Chances are most of your employees are on social media, and some of them may be using their private accounts to say things about their employment. Frustrated employees might even be complaining about their working conditions – or about you.

While it may seem prudent to ban employees from saying anything negative about your organization online – or perhaps even discussing work at all – the National Labor Relations Board, which interprets the National Labor Relations Act, has ruled that this kind of restriction is illegal. That said, employers can still encourage employees to think before they speak (or type), and remind them that behavior akin to unlawful harassment of their co-workers may still lead to discipline.

Also be aware that 23 states have already implemented social media privacy laws for employees, so you’ll want to ensure you’re not overstepping any legal requirements when drafting your social media policy.

Here are a few Do’s and Don’ts to keep in mind when creating one:

DO… Maintain control over company social media accounts. As the employer, you own them and have a right to access them. You should always have the current credentials to access company social media, even if you assign an employee or outside party to oversee the accounts.

DO… Respect the privacy of employees. Even publicly-viewable social media accounts are part of the personal lives of your employees. Monitoring the personal conversations of your employees indicates you don’t trust them. Employees who believe their employer doesn’t trust them will be less engaged and committed.

DO… Encourage employees to be respectful and to avoid statements that could be interpreted as threatening, harassing, or defaming. You can tell them not to present their opinions as those of the company and to refrain from sharing confidential company information on social media. Put employees on notice that you may request to see their social media activity if it’s relevant to an investigation of misconduct. State laws generally say you may request access to an employee’s personal social media only if you’re conducting an investigation into that employee’s alleged misconduct and you have a reasonable belief that the employee’s personal social media activity is relevant to the investigation.

And now for the Don’ts:

DON’T… Examine the social media accounts of applicants or employees. If you were to learn information about a protected class or protected activity, and then made an adverse decision regarding the employee or applicant, you could open yourself up to claims of retaliation or discrimination. Generally, it’s best that employers and supervisors not be online “friends” or “followers” of their employees.

DON’T… Restrict concerted activity. According to the National Labor Relations Board (NLRB), employer social media policies should not be so sweeping that they prohibit (or would seem to discourage) the kinds of activity protected by federal labor law, such as the discussion of wages or working conditions among employees.

DON’T… Ignore the laws. While state laws differ, they share some general themes. First, the laws prohibit employers from requiring or requesting that employees or applicants disclose their login credentials (usernames or passwords). Second, the laws say you can’t require or request that an employee or applicant access their personal social media in your presence or add you to their contacts or friends list. If an account is private, you shouldn’t try to gain access to it. Third, the law prohibits retaliation on your part. For example, if you were to discipline an employee for refusing to show you what’s on their social media timeline, or not hire an applicant who refused to do the same, you’d be in violation of the law.

“While it may seem prudent to ban employees from saying anything negative about your organization online – or perhaps even discussing work at all – the National Labor Relations Board, which interprets the National Labor Relations Act, has ruled that this kind of restriction is illegal.”

In conclusion, if you have employees working in any of the states with social media privacy laws, it’s a good idea to examine the specific laws to make sure you’re not in violation. But even if your state has no social media privacy law, we recommend using a social media policy that encompasses the advice above.