Employer Social Media Monitoring Laws in Massachusetts

Federal law provides limited protection for social media privacy in the employment context. The Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, prohibits intentional interception of electronic communications, but contains a broad "business use" exception that allows monitoring of employer-owned equipment and systems. The National Labor Relations Act (NLRA), 29 U.S.C. § 157, protects employees' rights to discuss wages and working conditions on social media if the speech relates to protected concerted activity, but does not broadly protect personal social media privacy.

Federal law does not impose a general requirement for employers to obtain consent before monitoring social media. The Fair Credit Reporting Act (FCRA), 15 U.S.C. § 1681, requires disclosures and consent when a third party conducts background checks that may include social media review. However, direct employer monitoring of personal accounts receives minimal federal protection outside of the NLRA context. Most social media privacy protections come from state law, making Massachusetts law more restrictive than the federal baseline. The EEOC enforces federal employment laws but has limited jurisdiction over social media monitoring issues.

Massachusetts provides stronger protections than federal law regarding social media monitoring. Massachusetts General Laws Chapter 149, Section 150 specifically prohibits employers from requesting, requiring, or compelling employees to disclose passwords, usernames, or other login credentials for personal social media accounts. This statute covers all employers in Massachusetts and applies to all employees, regardless of company size or industry.

Under this law, employers cannot require employees to access personal social media accounts in the employer's presence, change privacy settings, or provide screenshots or content from personal accounts. The statute also prohibits retaliation against employees who refuse to disclose social media credentials or account information. Employers cannot make employment decisions based solely on an employee's refusal to grant social media access.

Massachusetts General Laws Chapter 214, Section 1B establishes a constitutional right to privacy that protects against unreasonable intrusion into private affairs. Massachusetts courts have recognized that employees have a reasonable expectation of privacy in their personal social media accounts, even if the accounts contain some public information. Employers who access personal accounts without authorization or who conduct extensive monitoring of personal social media may face liability for invasion of privacy under this statute.

However, Massachusetts law permits employers to monitor work-related social media accounts, accounts created for company purposes, and public posts that directly relate to company business or job performance. Employers may also conduct limited monitoring of employee social media in connection with workplace investigations if there is reasonable suspicion of misconduct or if the monitoring is narrowly tailored to address legitimate business concerns. The key distinction is between personal accounts and work-related accounts, and between unauthorized access and monitoring of publicly available information.

Massachusetts law contains narrow exceptions to the prohibition on social media monitoring. Employers may access work-related social media accounts that are created for company purposes or owned/operated by the employer, even without explicit consent, as these are not personal accounts covered by the statute. Employers may review publicly posted information on social media without accessing private accounts or requesting passwords, though extensive monitoring of public posts may still constitute invasion of privacy if it violates reasonable expectations of privacy.

Employers can conduct limited social media monitoring in connection with workplace investigations where there is reasonable suspicion of employee misconduct, theft, breach of confidentiality, or violations of company policy. This investigation exception must be narrowly tailored—employers cannot conduct broad surveillance but rather must focus monitoring on specific suspected violations. Employers may also monitor social media in connection with background checks conducted by third parties, provided they comply with FCRA disclosure requirements.

Law enforcement and government employers may have broader monitoring rights in certain circumstances involving criminal investigations or national security, though these remain subject to constitutional privacy protections. Employers are not prohibited from considering publicly available social media information discovered independently by the employer (not obtained through password access or unauthorized account access) when making employment decisions, though such decisions must not violate other employment laws such as discrimination statutes.

Social media monitoring is also permissible to the extent necessary to prevent trademark infringement, protect trade secrets, or prevent disclosure of confidential business information. However, employers bear the burden of proving that monitoring was necessary for these legitimate purposes and must demonstrate that the monitoring was proportionate to the business need. Blanket monitoring policies are disfavored and are unlikely to satisfy the exception standard.

Step 1 — Document the Monitoring: Keep detailed records of any monitoring activity. Write down the date the employer requested social media access, the specific account or information requested, who made the request, and whether the request was in writing or verbal. Save all emails, messages, or written communications requesting passwords or account access. If the employer accessed your account without permission, document when you discovered the unauthorized access, what information was viewed, and any evidence of the access such as login notifications or account activity logs. Photograph or screenshot evidence of the request and your denial if applicable.

Step 2 — Internal Complaint Process: Before pursuing external legal action, provide written notice to your employer objecting to the social media monitoring request. Send a formal email or letter to your supervisor, HR department, and company compliance officer stating that the requested monitoring violates Massachusetts General Laws Chapter 149, Section 150. Specifically state: "I refuse to provide social media passwords or account access because this violates Massachusetts law." Request written confirmation that the employer will cease the monitoring request. Keep copies of all correspondence. Document any retaliation that follows your refusal, such as negative performance reviews, reduced hours, or disciplinary action.

Step 3 — File with Massachusetts Attorney General: The Massachusetts Attorney General's office enforces Chapter 149, Section 150. Visit the Attorney General's website at www.mass.gov/ago and locate the Employee Rights Division. File a complaint describing the unauthorized monitoring, password request, or retaliation. Provide copies of all documentation from Step 1 and Step 2. Include your name, contact information, employer name, dates of the violation, and the names of individuals who requested the monitoring. The Attorney General will review the complaint and may investigate. There is no specific filing deadline, but complaints should be filed promptly after the violation occurs.

Step 4 — Civil Lawsuit for Invasion of Privacy: You have up to 3 years from the date of the violation to file a civil lawsuit in Massachusetts Superior Court under Chapter 214, Section 1B for invasion of privacy. Before filing, consult with an employment attorney licensed in Massachusetts. You will need to prove that the employer intentionally intruded into your private affairs, that the intrusion was highly offensive to a reasonable person, and that you suffered damages as a result. The court may award actual damages (out-of-pocket losses and medical expenses), emotional distress damages, and in some cases punitive damages. The lawsuit process typically takes 1-2 years from filing to resolution unless settled earlier. Do not delay filing as the 3-year statute of limitations will bar your claim.

Step 5 — Consult an Employment Attorney: Contact a Massachusetts employment law attorney immediately if the employer accessed your account without consent or if retaliation follows your refusal. A lawyer can evaluate whether you have claims for invasion of privacy, retaliation under Chapter 149, or other violations. Many employment attorneys work on contingency for strong privacy violation cases. An attorney can also file administrative complaints, send cease-and-desist letters to your employer, and negotiate settlements. If your employer is large, seek an attorney experienced in employment litigation. Initial consultations are often free or low-cost.