The riskiest social media post about your company will not come from your marketing team; it will come from an employee's personal account on a Saturday. A social media policy cannot prevent every bad post, but it defines the rules in advance: who speaks officially, what stays confidential, and which behavior has consequences.
This template covers the full scope, official accounts, personal accounts, confidentiality, FTC endorsement disclosures, and harassment carryover, and includes the protected activity language that keeps the policy enforceable under federal labor law.
The NLRA trap: why overbroad policies backfire
Section 7 of the National Labor Relations Act protects employees, union or not, when they discuss wages, hours, and working conditions with each other, including publicly on social media. Policies that ban "disparaging the company" or "posting about work" have repeatedly been found unlawful by the National Labor Relations Board because employees would reasonably read them to cover protected complaints about working conditions. The consequence is worse than an unenforceable clause: discipline issued under an overbroad policy can itself be an unfair labor practice. This template handles it the way employment counsel do, with narrow prohibitions (confidentiality, harassment, false statements about products) plus an express carve-out for protected activity.
Endorsements: the disclosure rule most companies miss
When an employee praises the employer's product online without disclosing the employment relationship, the post is an undisclosed endorsement under the FTC's Endorsement Guides, and the company, not just the employee, is exposed. The fix costs nothing: a clear disclosure such as "I work at" or an #employee hashtag in the post itself. The policy makes the disclosure mandatory and bans fake reviews outright, in both directions, because posting fake negative reviews of competitors creates the same liability with worse optics.
Official account credentials are company property
Companies have litigated ownership of social accounts against departing employees who built them. The policy's credentials clause, official accounts and their logins belong to the company and are handed over at departure, prevents the dispute; make sure at least two people always hold access.
Rolling the policy out
A policy nobody signed is hard to enforce. Distribute it with the employee handbook or as a standalone document, and collect a signed handbook acknowledgment that names it. Remote teams should read it alongside the remote work agreement: home offices multiply the chances of confidential material appearing in the background of a video or photo. Revisit the policy yearly; platforms change faster than handbooks.
State law adds two limits
Most states forbid employers from demanding employees' personal account passwords, and several (including California, Colorado, and New York) protect lawful off-duty conduct. The policy acknowledges both: it disclaims password requests where prohibited and does not purport to police lawful personal activity.
Frequently asked questions
Can a company discipline an employee for a personal social media post?
Sometimes. Posts that leak confidential information, harass coworkers, or violate endorsement rules are legitimately disciplinable under a policy like this one. Posts discussing wages or working conditions with coworkers are generally protected by the NLRA, and some states also protect lawful off-duty conduct, which is why the policy carves those out.
Does the NLRA really apply to non-union workplaces?
Yes. Section 7 protects concerted activity by employees regardless of union membership, and the NLRB has applied it to social media discipline in non-union companies many times. Any policy language an employee would reasonably read as banning discussion of working conditions is a problem.
Can we require employees to disclose that they work for us?
When they post about your products, yes, and you should: FTC endorsement rules require the material connection to be disclosed, and the company can be liable for its employees' undisclosed endorsements. The policy makes the disclosure a standing requirement.
Who owns a social media account an employee runs for the company?
Under this policy, the company: official accounts, their followers, and their credentials are company property, surrendered when the employee's role ends. Put accounts in company-controlled emails and keep credentials accessible to more than one person so the clause never has to be litigated.
Can we ask for an employee's personal account password?
In most states, no: password protection laws in the majority of states prohibit requiring or requesting credentials to personal accounts. The policy explicitly disclaims the practice where prohibited, which also signals to employees that personal accounts stay personal.
Should contractors be covered by the policy?
Usually yes, for the rules that concern the company's information and brand: confidentiality, official accounts, and endorsement disclosures. The template offers the option. Avoid controlling contractors' general online behavior, which is both unnecessary and a misclassification risk factor.