How to respond to an inappropriate request for acess to personal social media

The Employer’s Issue: “You can’t ask that.”

Fourteen states have passed legislation that “prohibits an employer from requesting or requiring an employee or applicant to disclose a user name or password for a personal social media account.” Employment lawyers and social media consultants have spent the last year hammering home the message, “You can’t ask that” in workshops, blogs, tweets and journal articles aimed at employers and human resource professionals.

Pretty much every HR pro that reads knows the problem with asking for social media log-on-information. We are glad. We’re also certain, however, that the information on Facebook is so juicy and revealing, that the question still gets asked – all the time. According to a recent survey conducted by Jobvite, 85% of recruiters reported that they are likely to look at a candidate’s social media profiles. After all, who doesn’t want to know what employees and applicants write in the greatest of all cyber-diaries that is Facebook?

Flip the Issue: How should you respond to an inappropriate request for personal social media access?

Our friends in the Twitterverse and blogosphere have focused almost exclusively on telling employers how to prevent the question from being asked. That’s great. But what about the poor employee or job applicant? How do they respond to an inappropriate (and, in some states, illegal) inquiry without jeopardizing their job or a bone fide job opportunity?

The last thing most of us really want to do is wag our finger in the boss’ face and say, “You aren’t allowed to ask me that!” Please note that we are not advocating that employees bow and scrape, or give up on their rights. We just think that there should be a polite way to say, “I don’t want to give you what you are asking for and I don’t think I’m legally required to do so” without raising hackles or a negative inference that we have something to hide.

We think there is. Employers do it all the time.  Picture this:

Sue used to work for Acme Company. Acme has received a request from Baker Company (Sue’s prospective employer) for information about Sue’s employment with Acme. Acme politely and professionally declines, stating, “It is the policy of Acme not to give references or disclose the reason why an employee is no longer employed with Acme. We can, however, give you the dates of employment and job title.”

Baker is not surprised and goes away [relatively] happy. Why? Because Baker understands “that’s just the way it is.” As a rule, employers don’t disclose personal information.  No negative inference is created by the refusal to disclose the reason for Sue’s departure from Acme because the answer is not related to Sue at all.

Meeting of the Minds: Suggestions for responding to the request without raising hackles or a negative inference.

Now, back to the present issue. Why can’t applicants and employees use the same standard? Is there a response to the request for access to personal social media accounts that is polite and firm but which does not create a negative inference? We think so.

Why, yes, I do have a personal Facebook page but:

… my page is private and password protected. I don’t share the contents of my Facebook page with anyone who isn’t connected to me as a friend through Facebook.

This provides a “reasonable expectation of privacy” rationale. This response lets the employer (or prospective employer) know that you believe you may have a legal right to privacy in the personal information stored on Facebook because you’ve taken steps to protect the information from public view.


… when I set it up, I made the decision that it would be entirely personal. My family, friends and I depend upon each other to keep our communications private.

This protects others’ reasonable expectation of privacy. This is a trust rationale. After all, if you won’t take reasonable steps to protect information given to you by your friends, how can you be trusted to protect the employer’s confidential, proprietary or trade secret information?


… I don’t post about my job or my employer, and I don’t make Facebook friends with co-workers. When I started my job search, I decided to stick to that rule. So, I don’t share my page or wall with anyone at work.

This sends the message that you can be trusted not to disparage your employer on Facebook. While the employer cannot ask you to refrain from negative remarks about the company on Facebook (because doing so may violate the National Labor Relations Act), if you are pure as the driven snow, there’s nothing wrong with saying so. Be sure the statement is true, however, as lying has its own consequences.


… I don’t share my Facebook information with anyone. Anyway, all you’d read about is my love for (my kids, dog, latest woodworking project) and I’d be more than happy to tell you all about that.

Self-deprecation is great. But, really, unless you are laughing as you say it, don’t talk about your passion for kitten videos during a performance evaluation or job interview.


… I don’t share my Facebook information but I do have terrific AboutMe and LinkedIn pages and you can contact any of the folks who have endorsed me or provided a recommendation. They can tell you about my work ethics and what I am like as a person.

Mary and Deb prefer this approach because it says, “No,” while immediately redirecting interest. It gives the supervisor or hiring manager an immediate destination on the Internet instead of your personal Facebook page. Just don’t make it a “humble brag.” “Ugh. I hate these FB laws. You’ll just have to bother all the clients who think I’m wonderful. How embarrassing.”



If someone Googles your name, what would they find? Jobvite’s survey found that 52% of job seekers used social media during their job search. With over 1 billion active users on Facebook and millions of users on other social media sites, it’s safe to assume that the majority of employees and applicants use social media to some degree. So, it makes this a complicated issue. Where is the line drawn between your personal and professional online persona?

Have an online presence that you can show to a potential employer. Have a robust LinkedIn Profile, a vibrant AboutMe page, and a Facebook Page (not a personal profile) limited to professional posts. You can do the same thing on Twitter. It’s essential on these sites to have posts that show that you’re keeping up on your industry, including trends. You can post links to relevant articles (or better yet, to articles you wrote yourself) and generate discussions with your followers. You can also connect with thought-leaders in your industry and have professional communications with them.

The most critical thing to remember is that nothing you post on social media sites, no matter what your privacy settings are, is truly private. During a job search, even on your personal pages, you should maintain a professional demeanor. You never know when someone you’re connected with may be a resource to a job…or more importantly, a potential employer themselves.

If your company has a social media policy, FOLLOW IT! When applying for a job, ask if the company has a social media policy. If you’re in an industry, such as financial services or health care, be aware that there are government regulations that pertain to your use of social media.

Professional Post-Script:

Deb, the social media consultant, says: “When in doubt about what to post or not to post, simply ask yourself the following: If my significant other, parent or employer were to see it, what would they say?” Mary, the trial lawyer, adds: “If you wouldn’t want your mom to see it, your newspaper to print it, or the jury to read it, you should not post it.”

Both agree, it’s much easier to not post something that can be problematic than to try to undo the damage once you’ve posted it. And finally, remember that potential and current employers may look back at things you wrote years ago, so you may need to go back and review – and delete – posts that you don’t want seen today.


(Author’s Notes: I am a management-side employment lawyer. Some of my regular readers may question why I would write an article aimed at instructing employees, a.k.a. “potential plaintiffs,” on how to respond to a request for personal social media passwords. It’s pretty simple, really. I don’t know many HR professionals who don’t want to do the right thing. They agonize over hiring, firing and every decision in between. Next, a polite and professional decline, as advocated in this piece, is far less likely to ratchet up into a full scale employment dispute. That’s really the bottom line.

The states with social media password laws are:  California, Delaware, Illinois, Maryland, Massachusetts, Michigan, Minnesota, Missouri, New Jersey, New York, Ohio, Pennsylvania, South Carolina, Washington. This list changes moment by moment. National Conference of State Legislatures  Before making a stink over being asked to share your Facebook page, it would be wise to know if the request is, in fact, illegal in your state. Even if it is not, there is no law that says you must share it. You will simply have to decide whether, in those states where it is not illegal to ask for your information, refusing to disclose it is worth losing the opportunity being presented.

There are exceptions to this rule; instances when an employee can be required to give his employer access to personal social media. For instance, if an employee posts evidence of his or another employee’s wrongdoing on Facebook, a court may require disclosure to the employer. – Mary Wright, Editor)

By Mary Wright and Deb Krier

Share This Post On
468 ad