A written employee social media policy can require a disclaimer, bar leaking confidential information, and prohibit harassment, but it cannot be written broadly enough that an employee would reasonably read it as banning talk about pay, hours, or working conditions. That limit comes from the National Labor Relations Act, applies to Suvysoft's small-business clients whether or not anyone is unionized, and is currently governed by a standard the National Labor Relations Board could overturn within months.
Most templates circulating for small businesses mention a "2023 NLRB ruling" in one sentence and move on to disclosure language and confidentiality clauses. None of the ones we checked explain what that ruling actually tests for, and none mention that the Board spent most of 2025 without enough members to decide a case at all, then came back in 2026 with a majority that is expected to flip that exact standard. Writing a policy today means writing one that survives whichever rule is in effect when someone finally reads it closely.
Does labor law apply if nobody is unionized?
Yes. 29 U.S.C. Section 157, the NLRA's Section 7, gives employees "the right to self-organization" and "to engage in other concerted activities for the purpose of collective bargaining or other mutual aid or protection." Nothing in that text requires a union to exist first. The right belongs to the employee, not to a bargaining unit, and it covers the overwhelming majority of private-sector workers.
The carve-outs are narrow. The Act's definitions section excludes independent contractors and supervisors (anyone with real authority to hire, discipline, or direct other workers) from the "employee" status Section 7 protects. A sole proprietor with five hourly staff and no union card in sight is still a covered employer under Section 7. A business that treats this as a union-only problem is the business most likely to get a handbook clause wrong.
What makes a social media policy clause illegal?
A policy does not have to mention unions to violate the Act. It is enough that a facially neutral rule, read by an ordinary employee, chills discussion of pay, scheduling, safety, or management decisions, the exact topics Section 7 protects as "concerted activity for mutual aid or protection."
The current test comes from Stericycle, Inc., 372 NLRB No. 113, decided August 2, 2023 in a 3 to 1 vote. It replaced the more employer-friendly Boeing standard from 2017. Under Stericycle, a work rule is presumptively unlawful if an employee who is "economically dependent" on the employer, and therefore inclined to read restrictions conservatively, could reasonably interpret it to discourage Section 7 activity. The employer can still defend the rule, but only by proving it advances a real, substantial business interest that could not be served by a narrower rule. Any ambiguity in the policy's wording is read against the employer, since the employer is the one who drafted it.
This is why vague catch-all language is the single most common mistake. A clause barring posts that are "disparaging," "unprofessional," or that "embarrass the company" reads, to a worker who needs the paycheck, like a ban on complaining about a bad shift schedule or an unsafe workplace online, even if that was never the intent. Intent does not matter under Stericycle. Only the employee's reasonable reading does.
Is this standard about to change?
Almost certainly, and soon. The Board lost its quorum on January 27, 2025, after a sitting member was removed, leaving it unable to decide contested cases for most of the year. It regained a bare quorum on January 7, 2026, when two new Republican members, James Murphy and Scott Mayer, were sworn in alongside the lone remaining Democrat, David Prouty. For seven months that gave the Board a 2 to 1 Republican lean but not the three aligned votes needed to overturn precedent.
That changed on August 7, 2026, when the Senate confirmed a third Republican member, James Macy, by a 51 to 47 vote, in the same session that reconfirmed Prouty ahead of his term expiring three weeks later. Legal commentary from Proskauer describes the Board as now holding a 3 to 1 Republican majority "positioned to make precedent-shifting decisions," naming Stericycle specifically as one of the Biden-era rulings most likely to be revisited. As of this writing, Stericycle has not been overturned. It is still the live standard. But a policy written only for today's rule, with no margin for the return of something closer to the old Boeing framework, is a policy that will need rewriting again within the year regardless of which way the Board moves.
What can you actually restrict, under either standard?
Some restrictions survive both the current test and the one likely to replace it, because they protect a real business interest that has nothing to do with Section 7 activity.
- Confidential and proprietary information. Trade secrets, unreleased product details, financial data, and customer personal information can be off limits in specific, example-based language, not a vague "confidential" catch-all.
- Harassment, threats, and discriminatory speech. A rule barring harassment or threats of violence aimed at coworkers, customers, or the business has consistently been upheld, because it serves a legitimate interest a narrower rule cannot replace.
- Impersonation and unauthorized spokesperson claims. You can require employees not to speak as an official company spokesperson or imply authority they do not have, as long as the rule does not also bar identifying where they work.
- Illegal activity and defamation. Posting content that is actually defamatory (a knowing or reckless false statement of fact, not an opinion about working conditions) or that documents illegal conduct is not protected speech.
What does not survive either standard is a rule that only a lawyer would read narrowly. "Do not post anything that reflects poorly on the company" fails because an hourly employee reading it has no way to know it was meant to stop leaking trade secrets rather than complaining about a manager.
Can you ask for an employee's social media password?
In a large share of the country, no. A majority of states now restrict what an employer can demand from an employee's or applicant's personal social media accounts. California's version, Labor Code Section 980, is representative: an employer "shall not require or request" an employee or applicant to disclose a social media password, to log into an account in the employer's presence, or to otherwise divulge personal social media content. The law carves out a real exception for workplace misconduct investigations and for employer-issued devices, and it bars retaliating against anyone who refuses a request the law does not permit.
| Request | Generally allowed | Generally restricted in most states |
|---|---|---|
| Ask for login credentials to a personal account | No | No |
| Require login in the employer's presence | No | No |
| Request access during a specific misconduct investigation | Yes, with limits | Yes, with limits |
| Require credentials to an employer-issued device or account | Yes | Yes |
A policy that still includes a line asking new hires to "friend" a manager or share account access for "brand monitoring" is a liability in half the states a remote-hiring small business might draw applicants from, not just the ones with a storefront in a password-protection state.
How often does this actually come up?
More than most owners assume, and the trend is moving the wrong way for businesses without a written policy. A September 2025 survey covered by HR Dive found that roughly a quarter of employers had disciplined a worker over a social media post within the prior month alone, and 29% reported that social-media-related workplace conflict had increased over the previous six months. About a third of the employers surveyed said they had tightened their social media restrictions in response, which is exactly the moment an employer is most likely to write a rule broad enough to get challenged.
A business with no written policy is not avoiding this risk, it is handling every incident ad hoc, which is its own problem: inconsistent discipline across employees is one of the fastest ways to turn a single termination into a broader unfair labor practice charge, because the inconsistency itself becomes evidence the real reason was protected activity.
What should the policy actually say?
Four things, in plain language an hourly employee would read the same way a labor lawyer would:
- A savings clause up front. State plainly that nothing in the policy is meant to restrict discussion of wages, hours, working conditions, or other activity protected by federal or state labor law. This does not immunize an otherwise overbroad rule, but it is evidence of intent the Board will weigh.
- Specific, not categorical, restrictions. Replace "do not post anything unprofessional" with named categories: trade secrets, customer financial data, threats, and harassment, each with a one-line example.
- A named point of contact for questions, not a vague reference to HR policy nobody has read.
- A separate line on company-issued accounts and devices, since the rules for a business Instagram account someone manages as part of their job are different from the rules for their personal feed.
If a digital marketing team is already managing the brand's own accounts, the policy only needs to cover personal accounts and the line between the two, which is the part most templates blur. That same team, working inside a broader digital growth retainer, is also the one who ends up fielding the actual incident when an employee's personal post turns into a brand problem, so it is worth having the policy and the people managing public-facing accounts talk to each other before either gets written.
Frequently asked questions
Does the National Labor Relations Act protect employees without a union?
Yes. Section 7 of the NLRA, 29 U.S.C. Section 157, grants the right to engage in concerted activity for mutual aid or protection to employees generally, not to union members specifically. It applies to any private-sector, non-supervisory, non-contractor employee, whether or not their workplace has ever had a union election.
Can you fire an employee for a social media post about work?
It depends on what the post says and whether it connects to shared working conditions. A post made with coworkers, or about pay, scheduling, or safety, that other employees respond to is more likely protected concerted activity. A purely individual complaint unrelated to group concerns, or content that is harassing, threatening, or unrelated to work entirely, is less likely to be protected and more likely to support a lawful termination.
What makes a social media policy clause overbroad?
A clause is overbroad under the current Stericycle standard if an employee who depends on the paycheck could reasonably read it as discouraging discussion of wages, hours, or working conditions, even if the employer never intended that reading. Vague terms like "disparaging," "unprofessional," or "embarrassing to the company" are the most common offenders because they give no concrete example of what is actually restricted.
Can an employer require a new hire's social media password?
In most of the country this is now restricted by state law rather than federal law. Roughly half the states, including California under Labor Code Section 980, bar employers from requiring a password, requiring login in the employer's presence, or otherwise compelling access to personal accounts, with narrow exceptions for misconduct investigations and employer-issued devices.
Will the NLRB's new majority change what I can put in my policy?
Likely, but not yet. The Board reached a 3 to 1 Republican majority in August 2026, and legal commentary expects it to revisit the 2023 Stericycle standard along with several other Biden-era rulings. As of now, Stericycle remains the controlling test. A policy written to survive only the current standard, with no built-in savings clause or specific examples, will likely need revision again once a replacement standard issues.
What is the safest thing to put at the top of a social media policy?
A plainly worded savings clause stating that nothing in the policy restricts employees' rights to discuss wages, hours, working conditions, or other legally protected activity, followed by specific, example-based restrictions rather than broad categorical language. That combination has held up under every standard the Board has used since 2004.
Writing one of these from scratch, or auditing a handbook clause that has not been touched since before 2023, is exactly the kind of review worth doing before an incident forces the question. See how that kind of review has worked out for other clients in our case studies, or get in touch and we will look at what you already have.