UMCES policy Bans staff from demanding student social media passwords

Under a policy revised on November 9, 2023, employees at the University of Maryland Center for Environmental Science cannot require, request, suggest, or cause a student or prospective student to hand over the password, log-in information, or any other non-public access information for a personal social media account. The University of Maryland Center for Environmental Science reported that the rule carries real weight: a student who refuses such a request cannot be suspended, expelled, disciplined, penalized, or threatened with any of those actions.

This is a privacy rule that exists to balance two things at once — protecting student privacy while still allowing social media to be used for academic and career-based activities. For students at UMCES, the practical effect is simple: your Instagram, Snapchat, X, Facebook, LinkedIn, or YouTube password stays yours.

Five Things Employees Cannot Ask For

The policy, written to comply with the Family Educational Rights and Privacy Act (FERPA), spells out five specific prohibitions. UMCES employees shall not:

Require, request, suggest, or cause a student to disclose, grant access to, or allow observation of non-public access information pertaining to any social media account.
Require a student to change the privacy settings on a personal social media account.
Require a student to designate an employee or agent as a friend, follower, or any other status that would give the employee access to a personal account.
Require a student to log into a personal account in the employee’s presence.
Require a student to provide the names of the social media platforms they use.

Only certain people are even authorized to access a student’s account under appropriate circumstances: unit directors, the president, or other staff given authorization by one of them. Everyone else is locked out by default.

Safe usage illustration concept with characters privacy settings secure sharing safety modern flat style for landing page inf

A 2014 Rule, Revised in 2023

The timeline matters here. The president first approved the policy on February 21, 2014, and it was amended and approved again on November 4, 2014. Nearly nine years later, on November 9, 2023, the president revised and approved the policy once more, bringing the current version into force.

The policy defines a personal social media account as one created and maintained by a student in whole or in part for private use, and it explicitly excludes accounts owned by the institution itself as well as accounts created specifically for academic or university-assisted career-based activities.

Where Academic Use Still Fits

The policy does not ban social media from the classroom. An authorized UMCES employee may require a student to access a social media account for an assignment, but only under strict conditions. The student must have the option to use either an existing personal account or a generic account they create for the course. Access must be limited to the academic or career-based activity. The student cannot be asked for non-public access information, and the activity must be designed in a way consistent with FERPA obligations.

There are procedural guardrails too. Employees must get approval from the Vice President for Education or the student’s unit director before instituting any academic or career-based activity involving these accounts, and they are encouraged to give students notice in syllabi or other written publications when such use is required.

Two other doors remain open by design. Employees may look at personal social media information a student has voluntarily provided, and they may view publicly accessible information about a student’s account. What they cannot do is go digging through private settings or demand the keys to get in.

No Retaliation for Saying No

The discipline clause is the enforcement mechanism. If a student refuses a prohibited request — a password, a friend request, a live log-in, a list of platforms — the policy bars UMCES employees from suspending, expelling, disciplining, penalizing, or threatening any of those actions against the student. Privacy refusal, in other words, is a protected act, not an act of defiance.

College students face real consequences: their personal social media accounts document friendships, family ties, political beliefs, and daily activities, and the policy assumes this information is private. The rule draws a bright line between what is public, what is shared voluntarily, and what requires a password — and it puts the password firmly on the student’s side of the line. No end date or further revision is on record; as of the November 9, 2023 revision, the policy stands as UMCES’s current rule on student social media privacy.