With special thanks to our data privacy colleagues Jonathan Tam and Helena Engfeldt for their contributions.

It’s increasingly common for employers to use social media during the hiring process. The temptation is obvious — there’s a wealth of potentially useful information about applicants available online. It’s not unreasonable to wish to use social media to understand a prospective employee’s professional qualifications and skills to determine whether they fit with the criteria for the position. It’s no wonder that a recent survey from The Harris Poll finds that seventy-one percent of US hiring decision-makers agree that looking at candidates’ social media profiles is an effective way to screen applicants. Furthermore, 70% believe employers should screen all applicants’ social media profiles, while the majority (67%) say they use social networking sites to research potential job candidates.

Despite the potential benefits, this sleuthing causes significant heart burn for employment and privacy lawyers and HR professionals. While social media can be a fruitful way to find and recruit candidates, a minefield of legal risks appear when companies use social media during the screening process.

Potential Risks

  • Discrimination! Federal, state and local anti-discrimination laws prohibit discrimination in hiring based on a prospective employee’s protected class. The danger of researching applicants using social media is that you may become aware that the applicant belongs to a protected category – something that through the general application process you otherwise would be unaware of. And, you can’t put the genie back in the bottle. If a recruiter or hiring manager has accessed this data, it is difficult to prove that they were not influenced by it in their hiring decision.

Two cases underscore this danger:

    • In Gaskell v. University of Kentucky, the court denied a defense motion for summary judgment when a top candidate was passed over partly due to information about the employee’s religious beliefs the employer discovered through an online search.
    • In Hardin v. Dadlani, the court concluded that since the hiring manager had previously expressed a preference for white female employees, his instructions to an employee to look up an applicant on Facebook and invite her in for an interview “if she looks good” can be reasonably construed to refer to her race, which can establish discriminatory animus.
  • Running up against lawful off-duty conduct laws. Many states have enacted laws prohibiting employers from discriminating on the basis of an employee’s lawful off-duty conduct (for example, California, Illinois, New Jersey and New York). These laws vary in specificity. They generally protect an employee’s participation in recreational or leisure activities during personal time, such as tobacco use, consuming alcohol, possessing firearms, or engaging in political activities.
  • Violating the Fair Credit Reporting Act. In some instances, companies may find that working with a third-party social media background check provider may be preferable since the third-party provider can separate out any information about a prospective employee’s protected class or lawful off-duty conduct. But — be aware that social media background check companies are considered consumer reporting agencies under the FCRA or similarly regulated entities under state background check laws because they assemble or evaluate consumer report information that is provided to employers using that information as a factor in determining eligibility for employment.

Accordingly, employers using social media background check companies must also comply with disclosure and authorization requirements for obtaining consumer reports and taking adverse employment actions based on information in the reports under the FCRA and similar state laws. In particular, before obtaining a consumer report, an employer must under the FCRA:

    • Notify the prospective employee or current employee that the employer may obtain a consumer report for employment purposes.
    • Obtain written consent from the prospective employee or current employee.
  • Running afoul of the National Labor Relations Act. In recent years, the NLRB has scrutinized how social media policies, or enforcement of these policies, might discourage current employees from using social media to engage in concerted activity, such as discussing unions, wages, or other employment terms and conditions. The NLRB prohibits discrimination against applicants based on union affiliation or support. Therefore, using social media to screen out applicants on this basis may lead to an unfair labor charge against the company.
  • Liability under password protection laws. More than two dozen states have enacted laws addressing employer access to current and prospective employees’ social media accounts. These laws generally prohibit employers from requesting password and username information or otherwise accessing the password-protected portions of a prospective or current employee’s personal social media accounts, with certain exceptions. (Further, in all 50 states, asking for an applicant’s (or employee’s) password creates a real risk of violating the federal Stored Communications Act.)
  • Enhanced privacy obligations. Employers that collect and use personal data from social media should describe these practices in any privacy notices they provide to employment candidates. In addition, privacy laws may give individuals rights to access, port and limit the use of their personal data,[1] and companies that store and use candidates’ social media information should be ready to field their requests to exercise their rights under applicable privacy laws.
  • Computer interference laws. To comply with computer interference laws, like the United States Federal Computer Fraud and Abuse Act, employers must ensure that none of its employees or agents exceed any access to social media sites granted in the sites’ terms of use (which would be a violation both of the site terms as well as applicable computer interference laws).

Best Practices for Employers

If employers determine that there are substantial benefits to utilizing social media during hiring despite the risks, it’s paramount to do so properly to avert major legal pitfalls. Here are some recommended best practices:

  • Develop a social media screening policy demonstrating that legal and consistent practices are used. Employers must always base hiring decisions on information that is non-discriminatory and a valid predictor of job performance, and the policy should take care to reflect that.
  • Viewing social media profiles should only be used in compliance with social media sites’ rules to validate work history and experience and recruiters should receive special training on how to conduct this verification process. Consider limiting research to what is publically available on LinkedIn. Other forms are social media are personal and not professional.
  • Ensure that social media screening is performed by HR and that protected information (such as characteristics or classes protected by applicable discrimination laws and protected off-duty conduct and activities) is not shared with hiring managers.
  • Document that hiring managers have not been given access to any protected information discovered during the social media background check.
  • Be consistent. Determine what search, if any, will be performed for a given position and conduct that same search for each candidate after the in-person interviews.
  • In the event information is found that disqualifies an applicant, print and store such data since it could be useful in defending potential discrimination suits or other claims.
  • Comply with password protection laws. Do not request usernames or passwords or otherwise try to gain unauthorized access to private pages. Only review publicly available information about a prospective employee.
  • To avoid discrimination claims, it is prudent to conduct social media screenings later in the interview process, only after the interview has been conducted or even after the contingent offer has been made perhaps along with the reference or other background checks.
  • Do not make hiring decisions based on a prospective employee’s lack of a social media presence.
  • Implement internal protocols and training programs to ensure that HR personnel are able to field any requests from individuals to exercise their rights under privacy laws in a timely and compliant manner.

For help developing your social media screening policy or training HR on proper recruiting and hiring practices, contact your Baker McKenzie employment lawyer.


[1] For example, unless the HR exemption under the California Consumer Privacy Act (CCPA) is extended beyond January 1, 2023, employment candidates will have rights under the CCPA to access and port the personal information that a business holds about them and limit the business’ use and disclosure of their sensitive personal information. For more information, see here.