Monitoring Employee Social Media: What Employers Can Do

Employers can generally monitor social media use on company devices and networks and act on public posts that break lawful policies, but they must not demand personal account passwords in states that ban it, and they cannot punish employees for protected concerted activity, such as discussing pay or working conditions with coworkers online. A clear written policy keeps monitoring fair.

Key takeaways

• Many states bar employers from requesting personal social media usernames and passwords.
• The National Labor Relations Act protects group discussion of pay and working conditions, including online.
• Monitoring company systems is different from reaching into personal accounts.
• Policies should target specific harms, such as harassment or confidential data leaks.
• Investigate posts consistently and document decisions.

What the law allows and restricts

State social media privacy laws

The National Conference of State Legislatures tracks state laws, first introduced in 2012, that stop employers from requesting passwords to personal internet accounts to get or keep a job. Its tracker lists more than two dozen states with employer-related laws. Details differ: some states also restrict requiring employees to add a manager as a friend or to change privacy settings. Multi-state employers should follow the strictest applicable rule or tailor practices by state.

Protected concerted activity

The National Labor Relations Board states that social media posts can be protected concerted activity, even for non-union employees, when employees discuss pay, benefits or working conditions with coworkers. Individual gripes usually are not protected; posts tied to group action or bringing group concerns to management can be. The NLRB also warns that work rules that reasonably tend to discourage employees from exercising these rights are unlawful, and that employers may not surveil or create the impression of surveilling protected activity.

Other legal limits

Anti-discrimination and anti-retaliation laws still apply. Learning about an employee's religion, health or other protected traits from social media, then acting on it, creates risk. Whistleblower protections may also cover certain posts.

Company systems versus personal accounts

Activity	General risk level	Notes
Monitoring use of company devices and networks under a written policy	Lower	Disclose it clearly in policy and acknowledgments
Reviewing public posts reported by a coworker or customer	Moderate	Check whether the post is protected before acting
Running ongoing searches on employees' personal profiles	Higher	Can look like surveillance of protected activity
Asking for passwords or private account access	High	Prohibited in many states
Requiring employees to friend a manager	High	Restricted in some states

For broader monitoring programs on company systems, our guide to employee monitoring compliance for multi-state employers covers state notice requirements, and our article on monitoring work from home employees legally and fairly addresses remote staff.

Writing a social media policy that holds up

A good policy is narrow, specific and explained with examples. Include:

• A statement that nothing in the policy limits employees' rights to discuss wages, hours or working conditions.
• Clear rules on confidential business information and customer data, defined precisely.
• Prohibitions on harassment, threats and discrimination, consistent with existing conduct policies.
• Expectations for employees who post on behalf of the company, including disclosure of their role.
• What is monitored on company devices and networks, and why.
• How to report concerning posts.

Train managers on the policy too. Most social media problems start when a supervisor sees a post and reacts on the spot, for example by confronting the employee or asking coworkers to report on colleagues. Give managers one instruction: do not act alone, send concerns to HR, and do not ask employees for access to their accounts.

Avoid broad bans such as "never criticize the company online," which can discourage protected activity. Have employment counsel review the policy before rollout.

Handling a problem post

1. Capture the post with date, time and context as it was publicly visible.
2. Assess whether it involves group concerns about working conditions.
3. Check whether it violates a specific, lawful policy, such as harassment or disclosure of confidential data.
4. Interview the employee and any affected coworkers.
5. Apply discipline consistent with past cases, documented in writing.

Our article on disciplinary action at work covers documentation and consistency in more detail.

Frequently Asked Questions

Can an employer fire someone for a social media post?

Sometimes. Posts that harass coworkers, threaten violence or reveal genuinely confidential information can justify discipline under a lawful policy. Posts where employees discuss pay or working conditions together may be protected under the National Labor Relations Act. Assess each case carefully, apply policy consistently and involve employment counsel when protected activity might be involved.

Can my employer ask for my social media password?

In many states, no. The National Conference of State Legislatures tracks laws in more than two dozen states that bar employers from requesting usernames and passwords for personal accounts. Where no such law applies, requests still raise privacy and legal risk, so most employers avoid them entirely and focus on company accounts and systems.

Is monitoring employees on company Wi-Fi legal?

Monitoring company networks and devices is generally permitted when disclosed in a written policy, though some states require specific notice. Avoid using that monitoring to target protected activity or to gather information about protected characteristics. Limit collection to legitimate business purposes, restrict access to the data and set retention periods.

Next steps

1. Check social media privacy laws in every state where you employ people.
2. Revise your policy to protect concerted activity explicitly.
3. Train managers not to request access to personal accounts.
4. Set a documented process for reviewing reported posts.

Last reviewed: October 2026.

Sources

• Privacy of Employee and Student Social Media Accounts, National Conference of State Legislatures
• Social Media, National Labor Relations Board
• Interfering With Employee Rights (Section 7 and 8(a)(1)), National Labor Relations Board