Michigan’s Internet Privacy Protection Act bars employers from demanding access to personal online accounts

Michigan’s Internet Privacy Protection Act, 2012 PA 478, prohibits employers from requesting that employees or applicants grant access to, allow observation of, or disclose access information for personal internet accounts, or penalizing them for refusing. Employer-paid devices, employer accounts and some investigations are carved out.

Source facts

MCL 37.273, part of Michigan’s Internet Privacy Protection Act (2012 PA 478, immediately effective December 28, 2012), says an employer shall not request an employee or applicant to grant access to, allow observation of, or disclose information that allows access to or observation of a personal internet account. It also bars discharging, disciplining, failing to hire or otherwise penalizing an employee or applicant for refusing.

The definitions section defines access information as a user name, password, login information or other security information that protects access to a personal internet account, and defines an employer to include its agent, representative or designee.

Under MCL 37.275, the act does not prohibit requiring access information for an electronic communications device paid for in whole or in part by the employer, or for an account or service provided by the employer or used for its business purposes. Employers may also discipline an employee for an unauthorized transfer of proprietary or confidential information or financial data to a personal account, investigate when they have specific information about account activity or such a transfer, restrict websites and monitor data on employer-paid devices or networks in accordance with law, and view information available without access information or in the public domain.

Applicability

Use this for employers with Michigan operations. The act has more detail than this summary; confirm specific investigations and policies with counsel.

DSE recommendation

DSE recommends that Michigan employers keep investigations and monitoring to employer-paid devices, employer accounts and employer networks, and never ask staff or applicants for personal account passwords or a look at their accounts. Put the device and account boundaries in the acceptable-use policy, have IT and security staff route any personal-account question to HR and counsel, and document the specific information that triggers an investigation.

Verification

Review hiring scripts, background-check steps and investigation templates for requests to view personal accounts, and confirm monitoring tools cover only employer-paid devices, employer accounts and employer networks.

Official references

Michigan Legislature — MCL 37.273, Internet Privacy Protection Act (2012 PA 478), Duties of employer. Michigan Legislature — MCL 37.272, Definitions. Michigan Legislature — MCL 37.275, Certain acts by employer not prohibited or restricted. Reviewed October 18, 2026.