Template · Policies and handbooks
Social media policy
In short
A social media policy for employees sets out how staff may use personal and company social media in ways that affect work: who can speak for the company, what information must stay confidential, how to disclose the employment link when posting about products, and what conduct is off limits. It must also respect employees' legal right to discuss pay and working conditions.
Employee Social Media Policy template
Employee Social Media Policy
Replace each [Placeholder]. Keep the protected-rights section in place; it reflects federal labor law that applies to most private employers, whether or not they are unionized. Review with employment counsel, especially if you operate in states with social media privacy laws.
1. Purpose and scope
This policy explains how [Company Name] expects employees to use social media when their activity involves the company, our customers, or coworkers. Social media includes social networks, video and photo sharing sites, messaging groups, forums, review sites, blogs, podcasts and any similar platform, whether used on a personal device or a company device, during or outside working hours.
This policy applies to all employees. Contractors and temporary workers are covered where their agreements say so. Your personal social media is your own business. This policy only applies where your activity identifies the company, involves company information, or affects coworkers, customers or the workplace.
2. Your rights
Nothing in this policy limits your right to discuss or share information about wages, benefits, schedules, working conditions or other terms of employment with coworkers or others, to communicate about union activity, or to engage in any other activity protected by Section 7 of the National Labor Relations Act. Nothing in this policy prevents you from reporting possible violations of law to a government agency, or from participating in any government investigation. This policy will not be interpreted or applied to interfere with those rights.
3. Speaking on behalf of the company
Only employees authorized by [Communications / Marketing team] may post on official company accounts or make statements on behalf of [Company Name]. If a journalist, analyst or influencer contacts you about the company, refer them to [contact]. If you mention your work in a personal post and give opinions about the company or our industry, make clear the views are your own, for example: "Views are my own."
4. Confidential and personal information
Do not post: trade secrets; non-public financial results; unreleased products or plans; information about customers, clients or patients, including names, account details, photos or call recordings; other employees' personal data, such as home addresses, medical information or Social Security numbers; or security information such as badge photos, building layouts or system screenshots. This does not restrict your right to discuss your own or coworkers' wages and working conditions.
5. Endorsements and disclosure
If you post about [Company Name]'s products or services, or a client's, disclose that you work for the company (for example, "I work at [Company Name]" or #employee) in the post itself. This is required under the Federal Trade Commission's endorsement guidelines when there is a material connection between you and the brand. Do not post fake reviews or ratings of the company, its products or competitors.
6. Conduct toward others
Our [Anti-Harassment Policy] and [Equal Employment Opportunity Policy] apply online. Do not use social media to harass, threaten, or discriminate against coworkers, customers or others, including through private messages and group chats. Threats of violence and sharing intimate images without consent are never acceptable. Posts that are simply critical of the company or of management are not, by themselves, a violation of this policy.
7. Use during work time and on company systems
Personal social media use during working time should not interfere with your job duties or with safety. [Optional: Employees in customer-facing or safety-sensitive roles may not use personal devices while on the floor or operating equipment, except during breaks.] Company devices, networks and accounts may be monitored in line with our [Acceptable Use Policy] and applicable law.
8. Personal account privacy
[Company Name] will not ask applicants or employees for passwords or access to personal social media accounts, ask them to log in in front of a manager, or require them to add a manager as a contact, except where the law allows for a specific investigation. Managers should think carefully before sending connection requests to their direct reports.
9. Recruiting and hiring
Employees are welcome to share company job postings on their personal accounts. Hiring decisions must not be based on a candidate's personal social media content. If a background or social media screening is used for a role, it will be done by [HR or an approved vendor] using job-related criteria and in line with applicable law.
10. Violations and questions
Violations of this policy may lead to discipline up to and including termination, consistent with our [Progressive Discipline Policy] and applicable law. If you are unsure whether a post is appropriate, ask [contact] before posting. If you see content that may violate this policy or that threatens someone's safety, report it to [HR contact].
Effective date: [Date].
How to use this template
- Decide who can post on official company accounts and name the contact for media and influencer inquiries.
- Keep the protected-rights section; do not cut it to shorten the policy, because it is what keeps the other rules lawful.
- Make the confidential information list specific to your business (patient data, customer accounts, call recordings, store security) rather than a general ban on company information.
- Check social media privacy laws in your states, and remove any practice of asking for passwords or account access.
- Add the policy to your employee handbook, link it from the code of conduct, and collect acknowledgments.
- Train managers on what they can and cannot discipline for, using real examples, before they have to make that call.
Why most social media policies get employers in trouble
The biggest legal risk in a social media policy is not what employees post. It is policy wording that is too broad. Section 7 of the National Labor Relations Act protects most private-sector employees, union or not, when they discuss pay, schedules, management or working conditions with each other, and that includes on Facebook, TikTok, Reddit and group chats. Rules like "never post anything negative about the company" or "don't discuss internal matters online" have repeatedly been found unlawful by the National Labor Relations Board.
Under the NLRB's 2023 Stericycle decision, a work rule that could reasonably be read by an employee to discourage protected activity is presumed unlawful unless the employer shows it serves a legitimate and substantial business interest that a narrower rule could not serve. The Board's new majority has signaled it may revisit Stericycle, so check the current standard with counsel before relying on it either way. In practice that means: be specific about what is prohibited and why, include an explicit statement of employees' rights, and avoid catch-all bans. Supervisors and managers are generally not covered by the NLRA, but the policy applies to everyone, so write it to the standard that applies to non-supervisory staff. For background on the law, see the glossary entry on the NLRA.
What the policy should cover
A useful policy answers six practical questions for employees: Can I say where I work? (Yes.) Can I post on the company account? (Only if authorized.) What can't I share? (A specific list: customer data, trade secrets, unreleased plans, coworkers' personal data.) Do I need to disclose that I work here when I post about our products? (Yes, under the FTC's endorsement rules.) Does the anti-harassment policy apply in group chats? (Yes.) Can I complain about my job online? (Generally yes; that is protected activity.)
Keep the rules short and give examples. A sentence like "Do not post photos taken on the call floor that show customer screens" is clearer, and easier to defend, than "protect company confidential information at all times." The policy works best as part of the code of conduct and alongside your acceptable use policy, which governs company devices and accounts.
State law: passwords and off-duty conduct
More than half of US states have laws that restrict employers from asking applicants or employees for usernames, passwords or access to personal social media accounts. Some also ban requiring an employee to add a manager as a friend or to change privacy settings. Several states, including California, Colorado and New York, also protect lawful off-duty conduct or political activity to varying degrees, which limits disciplining employees for some personal posts. Rules vary by state, so check each one where you have employees, and note that laws outside the US, such as the GDPR in Europe, restrict monitoring of employees' personal accounts even further.
When a post becomes a discipline issue
Before acting on a post, HR should ask three questions. Is it protected activity, such as two employees complaining about mandatory overtime? Does it break a specific, lawful rule, such as sharing a customer's account details or threatening a coworker? Would we treat the same conduct the same way for anyone else? Disciplining one employee for a post while ignoring similar posts by others invites discrimination and retaliation claims.
Harassment, threats, discriminatory slurs about coworkers, and disclosure of protected customer or patient data are generally not protected and can be handled under normal discipline. A post that is rude about a manager but is part of a conversation with coworkers about working conditions often is protected. When in doubt, take advice before acting. Document what was posted, where, and why it breaks a rule, using screenshots shared with HR, not obtained by logging into the employee's account.
Frontline teams, recruiting and employee advocacy
In contact centers, retail and healthcare, the most common real problem is not opinion posts. It is photos and videos taken at work: a TikTok filmed on the call floor with a customer's details on screen, or a selfie in a clinic with a patient chart in the background. Say plainly in training that recording at work is only allowed in break areas, and why.
Many employers also want employees to share job openings, since referrals and employee shares often bring in better-fit applicants at a lower cost. Make that easy with ready-to-share posts, and say in the policy that sharing jobs is welcome. Keep it voluntary, and never base hiring decisions on what a candidate posts on personal accounts. Social media screening, if used at all, should be done by HR or a vendor against written, job-related criteria and in line with the FCRA where a consumer reporting agency is involved.
Frequently asked questions
What should a social media policy for employees include?
Scope, a statement of employees' protected rights, who can speak for the company, a specific list of confidential information, disclosure rules for posts about company products, conduct rules that link to your anti-harassment policy, use on work time and company systems, personal account privacy, and how violations are handled.
Can an employer fire an employee for a social media post?
Sometimes. Posts that harass or threaten coworkers or disclose protected customer data can lead to discipline. Posts where employees discuss pay or working conditions together are usually protected under the NLRA, and some states protect off-duty conduct. Get advice before acting on a post.
Can employers ask for an employee's social media password?
In many states, no. More than half of US states restrict employers from requesting passwords or access to personal accounts, and some also bar requiring employees to add managers as contacts. A good employee social media policy says the company will not ask.
Do employees have to disclose that they work for the company when posting about its products?
Yes, when there is a material connection between the employee and the brand. The FTC's endorsement guides require a clear disclosure in the post itself, such as "I work at [Company Name]."
Can a social media policy ban employees from criticizing the company?
Broad bans on criticism or on discussing internal matters are likely unlawful under the NLRA for most private employers. The policy can prohibit specific conduct, like harassment, threats and disclosing trade secrets or customer data, but not complaints about pay, management or working conditions.
What is the difference between a social media policy and social media guidelines?
A policy sets enforceable rules and consequences. Guidelines give practical advice, such as how to share job posts or respond to comments about the company. Many employers publish a short policy in the handbook and a longer set of social media guidelines for teams who post often.