Employer Access to Employee Personal Social Media Accounts in Utah
Not sure how this applies to you? Ask about your own facts and see which parts of current Utah law apply, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
At a glance
| Governing law and covered accounts | Internet Employment Privacy Act, Utah Code §§ 34-48-102 and 34-48-201–203, covers a personal Internet account used exclusively for personal communications unrelated to the employer's business (§ 34-48-102(4)). |
|---|---|
| Covered employers, employees, and applicants | Employer includes a person, the state, or a political subdivision with one or more workers or operators; the prohibitions cover employees and applicants (§ 34-48-102(2), § 34-48-201). |
| Credential and observed-access demands | Employer may not request a username and password, or a password allowing access to a personal Internet account (§ 34-48-201(1)); the chapter does not separately enumerate an observed-access demand. |
| Contact and privacy-setting demands | The chapter's prohibition addresses usernames and passwords; §§ 34-48-201–203 do not separately state a contact-addition or privacy-setting rule. |
| Refusal, retaliation, and hiring | Employer may not take adverse action, fail to hire, or otherwise penalize an employee or applicant for refusing the prohibited credential disclosure (§ 34-48-201(2)). |
| Investigation and specific-content route | With specific information about account activity tied to legal, regulatory, or work-misconduct compliance, or unauthorized employer-data transfer, an employer may investigate and require cooperation; it may require sharing reported content for a factual determination (§ 34-48-202(1)(c), (2)). |
| Employer accounts, public content, and regulated work | Employer-device and work-account credentials, lawful network controls and monitoring, legal or self-regulatory screening duties, law-enforcement employment investigations, and public or otherwise non-credentialed information are preserved (§ 34-48-202(1)(a), (d)–(e), (3)–(4)). |
| Inadvertently received credentials and use | The chapter does not state a separate safe harbor or later-use rule for an employer that inadvertently receives personal-account credentials; it separately addresses employer-device and network monitoring (§ 34-48-202(1)(e)). |
| Enforcement and remedies | A person aggrieved by a violation may sue an employer in a court of competent jurisdiction; the court must award not more than $500 if it finds a violation (§ 34-48-301). |
Requirements one by one
Passwords and refusal
Utah Code § 34-48-201 bars an employer from requesting an employee's or applicant's username and password, or a password that allows access to a personal Internet account. It also bars adverse action, failure to hire, or another penalty for refusing that disclosure. The account definition in § 34-48-102(4) is limited to an online account used exclusively for personal communications unrelated to the employer's business. Utah Code § 34-48-102(1) defines adverse action to include discharge, threats, and discrimination that affects employment, including compensation, terms, conditions, location, rights, promotions, or privileges.
Investigation and work resources
Utah Code § 34-48-202(1)(c)–(2) preserves an investigation based on specific information about personal-account activity connected to legal, regulatory, or work-misconduct compliance, or a specific unauthorized transfer of employer information. The employer may require cooperation and sharing of reported content to make a factual determination. The same section preserves credentials for employer-provided devices and work accounts, lawful employer-network controls under § 34-48-202(1)(d) and monitoring under § 34-48-202(1)(e), specified screening duties, law-enforcement employment investigations, and information available without the prohibited credentials or in the public domain.
Civil action
Utah Code § 34-48-301 permits a person aggrieved by a violation to bring a civil action against the employer in a court of competent jurisdiction. If the court finds a violation, it must award the aggrieved person no more than $500.
What trips people up
- The account definition is business-related. An account created, maintained, used, or accessed for the employer's business purpose is outside the statutory definition of a personal Internet account (§ 34-48-102(4)(b)).
- The investigation route is fact-specific. Section 34-48-202(1)(c) requires specific information about account activity or an unauthorized employer-data transfer; subsection (2) addresses sharing reported content for the factual determination.
- No monitoring duty exists. Section 34-48-203(1) says the chapter does not require an employer to search or monitor a personal Internet account.
Common questions
Can an employer ask for a password to its own account or device? Yes. Section 34-48-202(1)(a) preserves a request limited to an employer-supplied or employer-paid device, or an employer-provided business account or service.
Can an employer use public information? Yes. Section 34-48-202(4) preserves information available in the public domain or obtainable without the credential information described in § 34-48-201(1).
Does Utah's statute separately ban a demand to add a contact or change a privacy setting? Sections 34-48-201 through 34-48-203 state the credential prohibition and the listed access, investigation, and exception rules; they do not separately enumerate those demands.
Can an affected person sue? Yes. Section 34-48-301 permits a civil action and sets an award of not more than $500 when the court finds a violation.
Statutes and sources
- Utah Code § 34-48-102: definitions; accessed 2026-10-17.
- Utah Code § 34-48-201: credential request and refusal rule; accessed 2026-10-17.
- Utah Code § 34-48-202: permitted employer actions and exceptions; accessed 2026-10-17.
- Utah Code § 34-48-203: no monitoring duty and no-liability provision; accessed 2026-10-17.
- Utah Code § 34-48-301: private right of action and award; accessed 2026-10-17.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Utah law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Utah law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace