Employer Access to Employee Personal Social Media Accounts in Virginia
Not sure how this applies to you? Ask about your own facts and see which parts of current Virginia law apply, with citations to the statutes.
Free for 7 days, then $249/mo. Cancel anytime.
At a glance
| Governing law and covered accounts | Va. Code § 40.1-28.7:5 covers personal accounts for sharing or viewing user-generated content, including messages and email; employer-created, supplied, or represented accounts are excluded (§ 40.1-28.7:5(A)). |
|---|---|
| Covered employers, employees, and applicants | Current and prospective employees are protected; employer includes private employers, state/local units, and their agents or designees (§§ 40.1-2, 40.1-28.7:5(A)–(B)). |
| Credential and observed-access demands | Employer may not require disclosure of a personal account's username and password; § 40.1-28.7:5(B) states this credential rule rather than a separate observed-display rule. |
| Contact and privacy-setting demands | Employer may not require adding an employee, supervisor, or administrator to account contacts; § 40.1-28.7:5(B) does not separately enumerate privacy-setting changes. |
| Refusal, retaliation, and hiring | Employer may not punish or threaten a current worker, or refuse to hire an applicant, for exercising rights under this section (§ 40.1-28.7:5(D)). |
| Investigation and specific-content route | Existing rights to request an employee's password are preserved for a formal investigation or proceeding when activity is reasonably believed relevant to specified legal or written-policy allegations; use is limited to that purpose (§ 40.1-28.7:5(F)(2)). |
| Employer accounts, public content, and regulated work | Employer-created/provided or impersonating accounts fall outside the definition; public information and legal or self-regulatory compliance are preserved (§ 40.1-28.7:5(A), (E), (F)(1)). |
| Inadvertently received credentials and use | Receipt via employer device or network monitor creates no liability for possession, but the employer may not use the login to access the account (§ 40.1-28.7:5(C)). |
| Enforcement and remedies | § 40.1-28.7:5 states the employer duties and exceptions; its text specifies no damages, civil-action procedure, fee award, or complaint forum. |
Requirements one by one
Credentials and contacts
Va. Code § 40.1-28.7:5(B) prohibits requiring a worker or applicant to disclose a username and password or add an employee, supervisor, or administrator as a contact. Subsection (A)'s account definition includes messages and emails in a personal service used to create, share, or view user-generated content.
Formal investigations
Va. Code § 40.1-28.7:5(F)(2) preserves existing rights or obligations to request an employee's password when account activity is reasonably believed relevant to a formal investigation or related proceeding concerning a legal violation or the employer's written policies. Any password obtained under that route may be used only for that investigation or related proceeding.
Inadvertent receipt and refusal
Va. Code § 40.1-28.7:5(C) excuses possession of login information inadvertently received through an employer device or network-monitoring program, but bars using it to enter the account. Subsection (D) protects a current employee against threatened or actual penalties and a prospective employee against a refusal to hire for exercising rights under the section.
What trips people up
- The investigation route is narrower than routine screening. Section 40.1-28.7:5(F)(2) requires a formal investigation or related proceeding and a reasonable belief that account activity is relevant to specified allegations.
- Work accounts are outside the definition. Section 40.1-28.7:5(A) excludes employer-provided accounts and accounts created for the employer.
Common questions
Can an employer view public posts? Yes. Va. Code § 40.1-28.7:5(E) preserves viewing publicly available information.
Are government employers covered? Yes. Subsection (A) includes state and local government units and their agents or designees; Va. Code § 40.1-2 supplies the underlying employer definition.
Does receiving a password through network monitoring permit use? No. Section 40.1-28.7:5(C) says the employer may not use that information to access the account.
Statutes and sources
- Va. Code § 40.1-2: definitions; accessed 2026-10-17.
- Va. Code § 40.1-28.7:5: account-access rule; accessed 2026-10-17.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Virginia law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Virginia law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace