Imagine you're a motivated college senior interviewing for your dream job. Your resume is plump, your answers are impressive and your interviewer seems engaged.
Then you're asked to hand over your Facebook username and password.
Oregon joined 11 other states in banning such practices this week, when a law passed last May went into effect.
But without federal legislation, employers — as well as colleges and universities — are continuing to pry into the personal lives of their employees and students through the sparsely legislated realm of the Internet.
"If you have certain privacy protections in your own home … then my feeling is that you should have the same type of protections online as you do offline," says Bradley Shear, a lawyer who has worked with state and federal lawmakers to draft legislation on the issue.
Shear says the law is often slow to adapt to changes in technology.
In 2012, six states passed legislation preventing employers, schools or both from demanding access or passwords to social media accounts, according to information compiled by the National Conference of State Legislatures.
In 2013, seven more states joined their ranks, while lawmakers in 25 states without laws in place considered similar legislation.
Those who oppose employers gaining access to the social media profiles of prospective or current employees argue that such practices are too invasive and often put the privacy of third parties — such as an applicant's Facebook friends — at risk.
"When an employer asks for access to their social media, it's essentially the same as if an employer asked for full access to their house … poking through their mail, looking in their drawers, sitting in on conversations at the dinner table," says Dave Maass, a spokesperson for the Electronic Frontier Foundation.
Emory University junior Stanton Huang has been asked for his username and password several times when applying to internships in marketing and management — though the requests were mostly labeled optional.
"I've never given access and do not feel comfortable giving private information during a job interview outside of contact information and background checks," Huang says.
As part of its background check, the Virginia State Police asks applicants hoping to become troopers to sign into their social media accounts while an investigator looks on.
"The social media aspect is just one small part of a very complex process that takes place, and when you're entrusting an individual with the powers to enforce the law, we are going to make sure that we have vetted this person thoroughly," says spokesperson Corinne Geller.
Geller added that this part of the background check is optional (although nobody has ever refused), and denying access is "not an automatic disqualifier."
When it comes to colleges and universities, ACLU advocacy and policy strategist Allie Bohm says schools most often monitor the social media accounts of student-athletes.
Some schools require student-athletes to Facebook friend a coach, while others make them install software like Varsity Monitor or UDiligence.
Bohm admits that laws protecting social media accounts need to avoid blocking employers and schools from carrying out some necessary oversights.
Bohm says laws need to allow self-regulating companies to fulfill their legal obligations — such as a financial institution monitoring insider trading, for example, as well as some legitimate cases of bullying that schools must investigate.
"We try to make sure there is language in there that doesn't allow fishing expeditions but does allow folks to get at very real accusations of bullying," Bohm says.
Social media monitoring is more widespread than people understand, Shear says. But since most affected by it would rather stay quiet than miss out on employment or educational opportunities, privacy advocates struggle to sustain the attention needed to impart change.
"If we don't stand up and say, 'this is not how we want our society to be' … then it is going to continue and get worse," he says.