Education institutions (as well as other
organizations in the educational industry, including, without limitation,
providers of services to educational institutions) need to take into account
state laws that limit an educational institution from requiring students to
disclose social media account user names and passwords.
Melissa J. Krasnow
Dorsey & Whitney
Currently, nine states have such laws:
In a related development, 11 states have employer social media account laws:
Additional states are considering similar
This article provides a brief overview of the state educational
institution laws. If you wish to obtain a long-form summary of these state laws,
please e-mail the author at
To which educational institutions do these state laws generally
apply? These state laws apply to public and private
postsecondary educational institutions. The Michigan law also applies to
elementary and secondary schools, kindergartens, and nursery schools, public or
private educational testing services or administrators, and agents of
educational institutions, as well as to employers. MCL Section 37.272, Sec.
2(b)–(c). The Illinois law requires notification by public elementary or
secondary schools or school districts or nonpublic schools recognized by the
State Board of Education to students and their parents and guardians that such
school may request or require a student to provide a password or other related
account information to gain access to the student's account or profile on a
social networking website if such school has reasonable cause to believe that
the student's account contains evidence that the student has violated a school
disciplinary rule or policy. This notification must be published in such
school's disciplinary rules, policies, or handbook or communicated by similar
means. Ill. H.B. 64, Section 15.
What do these state laws typically restrict or prohibit? These state laws restrict educational institutions from requiring or
requesting students to disclose their social media
account user names and passwords. The Michigan, New Jersey, and Utah laws
additionally cover personal accounts or services. MCL Section 37.274, Sec. 4(a);
N.J. Sess. Law 2879, ch. 223 Section 2(a); and Utah Code Section 53B–24–201.
Educational institutions also are prohibited from penalizing students for failing to disclose this information. The California
law also requires private nonprofit or for-profit postsecondary educational
institutions to post their social media privacy policies on the institutions'
Internet websites. Calif. Educ. Code Section 99122.
What are some of the
exceptions to these state laws? Some state laws provide for
exceptions. For example, the California, Delaware, and Oregon laws do not apply
to certain types of investigations. Calif. Educ. Code Section 99121(c), Del.
H.B. 309 Section 9405, and Or. S.B. 344 Section 1(2)(A)–(B). The Arkansas,
Illinois, Michigan, New Mexico, and Utah laws carve out information about a student that is in the public domain. Ark. H.B. 1902 Subsection (d);
Ill. H.B. 64, Section 10(c); MCL Section 37.276, Sec. 6(2); N.M. S.B. 422 Section 1(D); and Utah Code Section
53B–24–202(2). The Michigan and Utah laws allow educational institutions to
require or request a student to disclose a user name and password to gain access
to or operate (1) an electronic communications device paid for by the
educational institution or (2) an account or service provided by the educational
institution that is either obtained by virtue of the student's admission to the
educational institution or used by the student for educational purposes. MCL
Section 37.276, Sec. 6(1) and Utah Code Section 53B–24–202(1).
What types of
enforcement do these state laws provide? By way of example, the
Michigan, New Jersey, Oregon, and Utah laws provide for civil actions. MCL
Section 37.278, Sec. 8(2); N.J. Sess. Law 2879, ch. 223 Section 4; Or. S.B. 344
Section 2(1); and Utah Code Section 53B–24–301. The Illinois and Michigan laws provide
for criminal penalties. Ill. H.B. 64, Section 20, and MCL Section 37.278, Sec. 8(1).
steps can organizations take?
First, organizations should take these state laws into account and monitor
developments such as legislation being considered in other states. Second,
organizations should determine whether these state laws apply to them or
organizations with which they conduct business or otherwise have a relationship.
Third, organizations should assess their policies, contracts, and practices and
make any modifications in light of these state laws. Fourth, private nonprofit
and for-profit postsecondary educational institutions in California need to
prepare and post their social media privacy policies on their institutions'
Internet websites. Calif. Educ. Code Section 99122.
Opinions expressed in Expert Commentary articles are those of the author and are
not necessarily held by the author's employer or IRMI. Expert Commentary articles
and other IRMI Online content do not purport to provide legal, accounting, or other
professional advice or opinion. If such advice is needed, consult with your attorney,
accountant, or other qualified adviser.
Please use the print button on the IRMI toolbar to print/preview this page.
© 2000-2015 International Risk Management Institute, Inc. (IRMI). All rights reserved.