Social media policy for a small business: a template with approval rules, account ownership and staff accounts

A small-business social media policy names who may post, who approves which content, who owns each account, how access and two-factor sign-in work, what happens in a crisis, and how staff disclose ties to the business on personal accounts.

Most small teams do not need a handbook. They need one page that answers six questions before something goes wrong, and an approval rule for each kind of post. This guide gives both, plus a template to copy. Every legal and platform fact below was read on the regulator's, lawmaker's or platform's own page on 2026-10-02, and each is labelled with the jurisdiction it belongs to.

What should a small-business social media policy cover?

Eight sections cover what goes wrong in small teams. Each one maps to a section of the template at the end.

Who should approve which posts?

Approval should follow risk, not seniority. A post that states a price, a claim about a product or a legal term can cost money if it is wrong. A photo of the shop window cannot. The matrix below is our recommendation for a team of two to ten people; it is a starting point to edit, not a legal requirement.

Two rules make the matrix work. Name people, not job titles, because in a team of four the "marketing lead" may be the owner. And name a stand-in for every approver, so a holiday does not stop all posting.

Who should own each account, and who gets which role?

The business should own every account, through an email address it controls and with recovery details nobody takes with them when they leave. Staff and agencies get the lowest role that lets them do their job. A shared password gives everyone the owner's full powers, and the only way to take it back is to change it for everyone.

The table shows what the main roles can do on three platforms, from each platform's help pages read on 2026-10-02.

Note the LinkedIn row: a Content admin can boost posts, which spends money. If paid posts need approval, that rule has to live in your policy, because the role does not enforce it.

YouTube's own help page puts the case for roles in one line: granting permissions "is safer than sharing your password or other sensitive sign in details." An invitation expires 30 days after it is sent.

For the step-by-step on adding people and agencies by role, see how to give an agency access without a password. For taking access back when someone leaves, the agency offboarding checklist works for departing staff too.

What should the policy say about passwords and two-factor authentication?

Three rules cover most small teams.

1. Each person signs in as themselves. Roles exist so nobody has to share a password; use them wherever a platform offers them.
2. Two-factor authentication is compulsory for everyone with access. On Meta, you can enforce this. Only people with full control of a business portfolio can turn on the requirement, and they choose "Admins only" or "Everyone"; everyone it applies to must set up two-factor authentication on their personal Facebook account before they can access the portfolio. Meta requires it automatically for some business portfolios more than 90 days old, and then it cannot be turned off (Meta).
3. Where a login must be shared, it lives in a password manager the business controls, and it is changed the day someone with access leaves. The recovery email and phone number belong to the business, not to a person.

What are the crisis and deletion rules?

Write these down before you need them. Our recommended rules for a small team:

• Anyone may pause scheduled posts. Pausing costs nothing. If something has happened in the news or to the business, the first move is to stop the queue, not to post.
• Only the owner or the named stand-in may delete a published post or speak for the business on the incident.
• Save before you delete. Take a screenshot of the post, its comments and the time it went up, and file it with a note of who decided to delete and why. A deleted post may still be needed for a complaint, a regulator's question or an insurance claim.
• Correct rather than delete where the error is factual. A wrong price or date can be fixed with an edit or a reply that states the correction.
• Pause, check, then speak. One holding line ("We are aware and looking into it") beats a fast wrong statement.
• Review within a week. What happened, what was deleted, and whether a rule needs to change.

Note that on Meta the Content task alone can delete posts. If deletion should be the owner's call, the policy has to say so, because the role allows it.

What can a business require of staff on their personal accounts?

This is where the law differs most by country. Two separate questions matter: what staff must disclose, and what the business may forbid.

Disclosure when staff post about the business

• US. The FTC's Endorsement Guides FAQ says an employee who mentions the employer's products should disclose the relationship, and "listing your employer on your profile page isn't enough" (FTC). The same applies to staff sharing a company post if the share could be seen as promoting a product. The FAQ says it would not be reasonable to expect a business to monitor every post by every employee, but that the business should "establish a formal program to remind employees periodically" of its policy, and ask staff to remove undisclosed reviews it learns about or add the disclosure. If the business actively encouraged staff to write reviews, it is responsible for monitoring them. The Guides' own example of an employee posting on a discussion board says the employer should train staff to limit its own liability and, where it directed the posts or has reason to know of them, to monitor them (16 CFR 255.5, Example 8).
• UK. The influencers' guide from the ASA, CAP and CMA says that if you are directly connected to a brand, as an owner, employee, shareholder or director, you need to make clear in any content that features the brand that it is advertising, "even when the brand doesn't know if or what you're creating" (ASA). The CMA's guidance for brands says a brand may be held responsible for content published on its behalf if it is misleading or otherwise non-compliant (CMA, updated 28 August 2025).
• EU. The #ad disclosure guide compares the rules in the EU, Germany and France, with sources.

A practical policy line for all three: staff who post about the business's products or offers say in the post that they work there.

Limits on what the business may forbid

• US. Section 7 of the National Labor Relations Act gives employees the right to engage in "concerted activities for the purpose of collective bargaining or other mutual aid or protection" (29 U.S.C. 157), and section 8(a)(1) makes it an unfair labor practice for an employer to "interfere with, restrain, or coerce" employees in exercising those rights (29 U.S.C. 158). Supervisors are excluded from the Act's definition of employee (29 U.S.C. 152(3)). In practice, a blanket rule such as "never criticise the company online" or "never discuss pay" is the kind of line a US employer should have checked by an employment lawyer before adopting. How the National Labor Relations Board applies Section 7 to workplace rules is set by its decisions, which this guide does not summarise.
• UK. Acas, the employment advisory service, has archived its social media advice and says it "may not be up to date" (Acas). Our recommendation: treat a breach of the social media policy like any other conduct issue under your disciplinary procedure, and say in the policy that you will.

Our advice for every jurisdiction: keep the personal-account section short and specific. Ban what you can explain (sharing confidential information, posting customers' details, speaking for the business without being named in section 2), require disclosure, and leave the rest alone.

What records should a small team keep?

Records answer two questions later: what went out, and who decided. Our recommended minimum:

• The access register. Every account, its owner-level person, everyone with a role, the date each role was granted, and the date it was removed.
• Approvals. For each post in an approval row of the matrix: who approved it, when, and the version they saw.
• Permissions. Written consent from customers or staff shown in posts, and the disclosure terms agreed with any creator or partner.
• Deletions. The screenshot, the reason, and who decided.
• Policy acknowledgements. The date each person read the policy, and the dates of the periodic reminders the FTC expects.

A shared folder and a spreadsheet are enough. Some scheduling tools hold posts for approval and record who did what; for example, Schedchie's Team plan (€24.99 a month for three invited members plus the owner) holds a flagged member's posts until the owner approves them, retries and reschedules included, and keeps a 30-day activity view per person. Agencies should agree where these records live during client onboarding.

Social media policy template

Copy it, replace the brackets, delete what does not apply. It fits on one page.

[BUSINESS NAME] SOCIAL MEDIA POLICY
Version [1.0], adopted [DATE], owner [NAME]

1. SCOPE
Covers every account in the access register and everyone
who posts for us: staff, freelancers and agencies.

2. WHO MAY POST
Only the people named in the access register, each
signed in as themselves, in the role listed there.

3. APPROVALS
Follow the approval matrix (appendix A). Prices, offers,
claims, paid partnerships and statements on incidents
are never posted without the named approver.
Stand-in approver: [NAME].

4. OWNERSHIP AND ACCESS
The business owns every account. Owner-level roles:
[NAME] and [NAME]. Recovery email: [BUSINESS ADDRESS].
Everyone else gets the lowest role that does the job.
Access is removed on the day someone leaves.

5. PASSWORDS AND 2FA
No shared passwords where a platform offers roles.
Two-factor authentication is required for everyone.
Any unavoidable shared login lives in [PASSWORD
MANAGER] and is changed when someone with access leaves.

6. CRISIS AND DELETION
Anyone may pause scheduled posts. Only [NAME] or
[STAND-IN] deletes a published post or comments on
an incident. Screenshot before deleting; log why.

7. PERSONAL ACCOUNTS
If you post about our products or offers, say in the
post that you work here. Never share confidential
information or customers' details. Do not speak for
the business unless you are named in section 2.
Nothing in this policy limits your legal rights to
discuss your pay and working conditions.

8. RECORDS
We keep the access register, approvals, permissions,
deletions and policy acknowledgements in [LOCATION]
for [PERIOD].

9. BREACHES AND REVIEW
Breaches are handled under our disciplinary procedure.
This policy is reviewed every [6/12] months and
re-sent to everyone after each review.

Read and understood: [NAME, DATE]

The last sentence of section 7 is there for US employers in particular; keep the section 8(a)(1) rule above in mind before adding restrictions to it.

Frequently asked questions

Does a small business legally need a social media policy?

No law we checked requires one by name. The FTC's FAQ, answering a company that has one, says it should remind employees of it periodically, and a written policy is what a disciplinary decision or an approval dispute will be judged against.

Can I require employees to share company posts from their personal accounts?

You can ask. If you encourage staff to promote the business in the US, the FTC expects them to disclose that they work for you, and says a business that actively encouraged staff to write reviews is responsible for monitoring them. In the UK, the ASA, CAP and CMA guide says employees' content about the brand needs to make clear that it is advertising.

Should the owner approve every post?

No. Approval on every post slows a small team down without reducing risk much. Approve by content type, as in the matrix: prices, claims, paid partnerships, complaints and incidents.

Who should own the business's social media accounts?

The business, through an email address and recovery details it controls, with at least two people holding an owner-level role so one departure does not lock everyone out.

What happens if an employee breaks the policy?

Handle it like any other conduct issue under your disciplinary procedure, and say so in the policy. In the US, check first that the rule broken does not restrict activity protected by Section 7.

Sources

All read on 2026-10-02.

• Federal Trade Commission, "FTC's Endorsement Guides: What People Are Asking". ftc.gov
• 16 CFR Part 255, Guides Concerning the Use of Endorsements and Testimonials in Advertising, section 255.5. ecfr.gov
• National Labor Relations Act, 29 U.S.C. 152, 157 and 158. law.cornell.edu
• ASA, CAP and CMA, "Influencers' guide to making clear that ads are ads", March 2023 edition. asa.org.uk
• Competition and Markets Authority, "Social media endorsements: guidance for brands", updated 28 August 2025. gov.uk
• Acas, archived advice on social media in the workplace. acas.org.uk
• Meta Business Help Center, "Business portfolio assets and their task-based access settings". facebook.com
• Meta Business Help Center, "How to require two-factor authentication for people in your Meta business portfolio". facebook.com
• LinkedIn Help, Page admin roles. linkedin.com
• YouTube Help, channel permissions. support.google.com