Many states have enacted social media privacy laws (statutes) that prohibit an employer from requesting or requiring an employee or job applicant to disclose their username or password on any personal social media account—or requesting or requiring the employee access the social media account in the presence of the employer. These laws often also prohibit an employer from penalizing, disciplining, or terminating/discharging an employee for refusing to disclose such information.

Social media privacy laws vary from state to state and may not apply if the employer is investigating an allegation of employee misconduct (harassing another employee on social media) or a violation of laws and regulations (communications on social media about workplace safety violations). And an employer may require or request an employee disclose a username, password, or other means of accessing an electronic device (phone, computer, tablet) issued by the employer.

States with specific social media privacy laws for the workplace include:

• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• Illinois
• Louisiana
• Maine
• Maryland
• Michigan
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• Oklahoma
• Oregon
• Rhode Island
• Tennessee
• Utah
• Vermont
• Virginia
• Washington
• West Virginia
• Wisconsin

In states without specific social media privacy laws for the workplace, other general privacy laws may apply.

In Nevada, social media privacy is protected under state law NRS 613.135, which prohibits employers from directly or indirectly requiring, requesting, suggesting, or causing any employee or prospective employee to disclose the username, password, or any other information that provides access to his or her personal social media account. Additionally, employers are not allowed to take action against or threaten to discharge, discipline, or otherwise penalize an employee for not providing this information, nor can they refuse to hire a prospective employee. However, there are exceptions to this rule, such as when an employer conducts an investigation based on the receipt of specific information about unauthorized transfer of the employer’s proprietary or confidential information, or other employment-related misconduct through a personal social media account. Employers may also require an employee to disclose login information for accessing an electronic communication device supplied by or paid for by the employer, or accounts or services provided by the employer or used for the employer’s business purposes.