Employer Access to Employee Personal Social Media Accounts in Colorado
Not sure how this applies to you? Ask about your own facts and see which parts of current Colorado law apply, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
At a glance
| Governing law and covered accounts | Colo. Rev. Stat. § 8-2-127 covers an employee's or applicant's personal account or service through a personal electronic communications device; its social-media contact and privacy-setting clauses are explicit (§ 8-2-127(2)(a)). |
|---|---|
| Covered employers, employees, and applicants | Private enterprises and state/local government units and their agents are covered; corrections departments and law-enforcement agencies are excluded (§ 8-2-127(1)(a), (c)). |
| Credential and observed-access demands | Employer may not suggest, request, or require disclosure of a user name, password, or other access means through the worker's personal device; the statute does not separately enumerate observed display (§ 8-2-127(2)(a)). |
| Contact and privacy-setting demands | Employer may not compel adding anyone to social-media contacts or require, request, suggest, or cause a social-network privacy-setting change (§ 8-2-127(2)(a)). |
| Refusal, retaliation, and hiring | No employee penalty or threat, or applicant refusal to hire, for declining credentials, contacts, or privacy-setting changes (§ 8-2-127(3)). |
| Investigation and specific-content route | Financial/securities compliance investigation after information about employee business use, or investigation after information about unauthorized employer-data download, is preserved (§ 8-2-127(4)). |
| Employer accounts, public content, and regulated work | Employer may require access means for nonpersonal accounts tied to internal systems and enforce nonconflicting personnel policies; confidentiality duties remain (§ 8-2-127(2)(b), (6)–(7)). |
| Inadvertently received credentials and use | § 8-2-127(2)(a) prohibits suggested, requested, or required disclosure of personal-account access means; the text centers on employer demands. |
| Enforcement and remedies | Injured person may complain to Labor and Employment Department; findings follow a hearing within 30 days; rules may set fines up to $1,000 first and $5,000 later (§ 8-2-127(5)). |
Requirements one by one
Access, contacts, and privacy settings
Colo. Rev. Stat. § 8-2-127(2)(a) bars even a suggestion that a worker or applicant disclose access information for a personal account through the person's own device. Colo. Rev. Stat. § 8-2-127(1)(a) defines an applicant as an applicant for employment. It separately prohibits compelled social-media contacts and requested or suggested privacy-setting changes. Subsection (2)(b) permits an access demand for a nonpersonal account connected to the employer's internal systems.
Refusal and investigations
Colo. Rev. Stat. § 8-2-127(3) protects employees against penalties and applicants against refusal to hire for declining the listed demands. Subsection (4) preserves the two stated investigations after receipt of information about specified business use or unauthorized downloading of employer data.
Complaint route
Colo. Rev. Stat. § 8-2-127(5) lets an injured person complain to the Department of Labor and Employment. The Department investigates and issues findings thirty days after a hearing. It may adopt penalty rules with a fine up to $1,000 initially and up to $5,000 for each later offense.
What trips people up
- The contact and settings clauses reach more than passwords. Section 8-2-127(2)(a) names both and even forbids suggesting a privacy change.
- Corrections and law enforcement are outside the employer definition. Section 8-2-127(1)(c) excludes those agencies despite covering other state and local government employers.
Common questions
Can an employer demand credentials for its own system? Section 8-2-127(2)(b) permits an access means for a nonpersonal account or service providing access to its internal systems.
Can an employer keep a workplace policy? Section 8-2-127(6) preserves existing personnel policies that do not conflict with this rule.
Does this let an employee share confidential company information? No. Section 8-2-127(7) preserves confidentiality under law or an employment contract.
Statutes and sources
- Colo. Rev. Stat. § 8-2-127: section-specific official text, checked against the 2026 compilation; accessed 2026-10-17.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Colorado law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Colorado law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace