The line between an employee’s personal life and professional identity no longer disappears at the office door. It follows employees onto TikTok, Instagram, Facebook, and every other platform where a quick workplace vlog, candid complaint, or offhand comment regarding an employer can travel far beyond its intended audience.
For employers, that blurred boundary may seem private until a post goes viral and an employee’s content becomes the company’s crisis. By then, the story may already be moving faster than the response: shares multiply, criticism spreads, and public attention shifts from what one employee posted to what the organization represents. In a few clicks, a personal post can become a professional problem, and the damage may be hard to contain.
What Laws and Agencies Govern Employee Social Media Policies?
A social media policy may begin as a shield for the company’s reputation, but its legal reach extends beyond public relations. Depending on what an employee posts and whether they speak for themselves or on behalf of the business, the same policy can intersect with federal labor protections, anti-discrimination law, advertising rules, industry-specific obligations, and state privacy restrictions.
National Labor Relations Board (NLRB) and the National Labor Relations Act
Section 7 of the National Labor Relations Act protects employees’ right “to engage in other concerted activities for collective bargaining or other mutual aid or protection.” Section 8(a)(1) makes it an unfair labor practice for an employer to interfere with, restrain, or coerce employees in exercising that right. 29 U.S.C. §§ 157, 158(a)(1). That protection extends to social media.
The NLRB expressly recognizes that “[u]sing social media can be a form of protected concerted activity.” Its guidance explains that employees may use social media to discuss work-related issues and share information with coworkers about pay, benefits, and working conditions, regardless of whether they are represented by a union.
Equal Employment Opportunity Commission (EEOC) and Federal Anti-Discrimination Law
The EEOC identifies harassment based on race, color, religion, sex, national origin, age, disability, or genetic information as a form of employment discrimination. The agency encourages employers to communicate that unlawful harassment will not be tolerated, maintain an effective complaint process, train managers and employees, and take immediate and appropriate action when an employee complains.
The legal question, therefore, is not where the conduct occurred, but where its effects were felt. In Okonowskyv. Garland, the Ninth Circuit held that conduct outside the physical workplace may be considered as part of the totality of the circumstances in a Title VII hostile-work-environment claim. The court specifically rejected a rule excluding online conduct merely because it occurred outside the physical workplace.
The Federal Trade Commission
Praise becomes advertising the moment your audience cares that the person posting actually works for the company. So, when employees hype up their employer’s products or services online, that can trip advertising law — even if it feels like a harmless post. Under 16 C.F.R. § 255.5, a material connection between an endorser and seller must be disclosed clearly and conspicuously when the connection could affect the endorsement’s weight or credibility and is not reasonably expected by the audience.
Disclosure is the first step. The FTC’s Guides also instruct advertisers to provide endorsers with guidance on avoiding misleading statements and unexpected material connections, to monitor compliance, and to take appropriate remedial action. 16 C.F.R. § 255.1(d).
Industry-Specific and State Requirements
The legal landscape changes again with the employer’s industry and location. Covered entities and business associates subject to HIPAA must safeguard protected health information and limit unauthorized uses and disclosures. Financial Industry Regulatory Authority (FINRA) member firms must address applicable content, supervision, approval, and recordkeeping requirements for business-related social media communications. Public companies must also consider Regulation Fair Disclosure (Reg FD) when individuals acting on the company’s behalf communicate material nonpublic information through social media.
The laws governing access to employees’ and applicants’ personal social media accounts vary by jurisdiction, and each applicable statute may impose different restrictions, exceptions, and employer obligations.
Finding the Right Balance in a Social Media Policy
A single post can leave an employer facing two risks: reputational damage from what was said and legal exposure from how the company responds. That tension lies at the heart of every effective social media policy.
Employers need enough authority to protect their brand, confidential information, workforce, and public image, but rules that reach too far may restrict protected employee activity or create new compliance problems. The challenge is drawing clear, practical boundaries that protect an organization without overstepping the law.
When a Policy Is Too Broad
When an employee’s post ignites a public controversy, an employer’s first instinct may be to say nothing online that could embarrass the company. Often, these long-arm policies are framed in more restrained language, such as:
- Employees may not make negative comments about the company.
- Employees may not criticize management online.
- Employees may not discuss workplace issues on social media.
- Employees must obtain approval before posting work-related concerns on social media.
But a policy designed to prevent one crisis can quietly create another. By sweeping too broadly, the rule may reach beyond genuinely harmful conduct and into employee discussions that federal labor law protects.
The National Labor Relations Board has repeatedly recognized that employees generally have the right to discuss wages, benefits, scheduling, staffing levels, workplace safety concerns, and other terms and conditions of employment, including through social media. Policies that employees could reasonably interpret as restricting those discussions may violate the National Labor Relations Act.
When a Policy Is Too Narrow
An employer may be tempted to tell employees to “use good judgment” online, but by saying too little, the rule may leave employees without meaningful direction on the conduct most likely to expose the organization to liability or business harm.
Effective policies replace vague appeals to judgment with clear guidance on questions such as:
- What confidential information may never be posted online?
- Who is authorized to speak on behalf of the company?
- What rules apply to employees managing company-owned accounts?
- What disclosures are required when employees promote company products or services online?
Without clear answers, a flexible policy can leave an employer improvising only after a problem has surfaced. The result may be inconsistent discipline, strained employee relations, and increased litigation risk – the very outcomes the policy was meant to prevent.
What Should an Employer-Focused Social Media Policy Include?
The strongest social media policies anticipate where online activity can expose the organization, draw clear lines, and leave protected employee speech untouched. Grounded in current law, agency guidance, and practical HR considerations, an employer-focused policy should address five essential areas.
1. Protect Confidential Information
Some information should never become content. The policy should clearly prohibit employees from sharing:
- Trade secrets;
- Proprietary business information;
- Nonpublic financial information;
- Client or customer information;
- Information regarding ongoing investigations or litigation; and
- Other protected business records.
That boundary reflects longstanding confidentiality and trade-secret principles and, in regulated industries, may also be required by laws such as HIPAA or securities regulations.
2. Extend Workplace Conduct Rules to Social Media
A social media policy should make clear that anti-harassment, anti-discrimination, and anti-retaliation policies apply to online conduct when that conduct reaches coworkers or affects the workplace.
A post made after hours may still shape what happens during the workday. EEOC harassment guidance, together with modern court decisions recognizing that online conduct may contribute to a hostile work environment, underscores why the policy must focus on workplace impact, not merely where or when the conduct occurred.
3. Clarify Who May Speak on Behalf of the Company
A single post online can blur the line between a personal opinion and an apparent company statement. Employees who manage company accounts should receive clear guidance on:
- Authorized spokespersons;
- Media inquiries;
- Customer complaints;
- Escalation procedures; and
- Brand standards.
These guardrails help ensure that an employee’s words are not mistaken for the company’s position and that a routine post does not become an unauthorized public statement.
4. Address FTC Endorsement Requirements
An enthusiastic employee endorsement can look like ordinary praise while carrying a connection consumers cannot see. If employees promote company products or services online, the policy should require clear disclosures and provide practical examples of how to make them. The FTC’s Endorsement Guides directly support that approach.
5. Include an Explicit NLRA Savings Clause
Every restriction needs a boundary. Most importantly, the policy should expressly state that it is not intended to interfere with employees’ rights to discuss wages, benefits, working conditions, workplace concerns, or other activities protected by applicable labor laws.
A savings clause won’t save an otherwise unlawful rule, but it can make the policy’s limits crystal clear. NLRB guidance and recent Board decisions evaluating handbook rules and workplace policies directly support this protection.
An Example Social Media Policy Outline
The five essential areas provide the guardrails. The next step is turning them into a policy employees can follow. The outline below shows how employers can organize those protections into a clear, practical framework, moving from defining the policy’s purpose and scope to addressing company accounts, personal posts, protected activity, and enforcement.
| Section | Contents |
| 1. Purpose | A brief statement of why the policy exists and what it covers. |
| 2. Scope | Who the policy applies to (employees, contractors, interns) and when (during and outside work hours). |
| 3. Company-Owned Accounts | Access controls, posting authorization, brand voice standards, approval process, and offboarding procedures. |
| 4. Employee Personal Accounts | Disclosure requirements when identifying as an employee, confidentiality obligations, prohibited content, and disclaimer language. |
| 5. Confidential and Proprietary Information | Specific categories of information employees may not disclose, with reference to any applicable NDAs or employment agreements. |
| 6. Harassment and Discrimination | Extension of existing workplace conduct standards to social media, with examples. |
| 7. NLRA-Protected Activity | Explicit carve-out confirming the policy does not restrict employees’ rights to discuss wages, working conditions, or workplace concerns. |
| 8. FTC Endorsements and Disclosures | Clear and conspicuous disclosure of employees’ material connections to the company when endorsing its products or services; guidance on accurate, non-misleading statements; practical disclosure examples; monitoring procedures; and corrective action for noncompliant promotional content. |
| 9. Industry-Specific Rules | Any sector-specific regulatory requirements applicable to the company. |
| 10. Violations and Disciplinary Action | How violations are documented, investigated, and addressed, including the range of possible consequences. |
| 11. Acknowledgment | Employee signature, date, and confirmation of receipt. |
The Right Policy Before the Wrong Post
The riskiest social media policy is often the one tested for the first time after the wrong post goes viral. By then, the employer may be forced to protect its reputation, preserve workplace standards, and navigate employee rights under public scrutiny; all while a story centered on the organization’s reputation continues to gather speed online. A well-designed policy changes an organization from reaction to readiness: it protects business interests, gives employees guidance, and draws legal boundaries before a crisis tests them.
Conn Maciel Carey’s labor and employment attorneys help employers navigate the federal, state, and industry‑specific rules that shape their obligations; develop and refine policies that reflect the realities of their workforce; and address situations where online conduct intersects with workplace expectations. In the end, the goal is to ensure that when a personal post becomes a workplace issue, the organization is prepared to respond appropriately and consistently.
