Employee-generated social media content has become a major safety and compliance issue for retailers, according to the law firm Fisher Phillips. Content can range from funny and harmless to harassment, bullying, threats and potential violence. Retailers have no legal obligations to monitor every employee’s Instagram or equivalent social media platform, states Fisher Phillips in an “Insights” report. There is no OSHA workplace violence standard. Retailers do need to have a process for responding to related workplace issues once they become aware of them, the law firm states. 

The “Insights” report states: “OSHA’s general duty clause requires employers to provide a workplace free from recognized hazards likely to cause serious harm. OSHA has recognized retail as a high-risk environment for workplace violence, and that recognition extends to threats that originate on social media. If a current or former employee posts something threatening online toward a co-worker and management is aware of it, the employer must have a protocol in place – a defensible response process is critical.”

Fisher Phillips urges retailers to be aware of any applicable state and local safety rules, and other Federal requirements, which the firm describes here:

• New York’s Retail Worker Safety Act took effect last year and requires covered employers to adopt violence prevention policies, conduct training, and in some cases install panic or alarm buttons.
• California requires almost all employers to develop and implement workplace violence prevention plans. Specific requirements relate to hazard assessments, violent incident logs, and annual training. The state’s definition of workplace violence includes online threats.
• Washington state issued standards updates for isolated employees on January 1^st, 2026, that apply to certain retailers. Updates include added training, recordkeeping, and functional requirements related to panic buttons, among other changes.
• Equal Employment Opportunity Commission (EEOC) rules must be addressed. Under EEOC requirements, employer liability for harassment claims can arise when management knows or should have known about harassing conduct, regardless of whether the conduct happened on company time or on a personal device. Conduct that occurs on private social media is not excluded because it didn’t happen on company property or time. If it surfaces in the workplace and contributes to a hostile work environment, it’s likely within the scope of EEOC rules.
• A social media policy must account for the right of employees to engage in activity about their terms and conditions of employment under the National Labor Relations Act. A retail worker posting about unsafe working conditions or management practices may be engaged in protected activity even if the post is critical or uncomfortable.

3 practical steps for retail employers  

As social media use increases, retailer policies and practices to protect their workforce and business should be adjusted to keep pace. Fisher Phillips offers three steps to consider:

1. Update safety programs. In California, addressing social media-originated threats in Workplace Violence Prevention Programs (WVPP) is now a compliance requirement. Updating WVPPs to reflect social media risks makes sense for multi-state retailers even where it isn’t required.
2. Train managers. The first person who sees a concerning post or hears about a viral clip is almost always a store manager. Managers need to know when to contact HR, when to call legal, and what not to do. Threatening discipline for a post that might be protected activity, or ignoring something that warrants a threat assessment, can be costly mistakes.
3. Review social media policies. A policy needs to cover new trends such as livestreaming, employee personal branding, and the growth of WVPPs. The policy needs to be specific enough to address safety and harassment concerns, narrow enough not to delete protected activity, and written so employees understand.