PostEaseThe short answer
A social media policy is a short written set of rules for how a business uses social media and how its people talk about it. It covers who may post for the brand and who approves, what staff may say about work on their own accounts, how to disclose a connection, how accounts are kept secure, how comments are moderated, and who acts when something goes wrong. Keep it to a page or two, and make sure everyone has read it.
Disclosure is the part people most often miss. The FTC’s guidance for influencers counts an employment relationship as a material connection, so staff who post about their employer’s products should say they work there. In regulated fields the stakes are higher: FINRA, for example, requires financial firms to keep records of business communications, social posts included, for at least three years.
What a social media policy covers
The sections most businesses need:
| Section | Question it answers |
|---|---|
| Accounts and access | Who owns each account, who can post, and how logins are kept safe? |
| Approval | What needs a second pair of eyes before it posts? |
| Voice | How do we sound? (Link the brand voice guide.) |
| Staff on their own accounts | What may staff say about work, clients and colleagues? |
| Disclosure | How do staff and partners disclose a connection to the brand? |
| Comment moderation | What do we reply to, hide, delete or report? |
| Brand safety | Where should our brand never appear, and next to what? |
| Crisis | Who pauses posts and speaks when something goes wrong? |
| Records | What must be kept, and for how long, in our field? |
Staff on their own accounts
Most people will mention work somewhere. A good policy encourages that while setting clear limits: no confidential information, no client or customer details, no speaking for the company unless asked, and a plain disclosure such as “I work here” when posting about the company’s products. Make clear that personal opinions are personal, and that harassment of colleagues or customers online is treated like harassment at work.
Comment moderation rules
A content moderation policy says what you will leave, hide, delete or report on your own pages, and is best published so commenters know the rules. Leave honest criticism and reply to it; hide or delete abuse, hate, threats, spam, scams and anyone’s private information; block repeat offenders. Apply the rules the same way to everyone, and keep a note of what was removed and why.
Brand safety
Brand safety is keeping your brand away from content that would damage it: hateful, violent, misleading or illegal material, whether through ads that appear beside it, partners who post it, or your own posts during sensitive news. Check partners’ past posts before working with them, use platforms’ placement controls for ads, and pause scheduled posts during a tragedy or crisis so nothing cheerful goes out at the wrong moment.
Security and access
Give each person their own login and a role, rather than sharing one password; turn on two-step verification on every account; remove access the day someone leaves; and keep a list of every account the business owns. Most account takeovers start with a shared or reused password, and most are prevented by these four habits.
Make it a policy people use
A policy nobody reads protects nobody. Keep it short, in plain words, with examples of what is fine and what is not. Walk every new starter through it, review it once a year and whenever a platform or the law changes, and keep it where the team works rather than in a forgotten folder. Ask people what is unclear, and fix that first. A policy that answers real questions gets followed.
When something goes wrong
Name who can pause every scheduled post and who approves a public statement, and keep their contact details in the policy. Speed matters: in Sprout Social’s Q2 2026 survey of 2,250 social media users, 84% said a brand’s response speed affected how they viewed a crisis, and 64% said it was important to respond publicly on social media.
Questions
What should a social media policy include?
Accounts and access, approvals, voice, what staff may say, disclosure, comment moderation, brand safety, crisis roles, and record-keeping rules for your field.
Do employees have to disclose that they work for a company when they post about it?
In the US, the FTC’s guidance counts employment as a material connection, so staff posting about their employer’s products should disclose it, for example with “I work here”.
What is a content moderation policy?
The rules for what you leave, hide, delete or report on your own pages, ideally published so commenters know them, and applied the same way to everyone.
What is brand safety?
Keeping your brand away from damaging content: in ad placements, through partners, and in your own timing during sensitive news.
Sources
- FTC, Disclosures 101 for social media influencers, checked October 2026.
- FINRA, Social media, key topics, checked October 2026.
- Sprout Social, Social media is now the primary channel for brand crisis response, new research finds, June 2026.