It’s no secret that companies often look up the Facebook pages of potential new hires, and smart job candidates have long known to keep their profiles private. To get around that, some companies have taken to requesting usernames and passwords from job applicants so they can have a look around, the Associated Press reports.

We’ve seen this before. In 2009, the city of Bozeman, Mont., began requiring city job candidates to hand over their login information, a policy that remained in place, despite protests, until last year. Now both Illinois and Maryland have proposed legislation on the table that would make such practices illegal.

Some companies that don’t require applicants to give up their logins find other ways to see their profiles, such as having them friend an HR representative or by asking them to log in themselves during an interview. Experts question the legality of these policies, calling them privacy violations and suggesting that even if providing the information is voluntary, candidates who are really in need of a job may not feel they have any choice.