A social media policy is a formal document that defines how a company and its employees are permitted to use social media — covering brand accounts, personal accounts when discussing work, content approval workflows, crisis response protocols, and legal compliance requirements. It protects the brand, sets clear expectations for staff, and ensures consistent messaging across every platform and team member.
Most companies have a social media policy buried somewhere in their HR handbook. Very few have one that employees have actually read, that marketing actually follows, or that the legal team helped write. This guide explains what a good policy covers, why it matters, and how to build one that works in practice.
What is a social media policy?
A social media policy is an official company document — typically maintained by marketing, HR, or legal (or all three jointly) — that sets rules and guidelines for social media use in three contexts:
- Brand-owned accounts — who can post, what content is permitted, what must be approved before publishing, tone of voice standards, and how to handle incoming messages
- Employee personal accounts — what employees can and cannot say publicly about their employer, how to disclose their affiliation, and what counts as confidential information
- Crisis and incident response — who speaks for the brand during a public incident, what the escalation chain looks like, and what to say (or not say) while a situation is unresolved
A well-crafted policy is short enough to actually read, specific enough to be actionable, and current enough to be relevant. A 40-page PDF last updated in 2019 is not a working policy — it is a liability document.
Why social media policies matter
The stakes are higher than most companies realise. Social media incidents that escalate into PR crises often originate in a single employee post, an unreviewed brand response, or a piece of confidential information shared carelessly. A clear policy prevents most of these before they happen.
Specific risks a policy helps mitigate:
- Reputational damage — an employee posting a divisive personal opinion while visibly affiliated with the company
- Legal exposure — publishing competitor comparisons that qualify as disparagement, or making unsubstantiated claims about products
- Regulatory violations — financial services firms, healthcare providers, and government bodies face strict rules about what can be said publicly
- Data leaks — sharing screenshots of internal systems, unreleased products, or customer data on personal accounts
- Brand inconsistency — multiple team members speaking in incompatible voices or contradicting each other's messaging
- Crisis amplification — well-meaning employees posting "support" during a crisis without realising they are making the situation worse
If you operate in financial services, healthcare, pharmaceuticals, government, or legal services, your social media policy is not optional — it is part of your compliance framework. The FTC, SEC, FDA, and HIPAA all have guidance that affects what you can and cannot say on social platforms, including endorsements, testimonials, and claims.
What to include in a social media policy
A complete social media policy covers eight key areas:
1. Scope
Define who the policy applies to: full-time employees, contractors, agency partners, executives. State which platforms it covers. Clarify whether it applies to personal accounts, brand accounts, or both — and under what circumstances personal use falls under the policy (e.g., when employees identify themselves as company employees).
2. Brand account governance
Specify who has credentials to brand accounts, who can post without approval, what content requires sign-off (and from whom), and how account access is revoked when someone leaves the company. Include login security requirements (two-factor authentication, password managers).
3. Content standards
Define tone of voice, language rules, topics to avoid, and prohibited content types. Include guidance on imagery (no competitor logos without permission), claims (no unsubstantiated product claims), and disclosure requirements (paid partnerships, sponsored content, affiliate relationships).
4. Employee personal account guidelines
Clarify that employees are personally responsible for their own posts. Specify when they must disclose their employer affiliation (e.g., when commenting on industry topics in a professional context). Define what constitutes confidential information. Make clear the difference between sharing opinions and representing the company.
5. Community management rules
How quickly should the brand respond to comments and messages? What comment types should be hidden or deleted (spam, hate speech)? Who escalates complaints that cannot be resolved publicly? What is the protocol for reviewing-related posts?
6. Crisis response protocol
Who is the crisis communications lead? What triggers a social media crisis (a threshold of negative mentions, a media pickup, a specific type of complaint)? What is the holding statement template? Who must approve communications during an incident? When does the company go "dark" on social?
7. Legal and compliance requirements
Cover FTC disclosure requirements for endorsements, copyright and fair use for images and video, defamation avoidance for competitor mentions, GDPR/privacy requirements for any customer data shared publicly, and industry-specific regulations applicable to your sector.
8. Consequences and enforcement
State clearly that violations of the policy can result in disciplinary action up to and including termination. This section must be reviewed by HR and legal to ensure it aligns with employment law in your jurisdiction.
Common social media policy mistakes
- Writing it in legalese — employees will not read a document they cannot understand. Write in plain language and save the technical legal language for an internal addendum reviewed by counsel.
- Covering personal accounts too broadly — overreaching into employees' genuine personal expression creates legal risk (labour law protections vary by jurisdiction) and destroys morale. Focus on posts that reference the company or use company information.
- No crisis section — most companies discover their policy has no crisis protocols the day they need them. Write this section before you need it.
- Never updating it — a policy written in 2021 does not account for TikTok's rise, AI-generated content rules, or current FTC influencer guidance. Review annually at minimum.
- No single owner — when everyone is responsible, no one is. Assign a named individual as policy owner with a calendar reminder to review it each year.
- Ignoring executive social activity — executives are often the highest-risk accounts. Senior leadership needs specific guidance, not an exemption from the policy.
Policy vs. brand guidelines vs. content calendar
These three documents are often confused but serve different purposes:
| Document | Purpose | Audience | Update frequency |
|---|---|---|---|
| Social media policy | Risk management and governance rules | All employees + HR + legal | Annually + after incidents |
| Brand guidelines | Visual and tone of voice standards | Marketing team + agencies | At rebrand or major campaign |
| Content calendar | Publishing schedule and post plans | Social media manager | Weekly or monthly |
| Community management guide | Response scripts and escalation paths | Community manager + support | Quarterly or as needed |
Social media policy and employee advocacy
Employee advocacy — encouraging staff to share company content on their personal social accounts — is one of the highest-ROI social tactics available. Content shared by employees gets 8x more engagement than content shared by brand channels, and employees collectively have far more followers than any single brand account.
A good social media policy enables employee advocacy instead of suppressing it. This means:
- Providing pre-approved content employees can share without policy risk
- Making disclosure requirements easy to fulfil (a simple "I work at [company]" disclosure in bio)
- Rewarding sharing rather than only punishing violations
- Running training sessions so employees know what the policy actually says
- Creating an advocacy program with optional participation — never mandatory
Requiring employees to share company content on their personal social accounts as a condition of employment or performance review creates legal risk in many jurisdictions, damages authenticity, and signals that your policy prioritises reach over employee trust. Advocacy programs must be voluntary to be effective and legally sound.
Best practices for writing and maintaining a social media policy
- Write it collaboratively. Get input from marketing, HR, legal, and at least one non-manager employee. Policies written in isolation by legal are often unworkable in practice; policies written in isolation by marketing often miss critical compliance requirements.
- Keep it under 5 pages. If the policy needs more than 5 pages, split it into a short policy document and a longer operational guide. The policy itself should be readable in 10 minutes.
- Include real examples. Abstract rules are hard to apply. Show examples of posts that are fine, posts that need approval, and posts that are prohibited.
- Run training, not just distribution. Sending a PDF via email is not training. Run a 30-minute session with Q&A, and include social media policy in your onboarding programme.
- Create a simple escalation path. Employees need to know exactly who to contact if they see a policy-relevant situation developing. Make this a named person with a Slack handle or email — not a generic HR inbox.
Frequently asked questions
A social media policy is a formal document that sets rules for how a company and its employees use social media platforms — including brand accounts, personal accounts referencing work, and crisis response protocols.
Any organisation with employees who interact publicly on social media — or that runs brand social accounts — should have a policy. Even solo operators with a small team benefit from basic written guidelines.
A comprehensive social media policy should cover: scope, brand account governance, content standards, employee personal account guidelines, community management rules, crisis response protocols, legal compliance requirements, and consequences for violations.
No legal mandate requires companies to have a social media policy, but regulated industries (financial services, healthcare, government) face rules that effectively require one. For everyone else, it is a risk management best practice.
Review your social media policy at least annually, and after any significant event — platform change, rebranding, crisis incident, or new regulatory requirement. Many policies become outdated within 18 months due to the speed of platform evolution.
Related glossary terms
Sources
