Employer Social Media Monitoring Laws in North Carolina

The primary federal law governing social media monitoring is the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2511, which prohibits the intentional and unauthorized interception of wire, oral, or electronic communications. ECPA applies to all private employers in the United States, regardless of size. Under ECPA, an employer may monitor electronic communications (including email and instant messages) on company equipment or networks if the employer has a legitimate business purpose and provides notice to employees.

However, ECPA contains an important exception: the "business use" exception allows employers to access communications made or stored on systems provided by the employer in the ordinary course of business. This exception does not apply to personal email accounts accessed on company equipment unless the employer has intercepted the communication at the point of transmission.

The Wiretap Act component of ECPA (Title III, 18 U.S.C. §§ 2510-2522) carries criminal and civil penalties. Employers who violate the Wiretap Act may face up to 5 years of imprisonment and fines up to $250,000 per violation, plus civil liability including actual damages, statutory damages of $100 per day per employee, and attorney's fees. The Federal Trade Commission (FTC) and the Department of Justice (DOJ) have enforcement authority. Social media platforms like Facebook, Twitter, and LinkedIn are considered electronic communications systems under ECPA. Courts have held that accessing someone's social media account without authorization—such as asking an employee for a password—violates ECPA. The Stored Communications Act (SCA), 18 U.S.C. § 2701, also protects against unauthorized access to stored electronic communications.

North Carolina has no specific state statute dedicated to social media monitoring in the workplace. Instead, employers and employees must rely on federal law, North Carolina's general wiretapping and eavesdropping statute (N.C.G.S. § 14-432), common law privacy torts, and North Carolina's lawful conduct protection statute.

N.C.G.S. § 14-432 makes it unlawful for any person to willfully intercept, endeavor to intercept, or procure any other person to intercept or endeavor to intercept any wire, oral, or electronic communication. This statute applies to all persons and employers in North Carolina. Unlike some states, North Carolina's statute does not contain an explicit business use exception or employer exemption. This means that even an employer monitoring electronic communications may face criminal liability if the monitoring is done without proper consent from both parties to the communication. North Carolina is a two-party consent state for wiretapping purposes, meaning both the sender and receiver must consent to monitoring.

N.C.G.S. § 95-25 provides that employees may not be discharged or discriminated against by their employer for engaging in lawful conduct during non-working hours and off the employer's premises. This statute protects employees' off-duty social media activity, political speech, union organizing, and other lawful personal conduct. An employer cannot monitor or access personal social media accounts (such as a private Facebook profile accessed from a personal device) for the purpose of disciplining or terminating an employee based on lawful off-duty conduct. Doing so may violate this statute and expose the employer to tort liability.

Common law invasion of privacy claims are also available in North Carolina. Courts recognize a tort for unreasonable surveillance or intrusion upon the solitude or seclusion of another. Monitoring highly personal social media communications, especially those unrelated to work or conducted on personal devices, may constitute an actionable invasion of privacy. State law provides no special exemption for employers conducting social media monitoring, whereas federal law permits monitoring on company systems with notice. Therefore, North Carolina's lawful conduct protections and privacy tort law may provide stronger protections than federal baseline for personal social media activity, but employers retain the right to monitor work-related social media use on company equipment with proper notice.

Employers in North Carolina have limited legal exceptions to social media monitoring restrictions. The primary exception is monitoring work-related communications on company-provided equipment (email, instant messaging, social media management tools) when employees have been provided clear notice that such monitoring will occur. An employer may require employees to disclose work-related social media accounts used for business purposes and may monitor those accounts when accessed on company systems or time.

Monitoring of personal social media accounts or highly private communications is not excepted under North Carolina law. Even if an employee uses a personal social media account during work hours on company equipment, intercepting or accessing that personal account without the employee's knowledge likely violates N.C.G.S. § 14-432. Asking an employee to disclose a password to a personal social media account and accessing it without the employee's ongoing consent is not protected; it may constitute a criminal violation of the wiretapping statute and/or the federal ECPA.

Union and collective bargaining carve-outs do not apply to social media monitoring in North Carolina; however, a union contract may impose additional restrictions on monitoring beyond what the law requires. At-will employment doctrine does not override statutory protections for lawful conduct under N.C.G.S. § 95-25. An employer cannot defend a termination based on monitored personal social media activity by claiming the employee was at-will; the employer must still comply with the lawful conduct statute. Employers also may not monitor social media for the purpose of discovering protected class information (race, color, religion, national origin, age, disability, etc.) and then use that information to make employment decisions; doing so violates Title VII and state discrimination law regardless of the monitoring method. Similarly, if monitoring reveals an employee's union activity, political affiliation, or other protected speech, the employer cannot take adverse action based on that discovery.

Step 1 — Document Everything: Preserve evidence of the unauthorized monitoring. If an employer asked you for a password to a personal social media account, save the request (email, text, written note). If you discovered unauthorized access to your personal account (unusual login location, changed settings, or account notification of logins from unfamiliar locations), screenshot the account activity log or security alert. Write down the date, time, what was monitored, and who authorized or conducted the monitoring. If monitoring occurred through a workplace tool or device that was supposed to monitor only work-related communications, document what personal information was accessed. Keep records of any disciplinary action taken by the employer based on information from the social media monitoring, including the termination letter, performance review, or written warning that references the monitored content.

Step 2 — Understand the Internal Complaint Process: North Carolina does not require employers to have an internal complaint process for privacy violations, unlike discrimination claims. However, if your employer has an HR department or employee handbook, review it for any privacy policy or complaint procedure. Send a written email or letter to your HR department documenting the unauthorized monitoring, citing the violation of N.C.G.S. § 14-432 or the employee's privacy rights, and requesting that the monitoring cease and that any information obtained be deleted. Keep a copy of this communication. Request a written response. This step creates a paper trail that may be useful in litigation and demonstrates that you attempted to resolve the issue internally.

Step 3 — File a Complaint with the Appropriate Agency: There is no state employment agency in North Carolina that handles social media monitoring complaints. Instead, you must file a criminal complaint with local law enforcement if the monitoring involves an unlawful wiretap under N.C.G.S. § 14-432. Contact your local police department or the North Carolina State Bureau of Investigation (SBI) and request to file a criminal complaint alleging unauthorized interception of electronic communications. Provide your documentation from Step 1. You may also file a federal complaint with the Federal Bureau of Investigation (FBI) if federal wiretapping laws were violated (18 U.S.C. § 2511). The FBI's local field office can be found at fbi.gov. There is no statutory filing deadline for criminal complaints, but reporting promptly is advisable. If the monitoring was accompanied by retaliation (termination, demotion, reduced hours), you may also file an unemployment claim with the North Carolina Division of Employment Security (NCES) at des.nc.gov to establish grounds for unemployment benefits. For civil claims (invasion of privacy tort, violation of N.C.G.S. § 95-25), you must consult with a private attorney, as these are not handled by a government agency.

Step 4 — Expect the Investigation Process: If you file a criminal complaint, law enforcement will investigate whether a violation of N.C.G.S. § 14-432 occurred. This typically takes 4-12 weeks depending on the complexity and the agency's workload. The agency will contact your employer and request information about the monitoring, including policies, the tools used, employee notices, and consent forms. They may also subpoena the employer's IT records. You will be interviewed about what happened. A criminal investigation does not result in compensation to you; it results in criminal charges against the employer or individuals if a violation is proven. Prosecution is at the discretion of the District Attorney. If you pursue a civil tort claim through a private attorney, discovery will take several months to a year. Your attorney will subpoena the employer's electronic communications records, monitoring software logs, employee policies, and related documents. Depositions of employer representatives and your own testimony will follow. Settlement negotiations or trial occur after discovery.

Step 5 — When to Consult an Attorney and What Type: Consult an employment lawyer as soon as possible if any of the following apply: (1) you were terminated or demoted following unauthorized social media monitoring; (2) the monitoring revealed protected information (union activity, political speech, medical information, etc.) and led to adverse action; (3) you were asked to disclose a password to a personal social media account; (4) the employer accessed your personal social media account without your consent; or (5) the monitoring was extreme (continuous surveillance, keystroke logging, etc.). An employment law attorney in North Carolina can evaluate your claim for invasion of privacy (a tort claim), violation of N.C.G.S. § 95-25 (lawful conduct protection), potential ECPA violations (which allow both criminal and civil remedies), and wrongful termination. Some attorneys handle criminal defense if you need to report the violation to law enforcement; others focus on civil litigation to recover damages. Ask potential attorneys whether they have experience with wiretapping law (N.C.G.S. § 14-432) and privacy torts, as not all employment lawyers specialize in these areas. Many employment lawyers offer free initial consultations. North Carolina's statute of limitations for tort claims (including invasion of privacy) is three years from the date of the violation; for statutory violations like N.C.G.S. § 95-25, the statute of limitations is typically two years. Do not delay in consulting an attorney, as deadlines may apply.