California is the latest state to enact legislation restricting the circumstances under which employers or schools can demand access to employees’ or students’ personal social media accounts.

California Gov. Jerry Brown signed two bills into law on Sept. 27.  The first, A.B. 1844, bars employers from requiring or requesting that employees or job applicants disclose personal social media usernames or passwords, access personal social media accounts in the employer’s presence, or otherwise “[d]ivulge any personal social media.” Employers are barred from firing or otherwise retaliating against anyone who refuses to comply with a request that is prohibited under the law. Employers may require employees to disclose information needed to access employer-issued devices and may request access to personal social media the employer reasonably believes is relevant to a misconduct investigation.

S.B. 1349 creates parallel protections for students, prospective students and student groups at public and private colleges and universities.

Both new laws define “social media” broadly to mean “an electronic service or account, or electronic content, including, but not limited to, videos or still photographs, blogs, video blogs, podcasts, instant and text messages, email, online services or accounts, or Internet Web site profiles or locations.”

Eric Goldman, posting at Forbes, expects that broad definition to have unintended consequences. Goldman also questions the law’s assumption that “personal” social media accounts can easily be distinguished from “non-personal” accounts, at least in the employment context.

As we have reported, Maryland and Illinois passed similar laws earlier this year restricting employers’ ability to demand access to employees’ social-media accounts. In addition, a Delaware law enacted in July prohibits public and private colleges and universities from demanding access to students’ personal social-media accounts under most circumstances.

The state laws vary on some key points. For instance, the Illinois law prohibits employers from demanding access to an employee or applicant’s account or profile on a “social networking website,” but the law excludes e-mail from the definition of such websites. In contrast, California’s definition of “social media” specifically includes e-mail, as well as a broad range of other types of online content.

The laws also differ on the scope of the prohibitions they impose. Maryland’s law bars employers from demanding usernames or passwords to employees’ personal accounts, while the California and Illinois laws also specifically prohibit employers from demanding that employees provide access to personal social-media accounts in other ways. The Delaware student-privacy law goes further, specifically barring colleges and universities from accessing student social-media profiles indirectly through the students’ friends or from installing monitoring software on students’ personal electronic devices.

Lawmakers have considered legislation on this topic in other states — including Washington, New Jersey and Colorado — as well as in Congress.