Many states have enacted social media privacy laws (statutes) that prohibit an employer from requesting or requiring an employee or job applicant to disclose their username or password on any personal social media account—or requesting or requiring the employee access the social media account in the presence of the employer. These laws often also prohibit an employer from penalizing, disciplining, or terminating/discharging an employee for refusing to disclose such information.

Social media privacy laws vary from state to state and may not apply if the employer is investigating an allegation of employee misconduct (harassing another employee on social media) or a violation of laws and regulations (communications on social media about workplace safety violations). And an employer may require or request an employee disclose a username, password, or other means of accessing an electronic device (phone, computer, tablet) issued by the employer.

States with specific social media privacy laws for the workplace include:

• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• Illinois
• Louisiana
• Maine
• Maryland
• Michigan
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• Oklahoma
• Oregon
• Rhode Island
• Tennessee
• Utah
• Vermont
• Virginia
• Washington
• West Virginia
• Wisconsin

In states without specific social media privacy laws for the workplace, other general privacy laws may apply.

In Colorado, social media privacy laws protect employees and job applicants from having to disclose their personal social media account information to their employers. Under Colorado Revised Statutes Section 8-2-127, employers are prohibited from suggesting, requesting, or requiring an employee or applicant to disclose their username or password for a personal social media account. Additionally, employers cannot require the individual to add anyone, including the employer or their agent, to the list of contacts associated with the social media account, nor can they require the individual to change the privacy settings associated with it. Employers are also barred from penalizing, disciplining, or refusing to hire an individual for not providing access to their personal social media accounts. However, these protections do not apply if the employer is conducting an investigation into allegations of employee misconduct or legal violations involving social media, provided that the employer has a reasonable basis for the investigation. Furthermore, employers are allowed to request or require login information for electronic devices they provide to employees.