After gaining prominence in 2012, state legislation restricting access to personal social media accounts by employers and schools has remained active.  Three more states have enacted their own restrictions thus far in 2013, and bills are pending in more than two dozen other states, according to the National Conference of State Legislatures. In 2012, Illinois and Maryland  enacted social media privacy laws restricting employers, Delaware and New Jersey enacted laws restricting academic institutions, and California and Michigan enacted both employer- and school-focused restrictions.

So far this year, Utah, New Mexico, and Arkansas have enacted their own restrictions. Utah enacted two laws — the Internet Employment Privacy Act and the Internet Postsecondary Education Privacy Act — as part of one bill, HB100, which was signed into law on March 26 and takes effect May 14. New Mexico enacted two separate bills — SB 371 and SB 422 — focusing on employers and post-secondary schools, respectively. Both bills were signed April 5 and take effect on June 14. In Arkansas, a bill imposing restrictions on public and private post-secondary schools was enacted as Act 998 on April 8.  Below is more information about each.


Utah’s employment-focused law bars employers from asking employees or job applicants to disclose usernames or passwords to “personal Internet accounts” and also prohibits retaliation against employees or applicants who refuse such requests. The law defines a “personal Internet account” as “an online account that is used by an employee or applicant exclusively for personal communications unrelated to any business purpose of the employer,” while specifically excluding “an account created, maintained, used, or accessed by an employee or applicant for business related communications or for a business purpose of the employer.”

The education-focused law imposes largely parallel restrictions on the ability of postsecondary schools to request that students or prospective students disclose usernames or passwords to their personal Internet accounts.

New Mexico

New Mexico’s employment-focused law makes it unlawful “for an employer to request or

require a prospective employee to provide a password in order to gain access to the prospective employee’s account or profile on a social networking web site or to demand access in any manner to a prospective employee’s account or profile on a social networking web site.” Notably, the law consistently refers only to “prospective” employees, without specifically addressing post-hiring practices.

The education-focused law makes it unlawful “for a public or private institution of post-secondary education to request or require a student, applicant or potential applicant for admission to provide a password to gain access” to his or her account or profile on a social networking web site or “to demand access in any manner” to those accounts or profiles. Colleges and universities also may not deny admission or take disciplinary action on the basis of a person’s having refused such a request.

Both laws define a “social networking web site” as “an internet-based service that allows individuals to: (1) construct a public or semi-public profile within a bounded system created by the service; (2) create a list of other users with whom they share a connection within the system; and (3) view and navigate their list of connections and those made by others within the system.”


The Arkansas law applies only to public and private post-secondary institutions such as colleges, universities, and vocational schools. These institutions may not “require, request, suggest, or cause” current or prospective employees or students to disclose usernames or passwords to their social media accounts. These institutions also may not require current or prospective students to change their account privacy settings or add school officials to their contact lists as a condition of participating in extracurricular activities.

The law defines a “social media account” as a “personal account with an electronic medium or service where users may create, share, or view user-generated content,” including but not limited to items such as videos, photos, blogs, or messages. The law does not apply to accounts provided by the school, opened on behalf of the school or at its request, or if the account is used to impersonate the school.

Schools may not penalize or fail to hire or admit anyone who exercises their rights under the statute.