Employer Access to Employee Personal Social Media Accounts in Michigan
Not sure how this applies to you? Ask about your own facts and see which parts of current Michigan law apply, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
At a glance
| Governing law and covered accounts | Internet Privacy Protection Act, MCL §§ 37.272–.278, covers a 'personal internet account' protected by access information and used to view, create, use, or edit account data (§ 37.272(a), (d)). |
|---|---|
| Covered employers, employees, and applicants | Employer includes private entities, state/local government units, and employer agents; § 37.273 protects employees and job applicants without a stated size threshold (§ 37.272(c)). |
| Credential and observed-access demands | Employer may not request granting access, observed account use, or disclosure of information enabling either; the ban is broader than a password request (§ 37.273(a)). |
| Contact and privacy-setting demands | The express § 37.273(a) ban addresses access, observation, and enabling information; it does not separately enumerate compelled contacts or privacy-setting changes. |
| Refusal, retaliation, and hiring | Employer may not discharge, discipline, fail to hire, or otherwise penalize a worker or applicant for refusing the listed personal-account access or observation demands (§ 37.273(b)). |
| Investigation and specific-content route | Employer may investigate or require cooperation based on specific information about account activity for legal/compliance or misconduct review, or specific information about unauthorized proprietary/confidential/financial data transfer (§ 37.275(1)(c)). |
| Employer accounts, public content, and regulated work | Employer-paid devices and employer-provided/work accounts, lawful network controls, required regulated screening/retention, and information available without credentials or in the public domain remain within § 37.275's express boundaries. |
| Inadvertently received credentials and use | The Act preserves lawful monitoring of data on employer-paid devices or its network (§ 37.275(1)(e)); § 37.273(a)'s prohibition addresses employer requests for personal-account access or enabling information. |
| Enforcement and remedies | § 37.278 makes a violation a misdemeanor with up to a $1,000 fine; affected individual may seek injunction and up to $1,000 damages plus fees/costs in district court, with a documented written demand at least 60 days before damages. |
Requirements one by one
Access and refusal
MCL § 37.273(a) prohibits a request to “grant access to, allow observation of, or disclose information that allows access to or observation of” a personal internet account. That covers a demand to open the account for the employer to watch as well as a demand for access information. Subsection (b) protects employees and applicants who refuse, including against refusal to hire. MCL § 37.272(a) defines access information; subsection (d) defines the account by its access-protected content, including profiles, communications, and stored data.
Work resources and specific investigations
MCL § 37.275(1)(a) preserves employer access information for its paid devices and work accounts. Subsection (1)(c) permits an investigation, or requiring cooperation in one, when the employer has specific information about personal-account activity relevant to listed misconduct or compliance issues, or about an unauthorized transfer of the employer's protected data. It does not turn an investigation into a general credential demand under § 37.273(a). MCL § 37.275(2) also preserves specified screening and communications duties imposed by federal law or a self-regulatory organization.
Civil and criminal consequences
MCL § 37.278(1) makes a violation of the employer prohibition a misdemeanor with a fine up to $1,000. Under subsection (2), an affected individual may seek an injunction and up to $1,000 damages plus reasonable attorney fees and court costs in district court. A damages claim requires a documented written demand at least 60 days before filing or adding that claim.
What trips people up
- The investigation route needs specific information. Section 37.275(1)(c) names the two circumstances; suspicion without that predicate is not the stated exception.
- Employer-paid devices and personal accounts differ. Section 37.275(1)(a) permits work-device and work-account access, while § 37.273 addresses a personal internet account.
- A monetary claim has a demand step. Section 37.278(2) requires the documented written demand 60 days before the damages action or amendment.
Common questions
Can an employer read a public profile without a password? Section 37.275(3) preserves information available without required access information or in the public domain.
Does the Act require employers to monitor workers' personal accounts? No. MCL § 37.277(1) expressly says the Act creates no such search or monitoring duty.
Can an employer restrict sites on its own network? Section 37.275(1)(d) preserves restrictions on certain websites while the employee uses an employer-paid device or the employer's network, subject to state and federal law.
Statutes and sources
- MCL § 37.272: definitions; accessed 2026-10-17.
- MCL § 37.273: employer demands and retaliation; accessed 2026-10-17.
- MCL § 37.275: exceptions; accessed 2026-10-17.
- MCL § 37.277: no monitoring duty; accessed 2026-10-17.
- MCL § 37.278: penalties and civil action; accessed 2026-10-17.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Michigan law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Michigan law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace