Quick answer: you're allowed to look at a candidate's public social media. What you're not allowed to do is use what you find there to make a hiring decision, if what you find touches religion, disability, pregnancy, age, or national origin. That's the whole problem in one sentence. Let's get into why it's so easy to trip over.
Nobody writes "candidate seemed too religious for our culture" on a rejection form. That's not how this goes wrong. It goes wrong quieter than that.
You pull up a candidate's profile to check for anything embarrassing, which is the reason most employers do this in the first place. Along the way you see a church group photo, a baby shower announcement, a post about a doctor's appointment, or their college graduation year. You didn't ask for any of that. You saw it anyway.
Now it's in your head. And if that candidate doesn't get the job, even for a completely unrelated reason, you're the employer who saw their pregnancy announcement right before you passed on them. Good luck proving that's a coincidence in a lawsuit.
This is the part employers underestimate. You don't have to dig. A completely ordinary, public profile hands you protected-class information without you searching for it at all.
None of that is a candidate oversharing. It's just what a normal person's public profile looks like. That's what makes this so hard to avoid by just "being careful."
Here's the part that catches employers off guard. You don't have to admit you used the information for it to become a problem. You just have to have seen it before making the call.
A candidate's lawyer doesn't need proof you thought "no" because of their religion. They need to show you saw information about a protected class, then made a decision that hurt that candidate. From there, you're explaining yourself. That's a much worse position than never having seen it at all.
This is why "I have good intentions, I'd never actually discriminate" doesn't hold up as a plan. Good intentions don't stop you from seeing a photo. The exposure happens the second you look, not the second you act on it.
The fix isn't "don't look at social media, ever." Plenty of employers still want that check. The fix is not being the person who looks.
Some employers use a third-party service to run the social media search instead of doing it themselves. The service pulls what's public, strips out anything touching a protected class, and hands the hiring manager a report with only what's actually relevant. Things like threats, harassment, evidence of on-the-job misconduct. Not a baby shower post.
That's the same basic idea as how a background check company works. You don't personally read the county court file. A CRA does, and hands you a clean result. Same logic here: put a filter between you and the raw profile, so you never see the stuff you're not supposed to be weighing in the first place.
I'll be blunt. If you're doing this manually, one HR person scrolling a candidate's Instagram, you're taking on risk for free. A filtered report costs you a little money and removes the entire "I saw something I shouldn't have" problem. That trade is worth it for almost anybody hiring at any real volume.
Here's a piece people miss. If you hire a third-party vendor to compile a social media report about a candidate and hand it to you for a hiring decision, that can trigger the Fair Credit Reporting Act. The same federal law that covers a criminal background check.
That means the same basic obligations. You need to disclose to the candidate that a report may be used, get their written consent first, and if you're going to turn them down partly because of it, give them a copy and a chance to respond before you make it final.
A lot of employers assume FCRA only applies to court records and credit checks. It doesn't work that way. It applies based on what the vendor is doing, not what you'd casually call the product. If a company is gathering information about a specific person from outside sources and handing you a report to make a decision on, you're probably in FCRA territory, social media or not.
If you're a small HR team and you're tempted to just Google a candidate yourself before an offer, I get the instinct. It's free and it feels thorough. I don't love it as a plan. You're one screenshot away from a discrimination claim you never intended to set yourself up for.
A filtered, vendor-run process costs more than free. It also gets you out of the position of personally having seen the thing you're not supposed to have seen. That's worth paying for.
One more thing, and I mean this: laws around social media screening and what counts as a "consumer report" move fast, and they're not identical in every state. Talk to an employment lawyer about your specific process before you build one. Nothing in this article is a substitute for that conversation. It's a starting point, not the final word.