Employers now hold employee data under the same privacy rules that govern consumer data in several states, a shift most HR functions were not built for. This hub covers employer obligations.
Employee Privacy
November 9, 2026
Louisiana's 2014 Personal Online Account Privacy Protection Act stops employers and educational institutions from asking for the login credentials to a personal online account. The definition of personal account is tightly drawn, the employer exceptions are longer than the school ones, and the chapter's only liability section limits exposure.
Read more →
Genetic Privacy
November 9, 2026
North Carolina's genetic employment statute is one short section enacted in 1997. It forbids refusing employment or discharging someone because of requested genetic testing or counseling, or genetic information about the person or family. It reaches any public or private entity, but says nothing about remedies and does not regulate testing itself.
Read more →
Employee Privacy
November 2, 2026
Maine's employee social media privacy rules were enacted as Part B of a 2015 bill about leave for victims of violence. Five sections of Title 26 bar employers from seeking passwords, in-person viewing, account information, contact additions or settings changes from employees and applicants, keep three exceptions, and leave enforcement to Department of Labor fines.
Read more →
Employee Privacy
November 2, 2026
Wisconsin's Internet privacy protection statute, created by 2013 Wisconsin Act 208, applies one access rule to employers, educational institutions and landlords. It bars conditioning a job, admission or tenancy on handing over or displaying a personal Internet account, lists what stays permitted, and routes retaliation claims through the Fair Employment Act process.
Read more →
Genetic Privacy
November 2, 2026
Wisconsin regulates genetic testing in employment through two statutes created by the same 1992 act. Section 111.372 of the Fair Employment Act bars employers, unions, employment agencies and licensing agencies from testing as a condition of a job, and s. 942.07 makes testing or disclosure without written consent a Class B misdemeanor.
Read more →
Genetic Privacy
October 26, 2026
Iowa Code 729.6, enacted in 1992 and rewritten in 2010, bars every Iowa employer regardless of size from soliciting, requiring or administering a genetic test as a condition of employment, requires written informed consent before anyone obtains genetic information, and lets an aggrieved worker, county attorney or the attorney general sue for equitable relief.
Read more →
Employee Privacy
October 26, 2026
New Hampshire's 2014 workplace privacy act, HB 1407 (chapter 305), bars employers from asking for login information to an employee's or applicant's personal social networking account, forcing contact additions, or demanding lower privacy settings. It keeps employer equipment, employer accounts and two kinds of investigation outside the bar, and is enforced only by a labor commissioner penalty.
Read more →
Employee Privacy
October 19, 2026
Michigan's Bullard-Plawecki Employee Right to Know Act, in force since January 1, 1979, gives employees of employers with four or more workers a right to review and copy their personnel records, but excludes eight categories of material, bars records of off-duty associations and political activity, requires mailed notice before disciplinary records go to outsiders, and lets employees sue.
Read more →
Background Checks
October 12, 2026
Massachusetts runs criminal record checks through a state system with tiered access. An employer or landlord sees convictions only within fixed lookback windows, must collect a signed acknowledgment and check identification first, must hand the record to the applicant before asking about it, and holds the result under storage and logging rules set by regulation.
Read more →
Employee Privacy
October 12, 2026
Section 52C of chapter 149 gives current and former Massachusetts employees a right to review and copy their personnel record within five business days of a written request, to be told within ten days when negative information is added, and to file a rebuttal that travels with the record. The Attorney General enforces it; courts have recognized a narrower personal remedy.
Read more →
Genetic Privacy
September 28, 2026
Title II of the Genetic Information Nondiscrimination Act took effect November 21, 2009. The EEOC's rule at 29 CFR Part 1635 forbids covered employers, unions and employment agencies to request, require or purchase genetic information, carves out six narrow routes by which it may lawfully arrive, and treats whatever is held as a confidential medical record.
Read more →
Genetic Privacy
September 28, 2026
The Illinois Genetic Information Privacy Act, 410 ILCS 513, has been in force since 1998. It adopts HIPAA's definition of genetic information, which covers family medical history, forbids employers to solicit that information, limits insurers, and lets any aggrieved person sue for $2,500 or $15,000 per violation. Public Act 104-642 adds biomarkers from January 1, 2027.
Read more →
Workplace Monitoring
September 7, 2026
Three states condition workplace electronic monitoring on notice rather than on consent, and each builds the requirement differently. Connecticut makes a posted notice the legal notice. New York requires a notice on hiring and a posting. Delaware offers a choice between a daily electronic notice and a one-time acknowledged one.
Read more →
Facial Recognition
September 7, 2026
Three states regulate what happens to an applicant's face during hiring, through four statutes that each define permission differently. Maryland asks for a signed waiver with four listed contents. Illinois asks for notice, an explanation and consent, and separately for a written release. Texas asks only that the individual be informed and consent before capture.
Read more →
FCRA
September 7, 2026
The Fair Credit Reporting Act does not have one adverse action notice. It has a notice owed before a decision that only employers owe, and a notice owed after any adverse action taken on a consumer report by anyone. The two sit in different sections, carry different contents, and answer to different silences in the statute.
Read more →
Background Checks
September 7, 2026
Four published Ninth Circuit opinions have construed a single sentence of the Fair Credit Reporting Act: the requirement that an employment background check disclosure appear in a document that consists solely of the disclosure. Read in sequence, Syed, Gilberg, Walker and Luna map what may sit on the page, what the page is, and where the line still has not been drawn.
Read more →
Employee Privacy
September 7, 2026
New Jersey's tracking device statute, N.J.S.A. 34:6B-22, was approved on January 18, 2022 and took effect ninety days later. It reached that form after four reprints that moved it from a fourth-degree crime to a civil penalty, from written consent to written notice, and from any tracking device to one designed for the sole purpose of tracking.
Read more →
FCRA
September 1, 2026
The Fair Credit Reporting Act does not ask credit bureaus to be careful about who receives a consumer's file. It gives a closed list of permissible purposes and forbids everything else, on both sides of the transaction: the agency that furnishes the report and the person who obtains it.
Read more →
BIPA
August 31, 2026
The Illinois Workers' Compensation Act makes its own remedies exclusive for injuries covered by it, and Illinois employers argued that a fingerprint timeclock claim was such an injury. In McDonald v. Symphony Bronzeville Park, the Illinois Supreme Court answered the certified question in the negative, on grounds that turn on what kind of injury the compensation scheme was built to price.
Read more →
AI & Privacy
August 24, 2026
There is no general American law on algorithmic decisions. What exists is a set of narrow regimes reaching them from different directions: California ADMT rules attaching to decisions in named life domains, profiling opt-outs in the state comprehensive statutes, employment statutes imposing audits and notice, and an FTC remedy that reaches the model itself.
Read more →
Biometric Privacy
August 24, 2026
Illinois is not the only state with a biometric privacy statute: it is the only one where a private plaintiff can bring the claim. Texas, Washington and Colorado each regulate the capture and retention of biometric identifiers, and each reserves enforcement to a state official. This guide reads the three statutes against each other and traces what that enforcement design produces in practice.
Read more →
Employee Privacy
August 24, 2026
There is no single employee privacy statute in any state. What exists is a stack of laws written decades apart, each aimed at whatever the anxiety of its moment was: a paper file, a tape recorder, a Facebook password, a fingerprint scanner. Read in the order they arrived, the stack explains its own gaps. This guide takes them chronologically rather than by state.
Read more →
FCRA
August 24, 2026
The Fair Credit Reporting Act governs employment background checks through a chain of definitions that decides whether it applies at all, then through a short list of steps around the hiring decision. Most reported litigation concerns the format of one piece of paper handed to the applicant before the report is ordered.
Read more →
BIPA
August 12, 2026
Illinois BIPA is the only major US biometric statute that lets individuals sue directly, which is why a single-state law drives nationwide settlement exposure. This guide sets out what the statute requires, what the Illinois Supreme Court has held about accrual and injury, and where the obligations sit relative to biometric rules in other states.
Read more →