How to Write an Employee Social Media Policy (Without Overreaching)

A good employee social media policy tells staff what they can’t share (confidential information, customer data), who is allowed to speak for the company, how to disclose their job when they promote your products, and that harassment and threats aren’t acceptable anywhere. It should also be clear about what it doesn’t restrict. In the US, the National Labor Relations Act protects many employees’ right to discuss pay and working conditions, including online, and the National Labor Relations Board has found overly broad social media rules unlawful.

The purpose of the policy is prevention. Most reputation problems that start with an employee post aren’t malicious. Someone shares a photo with a customer’s details in the background, answers a complaint in anger, or posts about a product without saying they work there. A short, clear policy and a little training prevent most of that.

Why a social media policy protects your reputation

Your employees are some of the most visible voices your business has. Customers, candidates and journalists read what they post, and a single post can become the story. A policy helps in three ways:

• It sets expectations before anything goes wrong. People can’t follow rules they have never been told.
• It separates personal voices from the company voice. Staff know who responds to complaints, press and reviews, so nobody freelances an official reply.
• It gives you a process. When a post does cause trouble, managers know who to call and what not to do in the first hour.

It won’t stop every problem, and it shouldn’t try to control what people say in their private lives. The best policies are short, specific and focused on real risks.

What to include

Confidential and private information

Define what staff must never post: trade secrets, unreleased products, financial information that isn’t public, security details, and anything about customers, patients or clients. Give examples that fit your business. For a clinic, that means no photos in treatment areas and no comments about patients, which is also a HIPAA issue. For a retailer, it might mean no photos of the stockroom showing supplier pricing.

Be precise. “Confidential information” should mean genuinely confidential business information, not “anything about the company.” That distinction matters under labor law, as explained below.

Who speaks for the company

Name the people or roles authorized to post on official accounts, reply to reviews, and talk to the media. Ask everyone else to pass press inquiries and escalating complaints to those people rather than responding themselves. This is especially important during a crisis, when a well-meaning employee defending the company in the comments can make things worse.

You can ask employees not to present their personal opinions as the company’s official position. Keep the wording narrow and focused on not claiming to speak for the company.

Disclosure when employees promote the company

If you encourage staff to share your products or services, they have a material connection to your business, and the FTC’s Endorsement Guides expect that connection to be disclosed clearly in the post itself. The FTC’s own guidance says listing your employer in a profile bio isn’t enough, because people reading a single post won’t see it. A short, clear disclosure at the start of the post, such as “I work here” or a hashtag like #employee, is the kind of thing the FTC describes.

The FTC’s 2024 rule on consumer reviews and testimonials also restricts undisclosed reviews by company officers and managers, and managers asking employees to post reviews without disclosure. In practice: employees shouldn’t post reviews of your business on Google, Yelp or similar sites, and managers should never ask them to. Our guide to the FTC fake review rule covers the details.

Harassment, threats and discrimination

Your existing anti-harassment and anti-discrimination policies apply online too. Say so. Harassing a coworker or a customer on social media, posting threats, or sharing content that discriminates on the basis of protected characteristics is covered by the same standards as in the workplace.

Security basics

Include a few practical rules: use strong, unique passwords and two-factor authentication on company accounts, don’t share login details, don’t post photos that show badge designs, screens or building access, and report suspicious messages. Remove former employees from company accounts promptly.

What not to include

This is where many policies go wrong. Section 7 of the National Labor Relations Act protects employees’ right to engage in “protected concerted activity,” which includes talking with coworkers about wages, hours and working conditions. According to the NLRB, that protection applies to many employees whether or not they are in a union, and it can extend to social media. The NLRB has found social media policies unlawful when they are broad enough to discourage that kind of discussion, and some employers have had to rescind parts of their policies and reinstate employees.

Rules that have caused problems in the past include:

• Blanket bans on “disparaging” or “negative” comments about the company, managers or coworkers.
• Bans on discussing pay, benefits, schedules or workplace conditions.
• Requirements to get approval before posting anything about the company.
• Vague definitions of “confidential” that could include wages or working conditions.
• Bans on talking to the media or government agencies about working conditions.

The NLRB’s standards for workplace rules have shifted over the years, and the law has exceptions (for example, supervisors and some other categories of workers aren’t covered by the same protections). Treat this section as a warning list, not a legal test. Have an employment lawyer review your policy before you roll it out, and check nlrb.gov for its current guidance on employee rights.

Training and rollout

A policy nobody reads doesn’t prevent anything. Roll it out with a short session, ideally with examples from your own industry:

1. Explain the purpose in one sentence: protecting customers, colleagues and the business, not policing personal accounts.
2. Walk through three or four realistic scenarios, such as a customer complaint in the comments, a photo with a whiteboard in the background, or an employee asked to review the company.
3. Show the escalation path: who to message if they see something concerning.
4. Get a simple acknowledgment and make the policy easy to find later.
5. Refresh it once a year and whenever you add a new platform or program, such as an employee advocacy campaign.

Cover employer review sites too. Current and former staff are allowed to review you as an employer, and your policy shouldn’t try to stop them. How you reply matters more; our guide to responding to Glassdoor reviews explains the approach.

Include managers in the training. Many problems come from a manager’s well-meant request, such as asking the team to leave five-star reviews, which is exactly what the FTC rule addresses.

When an employee’s post goes viral

Sometimes a post escapes anyway: an employee’s video of a messy kitchen, a rant about a customer, or a complaint about working conditions. Have a process ready:

1. Pause before reacting. Don’t comment publicly, and don’t let managers or coworkers pile in.
2. Establish the facts. Is the post accurate? Is it about a real safety or customer issue? Is the employee raising a concern about working conditions?
3. Protect anyone at risk. If a customer’s information has been exposed, deal with that first. If the employee is being harassed online, support them too.
4. Get advice on employment action. Talk to HR and an employment lawyer before any discipline, especially if the post concerns pay, hours or conditions.
5. Decide whether to respond publicly. Often a short statement is enough. A holding statement buys you time while you check facts.

If the post has spread widely, our guide on responding to a viral negative post covers the public side in detail. If the business was genuinely at fault, a clear public apology is usually better than silence.

If the story is spreading faster than you can manage in-house, our reputation crisis management service can help you plan the response and recover your search results afterward.

Template outline

Use this as a structure, not legal text. Adapt the wording to your business and have it reviewed by an employment lawyer.

1. Purpose: why the policy exists, in two or three sentences.
2. Scope: who it applies to and which accounts (official company accounts, and personal accounts only where they touch on the specific topics below).
3. Official accounts and spokespeople: who posts, who replies to reviews and complaints, who talks to the media.
4. Confidential information: a specific list with examples, limited to genuinely confidential business, customer and security information.
5. Promoting the company: how to disclose employment in posts, and no reviews of the company on review sites.
6. Respect and safety: harassment, threats and discrimination policies apply online.
7. Security: passwords, two-factor authentication, account access.
8. Your rights: a plain statement that nothing in the policy limits employees’ rights to discuss wages, hours or working conditions, or other rights protected by law.
9. Reporting and questions: who to contact about a concerning post or a question about the policy.

A worked example

This example is illustrative. A regional chain of fitness studios has no social media policy. A trainer replies to a critical Google review from her personal account, naming the member and mentioning their attendance habits. The member posts a screenshot and it spreads locally.

The owner’s first instinct is to fire the trainer and ban staff from mentioning the studio online. Instead, they remove the reply, apologize privately to the member, and have one manager post a short, calm response on the review. They then write a two-page policy: the operations manager replies to all reviews, staff never discuss members online, anyone who shares studio content adds “I work here”, and nothing in the policy restricts talking about pay or conditions. A lawyer reviews it, and every trainer goes through a short session with real examples from the incident, anonymized.

Frequently asked questions

Can an employer fire an employee for a social media post?

Sometimes, but not always. Posts that disclose genuinely confidential information or harass others may justify discipline. Posts where employees discuss pay or working conditions can be protected under the National Labor Relations Act. State laws also vary. Talk to an employment lawyer before acting.

Can a social media policy ban employees from criticizing the company?

A blanket ban is risky. The NLRB has found broad bans on negative or disparaging comments unlawful where they could discourage employees from discussing working conditions. Narrow rules aimed at specific unprotected conduct, such as harassment or disclosing trade secrets, are more defensible.

Do employees need to disclose that they work for us when they post about our products?

Yes. Under the FTC’s Endorsement Guides, employment is a material connection that should be disclosed clearly in the post itself, not just in a profile bio.

Can employees leave reviews of our business?

They shouldn’t. Employee reviews breach most review platforms’ conflict-of-interest rules, and the FTC’s 2024 rule restricts undisclosed insider reviews and managers soliciting them. Ask staff to encourage happy customers to leave reviews instead.