Arkansas
Ark. Code Ann. § 11-2-124; Code Ark. R. 010.14.1-500
Employers may not ask or require employees or applicants to disclose their user names or passwords to a personal online account; change the privacy settlings on their accounts; or add the employer or any of its employees as a contact associated with such an account. A personal online account is one that has user-generated content, including photos, videos, blogs, emails, messages, podcasts, and website profiles or locations. The Arkansas Department of Labor has authority to assess penalties or seek injunctive relief against employers that violate the law.
California
Cal. Lab. Code § 980
Employers may not ask or require employees or applicants to disclosure user names or passwords to social media accounts, to access their social media accounts in the presence of the employer, or to disclose the contents of their social media accounts. Social media means a personal online account or content, including videos, photos, blogs, podcasts, instant messages, text messages, email, or website profiles or locations.
Employers may ask employees to disclose content from their social media pages if it is reasonably believed to be relevant to an investigation into employee misconduct or violation of the law, as long as the information is used solely for the purpose of the investigation.
Colorado
Colo. Rev. Stat. Ann. § 8-2-127
Employers may not suggest, request, or require employees or applicants to disclose user names, passwords, or other means of accessing a personal account through a personal electronic communication device. Employers may not ask or require employees or applicants to change their privacy settings or force them to add anyone, including the employer or its agent, to their contact list.
Employers may investigate employees to ensure compliance with applicable securities or financial laws based on information about an employee’s use of a personal website or account for business purposes. Employers may also investigate employees with regard to unauthorized downloading of employer’s proprietary information or financial data to a personal website or account.
Employees and applicants may file a complaint with the Colorado Department of Labor and Employment. Employers can be fined up to $1,000 for the first violation and up to $5,000 for each subsequent violation.
Connecticut
Conn. Gen. Stat. Ann. § 31-40x
Employers may not ask or require employees or applicants to disclose user names, passwords, or other login information to a personal online account or authenticate or access an online account in the presence of the employer. Employers may not require employees or applicants to invite, or accept an invitation from, an employer to join a group affiliated with a personal online account. An online account is one that is used exclusively for personal purposes, including email accounts, social media accounts, and retail website accounts.
Employers may require employees or applicants to provide access to personal online accounts as part of an investigation into employee misconduct, violations of the law, or the unauthorized transfer of the employer’s confidential or financial data. However, the employer must have specific information relating to the employee’s activity on a personal account, and the employee cannot be required to disclose the user name or password for the account.
Employees and applicants may file a complaint with the state labor commissioner. Employers can be fined up to $500 for the first violation and between $500 and $1,000 for each subsequent violation. Employees can be awarded relief, including job reinstatement, payment of back wages, reestablishment of employee benefits, and reasonable attorneys’ fees and costs.
Delaware
Del. Code Ann. tit. 19, § 709A
Employers may not ask or require employees or applicants to: disclose user names or passwords to a social media account; access social media in the presence of the employer; change the privacy settings to their social media accounts; use personal social media as a condition of employment; or add anyone, including the employer, to their contacts. Protects accounts on social networking websites used exclusively for personal purposes.
Employers may require employees to disclose user names, passwords, or social media reasonably believed to be relevant to an investigation into employee misconduct or violations of the law, as long as the social media is used solely for such purposes.
Illinois
820 Ill. Comp. Stat. Ann. § 55/10; Ill. Admin. Code tit. 56, §§ 360.110, 360.120
Employers may not request, require, or coerce employees or applicants to: disclose user names or passwords or otherwise provide access to personal online accounts, or authenticate or access personal online accounts in the presence of the employer. Employers may not require employees or applicants to: invite the employer to join any group affiliated with the personal online account; join an online account established by an employer; or add an employer or employment agency to their contact lists.
Employers may require that an employee share specific content—but not user names and passwords— that has been reported to the employer from a personal online account for a variety of reasons, including: to comply with laws and regulations; to investigate specific allegations of the unauthorized transfer of the employer’s proprietary information; to investigate specific allegations of employee workplace misconduct or violations of the law; and to prohibit employees from using a personal account for business purposes, or during business hours while on company property and using the company’s network or equipment.
If an employer violates the law, an employees and applicants may file a complaint with the Illinois Department of Labor.
Louisiana
La. Stat. Ann. §§ 51:1951 to 51:1953, 51:1955
Employers may not request or require employees or applicants to disclose user names and passwords or other login information for their personal accounts.
Employers may require employees to share the contents of their personal online accounts as part of an investigation, based on specific information relating to activity on the employee’s personal account, into workplace misconduct, violations of law, or unauthorized transfer of the employer’s confidential or financial data. However, employers may not require the employee to provide the user name and password to the account.
Maine
Me. Rev. Stat. tit. 26, §§ 615 to 619
Employers may not request, require, or coerce employees or applicants to: disclose passwords or other means of access to personal social media accounts; access social media accounts in the presence of the employer; or change the privacy settings to their social media accounts. Employers may not require employees to disclose any personal social media information or add anyone to their contact list. A social media account is an online account through which share user-generated content including videos, photographs, blogs, podcasts, instant and text messages, email, online service accounts, and website profiles and locations.
Employers may require employees to disclose personal social media account information that is reasonably believed to be relevant to an investigation into workplace misconduct or a work-related violation of the law, as long as the information is used solely for such purposes.
An employer that violates the law is subject to a fine from the Department of Labor of at least $100 for the first violation, $250 for the second violation, and $500 for subsequent violations.
Maryland
Md. Code Ann., Lab. & Empl. § 3-712
Employers may not ask or require employees or applicants to disclose user names, passwords, or other information to access personal accounts through an electronic device.
Employers may conduct an investigation when: receiving information about an employee’s use of a personal account for business reasons, in order to ensure compliance with applicable securities or financial laws; or when receiving information about an employee’s unauthorized transfer of the employer’s proprietary information to a personal account.
Whenever the Maryland Labor Commissioner determines that this section has been violated, the commissioner will try to resolve the issue informally through mediation or ask the Maryland Attorney General to bring an action on behalf of the applicant or employee for damages or other relief.
Michigan
Mich. Comp. Laws Ann. §§ 37.271 to 37.278
Employers may not ask employees or applicants to grant access to, allow observation of, or disclose information that allows access to personal internet accounts. A personal account is one that is created through an internet-based service that requires a user to input or store login information on an electronic device to view, create, utilize, or edit the user’s account information, profile, display, communications, or stored data.
Employers may conduct an investigation when: receiving specific information about activity on the employee’s personal internet account, in order to ensure compliance with the law, regulations, or workplace misconduct rules; or when receiving specific information about an employee’s unauthorized transfer of the employer’s proprietary information or financial data to a personal account.
Employers that violate the law can be convicted of a misdemeanor and fined up to $1,000. Employees and applicants may also file a civil claim and recover up to $1,000 in damages plus attorney fees’ and court costs.
Montana
Mont. Code Ann. § 39-2-307
Employers may not ask or require employees or applicants to: disclose user names or passwords to personal social media accounts; access personal social media in the presence of the employer; or reveal personal social media or any information contained in a personal social media account. A personal social media account is a password-protected online account containing email, videos, photos, blogs, podcasts, instant and text messages, online services or accounts, or website profiles or locations.
Employers may request an employee’s user name or password to access personal social media when such access is necessary to make a factual determination in an investigation of workplace misconduct, criminal defamation, the unauthorized transfer of the employer’s proprietary information or financial data to a personal account, or compliance with applicable laws or regulations.
An employee or applicant may bring an action against an employer in small claims court for violations. If successful, an employee or applicant can receive $500 or actual damages up to $7,000, as well as legal costs.
Nebraska
Neb. Rev. Stat. Ann. §§ 48-3501 to 48-3511
Employers may not ask or require employees or applicants to: disclose user names, passwords, or other access information to a personal internet account; or access a personal internet account in the presence of the employer. Employers may not require employees or applicants to change the privacy settings to their personal internet accounts or add anyone to their contact lists.
Employers may require employees to cooperate when investigating specific information about workplace misconduct, violations of applicable laws or regulations, or the unauthorized transfer of the employer’s proprietary information or financial data to a personal online account.
An employee or applicant may file a lawsuit in court and receive appropriate relief, including temporary or permanent injunctive relief, general and special damages, reasonable attorneys’ fees, and costs.
Nevada
Nev. Rev. Stat. Ann. § 613.135
Employers may not request, require, or suggest that employees or applicants disclose user names, passwords, or other information providing access to personal social media accounts. Any personal online account with content including videos, photographs, blogs, podcasts, instant and text messages, email, or website profiles.
New Hampshire
N.H. Rev. Stat. Ann. §§ 275:73 to 275:75
Employers may not ask or require employees or applicants to disclose user names, passwords, or other login information to any personal account or service through an electronic device. Employers may not require employees or applicants to change the privacy settings on their email or social media accounts or add anyone to their email or social media contact lists.
Employers may conduct investigations when: receiving information about an employee’s activity on a personal account, in order to ensure compliance with laws, regulations, or workplace misconduct rules; or when receiving specific information about the unauthorized transfer of proprietary, confidential, or financial data to an employee’s personal account. However, employers may only require that the employee provide the content at issue in order to make a factual determination.
Employers that violate the law are subject to a fine of up to $2,500 from the New Hampshire Labor Commissioner.
New Jersey
N.J. Stat. Ann. §§ 34:6B-5 to 34:6B-10
Employers may not ask or require employees or applicants to disclose user names or passwords, or provide the employer with access in any other manner, to personal online accounts. This protection applies to any account, service or profile on a social networking website used exclusively for personal purposes.
Employers may conduct an investigation: when receiving specific information about an employee’s activity on a personal account, in order to ensure compliance with laws, regulations, and workplace misconduct rules; or when receiving specific information about the unauthorized transfer of proprietary, confidential, or financial data to an employee’s personal account.
Employers that violate the law are subject to a fine of up to $1,000 for the first violation and up to $2,500 for each subsequent violation from the New Jersey Labor Commissioner.
New Mexico
N.M. Stat. Ann. § 50-4-34
Employers may not ask or require applicants to disclose passwords to, or otherwise demand access to, personal accounts on social media networking websites. This protection extents to any internet-based service that allows individuals to: construct a public or semi-public profile within a bounded system created by the service; create a list of other users with whom they share a connection within the system; and view and navigate their list of connections and those made by others within the system.
Oklahoma
Okla. Stat. Ann. tit. 40, § 173.2
Employers may not require employees or applicants to disclose passwords or other information that provide access to personal online social media accounts or require employees to access personal social media in the presence of the employer. A social media account is an online account used exclusively for personal communications and to generate or store content, including videos, photographs, blogs, instant messages, audio recordings, or email.
Employers may review or access personal social media accounts that an employee uses on the employer’s computer system, network, or an employer-issued electronic device.
Employers may conduct an investigation: when receiving specific information about an employee’s activity on a personal social media account in order to ensure compliance with laws, regulations, or workplace misconduct rules; or when receiving specific information about the unauthorized transfer of proprietary or financial data to an employee’s personal social media account. Such investigation may include requiring the employee to share content from a special media account in order to make a factual determination.
An employee or applicant can file a lawsuit and receive injunctive relief and $500 in damages per violation.
Oregon
Or. Rev. Stat. Ann. § 659A.330
Employers may not ask or require employees or applicants to establish or maintain a personal social media account or to disclose user names and passwords to personal social media accounts. Employers may not require employees or applicants to allow the employer to advertise on their personal social media accounts; to access social media in the presence of the employer; or to add the employer or an employment agency to their contacts. Social media means an online medium for users to create and share user-generated content, such as videos, photos, blogs, podcasts, instant messages, email or website profiles or locations.
Employers may conduct an investigation when receiving specific information about an employee’s activity on a personal social media account, in order to ensure compliance with laws, regulations, or workplace misconduct rules. As part of such investigation, the employer may require the employee to share content that has been reported to the employer in order to make a factual determination. However, the employer may not require the employee or applicant to disclose a user names or password to the account.
Rhode Island
R.I. Gen. Laws §§ 28-56-1 to 28-56-6
Employers may not ask, require, or coerce employees or applicants to: disclose passwords or other means for gaining access to personal social media accounts; or access social media accounts in the presence of the employer. Employers may not require employees or applicants to disclose any personal social media account information; change the privacy settings to their social media accounts; or add anyone to their contacts. A social media account includes any online account or service or content, including videos, photos, blogs, podcasts, instant and text messages, email, online service or accounts, or website profiles or locations.
Employers may require an employee or applicant to disclose personal social media account information only when reasonably believed to be relevant to an investigation of employee misconduct or a work-related violation of laws or regulations. Such information may be used only to the extent necessary for purposes of the investigation or a related proceeding.
Employees and applicants may file a civil lawsuit for violations. The court can award declaratory relief, damages, reasonable attorneys’ fees and costs, and injunctive relief against the employer.
Tennessee
Tenn. Code Ann. §§ 50-1-1001 to 50-1-1004
Employers may not ask or require employees or applicants to disclose passwords to personal online accounts. Employers may not force employees or applicants to access personal online accounts in the presence of the employer or add the employer or an employment agency to their contact list.
An online account is one that used exclusively for personal communications, including any online service where users may create, share or view content, including, emails, instant messages, text messages, blogs, podcasts, photos, videos, or user-created profiles.
Employers may conduct investigations: when receiving specific information about activity on an employee’s personal online account, in order to ensure compliance with laws, regulations, and workplace misconduct rules; or when receiving specific information about the unauthorized transfer of the employer’s proprietary of financial data to a personal online account. During such investigations, employers may require employees to share content from a personal online account in order to make a factual determination.
Utah
Utah Code Ann. §§ 34-48-101 to 34-48-301
Employers may not ask employees or applicants to disclose user names or passwords to personal online accounts.
Employers may conduct investigations: when receiving specific information about activity on an employee’s personal online account, in order to ensure compliance with laws, regulations, and workplace misconduct rules; or when receiving specific information about the unauthorized transfer of the employer’s proprietary of financial data to a personal online account. During such investigations, employers may require employees to share content from a personal online account in order to make a factual determination.
Employees and applicants may file a civil lawsuit against the employer for violations, with a maximum award of $500.
Virginia
Va. Code Ann. § 40.1-28.7:5
Employers may not require employees or applicants to disclose user names or passwords to personal social media accounts or add the employer, a supervisor, or administrator to their contact list. This protection extends to any personal online account where users create, share, or view user-generated content, including, videos, photos, blogs, podcasts, messages, emails, or website profiles or locations.
Employers may ask for an employee’s user name or password to access a personal social media account that is reasonably believed to be relevant to an investigation into the employee’s violation of any laws, regulations, or the employer’s written policies. The employee’s user name and password may only be used for the purpose of the investigation or a related proceeding.
Washington
Wash. Rev. Code Ann. §§ 49.44.200 and 49.44.205
Employers may not request, require, or coerce employees or applicants to: disclose passwords or other login information for a personal social media account; access social media in the presence of the employer; or change the privacy settings on their social media accounts. Employers also may not force an employee or applicant to add anyone to their contact lists. Protection applies to social networking accounts.
Employers may conduct investigations: when receiving information about activity on an employee’s personal social media account, in order to ensure compliance with laws, regulations, and workplace misconduct rules; or when receiving information about the unauthorized transfer of the employer’s proprietary of financial data to a personal social media account. During such investigations, employers may require employees to share content from a personal social media account in order to make a factual determination relevant to the investigation. However, they may not require the employee or applicant to disclose a user name or password to the account.
Employees and applicants may file a civil lawsuit against the employer for violations and obtain injunctive relief, actual damages, a penalty of $500, and reasonable attorneys’ fees and costs.
West Virginia
W. Va. Code Ann. § 21-5H-1
Employers may not request, require, or coerce employees or applicants to disclose passwords or other login information to personal social media accounts or access social media in the presence of the employer. Employers may not force employees or applicants to add the employer or an employment agency to their contact lists. This protection applies to a personal account, service or profile on a social networking website that is used exclusively for personal purposes.
Employers may ask an employee to share specific content from a personal online account in order to comply with laws, regulations, or workplace misconduct rules.
Employers may investigate when receiving specific information about the unauthorized transfer of the employer’s proprietary or financial data to a personal online account. As part of such investigation, employers may ask employees to share content from a personal social media account in order to make a factual determination.
Wisconsin
Wis. Stat. Ann. § 995.55
Employers may not ask or require employees or applicants, as a condition of employment, to disclose login information to personal social media accounts or allow observation of personal social media accounts.
Employers may investigate, based on reasonable cause, the unauthorized transfer of the employer’s proprietary or financial data to a personal online account or the employee’s violation of laws, regulations, or workplace rules in an employee handbook. As part of such investigation, employers may ask an employee to share content or information from a personal online account but may not ask for login information.
Employees and applicants may file a complaint with the Wisconsin Department of Workforce Development for violations and receive appropriate relief.
October 2018
social media checking
checking social media accounts
checking facebook