Connecticut this month became the 21st state to enact a social media privacy law, and the absence of an overriding federal law means companies with employees in multiple states have to stay abreast of what changes are being made where, and how they impact individual offices and operations.

While the laws have similarities—they all broadly define social media, prohibit employers from asking employees or prospective employees for their social media passwords and include exceptions where employers can gain access to social media accounts—the differences between them require vigilance, said Howard Mavity, partner at law firm Fisher & Phillips.

“There’s model legislation that to some extent has been followed, so most of these laws are similar but they are not alike,” said Mr. Mavity. “So if you are a multistate employer there are 20-something laws now that have passed and all differ somewhat.”

Steven M. Richard, an attorney at law firm Nixon Peabody, said the laws are attempting to “regulate that fine line between what employees may do on social media that is relevant to their employment and what should be protected because of privacy concerns.”

In addition to the state laws, the National Labor Relations Board has come out strongly in favor of employee privacy protections, particularly for social media conversations between employees that pertain to wages, benefits and working conditions, even when they are critical of the company, said Mr. Richard. Whether legislatively or administratively, the rules are attempting “to balance the interests of employees and employers but respect the rights of employees to speak privately on social media.”

Since these laws are relatively new, it will take some time for cases to percolate into the legal system, said Mr. Richard. “Certainly we’re going to see such actions in the future,” he said.

Most important for companies is to know under what circumstances they are allowed to access employee social media accounts–for example if the employee is suspected of stealing company trade secrets, said Mr. Mavity. “Where this happens is with trade secret action. A company can get a temporary restraining order to compel access to it,” he said. “Pretty much every law I looked at has some language that it would be OK to demand passwords in those situations.”

Mr. Mavity said he doesn’t think employers are prying into employee actions on social media as much as the news media suggest. One reason is employers can check with coworkers to see what is going on with an employee. Also, many employees set their social media settings to public, which gives the company access to their statements without need of a password.

“You can Google so many articles in human resources journals about how employers are using social media to check out prospective candidates, but I don’t think it’s occurring as much as people think–and that is one reason we are not seeing so many legal issues,” said Mr. Mavity.

Still, companies are revising their policies, especially since many attorneys previously had advised them to establish strict rules that made it clear the company had the right to access emails, phones and voice messaging systems, said Mr. Mavity. “A lot of times employers put draconian statements in without any intention of using them,” he said. “They just didn’t want the employee to think they had an expectation of privacy. So now they have to go back and clean up a lot of those provisions because they may conflict with these various laws.”