Social Media Policy: What to Write Before Something Goes Wrong

A social media policy is a written set of guidelines that defines how a business and its employees use social media, both on behalf of the brand and in personal capacities where the brand could be implicated. Done properly, it protects the organisation, gives employees clear parameters, and ensures the brand behaves consistently across channels and crises.

Most businesses don’t write one until they need one. That’s the wrong order.

Why Most Businesses Write This Document Too Late

I’ve worked with a lot of organisations that had sophisticated social strategies, decent content calendars, and no policy document to speak of. The assumption tends to be that the team knows what they’re doing, and that’s usually true, right up until the moment it isn’t.

The trigger is almost always an incident. Someone posts something off-brand or legally problematic. A disgruntled employee vents about a client on their personal account. A community manager responds to a complaint in a way that escalates rather than resolves. A campaign lands badly and there’s no agreed protocol for how to respond publicly. Suddenly everyone wants a policy, and they want it written by tomorrow.

The problem with writing policy under pressure is that it ends up being reactive rather than considered. You write rules based on what just happened rather than what might happen. You patch gaps instead of building a framework. And you end up with a document that’s too narrow in some places and too vague in others.

The better approach is to write the policy when nothing is on fire. When you have time to think about the full range of scenarios, consult legal and HR, and produce something the whole organisation can actually use.

What a Social Media Policy Actually Covers

There’s a tendency to treat social media policy as a single document with a single audience. It isn’t. A well-constructed policy addresses at least three distinct groups, and the guidance for each looks quite different.

The first group is your social media team, the people who manage brand accounts day to day. They need guidance on tone, approval workflows, escalation paths, how to handle negative comments, when to respond and when not to, and how to behave during a crisis. They also need clarity on what they’re authorised to say without sign-off, and what requires it.

The second group is your broader marketing function, including anyone who might create content, brief agencies, or approve posts. They need to understand brand safety considerations, legal requirements around disclosure and endorsement, and how the policy interacts with any influencer or creator relationships the business has.

The third group is every other employee. This is where most policies are weakest. People post things on their personal accounts that reference their employer, comment on industry news in ways that could be attributed to the brand, or share company information without realising the implications. The policy needs to give these people enough guidance to make sensible decisions, without being so prescriptive that it reads like a surveillance document.

If you’re building out a broader social presence alongside your policy, the resources at The Marketing Juice social media marketing hub cover channel strategy, content, and paid social in more depth.

The Sections Your Policy Needs

There’s no universal template that works for every business, but there are sections that belong in almost every policy. consider this to include and why each one matters.

Purpose and scope

Start by stating what the policy is for and who it applies to. This sounds obvious, but a policy that doesn’t define its own scope creates ambiguity. Does it apply to contractors? Freelancers? Agencies posting on your behalf? Make that clear at the outset.

Approved brand accounts and ownership

List the official brand accounts across platforms, who owns them, and who has administrative access. This matters more than people think. When someone leaves the business, you need to know exactly which accounts they had access to and how to revoke it. When a new platform emerges and a team member sets up an account, you need a process for whether that becomes an official brand presence or not.

Content approval and publishing workflow

Define who can publish what without approval, what requires sign-off, and from whom. This is one of the most operationally important sections of the document. A good social media content calendar can help structure the publishing workflow, but the policy needs to define the governance layer that sits above it.

Be specific about categories. Routine organic content might need one level of approval. Paid social might need another. Anything touching a legal matter, a sensitive topic, or a crisis scenario needs a clearly defined escalation path that doesn’t depend on whoever happens to be in the office that day.

Tone and brand voice

The policy doesn’t need to replicate your full brand guidelines, but it should reference them and establish the non-negotiables. How does the brand behave in comments? What’s the position on humour? How does the brand handle criticism publicly versus privately? These aren’t just style questions, they’re risk questions.

Legal and compliance requirements

This section needs input from your legal team, not just marketing. It should cover advertising disclosure requirements (particularly relevant if you work with influencers or creators), copyright and intellectual property considerations, data protection obligations, and any sector-specific regulations your industry operates under. Financial services, healthcare, and legal sectors all have additional constraints that need to be written in explicitly.

Crisis and incident response

Define what constitutes a social media crisis, who gets notified, who is authorised to respond publicly, and what the holding position looks like while a proper response is being prepared. The worst time to work out your escalation path is when a thread is going viral for the wrong reasons.

I’ve seen this play out badly at agency level, where a community manager made a judgment call on a sensitive comment during a weekend, the client found out on Monday, and there was no policy to point to that either defended the decision or explained the oversight. It created a trust problem that took months to repair. A clear crisis protocol, even a simple one, would have changed that outcome.

Employee personal account guidelines

This is the section most businesses either skip entirely or write so broadly it’s useless. success doesn’t mean police what employees post on their own time. The goal is to give people enough clarity that they can make sensible decisions themselves.

Cover things like: whether employees should identify their employer in their bio, how to handle questions about the company from people in their network, what information is confidential and shouldn’t be shared publicly, and how to behave if they’re seen as a representative of the brand even in personal contexts.

The framing matters here. Write this section as guidance for sensible adults, not as a list of prohibitions. People respond better to “here’s how to protect yourself and the business” than to “consider this you’re not allowed to do.”

Policy Versus Strategy: A Distinction Worth Making

One thing I see regularly is organisations conflating their social media policy with their social media strategy. They end up with a hybrid document that tries to do both jobs and does neither particularly well.

The policy governs behaviour. It answers questions like: who can post, what can they say, what are the rules, what happens when something goes wrong. It’s a governance document. It should be written with HR and legal involved, and it should have teeth.

The strategy governs ambition. It answers questions like: which platforms should we be on, what content should we produce, how does social connect to commercial objectives, how do we measure success. It’s a planning document. It should be written by marketing, informed by data, and reviewed against results.

Keep them separate. When you mix them, the policy becomes aspirational and loses its authority, and the strategy becomes bureaucratic and loses its agility. If you’re building or refining your broader approach, there’s a range of social media management tools that can support the operational side once the governance layer is in place.

How to Handle Influencer and Creator Relationships

If your social activity involves working with influencers or creators, your policy needs a dedicated section for it. This isn’t optional, it’s a legal requirement in most markets. The FTC in the US and the ASA in the UK both have clear rules about disclosure, and “the influencer knew what they were supposed to do” is not a defence if something goes wrong.

The policy should define: what disclosure language is required and where it should appear, what content the brand needs to approve before it goes live, what topics or claims are off-limits regardless of how the creator wants to frame them, and what happens if a creator posts something outside the agreed brief.

This section also needs to address the grey area between paid and organic. When a creator you’ve worked with commercially posts something about your brand organically, is that covered by your policy? It should be. The lines between paid and organic social have blurred considerably, and your policy needs to reflect that reality.

The Employee Advocacy Question

Some businesses actively encourage employees to share brand content, amplify campaigns, and present themselves as brand ambassadors on their personal channels. Done well, this can extend reach significantly and add a layer of authenticity that branded accounts can’t replicate. Done badly, it creates exactly the kind of confusion and inconsistency the policy is supposed to prevent.

If you’re running any kind of employee advocacy programme, the policy needs to cover it explicitly. Who is participating voluntarily versus who feels pressured? What content are they being asked to share? What’s the disclosure requirement when an employee shares branded content on their personal account? What happens if someone participates in the programme and then leaves the business?

I’ve seen employee advocacy programmes produce genuine commercial value, particularly in B2B contexts where individual credibility carries weight. But they require more governance than most organisations build in at the start. The policy is where that governance lives.

Keeping the Policy Current

A social media policy written in 2020 is not the same document you need in 2026. Platforms have changed. Legal requirements have evolved. AI-generated content has introduced new questions about disclosure and authenticity that didn’t exist a few years ago. The role of AI in social media strategy is shifting fast enough that most policies haven’t caught up with it yet.

Build a review cycle into the policy itself. At minimum, annual. Ideally triggered by any significant platform change, legal update, or organisational shift that affects how the brand uses social. Assign ownership clearly, someone needs to be responsible for keeping it current, and that person needs the authority to convene the right people when a review is due.

An outdated policy can be worse than no policy. If the document references a platform that no longer works the way it describes, or doesn’t address a channel your team is actively using, it undermines confidence in the whole framework. People stop consulting it because they don’t trust it, and you’re back to operating on individual judgment rather than agreed standards.

Getting the Policy Actually Used

Writing the policy is the easy part. Getting people to read it, understand it, and apply it consistently is where most organisations fall short.

A few things that help. First, make it readable. A policy document written in dense legal language will sit in a shared drive and gather dust. Write it in plain English, use clear headings, and make it easy to handle to the section relevant to a particular situation. If you want people to consult it when something comes up, it needs to be the kind of document they can actually use under pressure.

Second, train people on it. Not a one-time all-hands session, but structured onboarding for anyone joining the marketing team, and periodic refreshers for the broader organisation. The policy should be part of how new employees understand the brand’s expectations from day one.

Third, make it easy to find. Not buried in a folder on the intranet that nobody remembers the path to. Linked from the onboarding documentation, referenced in the brand guidelines, accessible to anyone who needs it without having to ask.

Fourth, treat it as a living document rather than a one-time project. When something happens that the policy doesn’t cover well, update it. When a team member raises a question the policy doesn’t answer clearly, add the answer. The best policies improve over time because the people using them contribute to making them better.

Optimising the content that sits within your policy framework is a separate discipline. If you’re looking to sharpen what actually gets published, optimising social media content for engagement and reach is worth addressing alongside the governance layer.

The Commercial Case for Getting This Right

I’ve spent a significant part of my career thinking about social media ROI, and the honest answer is that most of the value destruction in social doesn’t come from bad strategy. It comes from bad governance. A campaign that performs well but triggers a compliance issue. A community manager who responds to a crisis in a way that makes it worse. An employee who posts something that creates a legal exposure the business didn’t see coming.

These aren’t edge cases. They happen regularly, across organisations of every size, and they’re almost always preventable with a policy that was written before the incident rather than after it.

The commercial case for a social media policy isn’t complicated. It protects the brand value you’ve built. It reduces the risk of legal and regulatory exposure. It gives your team the confidence to act decisively because they know what the boundaries are. And it means that when something does go wrong, you have a framework for responding that doesn’t depend on whoever is available at the time.

Early in my agency career, I overvalued speed and undervalued structure. I thought good judgment was enough, and mostly it was, until it wasn’t. The businesses I’ve seen handle social crises well are almost always the ones that had done the unglamorous work of writing clear policies before anything went wrong. That’s not a coincidence.

For a broader view of how social fits into the marketing mix, including channel strategy, content planning, and paid social, the social media marketing section of The Marketing Juice covers the full picture.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions