The controversy over employers requesting or requiring employees or applicants to disclose their usernames or passwords for their online accounts at services like Facebook and Twitter, has led some states to pass laws restricting employers’ rights to make such requests. On March 7, 2013, the Utah State Legislature joined these states and passed the Internet Employment Privacy Act (the Act). Under the Act, Utah employers may not request that an employee or job applicant disclose a username and password allowing access to a personal Internet account. It also prohibits employers from taking an adverse employment action (like refusing to hire, demoting or firing) against an employee who fails or refuses to disclose a username or password for a personal Internet account. A “personal internet account” is defined under the Act as an online account used by the employee or applicant for purely personal reasons unrelated to work. The Act provides a private right of action for any person aggrieved by such an action, but limits any potential award to $500. Even with this limited exposure, the Utah Internet Employment Privacy Act requires that employers proceed with caution when accessing or requesting access to employee information on the Internet.