How to Write a Social Media Policy: Sections, Legal Limits, and Examples

A good social media policy protects your brand, your accounts, and your confidential information without overreaching into what employees are legally allowed to say. Broad rules telling staff not to criticize the company are the most common drafting mistake, and in the United States they are presumptively unlawful under the current standard.

A complete policy covers six areas:

• Scope and who the policy applies to
• Official account management and approvals
• Personal account conduct
• Confidential information, defined specifically
• Account security and access control
• Enforcement and a review schedule

Decide Which Policy You Are Writing

Three different documents often get confused under one name, and combining them produces a policy that does none of its jobs well.

• An employee social media policy governs what staff may post on personal and work accounts.
• Brand channel guidelines govern tone, posting frequency, approval chains, and visual standards for official accounts.
• A social media crisis plan governs what happens when something goes wrong, including who decides and who posts.

Write them as separate documents. The first needs legal review, the second needs marketing input, and the third needs an escalation chart. If your team needs help building the brand side, our social media management services cover channel strategy, posting standards, and community replies.

The Legal Constraint Most Policies Miss

In the United States, Section 7 of the National Labor Relations Act (NLRA) protects employees who discuss wages, hours, and working conditions with each other, including publicly on social media. This applies to unionized and non-unionized private-sector workplaces alike. It does not generally cover supervisors, managers, or independent contractors.

The National Labor Relations Board (NLRB) tightened the standard in Stericycle, Inc., 372 NLRB No. 113, decided on August 2, 2023. That decision overruled the more employer-friendly Boeing standard that had applied since 2017.

Under the current Stericycle test:

• The NLRB General Counsel must first show that a rule has a reasonable tendency to chill employees from exercising their Section 7 rights.
• The rule is read from the perspective of an employee who is economically dependent on the employer, not from the drafter’s intent.
• If that showing is made, the rule is presumptively unlawful.
• The employer can rebut this only by proving the rule advances a legitimate and substantial business interest that a more narrowly tailored rule could not achieve.
• Ambiguous rules are interpreted against the employer.

Employment lawyers widely flagged social media policies as one of the first policy types to review after the decision. Rules banning employees from discussing the company, making disparaging remarks, or posting anything that “harms the company’s reputation” routinely fail this test.

Two drafting responses follow:

• Narrow every restriction to the specific business interest it protects, rather than writing a general prohibition.
• Add a savings clause stating that the policy does not restrict rights protected under Section 7 of the NLRA.

Watch this space: the standard has changed twice since 2004 (Lutheran Heritage in 2004, Boeing in 2017, Stericycle in 2023), and it may change again. As of late September 2026, the NLRB’s General Counsel is urging the Board to drop Stericycle in favor of a more employer-friendly test. Until the Board formally overrules it, Stericycle remains the law, so schedule regular legal reviews rather than treating your policy as permanent.

Define the Scope

State plainly who the policy covers and when. Ambiguity here produces disputes at enforcement.

Specify:

• Which groups it covers, such as employees, contractors, interns, and volunteers
• Whether it applies to personal accounts, and in what circumstances
• Whether it applies outside working hours, and the limits of that
• Which platforms it covers, written to include platforms that do not yet exist

Avoid claiming authority over all personal posting at all times. Several US states, including California, Colorado, and New York, restrict employer control over lawful off-duty conduct, and an unenforceable clause weakens the rest of the document.

Separate Official and Personal Accounts

This distinction needs to be explicit, because most disputes happen where it blurs.

For official accounts, specify:

• Who holds posting access, by role rather than by name
• What requires approval before publishing, and from whom
• Who responds to comments and complaints, and within what timeframe
• What happens to the account when that person leaves

For personal accounts, specify:

• Whether staff must identify themselves as employees when discussing the company’s products
• That personal views are their own, with suggested disclaimer wording
• That they may not speak on behalf of the organization without authorization

Require clear disclosure whenever an employee promotes the company’s products or services. In the US, the Federal Trade Commission’s Endorsement Guides require it, and similar rules apply in the UK, Canada, Australia, and many other countries. This is a regulatory requirement, not a style preference. If you want staff and founders posting on purpose, a structured personal branding program keeps that advocacy on-message and compliant.

Define Confidential Information Specifically

A clause prohibiting disclosure of “confidential information” fails the narrow-tailoring test when “confidential” is left undefined, because employees can’t tell whether their own pay falls inside it.

List the categories instead:

• Client and customer data
• Unreleased products, pricing, and commercial strategy
• Financial information not yet public
• Security details, including system access and physical security

Then state explicitly that the clause does not cover wages, hours, or working conditions. That one sentence is what protects the clause.

Secure Your Accounts and Control Access

Social media security often sits outside IT policies and gets overlooked, even though a hijacked brand account can do serious damage in minutes.

Require:

• Access through a password manager rather than shared passwords
• Multi-factor authentication on every official account
• Access granted by role, with a documented removal process when someone leaves
• A named owner for each account, plus a backup owner
• A quarterly audit of who has access to what

More than 20 US states prohibit employers from requiring employees or applicants to hand over passwords to their personal social media accounts. Do not include such a requirement.

Set Up Enforcement and Review

State consequences proportionately. A policy listing termination as the response to every breach will not be applied consistently, and inconsistent enforcement undermines later disciplinary action.

Set out:

• How to report a suspected breach
• Who investigates, and the process they follow
• A graduated range of outcomes
• An annual review date, with legal sign-off

Record that each employee has read the policy, with a date. Enforcement against an employee who never saw the document rarely survives a challenge.

Social Media Policies for Nonprofits and Small Teams

Small organizations often skip a policy because they have only one or two people posting. That is exactly when account ownership and access problems hurt most, since one departure can lock you out of years of audience building. Nonprofits, community organizations, and mosques should also cover volunteers, who often run pages but sit outside normal employment rules. Our team supports these groups through nonprofit and mosque digital support, including social media setup and governance.

A short, two-page policy covering the six areas above is enough for most small teams. Pair it with a clear content plan so the policy supports your goals rather than just restricting activity. Our guide to digital marketing strategies that drive results is a good starting point, and if you run online or in-person events, see our breakdown of the risks and benefits of a social media events strategy.

Frequently Asked Questions

Can an employer ban staff from mentioning the company online?

A blanket ban is presumptively unlawful for most private-sector employers in the United States, because employees have a protected right to discuss working conditions publicly. Restrictions must be narrowly tailored to specific business interests, such as protecting client data.

Does a social media policy apply outside working hours?

Partially. Confidentiality and harassment provisions apply regardless of timing, while general conduct rules on off-duty personal posting face legal limits that vary by state.

Who owns a work social media account?

The organization should own accounts created for business purposes, and the policy should say so explicitly. Disputes arise most often with accounts built under an employee’s own name, so decide ownership before the account grows.

How often should a social media policy be reviewed?

At least once a year. The governing US legal standard changed in 2017 and again in 2023, and it may change again soon, so the policy needs regular legal reassessment.

Should small businesses have a social media policy?

Yes. Section 7 protections and account security risks apply regardless of company size, and a short two-page document covers most situations for a small team.

Need Help With Your Social Media?

A policy keeps your accounts safe; a strategy makes them work. Halal Outreach helps brands, nonprofits, and mosques plan, run, and grow their social channels with one team and clear monthly reporting. Book a free consultation to get a scope and timeline within one week.This article provides general information and does not constitute legal advice. Have any social media policy reviewed by an employment lawyer in your jurisdiction before adopting it.