Employer Access to Employee Personal Social Media Accounts by State
When may an employer demand access to an employee's or applicant's personal social media account under current state law?
Jurisdictions
43 of 51 verified so far
Statutes checked
Every entry, oldest check October 17, 2026
Columns
9 per state
Access
Free, no account needed
Looking for your own state? Ask about your situation and see what your state's law says, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
What this survey covers
The table compares state rules on an employer's request or requirement that a worker or applicant disclose account credentials, show private content, add a contact, or change a privacy setting. It also records the statute's express investigation and work-account exceptions, refusal rule, and remedy.
Why the columns differ
Washington's RCW 49.44.200 separately prohibits credential demands, employer-observed access, forced contacts, and privacy-setting changes. Its § 49.44.200(2) permits a narrower request for specific content during a qualifying investigation without login information, and § 49.44.205 supplies a civil action. Virginia's Code § 40.1-28.7:5 covers passwords and contacts, but its formal-investigation provision can permit a purpose-limited password request. Illinois's 820 ILCS 55/10 addresses personal online accounts and specific-content investigations. These differences require separate columns.
Scope boundaries
This survey addresses access to a personal account, not every decision based on publicly visible posts or use of an employer's own account. A cell reports the exact accounts, people, exceptions, and remedies its current statute states, without filling silence with a presumed prohibition.
State by state
Every column answered the same way for each jurisdiction. Open a state for the full page, with the statute text and the date it was checked.
Scroll sideways in the table to see all columns →
| State | Governing law and covered accounts | Covered employers, employees, and applicants | Credential and observed-access demands | Contact and privacy-setting demands | Refusal, retaliation, and hiring | Investigation and specific-content route | Employer accounts, public content, and regulated work | Inadvertently received credentials and use | Enforcement and remedies |
|---|---|---|---|---|---|---|---|---|---|
| Alabama verified 2026-10-23 | No general private-employer social media account access statute; Ala. Code § 36-21-55.3(a)(5) addresses officer hiring |
No general private-employer coverage; § 36-21-55.3 applies to law-enforcement agencies and officers |
No general social media account statute addresses credential or observed-access demands |
No general social media account statute addresses forced contacts or privacy changes |
No general social media account refusal or hiring protection |
N/A — no general account-access investigation procedure |
Officer hiring has a separate available-account review (§ 36-21-55.3(a)(5)); no general account exception |
N/A — no general social media account inadvertent-receipt rule |
No general social media account statutory remedy for private workers |
| Alaska verified 2026-10-23 | No account-specific employer-access statute found in current Alaska Statutes |
No social media account statute covers private employers, workers, or applicants |
No social media account statute addresses credential or observed-access demands |
No social media account statute addresses forced contacts or privacy-setting changes |
No social media account statutory refusal or hiring protection |
N/A — no social media account investigation exception or content route |
N/A — no social media account employer-account or public-content exception |
N/A — no social media account inadvertent-receipt rule |
No social media account statutory forum, damages, or penalty |
| Arizona verified 2026-10-27 | No dedicated private-employer personal social media account-access statute in current Title 23 or the statewide code search |
No special account-access coverage for ordinary private employers, workers, or applicants |
No dedicated social media rule for password demands or employer-observed display |
No dedicated social media rule for forced contacts or privacy changes |
No account-specific statutory refusal, retaliation, or hiring protection |
N/A — no dedicated account-access investigation or content-request procedure |
N/A — no dedicated social media statute defining work-account or public-content exceptions |
N/A — no dedicated social media rule on accidentally received passwords |
No dedicated account-access statutory complaint or remedy for ordinary private employment |
| Arkansas verified 2026-10-17 | Ark. Code § 11-2-124 covers personal social media accounts with user-generated content, including messages and email; employer-requested, employer-provided, employer-use, and impersonation accounts are excluded (§ 11-2-124(a)(3)). |
Employers in the state include businesses, state/local government units, and their agents; current employees and prospective employees are covered (§ 11-2-124(a)(1)–(2), (b)). |
Employer may not require, request, suggest, or cause disclosure of a username and password for a personal account; the section does not separately enumerate employer-observed display (§ 11-2-124(b)(1)(A)). |
Employer may not require, request, suggest, or cause a privacy-setting change; it may not require adding another employee, supervisor, or administrator to account contacts (§ 11-2-124(b)(1)(B), (b)(2)). |
Employer may not take or threaten listed action against a current employee for exercising subsection (b) rights or fail/refuse to hire a prospective employee for doing so (§ 11-2-124(c)). |
A formal investigation or related proceeding into alleged law/regulation or written-policy violations may permit a username/password request if account activity is reasonably believed relevant; use is limited to that purpose (§ 11-2-124(e)(2)). |
Employer-requested or employer-provided business accounts are excluded; public Internet information may be viewed, and legal or self-regulatory duties remain (§ 11-2-124(a)(3)(B), (d), (e)(1)). |
Accidental receipt of login information through an employer device or network monitor excuses possession, but the employer may not use it to access the personal account (§ 11-2-124(b)(3)). |
§ 11-2-124 states the employer bans and exceptions but names no account-specific complaint forum, damages amount, or private action. |
| California verified 2026-10-17 | Labor Code § 980 covers personal social media; its broad social-media definition includes electronic accounts and content such as messages and email (§ 980(a)–(b)). |
The access ban names employers, employees, and employment applicants; § 980 states no employer-size threshold or express public-employer carveout (§ 980(b), (e)). |
Employer may not request or require a username/password for personal social media, access in its presence, or disclosure of personal social media (§ 980(b)(1)–(3)). |
Section 980 has no separate contact-addition or privacy-setting clause; its express prohibitions concern credentials, observed access, and divulging personal social media (§ 980(b)). |
Employer may not discharge, discipline, threaten either, or otherwise retaliate for refusing a demand that violates § 980; otherwise lawful adverse action remains possible (§ 980(e)). |
Employer may request an employee to divulge personal social media reasonably believed relevant to alleged misconduct or legal/regulatory violation; use is limited to the investigation or related proceeding (§ 980(c)). |
Employer may seek a login method for an employer-issued electronic device (§ 980(d)); § 980 states no separate public-content, regulated-work, or law-enforcement-screening exception. |
Section 980 gives no specific inadvertent-receipt or later-use rule; the listed rules address employer requests, access, disclosure, and retaliation (§ 980(b)–(e)). |
Section 980(e) prohibits retaliation, but § 980 itself names no dedicated complaint forum, damages, penalty, injunction, or attorney-fee remedy. |
| Colorado verified 2026-10-17 | Colo. Rev. Stat. § 8-2-127 covers an employee's or applicant's personal account or service through a personal electronic communications device; its social-media contact and privacy-setting clauses are explicit (§ 8-2-127(2)(a)). |
Private enterprises and state/local government units and their agents are covered; corrections departments and law-enforcement agencies are excluded (§ 8-2-127(1)(a), (c)). |
Employer may not suggest, request, or require disclosure of a user name, password, or other access means through the worker's personal device; the statute does not separately enumerate observed display (§ 8-2-127(2)(a)). |
Employer may not compel adding anyone to social-media contacts or require, request, suggest, or cause a social-network privacy-setting change (§ 8-2-127(2)(a)). |
No employee penalty or threat, or applicant refusal to hire, for declining credentials, contacts, or privacy-setting changes (§ 8-2-127(3)). |
Financial/securities compliance investigation after information about employee business use, or investigation after information about unauthorized employer-data download, is preserved (§ 8-2-127(4)). |
Employer may require access means for nonpersonal accounts tied to internal systems and enforce nonconflicting personnel policies; confidentiality duties remain (§ 8-2-127(2)(b), (6)–(7)). |
§ 8-2-127(2)(a) prohibits suggested, requested, or required disclosure of personal-account access means; the text centers on employer demands. |
Injured person may complain to Labor and Employment Department; findings follow a hearing within 30 days; rules may set fines up to $1,000 first and $5,000 later (§ 8-2-127(5)). |
| Connecticut verified 2026-10-17 | Conn. Gen. Stat. § 31-40x(a)(5) covers online accounts used exclusively for personal purposes, including email, social media, and retail sites, excluding business accounts. |
Employees and active job seekers are covered; employers include state/local government, but exclude police agencies in preemployment investigations of law-enforcement personnel (§ 31-40x(a)(1)–(3)). |
No request or requirement for authentication means or to open/authenticate an account in the employer's presence (§ 31-40x(b)(1)–(2)). |
Employer may not require the worker to invite it or accept its invitation to an account-affiliated group (§ 31-40x(b)(3)); that is the statute's stated contact rule. |
No employee penalty for listed refusals or for complaining; no refusal to hire an applicant for declining credentials, observed access, or group invitation (§ 31-40x(b)(4)–(5)). |
Specific information about misconduct/compliance or unauthorized company-data transfer permits investigation and requiring account access, without demanding authentication means (§ 31-40x(d)(1)). |
Employer/business accounts and employer-paid devices, discipline for unauthorized data transfer, network monitoring, and statutory or regulatory compliance are preserved (§ 31-40x(c)–(e)). |
§ 31-40x(c)(1), (d)(2) address employer devices and monitoring; § 31-40x states no separate accidental-credential receipt rule. |
Employee/applicant may complain to Labor Commissioner; prevailing complainant gets fees/costs. Employee penalties reach $500/$1,000 plus relief; applicant penalties $25/$500; appeal lies to Superior Court (§ 31-40x(f)–(i)). |
| Delaware verified 2026-10-17 | 19 Del. C. § 709A covers social-network accounts created and operated exclusively for personal use; employer-created/operated accounts used as part of employment are excluded (§ 709A(a)(5)–(6)). |
Delaware public and private employers and agents, employees, and applicants are covered; U.S. government employees/applicants and the federal government are excluded (§ 709A(a)(1), (3)–(4)). |
Employer may not require/request a personal-account username/password, observed login, personal social-media use as an employment condition, or content disclosure except as stated (§ 709A(b)(1)–(4)). |
Employer may not require/request contacts, group invitations/acceptance, or settings changes affecting third-party viewing (§ 709A(b)(5)–(6)). |
No discharge, discipline, threat, or other retaliation against employee/applicant for declining an unlawful demand; otherwise lawful adverse action remains possible (§ 709A(h)). |
Existing policy or legal rights/obligations can support an employee username/password or social-media request reasonably relevant to an employee-misconduct or law-violation inquiry; use is limited to that inquiry/related proceeding (§ 709A(c)). |
Employer-supplied/paid devices and work accounts, network monitoring, legal/self-regulatory screening and retention, law-enforcement hiring/conduct inquiries, and public-domain information remain (§ 709A(d)–(g)). |
§ 709A states no separate accidental-credential receipt or use procedure; its employer-network/device monitoring permission is in subsection (e). |
§ 709A states prohibitions and exceptions but does not specify an account-access complaint forum, damages, fine, or private action. |
| District of Columbia verified 2026-10-30 | No general private-employer account-access statute in the current District Code; § 38-831.04 concerns student accounts |
No general employment coverage; § 38-831.04 addresses educational institutions, school personnel, and students |
No dedicated ordinary-employer statute addressing credential or observed-display demands |
No dedicated ordinary-employer statute addressing forced contacts or privacy changes |
No special employee or applicant refusal protection under an employer account-access statute |
N/A — no general employer account-access investigation procedure |
N/A — no general employer account-access statute defining these exceptions |
N/A — no general employment account-access rule for accidental receipt |
No dedicated employer social media account-access remedy in the District Code |
| Florida verified 2026-10-23 | No general employer social media account access statute in current Florida Statutes |
No social media account statute covering ordinary private employers, workers, and applicants |
No general social media account statute addresses credential or observed-access demands |
No general social media account statute addresses forced contacts or privacy changes |
No general social media account refusal or hiring protection |
N/A — no account-access investigation route in a general social media account statute |
N/A — no general employer-account or public-content exception in such a statute |
N/A — no general social media account inadvertent-receipt rule |
No general social media account statutory remedy for private workers |
| Hawaii verified 2026-10-17 | Haw. Rev. Stat. ch. 487G covers login-protected personal online accounts, including social media and email; employer-opened/provided accounts or discrete portions intended mainly for employer use are excluded (§ 487G-2). |
Employee includes current workers, prospective workers expressing interest or applying, unpaid interns, and independent contractors; employer includes agents, and 'person' includes government entities (§ 487G-2). |
Employer may not require, coerce, or request login information, account access in its presence that exposes login/content, or an unlocked personal device for account access (§ 487G-3(a)(1)(A), (D)–(E)). |
Employer may not demand wider account settings; it may ask without coercion to be added/retained as a content viewer only with a clear statement that consent is voluntary and unnecessary (§ 487G-3(a)(1)(B)–(C)). |
Employer may not take or threaten adverse action for refusing a prohibited demand or the voluntary content-viewer request; prospective employees are within 'employee' (§§ 487G-2, 487G-3(a)(2)). |
Without login credentials, employer may seek specifically identified content for its legal duties, fact-based misconduct/confidentiality inquiry, or safety threats; it may view only shared content, use it only for that purpose, and not alter it (§ 487G-3(b)(4), (c)). |
Public information, federal/state law or court orders, statutory self-regulatory rules, employer-device policies, and discrimination/harassment investigation duties remain (§ 487G-3(b)(1)–(3), (e)). |
Lawful network/device monitoring receipt alone creates no Act liability; employer must secure, not use/share, and dispose of credentials promptly, with stated investigation/litigation retention exceptions (§ 487G-3(d)). |
Attorney general may sue in district court for equitable relief and up to $1,000 per violation/$100,000 per event; employee may sue for equitable relief, actual/general damages, costs, and reasonable fees (§ 487G-5). |
| Illinois verified 2026-10-17 | Right to Privacy in the Workplace Act, 820 ILCS 55/10(b), covers accounts used primarily for personal purposes, excluding accounts used for the employer's business; 'social networking website' is separately defined (§ 10(b)(6)). |
The § 10(b) ban names employers, prospective employers, employees, and applicants, without an express size threshold or public-employer exclusion. |
Employer may not seek credentials or demand access in any manner, nor require or coerce account authentication/display in its presence (§ 10(b)(1)(A)–(B)). |
Employer may not compel affiliated-group invitation, joining an employer account, or adding employer/agency to contacts enabling access; § 10 does not separately name privacy-setting changes (§ 10(b)(1)(C)–(D)). |
Worker retaliation for listed refusals or a complaint is barred; applicant refusal to provide access, observed display, or group invitation cannot justify refusal to hire (§ 10(b)(1)(E)–(F)). |
Employer may seek reported specific content for listed compliance, misconduct, or data-transfer purposes without asking for account authentication; conditions in § 10(b)(3)(C) control. |
Lawful equipment policies/monitoring, public information, legal duties, and specified work accounts remain; regulated screening route is limited to employer-paid or employer-directed accounts (§ 10(b)(2), (3)(A)–(B), (5)). |
Accidental receipt through lawful security/confidentiality monitoring excuses possession unless credentials are used for access or retained past reasonably practicable deletion, subject to a security-investigation exception (§ 10(b)(4)). |
Affected worker/applicant may sue in circuit court without administrative exhaustion; § 17 allows $100–$1,000 per violation, make-whole relief plus $10,000 for job loss/denial, damages, costs and fees, subject to a 3-year period and no double recovery; § 15 also permits a Labor Department complaint. |
| Indiana verified 2026-10-24 | No dedicated ordinary-employer personal social-account access statute in the current Indiana Code |
No dedicated account-access statute covering ordinary employers, employees, or applicants |
No general employer social-account statute addresses passwords or observed access |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated ordinary-employer account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Iowa verified 2026-10-23 | No general employer social media account-access statute in current Iowa Code |
No dedicated account-access statute for ordinary employers, employees, or applicants |
No general social media account statute addresses credentials or observed access |
No general social media account statute addresses contacts or privacy settings |
No dedicated social media account refusal or hiring protection |
N/A — no dedicated account-access investigation procedure |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated employer social media account-access remedy |
| Kansas verified 2026-10-23 | No dedicated ordinary-employer social media account-access statute in current Kansas statutes |
No dedicated account-access statute covering ordinary employers, workers, or applicants |
No general employer account-access statute addresses passwords or observed access |
No general employer account-access statute addresses contacts or privacy settings |
No dedicated social media account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social media account-access remedy |
| Louisiana verified 2026-10-17 | La. R.S. 51:1952(4), 1953 cover online accounts used exclusively for personal communications unrelated to the employer's business. |
Employees and applicants are covered; employer includes private enterprises, state/local government units, and their agents (§§ 51:1952(3), 1953(A)). |
Employer may not request or require username, password, or other authentication information for a personal online account; § 51:1953(A)(1) addresses authentication disclosure. |
§ 51:1953(A)(1) addresses username, password, and other authentication information for the defined account; its stated prohibition does not name contacts or settings. |
No discharge, discipline, hiring refusal, other penalty, or threat for declining the prohibited disclosure (§ 51:1953(A)(2)). |
Specific information about account activity or unauthorized data transfer permits the stated investigation; reported content may be requested to determine facts without obtaining username and password (§ 51:1953(B)(3)–(4)). |
Employer-supplied devices and business accounts, public information, lawful screening/communications duties, network restrictions, and voluntary disclosure are preserved (§ 51:1953(B)(1), (5), (D)–(G)). |
Monitoring-related accidental receipt does not create liability for possession, but the employer may not use the information to enter the account (§ 51:1953(C)). |
§ 51:1953 states the employer prohibitions; § 51:1955 says the chapter creates no duty to monitor an account and no liability for declining to seek access information. |
| Maine verified 2026-10-17 | 26 M.R.S. §§ 615–619 covers user-generated-content accounts, including messages, email, and online services; employer-opened, employer-provided, or primarily employer-use accounts are excluded (§ 615(4)). |
Employers include the State, political subdivisions, and direct/indirect agents; current paid workers and job applicants are covered (§ 615(1)–(3)). |
Employer may not require, coerce, or request a password/other access means or an account login in its presence; it also may not require/coerce disclosure of personal-account information (§ 616(1)–(3)). |
Employer may not require/cause adding anyone to account contacts or require/cause/request changes affecting third-party content visibility (§ 616(4)–(5)). |
No discharge, discipline, other penalty, or threat against an employee for refusing listed demands; no failure or refusal to hire an applicant for that refusal (§ 616(6)–(7)). |
Employer may require reasonably relevant personal-account information for an employee-misconduct or workplace-law investigation if otherwise lawful, using it only as needed for the investigation/related proceeding (§ 617(3)). |
Publicly available information, legally required financial/insurance/securities screening or monitoring, and employer-equipment/software/email policies and access remain (§§ 617(1)–(2), 618). |
The employee social-media subchapter states no separate accidental-credential receipt or use procedure (§§ 615–619). |
Department of Labor fine: at least $100 first violation, $250 second, and $500 each later violation (§ 619). |
| Maryland verified 2026-10-17 | Md. Code, Lab. & Empl. § 3-712 addresses a 'personal account or service' accessed through an electronic communications device; it does not define the term more narrowly (§ 3-712(a)–(b)). |
Employees and applicants are covered; employer includes private enterprises, state/local government units, and agents, representatives, or designees (§ 3-712(a)(2), (4), (b)–(c)). |
Employer may not request or require a user name, password, or other means for accessing a personal account or service; the text does not separately enumerate observed display (§ 3-712(b)(1)). |
§ 3-712(b)(1) prohibits demands for an access means; it does not separately enumerate compelled contacts or privacy-setting changes. |
Employer may not punish or threaten an employee, or fail or refuse to hire an applicant, for refusing the prohibited disclosure (§ 3-712(c)). |
Investigation is preserved after information about employee business use relevant to securities/financial compliance, or unauthorized download of employer proprietary or financial data (§ 3-712(d)–(e)). |
Employer may require access means for nonpersonal accounts serving internal systems; securities/financial compliance investigations are preserved (§ 3-712(b)(2), (e)(1)). |
§ 3-712(b) addresses employer requests or requirements for access means; the section gives no separate treatment to inadvertent receipt. |
Commissioner must try mediation or ask Attorney General to act; Attorney General may seek injunction, damages, or other relief in the county of the alleged violation (§ 3-712(f)). |
| Massachusetts verified 2026-10-30 | No enacted general employer account-access statute; pending S.1356 would add one to Mass. Gen. Laws ch. 151B, § 4 |
No dedicated enacted rule covering ordinary employers, workers, or applicants; S.1356 proposes one |
No general enacted employer account-credential or observed-display prohibition in the surveyed code |
No general enacted employer social-account rule addressing forced contacts or setting changes |
No special refusal or hiring protection under an enacted employer account-access statute |
N/A — no enacted general account-access investigation procedure |
N/A — no enacted employer account-access statute defining these exceptions |
N/A — no enacted general rule for accidentally received account credentials |
No dedicated enacted employer social-account access remedy |
| Michigan verified 2026-10-17 | Internet Privacy Protection Act, MCL §§ 37.272–.278, covers a 'personal internet account' protected by access information and used to view, create, use, or edit account data (§ 37.272(a), (d)). |
Employer includes private entities, state/local government units, and employer agents; § 37.273 protects employees and job applicants without a stated size threshold (§ 37.272(c)). |
Employer may not request granting access, observed account use, or disclosure of information enabling either; the ban is broader than a password request (§ 37.273(a)). |
The express § 37.273(a) ban addresses access, observation, and enabling information; it does not separately enumerate compelled contacts or privacy-setting changes. |
Employer may not discharge, discipline, fail to hire, or otherwise penalize a worker or applicant for refusing the listed personal-account access or observation demands (§ 37.273(b)). |
Employer may investigate or require cooperation based on specific information about account activity for legal/compliance or misconduct review, or specific information about unauthorized proprietary/confidential/financial data transfer (§ 37.275(1)(c)). |
Employer-paid devices and employer-provided/work accounts, lawful network controls, required regulated screening/retention, and information available without credentials or in the public domain remain within § 37.275's express boundaries. |
The Act preserves lawful monitoring of data on employer-paid devices or its network (§ 37.275(1)(e)); § 37.273(a)'s prohibition addresses employer requests for personal-account access or enabling information. |
§ 37.278 makes a violation a misdemeanor with up to a $1,000 fine; affected individual may seek injunction and up to $1,000 damages plus fees/costs in district court, with a documented written demand at least 60 days before damages. |
| Minnesota verified 2026-10-23 | No dedicated ordinary-employer personal social-account access statute in the current Minnesota Statutes |
No dedicated account-access statute for ordinary employers, employees, or applicants |
No general employer social-account statute addresses credentials or observed access |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Missouri verified 2026-10-23 | No dedicated ordinary-employer personal social-account access statute in current Missouri statutes |
No dedicated account-access statute covering ordinary employers, employees, or applicants |
No general employer social-account statute addresses passwords or observed access |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Montana verified 2026-10-17 | Mont. Code Ann. § 39-2-307 covers password-protected electronic services/accounts and listed content including email and messages; educational and employer-provided accounts intended solely for their respective purposes are excluded (§ 39-2-307(6)). |
Employer or its agent is restricted in demands to employees and job applicants; the section states no public-employer or size exception (§ 39-2-307(1), (4)). |
Employer/agent may not request or require credentials, access in its presence, or disclosure of personal social media or its information, subject to the investigation exception (§ 39-2-307(1)–(2)). |
§ 39-2-307 does not separately enumerate compelled contact additions or privacy-setting changes. |
Employer may not discharge, discipline, threaten either, or otherwise retaliate against an employee or applicant for declining a demand that violates the section (§ 39-2-307(4)(a)). |
Employee must provide requested username/password if specified misconduct, data transfer, or federal/regulatory compliance facts exist, an investigation is underway, and requested information is needed for a factual determination (§ 39-2-307(2)). |
Lawful employer-equipment policies and work-device/software/email access remain; required federal or self-regulatory compliance can trigger the investigation exception (§ 39-2-307(2)(a)(iii), (3)(a), (6)(b)). |
§ 39-2-307 states no separate rule for credentials inadvertently obtained through employer monitoring. |
Employee/applicant may sue within one year in small claims court; damages are $500 or actual damages up to the § 3-10-1004 limit, and prevailing-party costs may be awarded. An employee may seek injunctive relief against a qualifying credential request; a later security breach after improper acquisition triggers a cross-reference to § 30-14-142 penalties (§ 39-2-307(3)(b), (7)–(8)). |
| Nebraska verified 2026-10-17 | Workplace Privacy Act, Neb. Rev. Stat. §§ 48-3501–3511; a personal Internet account requires login information and excludes employer/school supplied or paid accounts and exclusively employer-business accounts, subject to the paid-enhancement carveout (§ 48-3502(6)). |
Public and nonpublic employers, their agents, current employees, and job applicants are covered (§ 48-3502(2), (4)–(5)). |
Employer may not request or require credentials or related access information, or require/request a login in its presence that lets it observe contents or gain access (§ 48-3503(1)–(2)). |
Employer may not require adding anyone to account contacts or require/coerce a settings change affecting others' ability to view content (§ 48-3503(3)). |
No adverse action, refusal to hire, or other penalty for declining a prohibited demand; no required waiver; no retaliation/discrimination for filing or participating in an Act complaint (§§ 48-3503(4), 48-3504–3505). |
Employer may investigate or require employee cooperation on specific information of potentially wrongful account activity or unauthorized transfer of specified employer data; § 48-3507(6) does not itself authorize a general credential demand. |
Employer equipment/business accounts, lawful monitoring/policies, public information, legal or self-regulatory screening, law-enforcement investigation, and specified law-enforcement employment screening remain within §§ 48-3507–3508. |
Accidental discovery through lawful service/security monitoring excuses receipt, but employer may not use or share credentials and must delete them as soon as practicable (§ 48-3510). |
Aggrieved employee/applicant may sue in county-of-violation district court within one year of violation or discovery, whichever later; successful complainant may receive injunction, general/special damages, fees, and costs (§ 48-3511). |
| Nevada verified 2026-10-17 | NRS 613.135 covers a personal social media account; the statutory account definition includes electronic content, email, messages, blogs, online services, and website profiles (§ 613.135(4)). |
The ban applies to any employer in Nevada and protects employees and prospective employees; § 613.135 states no employer-size threshold (§ 613.135(1)). |
Employer may not directly or indirectly require, request, suggest, or cause disclosure of a username, password, or other information providing personal-account access (§ 613.135(1)(a)); observed display is not separately enumerated. |
§ 613.135 addresses access information and refusal; it does not separately enumerate forced contacts or privacy-setting changes. |
Employer may not discharge, discipline, discriminate, deny employment or promotion, or threaten those actions because a worker or applicant refuses to disclose access information (§ 613.135(1)(b)). |
§ 613.135 states no separate investigation or specific-content exception; its express qualifications concern employer internal systems and compliance with law or self-regulatory rules (§ 613.135(2)–(3)). |
Employer may require access information for a nonpersonal account or service to enter its own internal system; state/federal law and self-regulatory compliance remain (§ 613.135(2)–(3)). |
§ 613.135 does not separately address accidental receipt of credentials or later use of them; the access-information prohibition remains in subsection (1)(a). |
§ 613.135 makes the listed employer conduct unlawful but states no specific complaint forum, damages amount, or civil-action mechanism. |
| New Hampshire verified 2026-10-17 | RSA 275:73–75 covers social-network accounts primarily used for personal communications; business-purpose or business-communication accounts are excluded. RSA 275:74(II) also names electronic-mail accounts for contacts and privacy settings. |
Employer restrictions address employees and prospective employees/applicants; the subdivision states no special public-employer or size threshold (RSA 275:73–74). |
Employer may not request or require login information for a personal account/service through an electronic communication device; observed login is not separately enumerated (RSA 275:74(I)). |
Employer may not compel adding anyone to contacts or require reduced settings that affect third-party viewing of an email or personal account (RSA 275:74(II)). |
No disciplinary action or threat against an employee for refusing an unlawful demand; RSA 275:74(III) does not separately state an applicant refusal-to-hire clause. |
On the information specified in RSA 275:74(VI), employer may investigate and require employee cooperation to share only content it already received, for a factual determination (RSA 275:74(VII)). |
Lawful policies and monitoring of employer equipment/email, employer-provided accounts/devices, public information, and statutory or self-regulatory duties remain (RSA 275:74(IV), (VI)(a), (VIII)). |
Inadvertent password receipt through employer network/device monitoring excuses possession but not use to enter the employee's personal account (RSA 275:74(V)). |
Violating RSA 275:74 exposes employer to a civil penalty imposed by the labor commissioner under RSA 273:11-a; employer may appeal under RSA 273:11-c (RSA 275:75). |
| New Jersey verified 2026-10-17 | N.J.S.A. §§ 34:6B-5–10; a personal account is a social-networking profile used exclusively for personal communications unrelated to the employer's business (§ 34:6B-5). |
Current and prospective employees are covered; employer includes agents but excludes corrections, parole, and state or local law-enforcement agencies (§§ 34:6B-5–6). |
Employer may not request a user name, password, or access to a personal account through an electronic communications device; this reaches an access demand beyond credentials (§ 34:6B-6). |
§ 34:6B-6 addresses credentials and account access; it does not separately enumerate a forced contact or privacy-setting change. |
Retaliation or discrimination for refusal, reporting, participation, or opposition is barred; a waiver tied to applying or an offer is void (§§ 34:6B-7–8). |
Investigation is preserved after specific information about account activity tied to compliance or misconduct, or an unauthorized transfer of employer data (§ 34:6B-10(c)). |
Work-device/account policies, legal and self-regulatory compliance, and public-domain information are preserved (§ 34:6B-10(a), (b), (d)). |
§ 34:6B-6 prohibits employer requests for credentials or access; § 34:6B-10 preserves the listed compliance, work-account, investigation, and public-information activities. |
Commissioner collects civil penalties up to $1,000 for a first violation and $2,500 for each later one in a summary proceeding (§ 34:6B-9). |
| New Mexico verified 2026-10-17 | N.M. Stat. § 50-4-34 covers an applicant's account or profile on a defined social networking web site; the definition requires profiles, connection lists, and navigation among connections (§ 50-4-34(A), (E)). |
Employer demands directed at prospective employees are covered; § 50-4-34 does not extend its access prohibition to current employees, and excludes federal, state, and local law enforcement agencies (§ 50-4-34(A), (D)). |
An employer may neither request nor require an applicant's password for access, nor demand access to the applicant's covered account or profile in any manner (§ 50-4-34(A)). |
The applicant-access ban is broad, but § 50-4-34 does not separately name contact additions or privacy-setting changes (§ 50-4-34(A)–(E)). |
§ 50-4-34 makes the applicant access demand unlawful; it states no separate refusal, retaliation, or hiring remedy (§ 50-4-34(A)–(E)). |
§ 50-4-34 states no investigation exception or specific-content request procedure for a covered applicant account (§ 50-4-34(A)–(E)). |
Workplace internet, social-site, and email policies and monitoring employer equipment/email are preserved; public-domain information and legally required government background checks remain available; law enforcement agencies are excluded (§ 50-4-34(B)–(D)). |
§ 50-4-34 states no rule for credentials accidentally received through an employer device or network (§ 50-4-34(A)–(E)). |
§ 50-4-34 declares the covered demand unlawful but names no complaint forum, damages amount, or private action in this section (§ 50-4-34(A)–(E)). |
| New York verified 2026-10-17 | Labor Law § 201-i covers an electronic account or profile used exclusively for personal purposes and user-generated content, including messages and profiles (§ 201-i(1)(d)). |
Private employers, listed state/local/public entities and their agents, employees, and applicants are covered; law-enforcement agencies, fire departments, and corrections are excluded (§ 201-i(1)(a), (c), (6)). |
Employer may not request, require, or coerce personal-account authentication information or access in its presence; it may not reproduce information obtained through those prohibited means (§ 201-i(2)(a)). |
Voluntarily adding an employer or its agent as an account contact is not 'access' under the section; no separate forced-contact or privacy-setting prohibition is stated (§ 201-i(2)(c)). |
Employer may not discipline, penalize, or threaten an employee, or refuse to hire an applicant, for declining information covered by § 201-i(2)(a) (§ 201-i(3)). |
Public information and specified material voluntarily shared by an employee, client, or authorized third party for a misconduct report/inquiry remain usable; a court order may require access (§ 201-i(5)(a)(iv), (c)). |
Business accounts and conditionally employer-paid devices have express routes; public-domain information, legal screening/monitoring duties, and statutory law-compliance defense remain; named safety agencies are exempt (§ 201-i(2)(b), (4)–(6)). |
The express rule prohibits reproducing personal-account material obtained through the credential or observed-access demands barred by § 201-i(2)(a); the section's other exceptions are in § 201-i(5). |
Section 201-i bars the listed employer conduct and allows an affirmative defense for legal compliance, but specifies no dedicated complaint forum, damages, penalty, injunction, or attorney-fee award (§ 201-i(2)–(4)). |
| Oklahoma verified 2026-10-17 | 40 O.S. § 173.2(H)(2) covers accounts used exclusively for personal communications through a content platform, whose content is unavailable to the general public. |
Employees and prospective employees are covered; cross-referenced 25 O.S. § 1301(1) defines employer by paid work or government contracting and excludes tribes and specified membership clubs. |
Employer may not require authentication disclosure or private-content display in its presence, subject to the stated investigation route (40 O.S. § 173.2(A)(1)–(2), (D)). |
§ 173.2(A)(1)–(2) states credential and observed-display prohibitions; those clauses do not name a contact or privacy-setting demand. |
No materially adverse retaliatory personnel action or refusal to hire solely for declining a username/password demand (§ 173.2(A)(3)–(4)). |
Specific information about work misconduct/compliance or unauthorized employer-data transfer permits investigation and seeking reported content needed for factual determination (§ 173.2(D)). |
Employer systems/devices and business accounts are excepted; access through employer systems and legal or self-regulatory compliance are preserved (§ 173.2(B), (E)–(F)). |
Accidental receipt through network/device monitoring creates no liability for possession but bars use to enter the personal account (§ 173.2(C)). |
Employee/applicant may sue in the county of violation within six months; injunction requires clear-and-convincing proof; damages are $500 per violation, without punitive or emotional damages (§ 173.2(G)). |
| Oregon verified 2026-10-17 | ORS 659A.330(8) covers social-media accounts used exclusively for personal purposes, unrelated to employer business, and neither supplied nor paid for by the employer. |
Employees and applicants are covered; Chapter 659A's employer definition reaches one or more employees and public bodies, but § 659A.330(7) excludes law-enforcement units. |
No request or requirement to establish an account or disclose/provide authentication access; no compelled private-content display in employer's presence except reported content under the investigation clause (§ 659A.330(1)(a), (d), (4)(b)). |
No compelled addition of employer or employment agency to social-media contacts; § 659A.330(1)(c) states the contact rule. |
No employee penalty or threat, or applicant hiring refusal, for declining the enumerated account, credential, contact, or observed-display demands (§ 659A.330(1)(e)–(f)). |
After specific information about account activity, employer may investigate legal/regulatory compliance or work misconduct and require reported content necessary for a factual finding, without authentication information (§ 659A.330(4)(a)–(b)). |
Employer-provided/work accounts, public information, and legal or self-regulatory compliance are preserved; law-enforcement units are excluded (§ 659A.330(2), (4)(c), (5), (7)). |
Accidental receipt through network/device monitoring creates no liability for possession, but employer may not use the credentials to enter the account (§ 659A.330(6)). |
Aggrieved person may file a verified labor-bureau complaint within one year; after hearing, commissioner may order cessation, equitable relief, and actual damages (§§ 659A.820(2), 659A.850(4)). |
| Pennsylvania verified 2026-10-24 | No dedicated ordinary-employer personal social-account access statute; separate unauthorized computer-access law (18 Pa.C.S. § 7611(a)(2)) |
No dedicated account-access statute covering ordinary employers, workers, or applicants |
No general employer social-account statute addresses password or observed-access demands |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Rhode Island verified 2026-10-17 | R.I. Gen. Laws ch. 28-56 covers electronic social-media accounts/content, including messages and email; employer-opened, employer-provided, and primarily employer-use accounts are excluded (§ 28-56-1(4)). |
State, political subdivisions, other in-state employers and their direct/indirect agents are covered; current paid workers and applicants are named (§ 28-56-1(1)–(3)). |
Employer may not require, coerce, or request a password/other access means or account access in its presence (§ 28-56-2(1)–(2)). |
Employer may not compel adding anyone to contacts or require, request, or cause settings changes affecting third-party viewing (§ 28-56-3). |
No discharge, discipline, penalty, or threat for employee refusal; no failure/refusal to hire applicant for declining the listed demands (§ 28-56-4). |
Employer may require/coerce relevant account information for an employee-misconduct or workplace-law inquiry if otherwise lawful; access/use is limited to the inquiry or related proceeding (§ 28-56-2(3)). |
Publicly available information and specified legal/self-regulatory financial, insurance, or securities screening and monitoring duties remain (§§ 28-56-1(4), 28-56-5). |
Chapter 28-56 states no distinct rule for accidentally received credentials (§§ 28-56-1–6). |
In a civil action, court may award prevailing employee/applicant declaratory relief, damages, reasonable fees/costs, and injunction against a violating or proposed violation (§ 28-56-6). |
| South Carolina verified 2026-10-24 | No dedicated ordinary-employer personal social-account access statute; separate computer-crime law (S.C. Code § 16-16-20(1)(a)) |
No dedicated account-access statute covering ordinary employers, workers, or applicants |
No general employer social-account statute addresses password or observed-access demands |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| South Dakota verified 2026-10-24 | No dedicated ordinary-employer personal social-account access statute in current South Dakota Codified Laws |
No dedicated account-access statute covering ordinary employers, workers, or applicants |
No general employer social-account statute addresses password or observed-access demands |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Tennessee verified 2026-10-17 | Employee Online Privacy Act of 2014, Tenn. Code §§ 50-1-1002–1003; personal internet accounts include private email, messages, blogs, photos, video, and profiles used exclusively for personal communications (§ 50-1-1002(5)). |
Employer includes any entity with at least one employee, the state and its subdivisions, and agents; applicants and employees are covered (§ 50-1-1002(2)–(3)). |
Employer may not request a personal-account password or compel an employee/applicant to open the account for employer observation (§ 50-1-1003(a)(1), (3)). |
Employer may not compel adding it or an employment agency to personal-account contacts; § 50-1-1003(a) does not separately enumerate privacy-setting changes. |
Employer may not take adverse action, fail to hire, or otherwise penalize refusal of a prohibited password, contact, or observed-access demand (§ 50-1-1003(a)(4)). |
With specific information about compliance/misconduct or unauthorized employer-data transfer, investigation or cooperation is preserved and may require sharing the reported content or information (§ 50-1-1003(b)(3), (c)). |
Employer-paid devices and work accounts, network controls, federal/self-regulatory or law-enforcement screening, and public information are preserved (§ 50-1-1003(b)(1), (4)–(7)). |
§ 50-1-1003(a) bars requesting a personal-account password; subsection (b) preserves specified employer-device and network monitoring. |
§ 50-1-1003 states employer prohibitions and exceptions; that section specifies no damages amount or complaint forum. |
| Texas verified 2026-10-24 | No dedicated ordinary-employer personal social-account access statute; separate computer-security offense (Tex. Penal Code § 33.02(a)) |
No dedicated account-access statute covering ordinary employers, workers, or applicants |
No general employer social-account statute addresses password or observed-access demands |
No general employer social-account statute addresses contacts or privacy settings |
No dedicated social-account refusal or hiring protection |
N/A — no dedicated employer account-access investigation route |
N/A — no dedicated ordinary-employer account-access exceptions |
N/A — no dedicated inadvertent-credential rule |
No dedicated ordinary-employer social-account access remedy |
| Utah verified 2026-10-17 | Internet Employment Privacy Act, Utah Code §§ 34-48-102 and 34-48-201–203, covers a personal Internet account used exclusively for personal communications unrelated to the employer's business (§ 34-48-102(4)). |
Employer includes a person, the state, or a political subdivision with one or more workers or operators; the prohibitions cover employees and applicants (§ 34-48-102(2), § 34-48-201). |
Employer may not request a username and password, or a password allowing access to a personal Internet account (§ 34-48-201(1)); the chapter does not separately enumerate an observed-access demand. |
The chapter's prohibition addresses usernames and passwords; §§ 34-48-201–203 do not separately state a contact-addition or privacy-setting rule. |
Employer may not take adverse action, fail to hire, or otherwise penalize an employee or applicant for refusing the prohibited credential disclosure (§ 34-48-201(2)). |
With specific information about account activity tied to legal, regulatory, or work-misconduct compliance, or unauthorized employer-data transfer, an employer may investigate and require cooperation; it may require sharing reported content for a factual determination (§ 34-48-202(1)(c), (2)). |
Employer-device and work-account credentials, lawful network controls and monitoring, legal or self-regulatory screening duties, law-enforcement employment investigations, and public or otherwise non-credentialed information are preserved (§ 34-48-202(1)(a), (d)–(e), (3)–(4)). |
The chapter does not state a separate safe harbor or later-use rule for an employer that inadvertently receives personal-account credentials; it separately addresses employer-device and network monitoring (§ 34-48-202(1)(e)). |
A person aggrieved by a violation may sue an employer in a court of competent jurisdiction; the court must award not more than $500 if it finds a violation (§ 34-48-301). |
| Vermont verified 2026-10-17 | 21 V.S.A. § 495l covers social-media accounts used to create, share, or interact with content, including messages and email; employer-provided or primarily employer-use accounts are excluded (§ 495l(a)(1)). |
Employers with one or more Vermont service providers, including governmental bodies and agents, are covered; § 495l protects employees and applicants (§§ 495d(1)–(2), 495l(b)). |
No required, requested, or coerced credentials, unlocked personal device for account access, employer-observed login, or account-content presentation (§ 495l(b)(1)–(3)). |
No required or coerced new contact; no required, requested, or coerced setting change that expands third-party access (§ 495l(b)(4), (c)). |
No discharge or other retaliation against an employee exercising these rights; the demand bans also cover applicants, but § 495l states no separate refusal-to-hire clause (§ 495l(b), (g)). |
Employer may request specifically identified content for legal/regulatory compliance or specified disclosure, harassment, violence, or discriminatory-content investigations; credentials are excluded from that content (§ 495l(a)(2), (e)(1)). |
Employer-provided or primarily work-use accounts are excluded; law-enforcement agencies have applicant screening and employee fitness/investigation access exceptions; employer-device credentials and legal compliance remain available (§ 495l(a)(1), (e)(2)–(4), (f)). |
Section 495l states no separate accidental-credential procedure; its access-demand ban and listed exceptions remain the stated rule (§ 495l). |
Attorney General or State’s Attorney may enforce; an aggrieved person may sue in Superior Court for damages or equitable relief, including costs and reasonable attorney fees (§§ 495l(g), 495b(a)–(b)). |
| Virginia verified 2026-10-17 | Va. Code § 40.1-28.7:5 covers personal accounts for sharing or viewing user-generated content, including messages and email; employer-created, supplied, or represented accounts are excluded (§ 40.1-28.7:5(A)). |
Current and prospective employees are protected; employer includes private employers, state/local units, and their agents or designees (§§ 40.1-2, 40.1-28.7:5(A)–(B)). |
Employer may not require disclosure of a personal account's username and password; § 40.1-28.7:5(B) states this credential rule rather than a separate observed-display rule. |
Employer may not require adding an employee, supervisor, or administrator to account contacts; § 40.1-28.7:5(B) does not separately enumerate privacy-setting changes. |
Employer may not punish or threaten a current worker, or refuse to hire an applicant, for exercising rights under this section (§ 40.1-28.7:5(D)). |
Existing rights to request an employee's password are preserved for a formal investigation or proceeding when activity is reasonably believed relevant to specified legal or written-policy allegations; use is limited to that purpose (§ 40.1-28.7:5(F)(2)). |
Employer-created/provided or impersonating accounts fall outside the definition; public information and legal or self-regulatory compliance are preserved (§ 40.1-28.7:5(A), (E), (F)(1)). |
Receipt via employer device or network monitor creates no liability for possession, but the employer may not use the login to access the account (§ 40.1-28.7:5(C)). |
§ 40.1-28.7:5 states the employer duties and exceptions; its text specifies no damages, civil-action procedure, fee award, or complaint forum. |
| Washington verified 2026-10-17 | RCW 49.44.200–.205 govern personal social networking accounts and employer-access demands; the current § 49.44.200 text includes a 2021 amendment. |
Employers with one or more workers, their agents, state and local governments, employees, and job applicants are covered (§ 49.44.200(5)(b), (d)). |
Employer may not request, require, or coerce disclosure of login information or an account display in its presence that lets it observe contents (§ 49.44.200(1)(a)–(b)). |
Employer may not compel an employee or applicant to add a contact or request, require, or cause a change in settings affecting third-party viewing (§ 49.44.200(1)(c)–(d)). |
Employer may not take adverse action because a worker or applicant refuses the listed demands; adverse action includes discipline, threats, and refusal to hire (§ 49.44.200(1)(e), (5)(a)). |
A qualifying investigation prompted by information about account activity may seek specific content for law, misconduct, or data-transfer review, but may not seek login information (§ 49.44.200(2)). |
Work platforms and employer-provided or employer-paid accounts/devices are outside or excepted; nonconflicting policies and legal or regulatory duties remain (§ 49.44.200(3)). The officer-background exception still forbids demanding login information (§ 49.44.200(3)(e)). |
Accidental receipt through an employer device or network monitor does not create liability for possession, but the employer may not use the login information to access the personal account (§ 49.44.200(4)). |
An aggrieved employee or applicant may sue; court may award equitable relief, actual damages, a $500 penalty, and reasonable attorney fees and costs; a frivolous-action fee rule also applies (§ 49.44.205). |
| West Virginia verified 2026-10-17 | W. Va. Code § 21-5H-1 covers an account, service, or profile on a social networking website used exclusively for personal communications unrelated to the employer's business (§ 21-5H-1(e)). |
The prohibition names an employer's demands to an employee or potential employee; § 21-5H-1 gives no special public-employer definition (§ 21-5H-1(a), (e)). |
Employer may not request, require, or coerce disclosure of authentication information or an account login in its presence (§ 21-5H-1(a)(1)–(2)). |
Employer may not compel adding itself or an employment agency to access-enabling contacts; § 21-5H-1 does not separately name privacy-setting changes (§ 21-5H-1(a)(3)). |
§ 21-5H-1(a) bars the listed demands to employees and potential employees; it states no separate refusal-retaliation or hiring clause. |
Specific information of unauthorized transfer permits an investigation and reported-content request; specific content may also be requested for legal/regulatory compliance or work-related misconduct (§ 21-5H-1(b)(4), (6)). |
Public information, legal compliance, employer devices and business accounts, limits on personal-account use during work, and harassment investigations are preserved (§ 21-5H-1(b)(1)–(3), (5), (d)). |
Accidental receipt through lawful security/confidentiality monitoring avoids liability only with no access/use by employer or enabled third party, timely deletion unless held for an ongoing security investigation, and reasonable security where likely (§ 21-5H-1(c)). |
The complete Article 5H consists of § 21-5H-1; it states the access prohibitions but names no account-specific complaint forum, damages, or private action. |
| Wisconsin verified 2026-10-17 | Wis. Stat. § 995.55 covers an internet account created and used exclusively for personal communications; 'access information' includes credentials and other security information (§ 995.55(1)). |
Any employer with at least one worker, including state/local government, is covered; employees and employment applicants are protected (§ 995.55(1)(c), (2)(a)). |
As a condition of employment, employer may not request or require credentials, access, or observation of a personal account (§ 995.55(2)(a)1.). |
§ 995.55(2)(a)1. covers access information, access, and observation; it does not separately enumerate contacts or privacy-setting changes. |
No discharge or discrimination for refusal, opposition, complaint, or testimony; no refusal to hire for declining access or observation (§ 995.55(2)(a)2.–3.). |
On reasonable cause for specified account-linked misconduct or unauthorized data transfer, employer may require account access/observation for investigation but not credentials (§ 995.55(2)(b)3.). |
Work devices/accounts, public information, legal screening/retention duties, and a financial-services business-use exception are preserved (§ 995.55(2)(b)1., 4.–7., (c)). |
No liability for inadvertently obtained credentials through employer devices or monitoring if the employer does not use them to access the account (§ 995.55(2)(d)). |
Violation may bring a forfeiture up to $1,000; a fired/discriminated worker or rejected applicant may complain to Workforce Development for remedial orders (§ 995.55(6)(a)–(b)). |
This survey covers 43 of 51 jurisdictions so far; new states are verified and added continuously. A state missing here hasn't been verified yet. We don't publish unverified answers. Georgia and Idaho and Kentucky and Mississippi and North Carolina and North Dakota and Ohio are a separate case: no official statute text is publicly available to quote there.
Have a specific situation?
A 50-state comparison shows the landscape. Ask your exact question and see what your state's law says for your facts, with citations.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace