Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.
\nMCL 37.273, part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing.
\nThe definitions section defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee.
\nUnder MCL 37.275, the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain.
\nUse this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel.
\nDSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation.
\nReview hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks.
\nMichigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer. Michigan Legislature — MCL 37.272, Definitions. Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted. Reviewed October 18, 2026.
", "content_text": "Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.\nSource facts\nMCL 37.273, part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing.\nThe definitions section defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee.\nUnder MCL 37.275, the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain.\nApplicability\nUse this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel.\nDSE recommendation\nDSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation.\nVerification\nReview hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks.\nOfficial references\nMichigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer. Michigan Legislature — MCL 37.272, Definitions. Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted. Reviewed October 18, 2026.", "content_markdown": "Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.\n\n## Source facts\n\n[MCL 37.273](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273), part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing.\n\nThe [definitions section](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-272) defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee.\n\nUnder [MCL 37.275](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-275), the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain.\n\n## Applicability\n\nUse this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel.\n\n## DSE recommendation\n\nDSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation.\n\n## Verification\n\nReview hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks.\n\n## Official references\n\n[Michigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273). [Michigan Legislature — MCL 37.272, Definitions](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-272). [Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-275). Reviewed October 18, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/", "url": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-18" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts", "item": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/#article", "identifier": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/", "url": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/", "headline": "Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts", "description": "Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow…", "abstract": "Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.", "articleBody": "Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.\nSource facts\nMCL 37.273, part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing.\nThe definitions section defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee.\nUnder MCL 37.275, the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain.\nApplicability\nUse this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel.\nDSE recommendation\nDSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation.\nVerification\nReview hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks.\nOfficial references\nMichigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer. Michigan Legislature — MCL 37.272, Definitions. Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted. Reviewed October 18, 2026.", "datePublished": "2026-10-18T21:01:13+00:00", "dateModified": "2026-10-18T22:22:08+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Briefing", "Advisory priority" ], "genre": "Briefing", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 393, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Michigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer", "url": "https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273" } } ] } }