Social Media Background Check: Rules for Employers

A manager on my team once stopped me in a hallway to say he had looked up our final candidate for an operations role and thought I should know she was about to have a baby. He was not being malicious. He thought he was being helpful, the way people are when they bring you information they assume you would want. He had spent four weeks in a process built specifically so that neither of us would ever learn that fact, and he undid it with one search and one sentence.

We hired her, which was the right call and also the only call I felt able to make. That is the part that stayed with me. If she had come third out of three on the scorecards, I would have had a rejection to justify, a documented moment where the hiring manager learned she was pregnant, and no way at all to prove the two were unrelated. The search cost us nothing in information and handed us a liability we had been careful to avoid for a month.

That is the real subject here, and it is not really about social media. It is about the fact that a hiring process is deliberately blind in specific places, and that a public profile removes the blindfold in about four seconds. This article covers when to look, when a search stops being a search and becomes a regulated consumer report, what your state says about passwords and off-duty conduct, and how to build a process where the protected information never reaches the person making the decision. I build people and records tooling for businesses with no HR department at FirstHR. This is general information rather than legal advice, and the state law in this area moves.

What a Social Media Background Check Actually Is

A social media background check is any review of a candidate’s public online presence used to inform a hiring decision. There is no federal statute that requires one, none that forbids one, and no standard definition of what it covers, which is exactly why the practice varies so wildly between employers who all believe they are doing the normal thing.

In practice small employers do one of three things. They do nothing deliberate and rely on individual curiosity. They have one person search finalists informally and mention anything odd. Or they buy a filtered report from a screening firm as an add-on to a criminal record check. Those three sit at very different points on a risk curve, and most owners have never been shown the curve.

The confusion is worth clearing up early because a lot of advice in this area treats every version as the same activity. It is not. A general guide to what a background check covers will walk you through criminal records, employment verification and the vendor market. Social media sits outside all of that, because the raw material is not a record held by an agency, it is a person’s life, published by them, with no filter for what an employer is allowed to know.

The Problem: A Profile Hands You Exactly What You Avoided Asking

The central risk is not that you will find something disqualifying. It is that you will find protected-class information you kept out of the application and the interview on purpose, and once you have seen it you cannot prove it played no part in what you decided next.

Think about how much work goes into not knowing these things. You wrote an application form that does not ask for a date of birth. You trained interviewers not to ask whether somebody has children. There is a whole body of guidance on illegal interview questions that exists for one reason: to keep protected characteristics out of the decision by keeping them out of the room.

A public profile defeats every one of those controls at once. A profile photograph gives you an approximate age, a probable race and often a national origin. A graduation year gives you a birth year to within two. A post about a church group, a fast, or a holiday gives you religion. A fundraiser for a treatment gives you a disability, sometimes the candidate’s and sometimes a family member’s, which brings genetic information rules into play as well.

Federal law prohibits employment decisions based on race, color, religion, sex including pregnancy, national origin, age, disability and genetic information (EEOC, prohibited employment policies and practices). Nothing in that prohibition turns on how you learned the fact. Learning it from a public post is legally identical to asking it in an interview, with one difference that runs against you: the interview question can be trained out, and the search cannot be untaken.

The practical effect is evidentiary. A candidate who is rejected after an employer demonstrably learned of her pregnancy has a story that fits together without any further proof. Your defense becomes an argument that you knew and did not care, which is a credible position and also one that a jury gets to weigh rather than a judge dismissing it on the papers.

When a Social Media Search Becomes a Consumer Report

It turns on one question: who compiled the information. If you or your own employee run the search, the Fair Credit Reporting Act does not apply. If you pay or direct a third party to assemble information about a candidate for an employment decision, that party is a consumer reporting agency, the output is a consumer report, and the full statutory process attaches from disclosure through adverse action.

The statute is old enough to predate everything it now catches, which is why employers assume it cannot reach a Facebook search. Read the definition and it plainly does. A consumer report is any written, oral or other communication by a consumer reporting agency bearing on a consumer’s credit worthiness, character, general reputation, personal characteristics or mode of living, used or expected to be used for employment purposes (15 U.S.C. 1681a). Character, reputation and mode of living describe a social media summary better than they describe a credit file.

The Federal Trade Commission settled the point directly. In a letter dated 9 May 2011, the Commission’s Division of Privacy and Identity Protection told an internet and social media screening service used by employers that it met the definition of a consumer reporting agency, because it assembled and evaluated information furnished to third parties for use in establishing eligibility for employment, and that it was therefore obliged to take reasonable steps to ensure maximum possible accuracy and to inform employer clients of their own obligations (FTC closing letter, 9 May 2011).

Two practical points fall out of that table. First, the FCRA has no public information exception, so the argument that the candidate published it themselves does not remove the report from the statute. Second, willful noncompliance carries statutory damages of $100 to $1,000 per violation plus attorney fees under 15 U.S.C. 1681n, and violations are counted per consumer, which is why FCRA claims arrive as class actions rather than as one aggrieved applicant.

What matters on this page is the trigger, and the trigger is the third party, not the subject matter.

The State Laws on Passwords and Private Accounts

Roughly half the states make it unlawful for an employer to require or request a username, a password or other access credentials for a personal social media account, and most of those statutes reach applicants and not only current employees. Several go further and bar asking the person to open the account in your presence or to add you as a contact.

California Labor Code section 980 is a fair model for the category. It prohibits an employer from requiring or requesting that an employee or applicant disclose a username or password for personal social media, access personal social media in the employer’s presence, or divulge any personal social media, with a narrow carve-out permitting disclosure where it is reasonably believed relevant to an investigation of alleged employee misconduct and where the material is used only for that investigation (California Labor Code 980). Illinois, Maryland, New Jersey and Washington all have statutes in the same family, enacted in the same wave, with differences in scope and remedy.

I am not going to quote a national count, because the tallies you find in circulation disagree with each other and the statutes keep being amended. Check your own state and the state where the candidate will actually work, which is the same instruction that governs every other screening rule and is laid out state by state in background check laws by state.

Three details catch employers who think they are safely outside this. In several of these statutes the request is the violation, so a candidate who refuses has already been wronged and does not need to have handed anything over. The prohibition typically covers indirect routes, including asking a current employee to show you a private group a candidate belongs to. And in states with no statute at all, using credentials you were not given to reach a private account raises exposure under the federal Stored Communications Act and state computer access laws, which is a considerably worse conversation than a hiring dispute.

Off-Duty Conduct and Lawful Activity Protections

A search does not only surface protected characteristics. In a number of states it surfaces protected activity, because what a candidate lawfully does on their own time is protected in its own right, which means a post showing it cannot be your stated reason for saying no. New York, Colorado, California and North Dakota each reach that ground by a different route, many states protect lawful tobacco use specifically, and a growing number restrict adverse action based on off-duty cannabis use.

Federal labor law adds the layer that surprises small employers most. Section 7 of the National Labor Relations Act protects concerted activity by employees about wages, hours and working conditions, and it applies in workplaces with no union. A public post complaining about a former employer’s pay practices, made together with or on behalf of coworkers, is close to the paradigm case of protected activity. It is also close to the paradigm case of what a hiring manager flags as an attitude problem, which is precisely the trap.

Put those two bodies of law together and a pattern emerges. A large share of what a social media search actually surfaces is either a protected characteristic or a protected activity. That is not an accident of the medium. People post about their beliefs, their families, their health, their politics and their working lives, because that is what social media is for.

What a Manager Stumbles Across Versus What a Process Produces

An undocumented look is the worst available option, because it carries the full exposure of a search and none of the defense. A documented process is defensible because it is consistent, limited and recorded. A hallway search is indefensible because there is no record of what was seen, when, or by whom, and the only account of it a year later is the candidate’s.

Consistency is the first thing a plaintiff’s lawyer probes and the first thing informal searching fails. If you looked up three of nine candidates and the three share a characteristic, the pattern speaks for itself regardless of what was in anybody’s head. Decide per requisition whether the role gets a search, then apply that to every candidate who reaches the stage or to none of them. The same discipline that makes a structured interview defensible is what makes this defensible.

The second failure is the record. If you acted on a post, you need a dated copy of it, because accounts get deleted and handles get changed. Without that copy you are asserting the existence of something that no longer appears to exist, against a candidate who remembers it differently.

The third is that a policy nobody enforces is worse than no policy. If your handbook says hiring managers do not search candidates and three of them do it anyway, you have created a written standard you are visibly failing to meet. Either enforce the prohibition properly or build the channel described in the next section. What does not work is a rule that exists only on paper, which is a training problem more than a policy problem and belongs in the same conversation as training your hiring managers.

What You See Online: Job Relevant, Protected, or Merely Distasteful

Almost everything you find online falls into three buckets, and only the first one belongs anywhere near a hiring decision. Job relevant findings connect to a requirement already written in the job description. Protected findings are ones you are not permitted to weigh at all. Distasteful findings are the large middle category that people act on most and can defend least.

The bottom row is the one I would put on a poster. In my experience the overwhelming majority of what gets escalated after a search is in that category: a photo somebody found unprofessional, a spelling mistake, a joke that did not land, a strong opinion about something irrelevant. None of it predicts performance and all of it correlates with things you are not allowed to select on.

I watched a competent manager argue against a warehouse candidate on the strength of a profile picture. When I asked what the photograph told us about pallet throughput or attendance, there was no answer, only a feeling. That feeling is what the process is for. It is also almost exactly how bias enters a hiring process, wearing the clothes of a legitimate concern.

One more caution on the job relevant column. A finding there is a reason to verify, not a reason to decide. Duplicate names are common, old accounts get repurposed, and screenshots circulate out of context. Where a finding is serious enough to change an outcome, confirm it through an independent route such as a reference check before it becomes the stated reason.

How to Structure a Search the Decision-Maker Never Sees

Split the job in two. One person who is not deciding runs the search against a list written before anybody was looked up, and the person deciding receives only a short written note of job-relevant findings. The decision-maker never opens the profile, never sees a screenshot, and never hears an informal account of what was there.

Who can be the screener at a small company is the obvious objection. The honest answer is that it has to be somebody with no stake in the outcome: an office manager, an operations lead from an unrelated team, a co-owner who is not on the panel, or an outside vendor. The vendor route is cleanest in terms of separation and heaviest in terms of compliance, because it converts the search into a consumer report with everything that follows.

The written list matters as much as the separation. Agree in advance the four or five categories a screener may report upward, tie each to a requirement that already appears in the job description, and make everything else unreportable by default. Screeners who are left to use judgment will report what struck them, and what strikes people is disproportionately the protected and distasteful material.

None of this survives contact with a company that does not write it down. The list, the named screener, the sources searched, the stage at which it runs and the note format should sit in one document that gets reviewed once a year, alongside the rest of your candidate screening standards. A structure that lives in one person’s head disappears the moment that person is on holiday.

When in the Process to Run It

Run it after the interviews are complete and the candidate has been assessed on the merits, at the same point as the rest of your background screening. For most small employers that means the finalist stage or immediately after a conditional offer. Never during application review, and never on a subset of candidates chosen by instinct.

Late placement solves three problems at once. It keeps the volume low enough that running the search on every candidate at that stage is actually achievable. It means your evaluation of the person exists in writing before anybody saw a profile, which is a genuinely useful piece of evidence. And it puts the search inside the part of the process candidates already expect to include verification, which is where it belongs in the sequence described in the hiring process guide.

Tell candidates it may happen. A single line in the job posting or the process overview stating that public online sources may be reviewed for finalists costs nothing and removes the ambush. If a vendor is doing the compiling, you are required to disclose it anyway, on a standalone document rather than buried in the application.

What to Document, and When

Record the date, the person who searched, the sources searched, how identity was confirmed, and each job-relevant finding stated as a fact with a link and a dated copy. Record nothing protected and none of your impressions. The most common correct entry in this file is a single line saying nothing job relevant was found.

Retention deserves a sentence of its own. Application and hiring records are subject to federal recordkeeping rules that require them to be preserved for a set period after the personnel action, and a search log created as part of a hiring decision is part of that file. Where to keep it is also a real question: this belongs with the requisition, not in the hired employee’s personnel file, where it would sit forever and be visible to managers who have no business with it.

Two anti-patterns to name explicitly. Do not keep a folder of candidate screenshots, because a folder of profile captures is a documented archive of protected information about people you did not hire. And do not write your reaction into the log. A note that says the candidate seemed unprofessional online, with no post attached, is a plaintiff exhibit that took you thirty seconds to create.

The Honest Case for Not Doing It at All

For most small employers, skipping the social media search is the better trade. Findings that legitimately change a hiring decision are rare, the process required to make those findings defensible is real work, and every search you run creates documented knowledge you may later have to explain. If you are not going to build the separation, do not run the search.

Run the numbers on your own hiring. Count the times in the last two years that something found online genuinely changed an outcome for a reason you would be comfortable stating in a deposition. For most owners I talk to the answer is zero or one. Then count the number of candidates whose protected characteristics somebody on your team learned along the way. That ratio is the whole argument.

There are roles where the case flips. Positions that publicly represent the company, safety-sensitive work, roles with unsupervised access to children or vulnerable adults, and jobs handling money or sensitive data all carry a specific, articulable reason to look. So does a concrete concern that arose elsewhere in the process, such as a reference who hinted at something and would not elaborate. What those cases share is that you can write the reason down before you search.

There is also a narrow middle path worth considering. Limit the search to professional material only: the public professional profile, the portfolio, the published work, the repository, and nothing else. Record the URLs, note what they showed against the requirements, and close the tab. That version captures nearly all of the real signal, because a candidate’s professional presence is where the job-relevant evidence actually lives, and it avoids most of the exposure.

If you are already sourcing on these platforms, keep the two activities separate in your own mind. Posting jobs and building an audience is a marketing function and is covered in social media recruiting. Screening an individual candidate is an evaluation function with a different legal profile, and the fact that both happen on the same website is a coincidence of technology rather than a reason to run them the same way.

My own rule, for what it is worth, is that I do not look, and neither does anybody who will vote on the hire. When a role genuinely warrants a review, somebody outside the decision does it against a written list and sends me one line. Most of the time that line says there was nothing. That outcome is not a failure of the process. It is the process telling me the truth, which is that the interview was always going to be where the decision came from.

Frequently Asked Questions