# Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts > Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out. - Canonical URL: https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-10-18T21:01:13+00:00 - Modified: 2026-10-18T22:22:08+00:00 - Last reviewed by DSE: 2026-10-18 - Resource type: Briefing - DSE priority: Advisory - Topics: Cybersecurity, IT - Reading time: 2 minutes ## What you need to know Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out. ## Potentially affected Michigan employers, including HR, IT and security teams that investigate misconduct, monitor company devices or screen applicants. ## DSE recommendation DSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. ## Article Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out. ## Source facts [MCL 37.273](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273), part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing. The [definitions section](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-272) defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee. Under [MCL 37.275](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-275), the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain. ## Applicability Use this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel. ## DSE recommendation DSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation. ## Verification Review hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks. ## Official references [Michigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273). [Michigan Legislature — MCL 37.272, Definitions](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-272). [Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted](https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-275). Reviewed October 18, 2026. ## Primary reference - Name: Michigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer - Authority: legislature.mi.gov - URL: https://legislature.mi.gov/Laws/MCL?objectName=mcl-37-273 - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts,” DSE Security, https://update.dsesecurity.com/updates/michigan-internet-privacy-protection-act-employer-personal-account-access/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.