Social Media Policy | NLRA Section 7 Compliant Template

It is a unilateral workplace rule, not a contract. The employer publishes it, employees sign an acknowledgment, and the employer keeps the right to amend it. The distinction matters in a dispute: a policy creates a defensible basis for discipline, while a signed confidentiality and invention assignment agreement creates obligations backed by consideration that survive the end of employment. Serious HR files carry both, cross-referenced rather than duplicated.

The document covers two subjects employers often split by mistake. The first is outward-facing speech: posts on personal accounts, comments on review sites, industry forums, endorsements of the employer's own products. The second is internal use of company systems: email, chat tools, internet access, company laptops and phones, and personal devices connected to company data. Splitting these into two documents creates gaps, because a story filmed on a personal phone inside a restricted area lands in both at once. A policy of this kind normally sits inside a broader employee handbook covering PTO, harassment reporting and progressive discipline.

Federal labor law is the dominant constraint, and it applies whether or not your workforce is unionized. Section 7 of the National Labor Relations Act gives most private sector employees the right to engage in concerted activity for mutual aid or protection, and Section 8(a)(1) makes it an unfair labor practice to maintain a rule that chills that right. Under Stericycle, Inc., 372 NLRB No. 113 (2023), a facially neutral rule is presumptively unlawful when an economically dependent employee could reasonably interpret it as restricting protected activity, and the burden shifts to the employer to prove the rule serves a substantial business interest that no narrower wording could achieve. A generic savings clause buried at the end of the handbook does not reliably cure an overbroad paragraph. Enforcement of mere maintenance cases has narrowed under Memorandum GC 26-03, but the standard holds until the Board changes it, as set out in the NLRB's announcement of the Stericycle standard for evaluating workplace rules.

Board law treats a comment thread the way it treats a break room conversation, and approving a coworker's post about payroll errors was held protected in Three D, LLC (Triple Play Sports Bar), 361 NLRB 308 (2014). Supervisors under Section 2(11) fall outside that protection, which is why the template addresses managers separately.

Privacy law fills the rest of the frame. The Electronic Communications Privacy Act and the Stored Communications Act, 18 U.S.C. §§2510 and 2701, allow monitoring of employer systems under the business use and consent exceptions, and the same statutes expose an employer who logs into a private account without authorization. Where employees promote the company online, the FTC Endorsement Guides at 16 C.F.R. Part 255 require clear disclosure of the employment relationship. Regulated employers add a layer: Regulation FD, FINRA Rules 2210 and 3110, the HIPAA Privacy Rule.

The most common trigger is the first serious hire in a company that already has a public voice. Once someone other than the founder holds the password to the company account, you need written rules on tone, approvals, credential storage and the last day of employment. A close second is the arrival of a formal handbook, when verbal norms stop working and inconsistency starts to look like discrimination.

Regulated industries need it far earlier. A broker-dealer, a home health agency, a clinic, a bank branch: each has supervisory or confidentiality duties that attach the moment an employee types. Companies running a bring your own device setup face the same pressure from another angle, since work data sits on a phone the employer does not own and cannot wipe without prior written consent. That scenario pairs with a remote work agreement setting equipment, expense and data security rules.

Two edge cases deserve attention. Union organizing almost always produces a wave of online posting, and issuing or tightening a social media rule during a campaign invites a charge of unlawful promulgation in response to protected activity. The other is the viral incident, where an employee posts something offensive under their own name with the employer named in the bio. Discipline there turns on the state, the subject matter and the real business harm, not the volume of the reaction.

• The scope and covered systems clause names every channel the policy reaches, from company email and collaboration tools to personal devices used for work and personal accounts that identify the employer. Naming them defeats the argument that a private group chat falls outside the rules.
• The Section 7 carve-out appears inside each restrictive paragraph rather than once at the end. Employees are told plainly that nothing limits their right to discuss wages, hours, benefits, staffing or working conditions with coworkers or the public, which is the wording the Board looks for after Stericycle.
• The confidentiality boundary defines protected information by category, from customer lists and pricing models to unreleased products, and states expressly that pay and working conditions are excluded. Vague bans on discussing "company business" are the most frequently invalidated clause in this area.
• The monitoring and privacy notice states what is monitored, on which systems, for what purpose and by whom, and records that employees have no expectation of privacy on employer equipment. The wording satisfies the notice statutes in Connecticut, Delaware and New York at once.
• The personal account protection clause commits the employer not to request credentials, not to require an employee to open an account in a manager's presence, and not to retaliate for refusing. It mirrors the statutes now in force in most states.
• The brand account ownership clause records that company handles, follower lists and credentials are employer property, requires storage in a company password manager, and sets a return obligation on separation. Disputes over a handle built by a departing marketing manager are expensive.

California is the strictest environment. Labor Code §980 bars employers from requesting personal social media credentials or asking an employee to open an account in the employer's presence, while Labor Code §§96(k), 1101 and 1102 protect lawful off-duty conduct and political activity, so discipline for a weekend post about a ballot measure carries real exposure. Labor Code §2802 also requires reimbursement of a reasonable share of personal phone costs used for work, a duty confirmed in Cochran v. Schwan's Home Service.

New York combines two rules. Labor Law §201-i, in force since March 2024, prohibits requesting, requiring or coercing disclosure of personal account credentials, and Civil Rights Law §52-c requires written notice of electronic monitoring to every new hire, with acknowledgment plus a conspicuous workplace posting, under penalties that escalate across repeat violations. Labor Law §201-d separately protects legal recreational and political activities pursued off premises on the employee's own time.

Illinois operates the Right to Privacy in the Workplace Act, 820 ILCS 55, protecting personal online accounts and off-duty use of lawful products. Employers collecting fingerprint or face data at device login should read the policy alongside BIPA, 740 ILCS 14, where damages accrue per violation.

Connecticut and Delaware pioneered monitoring notice. Conn. Gen. Stat. §31-48d requires prior written notice of monitoring types plus a conspicuous posting, while 19 Del. C. §705 lets the employer choose between a daily notice at login and a one-time notice with written acknowledgment.

Colorado protects lawful off-duty activity under C.R.S. §24-34-402.5, one of the broadest such statutes in the country. Texas and Florida sit at the other end, with no credential statute, so the federal floor and your own written rules do the work.

You start by selecting the states where you have employees, and the form adjusts the monitoring notice, the personal account language and the off-duty conduct wording to the strictest applicable standard. Next you describe the systems you actually monitor. Be accurate, because a policy claiming no monitoring while IT retains six months of mail logs is worse than no policy at all. The form then asks whether you operate company-branded accounts and who administers them, which turns on the FTC disclosure clause and the credential return obligation.

Device questions come next: company-issued only, bring your own device, or a mix, with reimbursement and remote wipe language adjusting accordingly. You then set the reporting channel and name the person who decides on discipline. The output is an editable Word file and a print-ready PDF with an acknowledgment page. Add it to your onboarding pack alongside the rest of your US employment forms and workplace policies, and reissue the acknowledgment whenever you amend the text.

The classic error is the sweeping ban. Rules telling employees to avoid "negative comments about the company" or to seek approval before posting anything work-related read as a restriction on protected concerted activity and rarely survive scrutiny. The confidentiality paragraph fails the same way when it defines protected information as everything learned at work, quietly capturing pay. Then comes enforcement drift: the employee who posted about understaffing gets a written warning while the one who insulted a customer gets a conversation, and that inconsistency becomes the plaintiff's best exhibit.

Monitoring mistakes are the costly ones. Employers describe surveillance they do not perform, or perform surveillance they never described, and both versions damage credibility in a hearing. Some managers still ask to see a private account during an investigation, unlawful in most states even when the suspicion is well founded. Never log into an employee's personal account using credentials obtained from a coworker; that is where Stored Communications Act claims come from. Companies also forget that handles and follower lists are corporate assets belonging in the same inventory as the rest of your company formation and corporate governance paperwork, and discover the gap when the password holder resigns.