Can a Wisconsin employer ask for your social media password? Wis. Stat. 995.55 explained

Wisconsin bars employers from asking for access to the personal internet accounts of employees and job applicants. The rules are in section 995.55 of the Wisconsin Statutes, "Internet privacy protection", created by 2013 Wisconsin Act 208 and amended by 2017 Wisconsin Act 59 (Wis. Stat. 995.55). The same section also covers schools and landlords; this page covers the employment rules.

The short answer: a Wisconsin employer may not request or require an employee or applicant, as a condition of employment, to disclose the login to a personal internet account or to grant access to it or allow it to be observed, and may not fire, discriminate against or refuse to hire someone for refusing. It can still require logins for devices and accounts it supplies or pays for, and in some investigations it can require a worker to show the account, but not to hand over the password.

Who is covered

• Employer: any person engaging in any activity, enterprise or business employing at least one individual, including the state, its political subdivisions and state and local government bodies, among them the legislature and the courts (995.55(1)(c)).
• Employees and applicants: both are protected (995.55(2)(a)).
• Personal internet account: an internet-based account created and used by an individual exclusively for personal communications (995.55(1)(d)). Access information means a username and password or any other security information that protects access to the account (995.55(1)(a)).

The law is not limited to social media, but because the definition is limited to accounts used exclusively for personal communications, an account also used for work falls outside it.

What employers may not do

• Ask for the login, access or a look: request or require an employee or applicant, as a condition of employment, to disclose access information for a personal internet account, or otherwise to grant access to or allow observation of the account (995.55(2)(a)1.).
• Retaliate: discharge or otherwise discriminate against an employee for refusing, for opposing a banned practice, for filing a complaint or trying to enforce the right, or for testifying or assisting in a proceeding (995.55(2)(a)2.).
• Refuse to hire: refuse to hire an applicant because they refused to disclose the login, grant access or allow observation (995.55(2)(a)3.).

Because the ban covers requests to "allow observation of" an account, our reading, not a court ruling, is that asking a worker to log in and show their account is covered as well as asking for the password. The law does not separately mention adding the employer as a contact or changing privacy settings.

What employers may still do

• Work devices and accounts: request or require an employee to disclose access information for an electronic communications device supplied or paid for in whole or in part by the employer, or for an account or service provided by the employer, obtained through the employment relationship or used for its business purposes (995.55(2)(b)1.).
• Data taken without permission: discharge or discipline an employee for transferring the employer's proprietary or confidential information or financial data to a personal account without authorization (995.55(2)(b)2.).
• Investigations: investigate, and require an employee to cooperate, where the employer has reasonable cause to believe there was an unauthorized transfer of its data, or that activity on the account relates to employment-related misconduct, a violation of law or a breach of work rules in an employee handbook. In such an investigation it may require the employee to grant access to or allow observation of the account, but may not require the login (995.55(2)(b)3.).
• Work networks: restrict or block certain websites on employer-supplied devices or the employer's network or other resources (995.55(2)(b)4.).
• Legal duties: comply with a duty to screen applicants or to monitor or retain employee communications set by state or federal law or the rules of a securities self-regulatory organization (995.55(2)(b)5.).
• Public information and email addresses: view, access or use information that can be obtained without access information or is in the public domain, and request or require an employee's personal email address (995.55(2)(b)6., 7.).
• Financial services: the ban does not apply to an account or device that an employee providing financial services uses to conduct the employer's business where federal securities laws or self-regulatory rules impose content, supervision and retention requirements (995.55(2)(c)).
• Logins picked up by monitoring: an employer that inadvertently obtains a login through monitoring its network or devices it supplies is not liable for possessing it, as long as it does not use it to access the personal account (995.55(2)(d)).

The section also says it creates no duty for an employer to search or monitor personal accounts, and that an employer is not liable for failing to ask for access (995.55(5)).

Enforcement

• Forfeiture: anyone who violates the employer rules may be required to forfeit not more than $1,000 (995.55(6)(a)).
• Complaint to the Department of Workforce Development: an employee who is discharged or discriminated against, or an applicant who is not hired, in violation of the law can file a complaint with the department, which processes it like an employment discrimination complaint and can order the employer to take remedial action authorized under s. 111.39 (995.55(6)(b)).

The section does not itself give workers a right to sue in court.

What this means in practice

• Employers: a request alone is covered, and so is asking to see an account. Keep login requirements to devices and accounts you supply or pay for, and in an investigation with reasonable cause ask to see the relevant content, never for the password.
• Workers and applicants: you can refuse. If you are fired, treated worse or not hired for refusing, you can complain to the Department of Workforce Development. Public posts can still be seen, and an employer may ask for your personal email address.

Compare the Oklahoma social media password law and the other states in social media password laws in the US. Rhode Island has its own law, which also bars compelling a worker to add contacts and requesting privacy setting changes.

This page covers Wisconsin and is general information based on the Wisconsin Statutes published by the Wisconsin Legislature when checked on 3 November 2026, not legal advice. Check for later amendments before relying on it.