A social media policy should make safe participation easier. It should distinguish official publishing from personal participation, define authority and review, protect people and information, and create a clear response when credentials, content, or conduct fail.
This template is an operating starting point. It must be reviewed for the organization's employment, privacy, security, records, regulatory, labor, intellectual-property, and geographic obligations.
Download the template
The CSV uses one row per policy section. It records scope, rule, rationale, owner, evidence, exceptions, review cadence, and consequence. Draft the complete policy in a document system, then use this matrix to prove every section has an accountable owner and maintenance cycle.
Define scope and account authority
List covered employees, contractors, agencies, executives, official accounts, personal accounts used for work, community spaces, messaging, review sites, and emerging platforms. Explain when a person is speaking for the organization and when they are speaking personally.
Maintain an official account register with business owner, operational owner, platform identity, purpose, administrator membership, authentication method, recovery path, data classification, retention, and offboarding requirement.
State who can create, connect, publish, advertise, moderate, message, export data, install automation, grant OAuth access, or change security settings. Apply least privilege and require named approval for high-impact access.
Set conduct, privacy, rights, and disclosure rules
Define prohibited harassment, threats, discrimination, impersonation, manipulation, confidential disclosure, deceptive endorsement, and unsafe engagement. Explain escalation for abuse, self-harm, threats, child safety, fraud, and other serious risks.
Protect customer, employee, partner, applicant, patient, student, minor, location, and security information according to applicable obligations. A social team should never infer permission to publish personal information from its availability elsewhere.
Require traceable rights for images, footage, music, designs, fonts, testimonials, user-generated content, and quotations. Define commercial, sponsorship, affiliate, political, synthetic-media, and other required disclosures.
Govern publishing, approval, AI, and automation
Use risk-based approval. Routine evergreen work may need editorial review; material claims, customer proof, regulated content, offers, crises, or executive statements may require accountable specialists and a final approver.
Bind decisions to a stable version and define which changes invalidate approval. Require timezone, destination identity, delivery-state verification, public URL, and recovery ownership for official publishing.
Define approved uses of generative AI and agents, restricted data, source verification, human review, disclosure, copyright and likeness checks, model or provider approval, audit logs, permission boundaries, spend controls, and emergency stop. Automation should never receive broader authority merely because it is convenient.
Cover security, records, incidents, and enforcement
Require organization-controlled accounts, supported authentication, strong unique credentials where passwords exist, multi-factor authentication, secure recovery, credential rotation, periodic access review, agency offboarding, and incident reporting.
Define which briefs, approvals, source evidence, media licenses, messages, moderation actions, live URLs, edits, deletions, analytics, and incident records must be retained, for how long, and where. Align retention and deletion with legal holds and privacy obligations.
Connect the policy to crisis, security, privacy, impersonation, account takeover, accidental publishing, and harmful-content response. State how violations are investigated, who decides consequences, how retaliation is prevented, and how exceptions are approved and documented.
Implement and maintain the policy
Assign one policy owner and section owners. Train covered people with real scenarios, not only an acknowledgment checkbox. Test account recovery, approval escalation, content removal, and incident contacts.
Review the policy on a fixed cadence and after major platform, legal, organizational, security, or AI changes. Record the version, effective date, approvers, training status, exceptions, and next review.
Social media policy checklist
- Scope distinguishes official authority from personal participation
- Official account register and least-privilege access process exist
- Conduct, privacy, safety, rights, and disclosure rules are explicit
- Risk-based approval and version invalidation are defined
- AI and automation data, permission, review, disclosure, and stop rules exist
- Security, offboarding, records, retention, and deletion are assigned
- Crisis, takeover, impersonation, accidental publish, and correction paths connect
- Training, exceptions, enforcement, version, and review cadence are documented
Use the approval workflow template, crisis response playbook, and publishing checklist to operationalize the policy.
