The U.S. State Department recently implemented a policy requiring visa applicants to submit information about any social media usernames, handles, and email addresses they have used in the past five years. Although the idea has been floated in the past, passwords are not required yet. In the employment context, many states have taken a different approach by passing so-called “password protection laws.”
Although these laws vary by state, they generally prohibit current or prospective employers from requesting passwords, usernames, or otherwise attempting to access password-protected social media accounts, with certain exceptions. For example, in Tennessee and many other states, employers are permitted to request password information for accounts created for business-related communications or another business purpose of the employer.
Twenty-six states have enacted laws that limit an employer’s or prospective employer’s access to social media accounts, internet accounts, or both. Of these states, all except Illinois, New Mexico, and West Virginia include anti-retaliation provisions.
Laws by State:
Arkansas
California
Colorado
Connecticut
Delaware
Louisiana
Maine
Maryland
Michigan
Montana
Nebraska
Nevada
New Hampshire
New Jersey
Oklahoma
Oregon
Rhode Island
Tennessee
Utah
Vermont
Virginia
Washington
Wisconsin