How to Write a Social Media Policy for Your Employee Handbook

Someone on your team posted something.

Maybe it named a client. Maybe it was a photo from the shop floor with a whiteboard visible in the background. Maybe it was just a bad night and a strong opinion, posted from an account that lists your company in the bio.

Now you're deciding what to do about it, and you're realizing you never said anything about this. There's no policy. There's just you, an upset employee, and a judgment call you'll have to defend later.

This is one section of your handbook. If you're building the whole thing, start with [What to Put in an Employee Handbook: A Small Business Guide] and come back here for this piece.

Start with what you actually can't restrict

This is the part almost every small business policy gets wrong, and it's worth understanding before you write a word.

Under federal labor law, employees have the right to discuss their pay, hours, and working conditions with each other, including publicly, including on social media. This is Section 7 of the National Labor Relations Act, and it applies to most private employers whether or not anyone in your building is unionized.

So these common policy lines are not enforceable:

"Do not discuss company matters on social media." "Employees may not post negative comments about the Company." "Salary and compensation are confidential and may not be discussed." "Always be respectful and professional when discussing your workplace."

That last one surprises people. A broad civility requirement can be read as chilling protected activity, because "be respectful" is vague enough to cover a legitimate complaint about working conditions.

The practical risk is not just that the rule is unenforceable. It's that having an overbroad policy on the books can itself be treated as a violation, even if you never enforce it against anyone.

Write narrowly. Restrict specific things for specific reasons.

The five things worth putting in writing

1. Confidential information

This is your strongest ground and the reason to have the policy at all.

Prohibit posting client or customer information, financial data, unreleased plans, security details, and anything covered by an NDA. Include photos and video, because this is where it usually happens. A team photo with a client file visible on the desk behind someone is a disclosure, even though nobody typed anything.

Be concrete: no photos taken inside the workspace without approval, no screenshots of internal systems, no client names.

2. Speaking for the company

Make clear who is authorized to speak on behalf of the business, and that everyone else isn't.

Then give people the disclaimer rule: if an employee identifies their employer on their profile and posts about industry topics, ask them to note that views are their own. This is a small thing that does real work, because it separates a personal opinion from a company position in a way a reader can see.

3. Harassment and discrimination don't stop at the door

Your harassment policy applies to conduct that affects the workplace, and that includes social media.

If an employee harasses a coworker on Instagram, the fact that it happened off the clock on a personal account does not make it someone else's problem. It's a hostile work environment issue and you have an obligation to address it.

Say this explicitly in the policy so nobody is surprised by it later.

4. Client and customer interaction

If your team interacts with clients, decide your position on connecting personally, posting about client work, and responding to reviews.

Reviews are the one worth thinking about hardest. Employees responding to a negative review from their personal accounts almost never ends well, and in regulated industries a public response can disclose something it shouldn't. Route reviews to one person.

5. Using company accounts

Separate rules for anyone posting from the business account: who has access, who approves content, what happens to passwords when someone leaves.

That last one is the practical failure. A former employee still holding the credentials to your Instagram is an ordinary and very fixable problem that becomes a crisis about once a year for somebody.

The part that isn't in most policies

Say what happens when someone gets it wrong.

Not every mistake is a discipline matter. A lot of them are a conversation, and a policy that treats a well-meaning photo the same as a deliberate leak will get ignored by everyone.

Tier it. Something posted in error gets a request to take it down and a reminder. Repeated issues follow your normal progressive discipline process. Deliberate disclosure of confidential information is treated as a serious matter on its own terms.

And give people a way to raise something they saw rather than screenshot it to a group chat.

Sample language to start from

Adapt this. It's a starting point, not a finished policy.

Social Media Policy

Purpose. This policy addresses employee use of social media as it relates to Company business. It does not restrict employees' rights to discuss wages, hours, or working conditions.

Confidential information. Employees may not post confidential Company or client information, including client names, financial data, unreleased plans, internal documents, or photographs taken inside Company workspaces without prior approval.

Speaking for the Company. Only [ROLE] is authorized to speak on behalf of the Company. Employees who identify the Company as their employer and post about work-related or industry topics should indicate that their views are their own.

Respectful conduct. The Company's harassment and discrimination policies apply to conduct on social media that affects the workplace or a coworker, regardless of whether the conduct occurs during working hours or on personal accounts.

Client interaction. Employees may not respond to customer reviews or complaints on behalf of the Company. Direct these to [ROLE].

Company accounts. Access to Company social media accounts is limited to authorized employees. Credentials are Company property and must be returned upon separation.

Reporting. Employees who become aware of a post that may violate this policy should report it to [ROLE].

Questions. Employees who are unsure whether something is appropriate to post should ask [ROLE] before posting.

One more thing

A policy nobody signed is a document, not a protection.

If you ever have to act on this one, the question won't be whether you had a policy. It'll be whether you can show that the person received it, read it, and acknowledged it on a specific date.

That's true of every section in your handbook, but it matters more here than most, because social media issues tend to arrive with an audience already watching.

This is general guidance, not legal advice. Labor law in this area is genuinely technical and enforcement priorities shift. If you're writing a policy you intend to enforce, have an employment attorney review it.

Human Solutions+ gives small businesses the handbook, the policies, and the acknowledgement tracking without the HR department. Join the waitlist →