Employee advocacy guidelines (with a template you can copy)

What employee advocacy guidelines are for

Employee advocacy guidelines are a short document that tells employees what they may share about their work on their own social accounts, how to disclose that they work for the company, what stays confidential, and who to ask when unsure. Good guidelines fit on one page, are written in plain language, and exist to make people more confident about posting — not less.

That last point is the one most policies miss. The most common reason employees do not post about their work is not that they are forbidden to; it is that they are not sure what is allowed, and the safest choice is silence. A clear page removes that hesitation. A twelve-page legal document makes it worse. Write the guidelines as permission with a few clear limits, not as a list of prohibitions with permission implied somewhere at the end.

This page is general guidance, not legal advice. Rules on advertising, disclosure, employment and confidentiality differ by country and industry. Have your legal, HR or compliance team review any policy before you publish it.

Employee advocacy policy template

Copy the block below into a document, replace the bracketed parts, and cut anything that does not apply to you. It is deliberately short. If you add a section, consider removing one.

The sections below explain the thinking behind the four parts that cause the most trouble: disclosure, confidentiality, regulated industries and criticism.

Disclosure: saying who you work for

When an employee promotes their employer's products, a reader is entitled to know about the connection. In the United States, the FTC's endorsement guides treat an employment relationship as the kind of material connection that should be disclosed when someone endorses a product, and consumer-protection and advertising rules in the UK, the EU and elsewhere take a broadly similar view. The principle is simple and does not need a lawyer to understand: if your relationship with the company could change how someone reads your post, tell them.

In practice, on LinkedIn, this is lighter than it sounds. Most people's employer is already on their profile, and posts about their own work make the connection obvious. But "obvious to people who click through" is not the same as clear. Encourage people to make it explicit in the post itself when they are recommending a product: "our team shipped", "at [Company] we", "full disclosure, I work here". It costs nothing and it reads as more honest, not less.

Two things raise the bar. First, incentives: if employees receive anything for posting — gift cards, points that convert to rewards, prize draws — that should be disclosed too. Second, reach beyond the employee's own network: when a post is reshared, the original context can disappear, so the disclosure should be in the text.

Confidentiality: the list people actually need

"Do not share confidential information" is the most common line in every social media policy and the least useful, because nobody knows exactly what it covers. Name the categories. For most companies they are:

• Unreleased products, features, dates and pricing.
• Financial results and forecasts before they are public — and, for listed companies, anything that could be price-sensitive.
• Customer names, logos, numbers and quotes without written permission from the customer.
• Screenshots of internal tools, dashboards, documents and chats, which leak far more than people notice.
• Colleagues' personal information, including photos taken without their agreement.
• Anything covered by an NDA, a partner agreement or an ongoing negotiation.
• Security incidents and vulnerabilities.

Then make the positive version just as concrete: what is fine to share. Public launches, published blog posts, open roles, events you are speaking at, lessons learned (without the confidential details), customer stories the customer has approved. People post more when they can see the green list as clearly as the red one. For ideas on what that looks like in practice, see employee advocacy examples by post type.

Employee advocacy for legal, financial services and healthcare

Regulated industries can run advocacy programs, and many do. They need more process, not a different philosophy. The rules vary a great deal by country and profession, so what follows is generic; your compliance team's view takes precedence over anything here.

Legal

Law firms usually face professional conduct rules on advertising and solicitation, on statements about results, and on client confidentiality. The safe ground is commentary on public developments, published articles, events, hiring and firm news. The risky ground is anything that identifies a client or matter, implies a guaranteed outcome, or could be read as legal advice to a specific reader.

Financial services

Financial firms are commonly subject to rules on financial promotions and communications with the public, and in some jurisdictions to pre-approval and recordkeeping requirements for what employees post about the business. Performance figures, product claims and anything resembling a recommendation are the obvious danger areas. Expect compliance to want a defined list of approved topics and a record of what was published.

Healthcare and life sciences

Patient privacy comes first: no patient details, images or stories without proper consent, ever. Claims about treatments and products may be subject to strict advertising rules, especially for pharmaceuticals and medical devices. Hiring, culture, research that has been published and public events are generally safer topics.

What this means for process

Involve compliance before the pilot, not after the first incident. Agree on three lists: topics that are fine to post without review, topics that need review first, and topics that are off limits. Decide who reviews, how quickly, and how published posts are recorded if your regulator expects it.

Be clear-eyed about tooling. Blabigo, for example, lets an author send a post to a reviewer — a workspace member or an external reviewer by email — who can approve it or request changes. That review is advisory: it does not block publishing. For most teams that is the right trade-off, because approval gates are what turn advocacy into paperwork. For a regulated team that needs a hard pre-approval control, it is not enough on its own; you need your own process (and possibly a dedicated compliance archiving tool) around it. We go deeper in employee advocacy in regulated industries.

Handling negative comments

Sooner or later, an employee's post about their work will attract criticism: a dissatisfied customer, a former employee, someone who disagrees, occasionally a troll. The guidelines should make three things clear.

1. They do not have to respond. An employee is not customer support. Ignoring a comment is a legitimate choice.
2. If they do respond, stay calm and factual. One polite reply, then move on. Never argue, never share confidential details to win a point.
3. Some things get passed on immediately. Customer complaints, legal threats, press enquiries, safety issues and harassment go to a named contact, who takes it from there.

The company's side of the bargain matters just as much: if an employee is harassed for posting about their work, the company should support them, not leave them to it. Say so in the guidelines. People will not spend their credibility for an employer who disappears when it goes wrong.

When someone posts something they should not have

It will happen. Someone shares a screenshot with a customer name visible, or mentions a launch date a week early. How you handle the first mistake determines whether anyone posts again.

The guidelines should ask people to fix it (delete or edit) and tell a named contact straight away, and promise that reporting a mistake promptly will not be punished. Fast reporting is worth far more than the deterrent effect of blame. Distinguish honest errors from deliberate breaches of confidentiality; the latter are a disciplinary matter under your existing policies, not a new one.

What happens when someone leaves

Posts an employee published on their own profile belong to them. When they leave, those posts stay. The company cannot delete them and should not ask. This is not a weakness of employee advocacy; it is the reason it is credible. The posts were never the company's.

What you can reasonably ask is simple: update the profile so it no longer shows them as current staff, stop describing themselves as speaking for the company, and keep honouring existing confidentiality obligations. On your side, remove them from advocacy teams and tools, and stop sending them material. In Blabigo, that means removing them from the workspace and its teams; their published LinkedIn posts are unaffected because they were always on their own account.

Rolling the guidelines out

Publish the guidelines before the program launches, and introduce them in person at the kickoff rather than by email. Walk through the green list and the red list, show two good example posts, and tell people exactly who to ask. Then review the document every six months, or after any incident, and keep the "last reviewed" date honest.

Guidelines are one part of a program. The rest — choosing a pilot group, preparing material, cadence and the 90-day plan — is in how to build an employee advocacy program. Leaders often need their own version of the conversation; see executive advocacy on LinkedIn. And if you want a tool that keeps material, teams and per-person results in one place while every post stays in the employee's own words, see how Blabigo runs employee advocacy.