Employer Social Media Monitoring Laws in Maryland

Federal law does not provide comprehensive protection against social media monitoring by employers. The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, generally permits employers to monitor communications sent over company equipment and networks, provided they have obtained consent or can claim a legitimate business purpose. The National Labor Relations Act (NLRA), 29 U.S.C. § 151 et seq., protects certain employee social media activity—specifically, employees have the right to discuss wages, hours, and working conditions on personal social media accounts without employer interference.

The NLRA's protections are limited to concerted activity (group discussion about working conditions) and are enforced by the National Labor Relations Board (NLRB). Federal employment discrimination law (Title VII, the ADA, and the ADEA) prohibits employers from making employment decisions based on protected class status revealed through social media monitoring, but does not restrict the monitoring itself. The Consumer Privacy Act (CCPA) and similar state laws do not apply to employer-employee relationships. At the federal level, employers generally have broad discretion to monitor employee social media, particularly on work devices, provided they do not violate NLRA protections or discrimination laws.

Maryland provides stronger protections than federal law in specific areas of social media monitoring. Maryland Code § 3-710 explicitly prohibits employers from requiring employees to disclose personal social media account passwords, usernames, or other authentication credentials. This is a direct prohibition with no exception for legitimate business purposes—the law is absolute on this point. The statute applies to all employers, regardless of size, and covers all employees.

Maryland Code § 3-707 further protects employees by prohibiting retaliation for lawful off-duty conduct, which includes social media activity on personal accounts during non-work hours. This means an employer cannot discipline, demote, or terminate an employee based on personal social media posts unless the posts directly damage the employer's business reputation or constitute illegal conduct. The law requires a direct causal link between the social media activity and business harm, not merely offense or disagreement with employee viewpoints.

Maryland Code § 3-706 establishes that employees retain privacy rights regarding personal social media accounts. Employers may monitor work-provided social media accounts (those created for business purposes) and may review publicly available social media posts, but cannot require disclosure of private accounts or access credentials. The distinction is critical: employers can see what employees post publicly, but cannot demand access to private messages or closed accounts.

Unlike federal law, Maryland's statute creates an affirmative employer duty not to interfere with employee privacy. This is stronger than the NLRA, which focuses narrowly on protected concerted activity. Maryland law covers broader personal expression and lawful off-duty conduct. The remedies under Maryland law include damages for wage loss, emotional distress, and attorney fees—broader than federal remedies in most cases.

Maryland's prohibition on requiring social media password disclosure has no exceptions—employers cannot demand passwords even for legitimate business purposes, such as investigating misconduct or accessing company accounts. However, this exception exists: if an employee creates a company account and the employer provides the password, the employer retains access rights to that work account.

The off-duty conduct protection under § 3-707 contains a critical limitation: it applies only to lawful conduct. If an employee's social media posts incite illegal activity, contain true threats, or constitute criminal behavior (e.g., planning a crime, harassment, or defamation), the employer may take action without violating the statute. The employer must document that the conduct is unlawful, not merely offensive or controversial.

Another exception exists for at-will employment relationships: while Maryland is an at-will employment state, retaliation for protected off-duty conduct violates § 3-707, creating a statutory exception to pure at-will doctrine. However, employers can still terminate for performance, economic reasons, or other legitimate non-retaliatory grounds. The burden falls on the employee to prove the primary motivation was retaliation.

Employers may monitor work-provided devices and work email accounts without restriction, even if employees use personal passwords. The privacy protection applies only to personal accounts created and maintained on the employee's own devices or time. Public social media posts (those intentionally shared with the general public) can be monitored and reviewed without limitation. Union employees and collective bargaining agreements may have additional protections, but the statute applies to unionized workplaces as well.

Step 1: Document Everything. Keep detailed records of all social media activity you want to preserve as evidence. Take screenshots of public posts, save URLs, note dates and timestamps. If an employer demands your password, document the request in writing—email a summary to yourself or a trusted contact immediately, including the date, who made the request, and what was demanded. Save any written communications (emails, text messages, Slack messages) where the employer requests access. If retaliation occurs after you refuse, document the retaliatory actions: dates of discipline, performance changes, shift reductions, or termination, and any statements connecting these actions to your social media activity or password refusal.

Step 2: Internal Complaint Process. Before filing externally, send a written complaint to your employer's HR department. Address it to the HR manager and CC your direct supervisor if that seems safe (use your judgment). State clearly: (1) the date and nature of the password demand or monitoring activity, (2) the statute violated (Maryland Code § 3-710 or § 3-707), (3) any retaliatory actions taken afterward, and (4) what remedy you seek (stop the conduct, clear your record, damages). Request a written response within 14 days. Keep a copy for yourself. This creates an internal record and may prompt the employer to cease the violation, avoiding the need for external filing. Some employers will correct the behavior at this stage to avoid regulatory involvement.

Step 3: File with Maryland Commission on Human Relations (MCHR). If internal resolution fails, file a charge of discrimination or unfair labor practice with MCHR. Visit the MCHR website at mccr.maryland.gov. Download the Charge Form or call (410) 767-8600 to request one by mail. You must file within 300 days of the violation (unlike federal EEOC claims at 180 days, Maryland gives you 300 days). Provide: (1) your name, address, phone, email, (2) your employer's name and address, (3) a detailed narrative of the violation including dates, (4) names of witnesses, (5) copies of documentation (screenshots, emails, the password demand), and (6) the remedy sought (back pay, front pay, damages). File by mail to: Maryland Commission on Human Relations, 6 St. Paul Street, Suite 600, Baltimore, MD 21202, or electronically through the MCHR portal. Include copies of all supporting documents. Keep originals for your records.

Step 4: MCHR Investigation Process. Once filed, MCHR assigns your charge to an investigator. MCHR will contact your employer and request a response. The investigation typically takes 60-90 days but can extend longer for complex cases. MCHR may request additional documents from you or the employer, conduct interviews with you and witnesses, and review social media evidence. You should cooperate fully and respond promptly to all MCHR requests. The investigator will issue a determination letter stating whether probable cause exists that a violation occurred. If probable cause is found, MCHR attempts conciliation (settlement negotiation) between you and the employer. If conciliation fails, MCHR issues a right-to-sue letter, which allows you to file a civil lawsuit in Maryland state court.

Step 5: Consult an Employment Attorney. Contact an employment lawyer licensed in Maryland as soon as possible—ideally before or immediately after filing with MCHR. An attorney can: (1) review your evidence and advise whether you have a strong case, (2) draft the MCHR complaint for maximum impact, (3) represent you during MCHR investigation and conciliation, and (4) prepare for civil litigation if needed. Many Maryland employment attorneys offer free initial consultations. Look for lawyers specializing in privacy rights, retaliation, or labor law. Attorney fees may be recovered under Maryland law if you prevail, so some attorneys work on contingency (payment from settlement or judgment). Do not delay—the 300-day deadline is firm.