The RPWA protects employees from being required to disclose certain personal information and from being punished for lawful, off-duty conduct. While many employers are familiar with the social media password rule, the Act extends much further. Its core protections include:

1. Employee Social Media Privacy

Under the RPWA (820 ILCS 55/10), employers may not:

• Request or require employees or applicants to disclose usernames, passwords, or other authentication information for personal social networking accounts.

• Demand access through indirect means such as “shoulder surfing,” forced login, or requiring the employee to modify privacy settings.

• Retaliate against an employee for refusing such a request.

Common issue:

A hiring manager screenshots protected social media content during screening. Note that even inadvertent access can create RPWA, retaliation, or discrimination risks. However,  employers may review publicly available information and may regulate employer provided accounts or devices used primarily for business purposes. Having clearly defined “business vs. personal” account distinctions is critical.

2. Use of Lawful Products Off Duty

Under 820 ILCS 55/5, employers may not refuse to hire, discipline, or terminate an employee for using lawful products off duty and off employer premises. This includes:

• Tobacco

• Alcohol

• Cannabis (when used lawfully and outside working time)

Employers may still prohibit impairment, possession, or use during working hours. This aligns with the Illinois Cannabis Regulation and Tax Act (CRTA), which permits disciplinary action when an employer has a good faith belief, based on specific, articulable symptoms, that an employee is impaired at work.

Employers may also impose reasonable restrictions tied to bona fide occupational requirements, including safety sensitive positions and federally regulated roles.

Imagine This:
A company supervisor, Mark, finishes his shift on a Friday. Over the weekend, he legally uses cannabis at home. He returns to work Monday morning feeling fine. During a routine, random drug test the following week, Mark tests positive for THC metabolites.

The HR manager, assuming “positive test equals drug use,” writes him up for violating the company’s drug-free workplace policy. Mark insists he wasn’t impaired, and no one observed anything unusual about his performance. But the company points to the test result and disciplines him anyway.

Under Illinois law, this seemingly simple decision can create major legal exposure for the employer. 

Many employers still operate under pre-legalization assumptions but under today’s Illinois laws, that approach is not just outdated, it exposes your company to legal risk.

Why RPWA Compliance Matters

The RPWA provides employees with a private right of action. Violations can result in:

• Statutory and actual damages

• Attorneys’ fees and costs

• Injunctive relief

• Reputational harm especially in cases involving social media access or cannabis related discipline

With recreational cannabis now legal in Illinois, employers should revisit long standing policies to align with both the RPWA and the CRTA while maintaining safety standards.

Common RPWA Compliance Pitfalls for Illinois Employers

1. Outdated Employee Handbooks

Many handbooks still contain pre-legalization drug policies, blanket cannabis prohibitions, or broad lifestyle conduct rules that conflict with the RPWA.

2. Confusing or Outdated Drug Testing Policies

Because cannabis can remain detectable long after lawful off-duty use, a positive test alone is not enough to discipline an employee. Employers must:

• Identify observable, specific signs of impairment at work

• Document those observations

• Apply testing policies consistently and in compliance with the CRTA

Legally reviewed policies are essential to avoid inconsistent application.

3. Improper Social Media Screening

Recruiters or managers may access restricted content without realizing it. This can trigger privacy claims or allegations that hiring decisions were based on protected characteristics.

4. Insufficient Supervisor Training

Frontline managers often make quick decisions around drug testing, social media issues, or performance concerns without understanding statutory limits. Training significantly reduces inadvertent violations.

Harbor and Main Law Helps Illinois Employers Stay Compliant

Harbor and Main Law’s fractional general counsel services provide ongoing, strategic legal support without the cost of a full time attorney. For RPWA compliance, this includes:

• Updating employee handbooks and privacy policies

• Drafting compliant social media, cannabis, and drug testing policies

• Training supervisors, managers, and HR teams

• Reviewing hiring, background check, and screening processes

• Advising on impairment protocols and documentation procedures

Most RPWA issues arise from small, preventable errors. Proactive legal guidance helps employers avoid disputes and create consistent, defensible practices.

Final Thoughts

Compliance with the Illinois’ Right to Privacy in the Workplace Act is not a one time update; it requires ongoing attention as workplace expectations shift and cannabis related laws continue to develop. If you haven’t reviewed your RPWA-related policies in the past 12–18 months, now is the ideal time to do so.

Harbor and Main’s fractional general counsel service provides the tailored, cost-effective support Illinois employers need to stay compliant, reduce risk, and build a workplace culture rooted in trust and transparency.