Overview
Social media screening is the only component of a background check where the employer is not looking for a specific record. Everything else asks a narrow question and gets a narrow answer. This one opens a window onto a person’s whole life and asks the employer to notice only the job related parts.
That is the difficulty in a sentence. The legal exposure here is not created by what an employer finds. It is created by what an employer sees on the way.
Throughout this page, “screening company” refers to the outside firm an employer hires to run the check. In the law it is called a consumer reporting agency, or CRA.
Why Employers Look
The stated reasons are usually some version of these:
- Checking for public conduct that would embarrass the organization or its clients
- Confirming that professional claims on a resume match a public professional profile
- Looking for threats, harassment, or violent content relevant to workplace safety
- Roles that are public facing, where the person’s public presence is part of the job
The unstated reason is that it is free and nobody has to ask permission. That is precisely why it goes wrong so often.
What You Cannot Unsee
A criminal search returns a criminal record. A social media search returns a person. Within seconds of opening a profile an employer typically learns the candidate’s approximate age, race, national origin, religion, family status, likely disability status, pregnancy, sexual orientation, and political views. Almost every one of those is a protected characteristic, and none of them can be unlearned once seen.
That creates a problem no policy solves cleanly. If the employer views the profile and then rejects the candidate, the candidate can point out that the employer knew. The employer cannot prove a negative. Every other screening component has a natural firewall, because a court record search does not reveal religion. This one has none.
The practical consequences are worth stating plainly:
- Timing matters. A search run before an interview is far harder to defend than one run after a conditional offer, when the employer already knew most of this anyway.
- Who looks matters. If the hiring manager looks personally, the protected information lands directly on the decision maker.
- Consistency matters. Searching some candidates and not others is difficult to explain, and the pattern of who got searched tends to be revealing.
Password Laws and What They Prohibit
More than half of U.S. states have enacted laws restricting employer access to personal social media accounts. Counts published in 2026 range between 27 and 28 and the number keeps moving, so the safe assumption is that your state has one.
The statutes vary in detail but converge on the same prohibitions. An employer generally may not:
- Request or require a username, password, or other access credential
- Require the person to open an account in the employer’s presence, sometimes called shoulder surfing
- Require the person to add the employer or its agent as a friend or contact
- Require the person to change privacy settings so content becomes visible
- Retaliate against anyone who refuses any of the above
Several states go further. Arkansas, Colorado, and Nevada prohibit an employer from even suggesting it, which removes the argument that a request was casual. Some statutes also prohibit using credentials the employer came across inadvertently.
Two exceptions appear in most of these laws. Employer issued devices, accounts, and systems are generally outside the protection, so an employer may monitor its own equipment. And many states permit an employer to request specific content where it is genuinely investigating alleged misconduct or a regulatory violation.
What none of these laws restrict is looking at content the candidate made public. That remains lawful everywhere, which is exactly why the discrimination exposure described above is the real constraint rather than the password statutes.
Activity the Law Protects
Some of what an employer will find on a public profile is legally protected, and acting on it creates liability independent of discrimination law.
Talking About Work
Federal labor law protects employees who act together concerning pay, hours, and working conditions. That protection reaches social media, and it applies whether or not a workplace is unionized. An employee complaining publicly about scheduling, wages, or safety, particularly alongside coworkers, is frequently engaged in protected activity. Rejecting or disciplining someone for it is a labor law problem, not a judgment call about attitude.
Lawful Off-Duty Conduct
Several states protect employees from adverse action based on lawful activity conducted off duty and off premises. Coverage varies, with some statutes limited to tobacco, others reaching all lawful products, and others covering lawful activity generally. Off-duty marijuana use is a distinct question covered on our drug testing page, where 12 jurisdictions protect it and 26 do not.
Political and Religious Expression
Private employers are not bound by the First Amendment, so the common belief that free speech protects a private sector employee is wrong. But several states and cities do restrict adverse action based on political activity, and religious expression is protected as a characteristic under discrimination law regardless of where it appears.
When It Becomes a Background Check
Whether federal background check law applies turns on who does the looking.
When an employer hires a company to compile social media information about candidates, that company is a consumer reporting agency. The Federal Trade Commission reached exactly that conclusion in 2011 about a social media screening service, holding that it assembles consumer report information furnished to third parties for employment eligibility decisions, and that consumer reporting agency obligations apply equally in the social networking context. Among those obligations is taking reasonable steps to ensure the maximum possible accuracy of information reported from social networking sites.
So a vendor supplied social media report carries the full apparatus: standalone disclosure, written authorization, and the adverse action process before any rejection.
A hiring manager who simply searches a candidate’s name triggers none of those obligations, and that is the more dangerous option rather than the safer one. No disclosure, no authorization, and no adverse action notice, but also no record of what was viewed, no filter between protected information and the decision maker, and no accuracy standard. The unregulated route removes the paperwork and keeps all of the discrimination exposure.
A well built vendor process does the one thing informal searching cannot: it reviews the material and reports only job related findings, so the decision maker never sees the protected characteristics at all.
The Accuracy Problem
Even where the process is lawful, the underlying material is unusually unreliable.
- Wrong person. Profiles are matched on name and photograph, with no date of birth and no identifier. Common names produce confident, wrong matches constantly.
- Missing context. A post written inside a joke, a fandom, a game, or an argument reads very differently stripped of the thread it belonged to. Screenshots destroy context by design.
- Age of the material. Platforms surface content from years ago as readily as from yesterday. A post written at 19 is being read as evidence about a 35 year old.
- Impersonation and parody. Fake accounts using a real person’s name and photo are trivial to create and hard to disprove.
- Synthetic content. Images and audio of a person saying things they never said are now cheap to produce, which makes a screenshot weak evidence of anything.
None of this means the material is worthless. It means a finding is a starting point requiring verification, exactly as a database criminal hit does.
If You Are Going to Do It
Employers who decide the value outweighs the risk can reduce that risk substantially with process:
- Write down what you are looking for before anyone searches, and limit it to job related conduct such as threats, harassment, or disclosure of confidential information.
- Run it after a conditional offer, not during screening, so the timing does not suggest the protected information drove the decision.
- Use someone who is not the decision maker, whether a vendor or an internal person outside the hiring process.
- Report only findings, never profiles. The decision maker should receive job related findings and nothing else.
- Apply it to every candidate for the role, not selectively.
- Document what was found and what was disregarded, including protected information that was filtered out.
- Give the candidate a chance to respond before acting, since context and impersonation are both common.
The Rules Employers Must Follow
Three rules apply. Each has its own page on this site, so this is the summary.
Never Ask for Access
In more than half the states, requesting a password, requiring a login in your presence, or requiring a friend request is unlawful, and in several it is unlawful even to suggest it. Public content is fair game. Private accounts are not.
Get Written Permission When a Vendor Is Involved
A vendor supplied social media report is a consumer report. The employer must give a standalone written disclosure and obtain written authorization before requesting it. See our FCRA overview.
Follow the Steps Before Rejecting Someone
If a vendor supplied report is going to cost the candidate the job, the employer must send a preliminary notice with a copy of it, allow time to respond, and only then issue the final decision. Given how often the person is misidentified or the context is missing, this step is doing real work. See the adverse action process.
For Applicants
- Assume public means public. Anything visible without logging in can be seen, and that is lawful in every state. Review your own accounts the way a stranger would.
- Nobody may ask for your password. In more than half the states that request is illegal, along with requiring you to log in while they watch or to accept a friend request. Refusing is protected.
- Check what a search of your name returns. You may be sharing it with someone whose content will be attributed to you.
- Old posts get read as current. Content from years ago surfaces alongside recent material with nothing marking the gap.
- Talking about pay and working conditions is protected. Federal labor law protects employees acting together about workplace issues, union or not.
- If a vendor reported it, you can dispute it. You are entitled to a copy before a final decision. Our guide to disputing a background check covers the process.
Best Practices
- Decide whether this component earns its risk for the role, and skip it where it does not
- Never request credentials, a login in your presence, or a connection request
- Search after a conditional offer rather than during screening
- Keep the searcher separate from the decision maker
- Report job related findings only, and filter protected characteristics before they reach anyone deciding
- Apply the same process to every candidate for the same position
- Verify identity before acting, since name and photo matching is weak
- Ask the candidate about anything you intend to act on, because context and fake accounts are both common