NDA Enforceability by State: A 2026 Reference for Corporate Counsel

Short answer: Courts generally enforce a confidentiality agreement that protects a legitimate interest and is reasonable in scope and duration, but the statutory carve-outs differ by state. Under the federal Speak Out Act, a nondisclosure or nondisparagement clause agreed to before a sexual harassment or sexual assault dispute arises is not judicially enforceable where the conduct alleged violates federal, tribal or state law (42 U.S.C. § 19403(a)). At least 17 states also limit employment or settlement NDAs by statute: California, Colorado, Hawaii, Illinois, Louisiana, Maine, Nevada, New Jersey, New Mexico, New York, Oregon, Rhode Island, Tennessee, Utah, Vermont, Virginia and Washington. Texas and Alabama void NDA terms that hide sexual abuse. Use the state table to find the rule for the signer's state.

Reviewed and corrected on 6 October 2026. This is general information, not legal advice; check the cited statute or opinion before relying on it.

Official text, as of 6 October 2026

Washington's is one of the broadest of the state statutes. This is the operative text, read on the legislature's site on 6 October 2026.

Citation: RCW 49.44.211(1), app.leg.wa.gov.

"A provision in an agreement by an employer and an employee not to disclose or discuss conduct, or the existence of a settlement involving conduct, that the employee reasonably believed ... to be illegal discrimination, ... is void and unenforceable."

The ellipses skip the rest of the list of covered conduct, which is illegal harassment, illegal retaliation, a wage and hour violation, sexual assault, or conduct recognized as against a clear mandate of public policy. The section covers employment agreements, independent contractor agreements, agreements to pay compensation in exchange for the release of a legal claim, and "any other agreement between an employer and an employee."

Four details matter in practice:

• Settlement amounts. A provision that keeps the amount paid in settlement confidential can still be enforced (subdivision 2).
• Trade secrets. The employer and employee may still protect "trade secrets, proprietary information, or confidential information that does not involve illegal acts" (subdivision 6).
• Remedy. An employer that violates the section after June 9, 2022 is liable for "actual or statutory damages of $10,000, whichever is more, as well as reasonable attorneys' fees and costs" (subdivision 7). Attempting to enforce a prohibited provision "through a lawsuit, a threat to enforce, or any other attempt" is itself a violation (subdivision 5).
• Reach. A nondisclosure or nondisparagement provision in an agreement signed by a Washington resident "is governed by Washington law" (subdivision 9). The section reaches back to agreements created before June 9, 2022 only to invalidate provisions agreed at the outset of or during employment, with damages allowed only to prevent enforcement, and that retroactive rule does not apply to a provision in an agreement to settle a legal claim (subdivision 11).

What changed in 2026: Nothing in this section; its history line lists only 2022 c 133 s 2. Elsewhere, Illinois amendments took effect on January 1, 2026, Utah amended its statute in the 2026 session, Alabama's new law applies to agreements made on or after October 1, 2026, and the NLRB General Counsel asked the Board to overrule McLaren Macomb (see below).

The call you actually get

Picture a general counsel at a 60-person SaaS company. A VP of sales who left in March is now at a competitor and has been posting on LinkedIn about a "toxic culture" with enough specificity that customers are asking. This is a hypothetical, built to show the order in which the questions arise.

The NDA she signed at hire is on the GC's screen: a two-page form downloaded from a template site in 2019 that defines "Confidential Information" as "any information relating to the Company." It has no whistleblower carve-out, no reference to 18 U.S.C. § 1833(b), and no Speak Out Act recital. The GC wants to send a cease-and-desist by Monday.

Sending it may be the wrong move. If the posts describe conduct covered by a state statute, the letter can be a violation by itself. In Washington, for example, a "threat to enforce" a prohibited provision violates RCW 49.44.211(5). The SEC has also brought Rule 21F-17 cases over confidentiality terms that impede whistleblowing, and the NLRB has taken positions on severance-agreement confidentiality that are now being contested.

Read the form and the facts before anything goes out.

An NDA is the kind of contract that gets drafted once and reused for years. Between the federal Speak Out Act, California Civil Code § 1670.11, New York's General Obligations Law § 5-336, Washington's RCW 49.44.211 and the other statutes below, an old form may not say what the GC thinks it says. This piece sorts the states into four buckets, walks through six drafting failures, and ends with a checklist.

How to use the map: identify the signer's state of residence and the type of information at issue first. If the dispute is about sexual harassment or sexual assault, start with the Speak Out Act, then check the state rule. Everywhere else, the baseline reasonableness test, the federal whistleblower provisions and any state statute in the table control.

TL;DR

• Courts generally enforce a reasonable, supported NDA. The fight is over the statutory carve-outs and the definition of confidential information.
• The Speak Out Act, 42 U.S.C. §§ 19401-19404 (claims filed on or after Dec. 7, 2022), makes a pre-dispute nondisclosure or nondisparagement clause judicially unenforceable in a sexual harassment or sexual assault dispute. It is a floor, and states may be more protective.
• At least 17 states restrict employment or settlement NDAs by statute, including Colorado (C.R.S. § 24-34-407), Hawaii (HRS § 378-2.2), Louisiana (La. R.S. 9:2717.3), Rhode Island (R.I. Gen. Laws § 28-5-7) and Tennessee (Tenn. Code Ann. § 50-1-108), which earlier versions of this post listed as having no rule. Connecticut has no such statute.
• The DTSA whistleblower-immunity notice, 18 U.S.C. § 1833(b)(3), belongs in any employer agreement with an employee or contractor that governs trade secrets or other confidential information. Omit it and the employer may not be awarded exemplary damages or attorney fees in a DTSA action against that person.
• McLaren Macomb (NLRB 2023) is still Board law, but the General Counsel has asked the Board to overrule it. Check status before relying on it.
• Six drafting failures, in rough order of how fixable they are: overbroad scope, undefined duration, no whistleblower notice, no subpoena or government-cooperation clause, penalty-style liquidated damages, and ignoring the signer's state.

Part of our state law reference series.

The federal baseline: the Speak Out Act

Most employment NDA arguments about sexual harassment start with the Speak Out Act. Public Law 117-224, codified at 42 U.S.C. §§ 19401-19404, was signed on December 7, 2022.

The operative rule is in § 19403(a). With respect to a sexual assault dispute or sexual harassment dispute, "no nondisclosure clause or nondisparagement clause agreed to before the dispute arises shall be judicially enforceable in instances in which conduct is alleged to have violated Federal, Tribal, or State law." The statute makes the clause judicially unenforceable. It does not say the clause is void. It also applies only to disputes about sexual harassment or sexual assault, and it applies to clauses agreed to before the dispute arises, so it does not govern a nondisclosure clause negotiated after the dispute begins.

Points to check when you review a form:

• Timing. The Act applies to a claim filed on or after December 7, 2022 (§ 19404). The statute speaks of claims filed after that date, so the date the NDA was signed is not what matters.
• Nondisparagement. The Act defines a nondisparagement clause in § 19402(2) and § 19403(a) covers it alongside nondisclosure clauses. Many older forms have both.
• Floor. Section 19403(b) preserves state laws that are "at least as protective of the right of an individual to speak freely."
• Trade secrets. Section 19403(d) says nothing in the chapter prohibits an employer and employee from protecting trade secrets or proprietary information.
• Scope. The Act defines only sexual assault and sexual harassment disputes (§ 19402(3), (4)). Race, disability, age and pay discrimination claims are outside it, although several state statutes cover them.

Drafting for it is cheap. A short recital that the agreement does not restrict disclosure of conduct alleged to be sexual harassment or sexual assault shows the rest of the form was drafted with the statute in view.

The four buckets

The bucket framework below is a drafting heuristic, not a doctrinal taxonomy. State NDA law is messier than a four-category sort: states differ in baseline reasonableness tests, in whether settlement-NDA rules track employment-NDA rules, and in the stage (pre-dispute or settlement) at which each statute applies. Most states sit in more than one bucket. The binding analysis is in the specific state's statute and case law.

Bucket 1: Enforcement of reasonable NDAs (the default)

Outside the statutory carve-outs below, an NDA is a contract, and the usual contract questions apply: does it protect a legitimate interest in confidential business information, is it supported by consideration (employment, payment or access to the information), and is it reasonable in scope and duration. Whether a given court will find a specific clause reasonable is a state-law question that this post does not try to answer for every state. Not verified in our October 2026 review: state-by-state case law on scope and duration. Check the governing state's cases.

Bucket 2: Sexual harassment and discrimination carve-outs

Each entry below was read from the statute text in October 2026.

• California. Cal. Code Civ. Proc. § 1001 prohibits settlement terms that restrict disclosure of factual information about claims of sexual assault, sexual harassment, workplace harassment or discrimination, retaliation, and housing discrimination. A claimant may still request a term shielding their identity, and a term keeping the settlement amount confidential is allowed (§ 1001(c), (e)). Cal. Civ. Code § 1670.11 voids a term in a contract or settlement agreement entered on or after January 1, 2019 that waives a party's right to testify about the other party's alleged criminal conduct or sexual harassment, or that of the other party's agents or employees, when the party is required or requested to attend under a court order, subpoena or written request from an agency or the Legislature. Cal. Gov't Code § 12964.5 makes it unlawful to require an employee to sign a nondisparagement agreement that denies the right to disclose information about unlawful acts in the workplace, or to put such a restriction in a separation agreement. A restriction on disclosing workplace conditions must include, in substantial form, "Nothing in this agreement prevents you from discussing or disclosing information about unlawful acts in the workplace, such as harassment or discrimination or any other conduct that you have reason to believe is unlawful." A separation agreement offer must give at least five business days to consult an attorney (§ 12964.5(b)(4)). The section does not apply to a negotiated settlement of a claim already filed (§ 12964.5(d)).
• Colorado. C.R.S. § 24-34-407, part of the POWR Act (SB23-172, effective August 7, 2023 according to the General Assembly's bill page). A nondisclosure provision about alleged discriminatory or unfair employment practices in an agreement entered into or renewed after the effective date is void unless six conditions are met: it applies equally to all parties; it expressly says it does not restrain disclosure of the underlying facts (to family, advisers, agencies, and in response to legal process); it says that such disclosure is not disparagement; if the agreement has a nondisparagement provision and the employer disparages the employee to a third party, the employer may not enforce the nondisparagement or nondisclosure provisions or seek damages for violating them; any liquidated damages are reasonable, proportionate and not punitive; and a signed compliance addendum is attached. Each violation carries actual damages and a $5,000 penalty.
• Hawaii. HRS § 378-2.2 bars an employer from entering into, or requiring an employee to enter into, a nondisclosure agreement that prevents the employee from disclosing or discussing sexual harassment or sexual assault in the workplace. It excludes human resources employees and employees asked to keep an ongoing HR investigation confidential.
• Illinois. The Workplace Transparency Act, 820 ILCS 96. Section 1-25 voids a unilateral condition of employment that has the purpose or effect of preventing truthful statements about alleged unlawful employment practices. A mutual condition may include such terms only if it is in writing, shows bargained-for consideration from both sides and acknowledges five listed rights (six after the 2026 amendment). Section 1-30 allows settlement confidentiality only on the employee's documented preference, with notice of the right to have an attorney review it, 21 days to consider and 7 days to revoke (each waivable by the employee). P.A. 104-320, effective January 1, 2026, broadened the protected subjects to include concerted activity, added a separate-consideration requirement for settlement confidentiality, and added to § 1-25(b) clauses that apply non-Illinois law to an Illinois employee's claim or require a venue outside Illinois.
• Louisiana. La. R.S. 9:2717.3 (Acts 2024, No. 781): a nondisclosure clause "required by an employer and agreed to prior to a hostile work environment dispute or sexual harassment dispute" is not judicially enforceable. Confidential settlements are allowed once a report is filed or a dispute has occurred.
• Maine. 26 M.R.S. § 599-C (P.L. 2021, c. 760). An employer may not require an employee, intern or applicant to waive or limit the right to report or discuss unlawful employment discrimination. A settlement, separation or severance agreement may include a term preventing later disclosure of facts about a discrimination claim only if it gives separate monetary consideration, applies to all parties, preserves the right to report to and testify before agencies and courts, and the employer keeps a copy for six years. The Department of Labor enforces the section.
• Nevada. Nev. Rev. Stat. § 10.195: a settlement agreement entered into on or after July 1, 2019 may not restrict disclosure of factual information about a claim of sex discrimination or retaliation by an employer or landlord, or about conduct that would be a felony sexual offense. The claimant may request an identity-shielding term, and a settlement-amount term is allowed. NRS 50.069 separately voids a contract or settlement term that restricts testimony required by court order, subpoena or written agency request about the other party's crime, sexual harassment, discrimination or retaliation by an employer or landlord.
• New Jersey. N.J.S.A. 10:5-12.8: a provision in an employment contract or settlement agreement "which has the purpose or effect of concealing the details relating to a claim of discrimination, retaliation, or harassment" is against public policy and unenforceable against the employee, and unenforceable against the employer too if the employee publicly reveals enough detail that the employer is reasonably identifiable. Settlements must carry a bold notice to that effect. Non-competes and agreements not to disclose proprietary information (defined to include "only non-public trade secrets, business plan and customer information") are not affected. In Savage v. Township of Neptune, No. A-2-23 (N.J. May 7, 2024), the New Jersey Supreme Court unanimously held that a nondisparagement clause in a settlement of sex discrimination, harassment and retaliation claims was unenforceable because the statute reaches any provision with the purpose or effect of concealing those details. The court added that parties can still agree not to disparage each other on matters unrelated to such claims if the clause is narrowly drawn.
• New Mexico. N.M. Stat. § 50-4-36: a private employer may not, as a term of employment, require an employee to sign a nondisclosure provision of a settlement agreement on a sexual harassment, discrimination or retaliation claim, or prevent an employee from disclosing such a claim. Confidentiality is allowed for the monetary amount, and for identifying facts or underlying factual information at the employee's request.
• New York. N.Y. Gen. Oblig. Law § 5-336 has three separate rules. Subdivision 1 covers settlements and other resolutions of discrimination, harassment or retaliation claims: no term may prevent disclosure of the underlying facts "unless the condition of confidentiality is the complainant's preference." The complainant has up to 21 days to consider it, the preference is recorded in a signed agreement, and the complainant may revoke for at least 7 days. Such a term is void to the extent it restricts participating in an agency investigation or disclosing facts needed to receive unemployment insurance, Medicaid or other public benefits. Subdivision 2 voids a term in an employer's contract with an employee, applicant or contractor, entered into on or after January 1, 2020, that prevents disclosure of facts about any future discrimination claim unless the term says the person may still speak with law enforcement, the EEOC, the state division of human rights, the attorney general, a local human rights commission or an attorney. Subdivision 3 makes a release unenforceable if the complainant must pay liquidated damages or forfeit consideration for violating a nondisclosure or nondisparagement clause, or must state that no discrimination occurred. Section 5-336 was amended in 2023 (S.4516). CPLR § 5003-b applies a parallel 21-day and 7-day rule to agreements resolving discrimination claims.
• Oregon. ORS 659A.370 makes it an unlawful employment practice to require, as a condition of employment, continued employment, promotion, compensation or benefits, a nondisclosure or nondisparagement provision that prevents discussing discrimination prohibited by ORS 659A.030 (including sexual assault), 659A.082 or 659A.112. A release agreement may include one only at the employee's request, with at least seven days to revoke. An employer cannot make a settlement offer conditional on that request. The section does not apply where the employer makes a good faith determination that the employee engaged in prohibited conduct. A civil penalty of up to $5,000 is available.
• Rhode Island. R.I. Gen. Laws § 28-5-7(1)(vi) makes it an unlawful employment practice to require an employee, as a condition of employment, to sign a nondisclosure agreement that requires alleged violations of civil rights to remain confidential, or a nondisparagement agreement about alleged violations of civil rights or alleged unlawful conduct. A contract provision in violation is void as against public policy.
• Tennessee. Tenn. Code Ann. § 50-1-108: an employer may not require an employee or prospective employee to execute or renew a nondisclosure agreement "with respect to sexual harassment in the workplace as a condition of employment." An injured employee has the remedies available under § 50-1-304.
• Utah. Utah Code § 34A-5-114 (amended in the 2026 General Session): a confidentiality clause regarding sexual misconduct, as a condition of employment, is void and unenforceable. After an allegation of sexual harassment or assault, the employer may not retaliate, and an employee has three business days to withdraw from a settlement that includes such a clause. The section allows terms keeping the settlement amount confidential and, at the employee's request, terms protecting the employee's identity. It does not prohibit non-competes or protecting confidential information that does not involve illegal acts.
• Vermont. 21 V.S.A. § 495h has two rules. Subsection (g) bars an employer from requiring an employee or prospective employee, as a condition of employment, to sign an agreement that restricts opposing, disclosing, reporting or participating in an investigation of sexual harassment, and voids such a provision. Subsection (h) governs settlement agreements: a settlement of a sexual harassment claim may not stop the employee from working for the employer or its affiliates (a no-rehire ban), and it must expressly state that it does not prevent complaints to agencies, testimony, responding to discovery, or concerted activity.
• Virginia. Va. Code § 40.1-28.01: an employer may not require an employee or prospective employee, as a condition of employment, to execute or renew a nondisclosure or confidentiality agreement, including a nondisparagement provision, that has the purpose or effect of concealing the details of a claim of sexual assault or sexual harassment. Such a provision is void and unenforceable.
• Washington. RCW 49.44.211, quoted above. It covers wage and hour violations as well as discrimination, harassment, retaliation and sexual assault.

Narrower statutes in other states:

• Texas. Tex. Civ. Prac. & Rem. Code § 129C.002 (S.B. 835, effective September 1, 2025) voids a confidentiality term in an employment agreement, settlement agreement or any other agreement to the extent it prohibits disclosing an act of sexual abuse or facts related to it. Parties may still keep the amount and payment terms confidential.
• Alabama. Ala. Code § 6-5-861 (Act 2026-63) voids a term in a nondisclosure, confidentiality, employment, settlement or other agreement that prohibits disclosing an act of sexual abuse, for agreements entered into, executed or amended on or after October 1, 2026. It does not reach other parts of the agreement, such as compensation.
• Arizona. A.R.S. § 12-720 says an NDA may not be used to stop a party from answering a peace officer's or prosecutor's inquiry, or making an uninitiated statement in a criminal proceeding, about certain listed offenses, and bars using public money as consideration for an NDA about alleged sexual assault or sexual harassment. It does not reach private employment NDAs generally.
• Maryland. Md. Code, Lab. & Empl. § 3-715 voids a provision in an employment contract that waives a substantive or procedural right or remedy for a future sexual harassment claim. It is a waiver statute and does not itself bar an NDA.

Bucket 3: Rules that reach beyond sexual harassment

Several of the statutes above reach more than sexual harassment or assault. Colorado, Illinois, Maine, New Jersey, New Mexico, New York, Oregon and Rhode Island cover discrimination, retaliation or unlawful conduct generally, and Washington adds wage and hour violations. California's Gov't Code § 12964.5 reaches information about "unlawful acts in the workplace." Louisiana's statute covers hostile work environment disputes. A form that is fine under a sexual-harassment-only rule can fail under these.

Three statutes that people cite for NDAs are waiver rules, and they should stay out of a state rider unless counsel confirms they apply:

• Cal. Lab. Code § 432.6 bars requiring an employee, as a condition of employment, to waive "any right, forum, or procedure" for a violation of the Fair Employment and Housing Act or the Labor Code. It was added by AB 51 to address forced arbitration, subdivision (f) says it does not invalidate an arbitration agreement enforceable under the Federal Arbitration Act, and the Ninth Circuit held AB 51 preempted by the FAA in Chamber of Commerce v. Bonta, No. 20-15291 (9th Cir. Feb. 15, 2023). It is framed as a waiver rule rather than a nondisclosure rule, although its text lists the right to "notify" a state agency.
• Conn. Gen. Stat. § 31-51bb gives an employee covered by a collective bargaining agreement the right to bring a statutory cause of action in court. It says nothing about waivers or NDAs. Connecticut has no NDA statute that we found. The 2026 bill on the subject, S.B. 355, was tabled on the Senate calendar on April 13, 2026, which is its last recorded action on the General Assembly's site.
• Md. Code, Lab. & Empl. § 3-715 is a waiver rule, described above.

Bucket 4: Government-reporting and testimony limits

Many of the statutes above protect a person's ability to talk to the government or testify, whatever else the NDA says. Examples: Cal. Civ. Code § 1670.11 and Nev. Rev. Stat. § 50.069 on testimony required by subpoena or agency request; N.Y. Gen. Oblig. Law § 5-336(1)(c) and (2) on agency investigations and speaking with law enforcement; Maine's § 599-C(3) on reporting to agencies, testifying and reporting to law enforcement; Colorado's § 24-34-407(1)(b) on agencies and legal process; and Vermont's § 495h(h)(2) on complaints, testimony and discovery. Federal law adds three layers:

• SEC Rule 21F-17, 17 C.F.R. § 240.21F-17(a): "No person may take any action to impede an individual from communicating directly with the Commission staff about a possible securities law violation, including enforcing, or threatening to enforce, a confidentiality agreement ... with respect to such communications." (The omitted parenthetical excludes agreements dealing with information related to the legal representation of a client.) The SEC adopted its whistleblower rules in 2011. Its first enforcement action under the rule against restrictive confidentiality language was against KBR Inc. on April 1, 2015 ($130,000 penalty). On May 22, 2026 the SEC settled with Foot Locker, Inc. over award-waiver language in about 148 separation agreements ($148,000 civil penalty), per the SEC's announcement.
• 18 U.S.C. § 1833(b), the DTSA immunity for confidential disclosure of a trade secret to a government official or an attorney, or in a sealed filing, solely to report or investigate a suspected violation of law.
• The NLRB. McLaren Macomb, 372 NLRB No. 58 (Feb. 21, 2023), held that an employer violates Section 8(a)(1) of the National Labor Relations Act by proffering a severance agreement with broad confidentiality and nondisparagement terms, because the offer interferes with employees' Section 7 rights. It overruled the Board's earlier Baylor and IGT decisions.

The 50-state framework table

This is the table to keep open while drafting. It records what we found in each state's statutes in October 2026. The Speak Out Act floor applies everywhere and is omitted. "Common law" means we found no NDA-specific statute for private employment, so the federal rules plus general contract law control. "None found" is an absence finding, and absence is harder to prove than presence: a narrow statute (for example, on settlements of childhood sexual abuse claims or public-employer settlements) may exist even where this table shows none. Check the official code for the signer's state. The table also does not track pay-transparency laws that bar employers from requiring employees to keep their wages confidential, such as Mich. Comp. Laws § 408.483a and Minn. Stat. § 181.172.

Commercial NDAs (M&A diligence, joint venture, vendor confidentiality) sit mostly in the common-law lane, because these statutes are about employment and settlement agreements. Check the signer's state anyway when an individual is a party.

The six substantive drafting failures

1. Overbroad scope

The most common failure is a definition such as "any information relating to the Company" or "any non-public information the Employee learns during employment." A definition that broad sweeps in facts about unlawful workplace conduct, which the statutes above protect. The statutes themselves point to the fix: Washington leaves room to protect "confidential information that does not involve illegal acts" (RCW 49.44.211(6)), Utah does the same (§ 34A-5-114(4)(b)), and California's § 12964.5(f) protects "confidential information that does not involve unlawful acts in the workplace."

The fix is a closed-list definition with carve-outs for (a) publicly available information, (b) information independently developed, (c) information lawfully received from a third party, and (d) information already known to the recipient, plus an express statement that it does not cover information about unlawful conduct.

2. Undefined duration

Some NDAs run "in perpetuity." None of the statutes in this post sets a maximum duration. Whether a perpetual term on ordinary business information is reasonable is a state-law question. Not verified in our October 2026 review: state-by-state case law on duration. Check the governing state's cases. As a drafting matter, give ordinary confidential information a defined period and treat identified trade secrets separately, for as long as they remain trade secrets. For how the underlying trade-secret protection varies, see trade secret enforceability by state.

3. No DTSA whistleblower notice

Under 18 U.S.C. § 1833(b)(3), "an employer shall provide notice of the immunity set forth in this subsection in any contract or agreement with an employee that governs the use of a trade secret or other confidential information." "Employee" includes a contractor or consultant (§ 1833(b)(4)). The notice may be a cross-reference to a policy document that sets out the employer's reporting policy for suspected violations (§ 1833(b)(3)(B)). The duty applies to contracts and agreements entered into or updated after May 11, 2016 (§ 1833(b)(3)(D)).

The immunity itself is that no individual is liable under federal or state trade secret law for disclosing a trade secret in confidence to a government official or an attorney solely to report or investigate a suspected violation of law, or in a sealed court filing (§ 1833(b)(1)). The penalty for omitting the notice: the employer "may not be awarded exemplary damages or attorney fees" in a DTSA action against the employee who did not receive it (§ 1833(b)(3)(C)). The fix is a paragraph in every employee, contractor and consultant agreement that governs trade secrets or confidential information.

4. No subpoena and government-cooperation carve-out

A clean NDA says what the recipient does when a subpoena arrives: notify the disclosing party where lawful, comply, and cooperate if the disclosing party seeks a protective order. Several states void NDA terms that restrict testifying under subpoena or cooperating with an agency (Cal. Civ. Code § 1670.11, Nev. Rev. Stat. § 50.069, N.Y. Gen. Oblig. Law § 5-336(1)(c), Colorado § 24-34-407(1)(b)(II) and (III)). A carve-out for communications with government agencies (SEC, DOJ, NLRB, EEOC, state agencies) also addresses the Rule 21F-17 and McLaren Macomb concerns above.

5. Penalty-style liquidated damages

A flat $50,000 or $250,000 per-breach liquidated damages clause with no tie to expected harm invites a penalty challenge, and the test varies by state. Colorado makes the point by statute: a liquidated damages provision in a covered nondisclosure agreement must be reasonable and proportionate to the anticipated actual economic loss, vary with the nature or severity of the breach, and not be punitive (C.R.S. § 24-34-407(1)(e)). In New York, a release of a discrimination, harassment or retaliation claim is unenforceable if the complainant is required to pay liquidated damages or forfeit consideration for violating a nondisclosure or nondisparagement clause (Gen. Oblig. Law § 5-336(3)(a), (b)). The safe fix is to drop liquidated damages from employee NDAs or tie them to a reasonable forecast of harm.

6. Ignoring where the signer lives

A Delaware or New York choice-of-law clause in a form agreement does not control every question. Washington says a nondisclosure or nondisparagement provision in an agreement signed by a Washington resident "is governed by Washington law" (RCW 49.44.211(9)). Illinois voids a unilateral clause that applies non-Illinois law to an Illinois employee's claim about unlawful employment practices (820 ILCS 96/1-25(b), as amended effective January 1, 2026).

California's Bus. & Prof. Code § 16600.5 (effective January 1, 2024) says a contract that is void under the chapter on restraints of trade "is unenforceable regardless of where and when the contract was signed" and lets an employee sue for damages and fees. That chapter is the one that voids non-competes, so § 16600.5 matters when an NDA is drafted so broadly that it works as a non-compete. Not verified in our October 2026 review: how courts treat an NDA that operates as a non-compete in disguise. Check California authority before relying on that argument. For more on choice of law, see choice-of-law clauses that quietly fail. To keep the NDA from carrying a non-compete's job, see NDA vs. non-compete vs. non-solicit.

What to do before the cease-and-desist goes out

Back to the hypothetical Friday call. Read the form and the facts first, in this order:

1. Pull the exact NDA the former employee signed, not the current template. The version on the GC's screen may not match the one in HR's onboarding file. The date of signature controls.
2. Pull the LinkedIn posts and any other public statements verbatim, with URL and timestamp. What the posts are about (harassment, pricing data, customer lists, a personnel grievance) decides which statute applies.
3. Confirm the former employee's state of residence at signing and at posting. Washington law governs a nondisclosure provision signed by a Washington resident (RCW 49.44.211(9)), and the other statutes above each have their own reach.
4. Interview the manager who reported the posts and the HR partner who handled the departure. If anyone says the employee complained about harassment, discrimination or retaliation, the analysis changes.
5. Then read the form. No Speak Out Act recital, no DTSA notice, a catch-all definition and a flat liquidated damages number is a common old template. Sending a cease-and-desist on that form into a state in Bucket 2 or 3 invites a complaint to the SEC or a state agency, and in Washington a statutory damages claim, because a threat to enforce a prohibited provision is a violation.

The cleaner case is the one where the posts disclose actual trade secrets (a customer pipeline, source code, pricing models) and the form carries the DTSA notice and carve-outs. The riskier case is the one where the posts are about workplace conduct and the employee lives in a state with a statute above.

The redline that fixes the form: a closed-list definition, the DTSA notice paragraph, a Speak Out Act recital, a subpoena and government-cooperation carve-out, removal of the flat liquidated damages number, and a state rider for each state in Buckets 2 and 3 where employees live. Once counsel signs off, replace the form in the onboarding stack and the severance template at the same time.

Drafting checklist

A single template, modified by state, should include the following at a minimum.

1. Speak Out Act recital: the agreement does not restrict disclosure of conduct alleged to constitute sexual harassment or sexual assault, consistent with 42 U.S.C. § 19403.
2. DTSA whistleblower notice (or a cross-reference to a policy document that contains it) in every employee, contractor and consultant agreement that governs trade secrets or confidential information.
3. Closed-list definition of confidential information with the four standard carve-outs (public, independently developed, third-party lawful, prior knowledge), and an express statement that it does not cover information about unlawful conduct.
4. Defined duration for ordinary confidential information, with trade secrets treated separately and identified.
5. Subpoena and government-cooperation carve-out: notice to the disclosing party where lawful, compliance with legal process, and no restriction on communications with the EEOC, NLRB, SEC, DOJ or state agencies, including Rule 21F-17 protected activity and award rights.
6. State rider: if the signer lives in a state in Bucket 2 or 3 (see the table), add that state's required language. California's sentence ("Nothing in this agreement prevents you from discussing or disclosing information about unlawful acts in the workplace ...") and New York's list of agencies (§ 5-336(2)) are two examples.
7. Settlement agreements: use the settlement-specific rules, such as New York's 21 days to consider and 7 to revoke, Maine's separate consideration, Illinois's documented employee preference, and California's identity-shield option.
8. Liquidated damages: drop, or tie to a reasonable forecast of harm. Never use a flat per-breach figure in a New York discrimination settlement or a Colorado covered agreement.
9. Separate non-compete: keep the NDA and any non-compete as separate, independently defensible clauses. The map of non-compete enforceability by state shows where each can live.
10. Annual review of the form against agency actions (SEC, NLRB, EEOC) and the Bucket 2 and 3 statutes.

FAQ

Are NDAs still legal?

Yes. Courts generally enforce a confidentiality agreement that protects a legitimate interest and is reasonable in scope and duration. Federal law and the state statutes above void specific terms, such as pre-dispute gag clauses on sexual harassment disputes and terms that stop an employee from reporting to an agency. They do not make NDAs unlawful as a category.

Are NDAs enforceable by state, or is it one national rule?

NDAs are governed mostly by state contract law, so the baseline test and the carve-outs vary. On top of that sit federal rules: the Speak Out Act (sexual harassment and sexual assault disputes), the DTSA immunity notice at 18 U.S.C. § 1833(b), SEC Rule 21F-17, and the NLRA as read in McLaren Macomb, which is currently being contested. The table above shows which states add employment or settlement NDA statutes.

When are NDAs not enforceable?

Examples from the statutes above: a pre-dispute clause in a sexual harassment or sexual assault dispute (Speak Out Act); a provision about conduct in Washington that the employee reasonably believed to be illegal discrimination, harassment, retaliation, a wage and hour violation or sexual assault (RCW 49.44.211); a Colorado nondisclosure provision that lacks the conditions in C.R.S. § 24-34-407; and a term that stops a person from testifying under subpoena about the other party's alleged crime or harassment in California or Nevada. An overbroad definition or a missing DTSA notice weakens an NDA without voiding it.

Can an NDA stop you from reporting sexual harassment?

Not a pre-dispute one. Under 42 U.S.C. § 19403(a), a nondisclosure or nondisparagement clause agreed to before a sexual harassment or sexual assault dispute arises is not judicially enforceable where the conduct alleged violates federal, tribal or state law. The Act applies to claims filed on or after December 7, 2022. Many states go further, and settlement agreements are governed by state law (for example the 21-day and 7-day rules in New York).

What should a confidential settlement for workplace harassment include?

It depends on the state. In New York, confidentiality must be the complainant's preference, with up to 21 days to consider it and at least 7 days to revoke (§ 5-336(1)). In Maine, the term needs separate monetary consideration, must apply to all parties and must preserve the right to report to agencies (§ 599-C(4)). In Illinois, it needs the employee's documented preference, separate consideration, 21 days to consider and 7 to revoke, each of the last two waivable by the employee (820 ILCS 96/1-30). In California, the claimant may request an identity-shield term and the amount may be kept confidential (CCP § 1001(c), (e)). Check the signer's state.

How long is an NDA enforceable?

The statutes in this post set no maximum term. Ordinary confidential information should carry a defined period, and identified trade secrets can be protected for as long as they remain trade secrets. Not verified in our October 2026 review: state-by-state case law on how long is too long. Check the governing state's cases.

What is the difference between an NDA and a non-compete?

An NDA protects specific confidential information. A non-compete restricts where a person can work for a period of time, and several states restrict or ban them. See the non-compete map for the state rules. Drafting the NDA so broadly that it works as a non-compete creates a risk of challenge; keep them as separate clauses.

Does a Delaware or New York choice-of-law clause save a broad employee NDA?

Not always. Washington law governs a nondisclosure provision signed by a Washington resident (RCW 49.44.211(9)), and Illinois voids a unilateral clause that applies non-Illinois law to an Illinois employee's claim about unlawful employment practices (820 ILCS 96/1-25(b)). California's § 16600.5 makes a contract that is void under its restraint-of-trade chapter unenforceable wherever it was signed, which is a rule about non-competes. See choice-of-law clauses that quietly fail.

Is an NDA enforceable in California?

Yes, for protecting genuine confidential information and trade secrets. California limits the silencing terms: CCP § 1001 (settlement terms about sexual assault, harassment, discrimination and retaliation claims, with identity-shield and settlement-amount exceptions), Civ. Code § 1670.11 (waivers of the right to testify about the other party's alleged criminal conduct or sexual harassment under subpoena or agency request), and Gov. Code § 12964.5 (nondisparagement and separation-agreement terms that deny the right to disclose unlawful acts in the workplace, with a required sentence and five business days to consult an attorney). Section 12964.5 does not apply to a negotiated settlement of a claim already filed.

Closing

NDAs remain the workhorse for protecting business information, and a form drafted before the recent statutes may not do what its drafter assumed. The Speak Out Act sets a federal floor, at least 17 states add their own limits, the DTSA notice is a statutory requirement for employer agreements covering trade secrets and confidential information, and the SEC and NLRB continue to police confidentiality terms in ways that are still shifting.

For related state-by-state reference coverage, see Non-Compete Enforceability by State: A 2026 Map and Choice-of-Law Clauses That Quietly Fail: A State-by-State Breakdown.

For the US statutes, regulations and court rules these laws sit in, see the US primary law API.

Arshita Anand

Co-Founder & CEO · Attorney

Arshita leads product and strategy at Vaquill AI, the US primary law data API. As an attorney, she decides which law we carry, how each section is sourced and cited, and what legal AI and compliance teams need from the data.