United States Social Media Privacy Laws by State
Updated November 12, 2025 (source article date)
Over the past decade, many U.S. states have enacted laws commonly known as Social Media Privacy Laws (also referred to as Personal Online Account Privacy Laws). These laws aim to protect individuals’ privacy by limiting access to their personal online accounts, including social media. That has implications for background screening companies and employers—especially when consent forms request a candidate’s social media usernames or handles.
These state laws vary in scope and language, but they generally restrict an employer’s ability to access a candidate’s or employee’s personal social media accounts during hiring or employment decisions. Most laws focus on three key prohibitions:
Requesting login credentials — Employers cannot request or require login information (for example, usernames and passwords) for personal online accounts, including social media.
Requiring access in presence — Employers cannot demand that a candidate or employee log in to their account in the employer’s presence to display social media content.
Conditioning employment on connections — Employers cannot require a candidate or employee to add the employer or hiring manager as a “friend” or connection as a condition of employment.
### Implications for social media background screening
For background screening limited to publicly available posts (consistent with FCRA-oriented public-content screening practices described in Ferretly materials), only the first prohibition (requesting login credentials) is typically the main operational concern. Passwords should never be requested—they are unnecessary for reviewing public content.
In most states, laws explicitly reference “login information” or “credentials” as including both username and password together. In those states, requesting only a username (without a password) is generally treated as permissible in the published source summary, because it does not grant full account access.
However, in a subset of states, the law’s language is ambiguous (for example, phrased as “username or password”), which could be interpreted as prohibiting requests for either a username or a password. To reduce risk, employers and screeners should err on the side of caution in those states and avoid requesting usernames.
### Current state of the law (as of November 2025)
As of November 2025, 28 states have enacted some form of social media privacy law applicable to employers (an increase from 27 states as of April 2022). New York is noted as the most recent addition (effective March 12, 2024). New York’s law prohibits employers from requesting or requiring access to personal social media accounts, including usernames and passwords, and bars retaliation for refusing such requests.
The table below lists all 28 states from the source summary. States where the law specifically or ambiguously prohibits requesting usernames alone are marked Username caution (8 states total, based on phrasing like “username or password”). These interpretations are conservative per the source; always consult legal counsel for your situation.
State | Key provisions summary (source paraphrase) | Username-only caution |
|---|---|---|
--- | --- | --- |
Arkansas | Prohibits requesting or requiring username or password; cannot coerce access. | Yes |
California | Prohibits requesting username and password; cannot require login or friending. | No |
Colorado | Prohibits requesting or coercing username or password; broad anti-retaliation. | Yes |
Connecticut | Prohibits requesting login credentials (username and password). | No |
Delaware | Prohibits requesting username and password; applies to educational institutions too. | No |
Hawaii | Prohibits requesting access information for personal accounts. | No |
Illinois | Prohibits requesting username and password; cannot require disclosure of content. | No |
Louisiana | Prohibits requesting username or password; anti-retaliation protections. | Yes |
Maine | Prohibits requesting or requiring access to personal accounts. | No |
Maryland | Prohibits requesting username or password; cannot discipline for refusal. | Yes |
Michigan | Prohibits requesting username or password; broad privacy protections. | Yes |
Montana | Prohibits requesting login credentials for personal accounts. | No |
Nebraska | Prohibits requesting username or password; applies to public employees. | Yes |
Nevada | Prohibits even suggesting or requesting username or password. | Yes |
New Hampshire | Prohibits requesting access to personal online accounts. | No |
New Jersey | Prohibits requesting username or password; cannot require friending. | Yes |
New Mexico | Prohibits requesting login information for personal accounts. | No |
New York | Prohibits requesting or requiring access, including usernames and passwords; no retaliation. | See note* |
Oklahoma | Prohibits requesting credentials for personal social media. | No |
Oregon | Prohibits requesting or requiring access to personal accounts. | No |
Rhode Island | Prohibits requesting username or password for personal accounts. | No† |
Tennessee | Prohibits requesting password; focuses on access denial. | No |
Utah | Prohibits requesting login credentials. | No |
Vermont | Prohibits requesting access to personal online content. | No |
Virginia | Prohibits requesting login information. | No |
Washington | Prohibits requesting or requiring access to personal accounts. | No |
West Virginia | Prohibits requesting credentials for social media. | No |
Wisconsin | Prohibits requesting username or password; anti-coercion rules. | No† |
* New York is described in the source as prohibiting requesting or requiring access, including usernames and passwords. Treat username requests carefully; confirm with counsel.
† Source lists Rhode Island and Wisconsin with “username or password” wording but only bolded eight states as the username-caution set: Arkansas, Colorado, Louisiana, Maryland, Michigan, Nebraska, Nevada, and New Jersey. Do not expand that set without legal review.
### Notes on the table
Summary draws from state statutes and focuses on employer–applicant/employee contexts. Some laws also apply to educational institutions or landlords.
The Username caution states (Arkansas, Colorado, Louisiana, Maryland, Michigan, Nebraska, Nevada, New Jersey) use language that could prohibit username requests alone due to ambiguity (for example, “or” instead of “and”).
No comprehensive federal social media privacy law of this type is described in the source; FCRA compliance remains critical for screenings.
### Recommendations (from source)
Consent forms: Only request usernames in states where that is explicitly allowed under a careful reading. Avoid passwords entirely.
Best practices: Limit screenings to public posts. Document FCRA compliance.
Consult experts: Review with your internal compliance team or legal counsel before implementing social media screening. Laws evolve, and interpretations vary.
### Further reading
National Conference of State Legislatures (NCSL): Privacy of Employee and Student Social Media Accounts
Ferretly contact for additional guidance: sales@ferretly.com
Ferretly’s Conformance to Canadian Privacy Laws (Canada/Quebec—not U.S. state privacy statutes)