Last week, New York’s Governor signed a bill into law that effectively prohibits employers from accessing employees’ or job applicants’ personal social media accounts. The law goes into effect on March 12, 2024.

Under the new legislation, “personal accounts” are broadly defined to mean “an account or profile on an electronic medium where users may create, share, and view user-generated content, including uploading or downloading videos or still photographs, blogs, video blogs, podcasts, instant messages, or internet website profiles used exclusively for personal purposes.”

The new law makes it unlawful for an employer to request, require, or coerce an employee or applicant to: (i) disclose the username, password, or “other authentication information” for accessing personal accounts, (ii) access “personal account in the presence of the employer,” (iii) or “reproduce in any manner photographs, videos, or other information contained within a personal account” obtained by the prohibited means in (i) and (ii). Employers are prohibited from retaliating against an employee or applicant that refuses to provide personal account access information to an employer that unlawfully requests it.

There are a few exceptions to the sweeping prohibition on accessing employee and applicant social media accounts.

• First, if an employee or applicant voluntarily adds the employer to their list of contacts associated with a personal account, the employer is not prohibited from then accessing the account.
• Second, an employer may require employees to disclose the username, password, or other authenticating information for non-personal accounts that “provide access to the employer’s internal computer or information systems,” such as through a link to the employer’s intranet or internal database.
• Third, employers can still require that employees disclose access information to an account provided by the employer for business purposes and access an electronic communications device paid for by the employer, so long as the employee was provided prior notice of the employer’s right to request such access and the provision of the device was conditioned on the employer’s right to access it. Notably, however, employers are still prohibited from accessing personal accounts on devices it paid for.
• Finally, the new legislation does not restrict employers from viewing, accessing, or utilizing information: (i) “about an employee or applicant that can be obtained without any required access information,” (ii) “that is available in the public domain,” or (iii) “for the purposes of obtaining reports of misconduct or investigating misconduct, photographs, video, messages, or other information that is voluntarily shared by an employee, client, or other third party that the employee subject to such report or investigation has voluntarily given access to contained within such employee’s personal account.”

New York’s law is just one of many similar measures introduced across the country this year related to safeguarding employees’ online privacy from employer inquiries. States including California, Connecticut and Oregon prohibit employers from asking employees to access their social media accounts while the employer is present. New Hampshire, Maine, and Delaware prohibit employers from requiring employees to add the employer as a “friend” or to invite the employer to a group that gives access to non-public information. Most of these laws, like the recent New York law, include an anti-retaliation provision to protect employees that refuse to share their personal social media accounts with their employer. In New York, the law is enforced through the state’s Department of Labor’s Division of Labor Standards and there is no private right of action.

New York employers should evaluate their current application processes and social media policies to ensure compliance with the new law.