Social Media Policies at Work: What Employers Can Restrict and What They Cannot

Employer social media policies are common, and many of them are overbroad. Federal and state laws limit what an employer can restrict in employees' social media use — most importantly through the National Labor Relations Act's protection of "concerted activity" by both unionized and non-unionized workers.

The NLRB has issued extensive guidance on what social media policies cross the line. The 2023 Stericycle decision narrowed the standard for evaluating these policies, requiring that the employer show its interest in the rule outweighs the burden on protected activity.

What employers CAN restrict

• Use of company confidential information, trade secrets, and customer information
• Misrepresentation of company products or services
• Use of company logos or trademarks without authorization
• Posting from company devices during work time (with limits)
• Defamatory or harassing statements about specific co-workers
• Disclosure of personnel decisions or HR processes (within limits)

What employers CANNOT restrict (federally)

• Concerted activity: Discussions among employees about wages, hours, working conditions, scheduling, management decisions, or unionization. This applies to ALL employees, unionized or not, in private and public posts.
• Whistleblower communications: Reporting suspected illegal activity to government agencies (SEC, OSHA, EEOC, NLRB, etc.) cannot be prohibited.
• Truthful complaints about working conditions: Employees can publicly discuss their pay, schedule, management quality, and work environment.
• Off-duty political and social commentary: Generally protected from employer retaliation (with some exceptions for public-policy-violating statements).
• NLRB charge filing and union organizing: Cannot be prohibited.

Common overbroad policy provisions

The NLRB has found these provisions unlawfully overbroad:

• "Do not post anything that may damage the company's reputation"
• "Do not discuss internal company matters online"
• "Be respectful of co-workers and managers in all online communications"
• "Confidential information includes salary, working conditions, and personnel decisions"
• "Posts about the company must be approved by HR before publication"
• "Do not use company name or logo on personal accounts"

Each of these can be read to prohibit protected activity. Even if the employer enforces them only against genuine misconduct, the existence of the rule chills protected activity and can support a NLRA charge.

State-specific protections

• California: Labor Code § 96(k) prohibits adverse action based on off-duty lawful conduct. Multiple statutes prohibit social media login/password demands.
• New York: Labor Law § 201-d prohibits discrimination based on legal off-duty conduct.
• Many states: Specific prohibitions on requiring social media passwords from employees or applicants.

Step-by-step: how to navigate

1. Review the policy

Pull your employer's social media policy. Identify provisions that may be overbroad.

2. Identify what type of speech you want to engage in

• Personal opinion on a political issue → likely protected, especially off-duty
• Discussion with co-workers about pay or schedule → NLRA protected
• Complaint about a working condition → NLRA protected if framed as concerted concern
• Specific personal grievance about a manager → less protected; risk of defamation
• Disclosure of confidential business information → generally restrictable
• Whistleblower report to a regulator → strongly protected

3. Know your audience

NLRA protections require the activity to be "concerted" — taken with or on behalf of other employees, or to bring group concerns to management's attention. A solo rant about your bad day is less protected than a discussion among co-workers about a common issue.

4. Document the underlying concern

If you are raising a working-condition issue publicly, also document it internally. Internal complaints support the "concerted activity" framing and create a paper trail showing the employer was on notice.

5. Keep personal accounts personal

Use separate accounts for personal and work-related communications. Avoid using company email, company devices, or company hours for personal posts. This reduces the basis for legitimate employer action.

Scripts to use

Pushing back on policy enforcement:

"I want to discuss the application of the social media policy to my [specific post]. The post addresses [specific working condition / pay / scheduling concern] and was made in coordination with co-workers who share the concern. This is protected concerted activity under Section 7 of the National Labor Relations Act. Could we discuss the basis for any potential adverse action?"

Responding to a request for social media credentials:

"Under [state law], employers cannot require employees or applicants to provide social media login credentials. I'd be happy to discuss any specific public posts that have raised concerns, but I cannot provide login access to my personal accounts."

Documenting a concerted-activity discussion:

"Following up on our group discussion about [working condition]. Several of us share the concern about [specific issue]. I have raised this internally with [manager / HR] on [dates], and we plan to continue discussing potential collective approaches to resolution."

What to document

• The employer's social media policy
• The specific posts at issue
• Whether the activity was concerted (involved or addressed other employees)
• Any internal complaints raising the underlying issue
• The employer's response to the post (warning, discipline, termination)
• The temporal relationship between the post and any adverse action

When to escalate

If you face adverse action based on social media activity:

1. File a charge with the National Labor Relations Board for NLRA-protected activity. NLRB charges have a 6-month statute of limitations.
2. File an EEOC charge if the social media activity touched on discrimination, harassment, or retaliation themes.
3. Consult an employment attorney for state-specific protections (off-duty conduct, social media password laws, defamation defense).
4. File with the SEC, OSHA, or other relevant agency if the activity was a whistleblower report.

NLRA protection for non-unionized workers is one of the most underused remedies in employment law. Many workers do not know that discussions of pay, working conditions, and management are federally protected even without a union.

Educational content only — not legal advice. Employment law varies by jurisdiction and situation. Consult a qualified employment attorney for advice specific to your circumstances.