How New York City employers must handle social media screening under city and state law

What to take away

What New York City and New York state each regulate

The city and the state regulate different parts of the same hiring process. New York City law governs the local employment relationship through the NYC Human Rights Law, Title 8 of the New York City Administrative Code, enforced by the NYC Commission on Human Rights.

The law dates to 1965 and has been amended many times since. It covers employers in the five boroughs and reaches hiring, promotion and termination.

New York state law adds privacy and data rules that apply statewide, plus separate provisions on social media account access.

New York Labor Law § 201-i, signed in 2023, took effect in March 2024 and bars employers from requiring credentials for personal accounts from applicants and employees. State law sets the floor; city law often goes further for employers inside the city.

Federal law sits above both. The FTC enforces the Fair Credit Reporting Act, enacted in 1970, and the EEOC enforces anti-discrimination rules in hiring. New York employer background checks therefore have to satisfy all three layers at once.

For a general map of the obligations that attach to hiring and screening, the Legal Information Institute keeps a plain-language employment law overview of the field.

NYC Human Rights Law and its reach over screening tools

The NYC Human Rights Law, at section 8-107 of the New York City Administrative Code, prohibits discrimination based on protected traits such as race, color, religion, sex and national origin. Gender identity, age, disability, pregnancy and marital status are covered as well. Sexual orientation also counts, and so does arrest and conviction record, with narrow exceptions.

Social media is a poor filter for those traits. A profile photo, a religious holiday post, a wedding announcement, a visible disability or a graduation year can disclose protected information before the reviewer ever assesses job qualifications.

Two practices create the most exposure. First, a manager browses profiles informally and then claims the decision was neutral. Second, the employer screens only some applicants, which produces uneven records.

Treat the check as a selection procedure, not a background curiosity. The EEOC explains in its guidance on Employment Tests and Selection Procedures that selection tools must be job related and consistent with business necessity, and applied without disparate impact.

That framing matters in a city where the workforce is diverse and the applicant pool is large. If a screening step screens out members of a protected group at a higher rate, the employer needs evidence the step predicts job performance.

The NYC Fair Chance Act and screening for arrest or conviction record

Section 8-107(11-a) of the New York City Administrative Code carries the NYC Fair Chance Act. It bars employers from asking about or considering an applicant's arrest record or criminal conviction record before a conditional offer of employment.

The original law took effect in 2015. The 2021 amendments, effective July 29, 2021, extended the process to current employees and added duties for the employer.

A social media review can surface an arrest photo, a court notice or a news item about a charge. Finding that material before the conditional offer is the same as asking about it, so the employer cannot use it to screen the candidate out at that stage.

After a conditional offer, conviction record can be considered only through the fair chance process and the factors in Article 23-A of the New York Correction Law. New York Executive Law § 296(16) separately bars inquiries about arrests that did not lead to conviction and about sealed or dismissed charges.

State privacy protections that limit employer searches

New York state privacy protections limit how far an employer can go into personal accounts. The statute behind the rule is Labor Law § 201-i. Employers generally cannot demand a username, password or other credential that gives access to a personal social media account.

They also cannot require an employee or applicant to log in while the employer watches, or to add the employer to a friends or contacts list as a condition of hire. Asking a colleague to look at a private profile can raise the same problem.

Public content is different. Information an applicant has posted publicly can generally be reviewed, but the review still has to avoid protected characteristics and stay tied to the job.

Some searches drift into monitoring current staff rather than applicants. Employers that extend screening to existing employees should treat that as an online monitoring question, and there is a reason so many programs fail: monitoring included every time is where the drafting gets thin.

When a review of an employee's online conduct turns into an investigation, the process that follows has its own rules, as covered in the texas teacher social media policy. For a New York City employer, the same city and state limits apply to that investigation.

FCRA steps when a third party compiles the social media report

Hiring a vendor to compile a social media report changes the legal picture. If the vendor assembles information about a consumer and sells it for employment decisions, it is a consumer reporting agency and the report is a consumer report.

That triggers FCRA notice and consent steps. The employer must tell the applicant in writing, in a stand-alone document, that a consumer report may be obtained for employment purposes, and must get written authorization before ordering it.

The FTC sets out these duties in Using Consumer Reports: What Employers Need to Know. It also explains the pre-adverse action step: before acting on a report that may lead to rejection, give the applicant a copy of the report and a summary of FCRA rights.

After the applicant has had a reasonable chance to respond, the employer sends an adverse action notice. The companion FTC resource, Background Checks: What Employers Need to Know, walks through the same sequence for background checks generally.

New York adds its own notice and copy requirements for employment background checks, so a vendor workflow built for another state may fall short in the city.

Practical sequence: notice, consent, review, and documentation

A defensible program follows the same order every time. Deviating once creates a record that is hard to explain later.

Use this checklist before the next requisition opens:

Run the same checklist against a sample of files each month for high-volume roles, and note where the sequence slipped.

Managers still ask whether they can look at a candidate's profile on their own. The short answer is that informal browsing breaks the sequence, which is why a written rule belongs in the ccpa social media data requests that new hires receive.

Records, retention, and audit trails for screening decisions

Keep the disclosure, the signed authorization, the report or a summary of it, and the reviewer's notes together. Add the pre-adverse action notice, any applicant response, and the final notice.

Keep screening records separate from the personnel file. Access should be limited to the people who need it, and the applicant should be able to request a copy of what was used.

Retention periods differ by record type. The FCRA sets no retention period of its own, so the floor comes from other rules. The EEOC recordkeeping regulation at 29 CFR 1602.14 requires hiring records, including screening files, to be kept for one year from the date of the record or the personnel action, whichever is later.

Federal contractors must keep those records for two years under 41 CFR 60-1.12. If a discrimination charge is filed, the records stay until the charge is closed. New York wage and hour rules require payroll records for six years. Set the schedule by category against those floors.

Audit the program at least once a year. Pull a sample of hires and rejections, check that consent was obtained before the report was ordered, and confirm the pre-adverse action step happened where it was required.

Age-related limits on who can be screened and how data about minors is handled also touch hiring in media and app roles. The rules that apply to younger applicants and audiences are collected in How US employers can lawfully monitor, which is worth reading before a screening program covers interns or junior staff.

Common questions