Employer Access to Employee Personal Social Media Accounts in Illinois
Not sure how this applies to you? Ask about your own facts and see which parts of current Illinois law apply, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
At a glance
| Governing law and covered accounts | Right to Privacy in the Workplace Act, 820 ILCS 55/10(b), covers accounts used primarily for personal purposes, excluding accounts used for the employer's business; 'social networking website' is separately defined (§ 10(b)(6)). |
|---|---|
| Covered employers, employees, and applicants | The § 10(b) ban names employers, prospective employers, employees, and applicants, without an express size threshold or public-employer exclusion. |
| Credential and observed-access demands | Employer may not seek credentials or demand access in any manner, nor require or coerce account authentication/display in its presence (§ 10(b)(1)(A)–(B)). |
| Contact and privacy-setting demands | Employer may not compel affiliated-group invitation, joining an employer account, or adding employer/agency to contacts enabling access; § 10 does not separately name privacy-setting changes (§ 10(b)(1)(C)–(D)). |
| Refusal, retaliation, and hiring | Worker retaliation for listed refusals or a complaint is barred; applicant refusal to provide access, observed display, or group invitation cannot justify refusal to hire (§ 10(b)(1)(E)–(F)). |
| Investigation and specific-content route | Employer may seek reported specific content for listed compliance, misconduct, or data-transfer purposes without asking for account authentication; conditions in § 10(b)(3)(C) control. |
| Employer accounts, public content, and regulated work | Lawful equipment policies/monitoring, public information, legal duties, and specified work accounts remain; regulated screening route is limited to employer-paid or employer-directed accounts (§ 10(b)(2), (3)(A)–(B), (5)). |
| Inadvertently received credentials and use | Accidental receipt through lawful security/confidentiality monitoring excuses possession unless credentials are used for access or retained past reasonably practicable deletion, subject to a security-investigation exception (§ 10(b)(4)). |
| Enforcement and remedies | Affected worker/applicant may sue in circuit court without administrative exhaustion; § 17 allows $100–$1,000 per violation, make-whole relief plus $10,000 for job loss/denial, damages, costs and fees, subject to a 3-year period and no double recovery; § 15 also permits a Labor Department complaint. |
Requirements one by one
Demands for access and contacts
Under 820 ILCS 55/10(b)(1), an employer may not demand access “in any manner” to a personal online account. The provision separately bars authentication in the employer's presence, forced invitations to account groups, and compelled contacts that would enable account access. Its definition covers an account used primarily for personal purposes, while excluding an account used for the employer's business (§ 10(b)(6)(B)).
Specific reported content
Section 10(b)(3)(C) permits asking for particular content already reported to the employer for the listed compliance, information-transfer, or misconduct purposes. The employer cannot use this route to require a username, password, or other account authentication. Lawful equipment policies and monitoring are addressed separately by § 10(b)(2).
Accidental receipt and remedy
Section 10(b)(4) excuses possession of credentials inadvertently captured by otherwise lawful security or confidentiality monitoring, but the employer may not use them to enter the account and generally must delete them promptly once aware, subject to the stated security-investigation exception.
An aggrieved employee or applicant can sue in circuit court under 820 ILCS 55/17(a), without first exhausting the agency route. It provides a $100–$1,000 penalty per violation, additional make-whole relief and a $10,000 penalty for employment denial or loss, plus damages, litigation costs, expert fees, and reasonable attorney fees. Section 17(b) sets a three-year filing period; § 15(b) separately permits a Labor Department complaint.
What trips people up
- A business account has a different boundary. Section 10(b)(6)(B) excludes an account used for the employer's business from the personal online account definition.
- Refusal protection extends to complaints. Section 10(b)(1)(E) covers an employee who files a complaint about a violation as well as one who declines the listed access demands.
- Later use matters after accidental receipt. Section 10(b)(4)'s possession protection ends if the employer uses the credentials for access.
Common questions
Can an employer ask for a specific screenshot during a misconduct inquiry? Section 10(b)(3)(C) permits a request for specific reported content under its listed conditions, without asking for account authentication.
Can an employer monitor its own equipment? Section 10(b)(2) preserves lawful equipment policies and monitoring of employer equipment and email, without turning that into access to a personal online account.
Must a worker complain to the Labor Department before suing? No. Section 17(a) permits a circuit-court suit without exhaustion of the Act's alternative administrative remedies.
Statutes and sources
- 820 ILCS 55/10: account-access limits, exceptions, and definitions; accessed 2026-10-17.
- 820 ILCS 55/15: agency complaint; accessed 2026-10-17.
- 820 ILCS 55/17: private action; accessed 2026-10-17.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Illinois law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Illinois law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace