonable efforts to secure them (21-5H-1(c)).

Enforcement

The section does not itself name a penalty, fine, enforcing agency or right to sue. Anyone who thinks it has been broken should ask a West Virginia employment lawyer what routes apply.

What this means in practice

• Employers: do not ask for personal social media logins or for staff and candidates to log in in front of you, and do not press them to connect with you. Keep login requirements to devices and accounts you issue, and ask only for specific content in investigations.
• Workers and applicants: you can refuse a request for your login. The section does not spell out what happens if you are punished for refusing, so get legal advice if that happens.

Compare the Nebraska social media password law and the other states in social media password laws in the US.

This page covers West Virginia and is general information based on W. Va. Code 21-5H-1 as published by the West Virginia Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.