New York Governor Kathy Hochul signed into law bill A.836 on September 14, 2023, prohibiting employers from requesting or requiring employees or job applicants to disclose the login credentials for their personal social media accounts, or from retaliating against employees or job applicants who refuse to do so. Specifically, the law renders it unlawful for an employer to request, require, or coerce any employee or job applicant to:

1. Disclose any username and password, password alone, or other authentication information for accessing a personal account through an electronic communication device.
2. Access the employee or applicant’s personal account in the presence of the employer.
3. Reproduce in any manner photographs, videos, or other information contained within a personal account obtained by prohibited means.

It is similarly unlawful for an employer to take any adverse action against an employee or to refuse to hire an applicant because the individual refused to provide the above-noted information.

Importantly, the law broadly defines the term “employer” as any “person or entity engaged in a business, industry, profession, trade or other enterprise in [New York],” as well as any “agent, representative or designee of the employer.” Accordingly, the law’s impact will likely be widely felt.

Permitted Activity

Even though the new law is concerned with prohibiting employers from requiring disclosure of an employee or applicant’s personal login credentials, employers may continue to view information on an individual’s personal social media account that is publicly available. Indeed, the law expressly “does not prohibit or restrict an employer from viewing, accessing, or utilizing information about an employee or applicant that can be obtained without any required access information, that is available in the public domain, or for the purposes of obtaining reports of misconduct or investigating misconduct, photographs, video, messages, or other information that is voluntarily shared by an employee, client, or other third party that the employee subject to such report or investigation has voluntarily given access to contained within such employee’s personal account.” Similarly, the law does not prohibit an employer from requesting that an employee or applicant disclose their social media usernames, only their usernames and passwords.

The law also provides that employers may still lawfully:

• Request or require an employee to disclose access information to an account provided by the employer where such account is used for business purposes, and the employee was provided prior notice of the employer’s right to request or require such access information.
• Request or require an employee to disclose access information to an account known to an employer to be used for business purposes.
• Access an electronic communications device paid for in whole or in part by the employer, where the provision of or payment for such electronic communications device was conditioned on the employer’s right to access such device, and the employee was provided prior notice of—and explicitly agreed to—such conditions. However, the employer is still not permitted to access any personal accounts on such devices.
• Comply with a court order to obtain or provide information from, or access to, an employee’s accounts in compliance with that court order.
• Restrict or prohibit an employee’s access to certain websites while using the employer’s network or while using an electronic communications device paid for in whole or part by the employer, where the provision of or payment for such electronic communications device was conditioned on the employer’s right to restrict such access, and the employee was provided prior notice of—and explicitly agreed to—such conditions.

The law also provides that it will be an affirmative defense to any legal action under the law that the employer acted to comply with requirements of federal, state, or local law.

Next Steps for Employers

The law will take effect on March 12, 2024. In anticipation of the new law, employers should closely assess their social media policies and speak with experienced counsel to implement appropriate internal procedures and devise required notices and acknowledgements to ensure compliance with the law’s requirements.