Your password to Facebook and other social media sites may soon be getting tough legal protection.

The Massachusetts Senate passed a bill Thursday that would make it illegal for businesses and schools to ask employees and students to hand over social media passwords and user names.

While privacy experts say the practice does not appear to be widespread, several high-profile cases in other states have caused lawmakers nationwide to take notice.

Maryland passed the first password protection law in 2012 after the state corrections department forced an officer to provide his Facebook log-in information. More than a dozen states have passed laws to protect users from divulging details of their private social media accounts. Many other states are considering similar password-protection legislation.


“If I want to put something on Facebook for everyone to see, that’s my business,” said state Senator Cynthia Creem, a Democrat from Newton, who originally filed the Password Protection Act. Demanding passwords as a condition of employment, Creem added, “doesn’t seem acceptable.”

The legislation Creem sponsored would also prohibit school officials and employers from pressuring students and workers into adding them as contacts or to “friend” them on social media sites. It would ban sharing Instagram pictures, for instance, as a condition of employment, or having to show otherwise private blogs and online videos to a school team or club. Some school districts already prohibit their employees from using those practices.

“The point here is that there needs to be a clear dividing line between what you put out about yourself that is meant to be private and what is meant [to be] public,” said Gavi Wolfe, legislative counsel for the American Civil Liberties Union of Massachusetts, a supporter of the bill.

“Having employers demand passwords to social media accounts is a serious violation of privacy,” said Wolfe.


The federal Stored Communications Act protects individuals from having to divulge information stored on websites. Moreover, Facebook’s terms of service prohibit users from giving their passwords to others.

The Massachusetts bill was passed as an amendment to the Senate version of the state’s annual budget. It must be also approved by the House of Representatives.

The practice has already been condemned by many human resources professionals even as social media sites such as Twitter and LinkedIn have become a key resource in hiring and for screening employees.

“The Society for Human Resource Management does not believe that asking job candidates for a social media password is generally an effective practice,” said Kate Kennedy, a spokeswoman for the organization.

Still, with the rapid rise of people posting every tidbit — and many embarrassing moments — about their lives on social media, sites such as Facebook can be a tempting wellspring of information about prospective employees and students, said Kabrina Chang, an assistant professor of business law and ethics at Boston University.

And even if employers aren’t outright asking for log-in credentials, more companies are looking at photos publicly available online or combing the Web for information about the personal lives of candidates.

A Society for Human Resources Management survey found that 20 percent of employers used social media sites to screen job applicants in 2013.

“Employees are paying attention to what we do online more and more,” said Chang. “It’s unrealistic to think they won’t.”

But that can also be dangerous and open up potential employers and schools to discrimination lawsuits, she added. “They are exposed to so much information that by law they are not allowed to use in employment decisions,” said Chang. “But once you’ve seen it, it’s hard not to use it.”


Even though privacy advocates and many lawmakers are strongly against schools and businesses prying into private social media accounts, they also recommend that anyone in the job market scrub social media accounts of anything incriminating.

When talking to her Boston University students, Chang said she warns them “until I’m blue in the face that they need to clean up their Facebook pages.”

Michael B. Farrell can be reached at michael.farrell@globe.com. Follow him on Twitter @GlobeMBFarrell.