⚖ The Advocate
Privacy & Data Rights

Employer Demands Social Media Passwords

Requiring social media credentials as a condition of employment is prohibited in most US states

Premium intermediate 8 minutes
The Situation

What They Said

“We require all employees to give us their social media login details for vetting.”
The demand for social media passwords by employers is a phenomenon that emerged in the early 2010s and prompted swift legislative responses in dozens of states. What began as an expansion of social media screening — looking at public profiles — evolved into demands for login credentials that would give employers access to private messages, posts shared only with friends, profile information not publicly visible, and communications with people who expected their conversations to remain private. This practice raises profound concerns not just for the job applicant but for every person who communicated with them through that platform. The federal response to this practice has been slower than the state response. The Electronic Communications Privacy Act (ECPA), enacted in 1986 for different purposes, has been interpreted by many legal scholars to prohibit employers from accessing private electronic communications through demanded credentials — because the employer would thereby be accessing stored electronic communications without authorization under 18 U.S.C. § 2701. However, the statute's application to this specific context remains contested in some circuits. What is far clearer is the state law landscape: as of 2024, more than 26 states have enacted statutes that explicitly prohibit employers from requiring job applicants or employees to provide social media credentials as a condition of employment or continued employment. These laws protect not only the applicant's privacy but also the privacy of all the applicant's social media contacts whose private communications would be exposed if the employer were given account access. Note: State law may provide additional protections beyond the federal baseline described here — state social media password protection laws are now the primary legal protection and vary in their scope and remedies.
The Fallacy

Employer Entitlement to Employee Private Life

The employer is asserting an Employer Entitlement fallacy — the claim that the employment relationship creates a right to access all aspects of a prospective employee's private life, including their private online communications. Employment law does give employers broad rights to set workplace conduct standards, but those rights have limits, and one of the clearest limits is the employee's private life outside the employment relationship. The password demand is qualitatively different from asking for a background check, requesting professional references, or even reviewing a public social media profile. A social media login gives access to private messages between the applicant and their friends, family, and colleagues — communications that were made with an expectation of privacy by both parties. The employer is not just examining the applicant; they are examining everyone the applicant has communicated with, without those people's knowledge or consent. This practice is prohibited not merely because it is a privacy violation for the applicant, but because it violates the privacy of third parties who have done nothing to subject themselves to employer scrutiny. Social media platforms themselves prohibit sharing login credentials in their terms of service. And the employer who uses obtained credentials to access private communications is accessing stored electronic communications without authorization — which is precisely what ECPA § 2701 was designed to address.

What the Law Says

Your Legal Foundation

Electronic Communications Privacy Act (ECPA) / Stored Communications Act (SCA), 18 U.S.C. § 2701
§ 2701(a) — Unlawful Access to Stored Communications
“Except as provided in subsection (c) of this section whoever — (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.”
When an employer uses login credentials obtained from an employee or applicant to access private social media accounts, they are accessing a facility through which an electronic communication service is provided and obtaining stored electronic communications. Under the majority view, this constitutes unauthorized access to stored communications under § 2701, regardless of whether the employer obtained the credentials through an employment condition rather than through hacking. The employee does not have the authority to grant access to others' private communications.
State Social Media Privacy Laws — Majority Rule (26+ States)
Model Provision — e.g., California Labor Code § 980; Illinois Right to Privacy in the Workplace Act, 820 ILCS 55/10 — Prohibition on Employer Demands for Social Media Credentials
“An employer shall not require or request an employee or applicant to disclose a username or password for the purpose of accessing personal social media, access personal social media in the presence of the employer, or divulge any personal social media. An employer shall not discharge, discipline, threaten to discharge or discipline, or otherwise retaliate against an employee or applicant for not complying with a request or demand by the employer that violates this section.”
Over 26 states have enacted laws directly addressing this practice. These statutes create an explicit prohibition on demanding credentials, a non-retaliation protection for refusing to provide them, and civil remedies for violations. An applicant or employee who refuses a password demand and is denied employment or is terminated as a result has a cause of action under applicable state law. The applicant should document the demand in writing and consult a state employment attorney.
What Scripture Says

God's Word on This

Matthew 6:6 (NIV)
“But when you pray, go into your room, close the door and pray to your Father, who is unseen. Then your Father, who sees what is done in secret, will reward you.”
The principle of private space — a room, a closed door, a sphere of life that belongs to the individual and God alone — is fundamental to Jesus' teaching. Social media accounts with private settings are the modern equivalent of that closed room: communications shared with trusted individuals in a space the speaker controlled. An employer's demand for those credentials is a demand to open that door permanently — a demand that violates the same principle of human dignity and private space that Jesus honored.
1 Thessalonians 4:11-12 (NIV)
“...and to make it your ambition to lead a quiet life: You should mind your own business and work with your hands, just as we told you, so that your daily life may win the respect of outsiders and so that you will not be dependent on anybody.”
Paul's instruction to 'mind your own business' is a call to respect the sphere and privacy of others. An employer who demands access to private communications beyond what employment legitimately requires is failing to mind their own business — literally. The employment relationship entitles the employer to assess professional qualifications and workplace conduct, not to examine every private conversation the employee has ever had with their family and friends.
🔒
You Know the Law — But Do You Know What to Say?
Reading your rights is one thing. Using them under pressure — calmly, correctly, in the right words — is what actually protects you. Members get the scripted rebuttal for this exact situation: what to say first, what to say if they push back, the tone to use, and the constitutional provision to cite. Practise out loud with audio until it's automatic.
Unlock This Scenario — R89/month
Identity & Dignity and Gender & Equality are free · All 17 domains from R89/month · Cancel anytime
Not ready to subscribe? Get the free checklist first.
10 South African rights scenarios — what to say, what to cite, what to refuse. Free, no card needed.
What They'll Say Next

Common Counter-Arguments

After you respond, they may push back with these arguments. Members get the full rebuttal for each.

They might say: “We're in a state that doesn't have a social media password law — you have no protection.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
They might say: “This is a security clearance position — government contractors and positions requiring clearance have different rules.”
🔒 Subscribe to see the full rebuttal and legal counter-argument.
Know Your Rights. Know Your Word.
149 South African rights scenarios — exact rebuttals, constitutional law, and Scripture. Practise out loud with audio. Free to start with 2 full domains.
Try Free — Identity & Dignity
No credit card · Upgrade anytime for all 17 domains
Think you know your rights? 5 real SA law scenarios — find out where you’re at risk.
Take the Quiz →