Two things are worth saying at the outset. There is no separate body of law for social media. And the ground is shifting this autumn in ways that raise the stakes for both sides.
There are no special rules, and that is the point
Where an employee is dismissed over something they posted, the tribunal asks the same question it asks about any conduct dismissal. Did the employer genuinely believe the employee was guilty of misconduct, did it have reasonable grounds for that belief after a reasonable investigation, and did dismissal fall within the range of responses a reasonable employer might have adopted?
That test can cut either way. In British Waterways Board v Smith, the Employment Appeal Tribunal upheld the dismissal of an employee who had posted derogatory comments about his supervisors on Facebook, and had boasted about drinking while on standby, despite the posts being two years old and defended as banter. The tribunal below had substituted its own view. The EAT said that was not its job.
What employers should not take from that case is a general licence. The decision was upheld because it fell within the band of reasonable responses on those particular facts, not because offensive posts justify dismissal as a rule.
Offence is not the same as gross misconduct
The leading authority is now Higgs v Farmor's School, decided by the Court of Appeal in February 2025, with the Supreme Court refusing the school permission to appeal in June that year. Mrs Higgs, a pastoral administrator, was dismissed after a parent complained about Facebook posts (most of which were reposts), criticising the teaching of gender and relationships in primary schools. She used her maiden name, posted from a personal account, and did not identify her employer.
The Court of Appeal held that the dismissal was unlawful discrimination on grounds of religion or belief. Her beliefs were protected. Where a dismissal is prompted by the way someone manifests a protected belief, the employer must show its response was proportionate. Here it could not. The language was objectionable but not grossly offensive, there was no evidence that the school's reputation had, in fact, been damaged, and nothing suggested her views had ever influenced how she treated pupils.
The practical lesson for employers is uncomfortable but clear. Reputational risk asserted in the abstract, with no evidence of actual harm, is a thin basis for dismissal. The court accepted that the school was entitled to investigate. It was the leap from investigation to dismissal that failed.
Private accounts and private groups are rarely “private”
Employees often assume that a closed group, a personal phone or a pseudonymous account puts them beyond reach. It generally does not.
In Young v Royal Mail Group Ltd, decided by the Employment Appeal Tribunal in June 2026, an employee with over ten years' service posted two messages in a WhatsApp group set up by local union representatives during the 2022 industrial dispute. One was straightforward abuse of the employer. The other told two named colleagues to choose sides, adding that the wrong answer would result in their car being blown up, followed by "lol". He was dismissed for gross misconduct and argued he had been dismissed for taking part in trade union activities.
The tribunal rejected that, and the EAT upheld the decision. The forum does not determine the character of what is said in it. A union group chat is not a protected space simply because it is a union group chat and abuse aimed at an employer is not, without more, the advancement of union aims.
Employers should not read that as a licence to trawl group chats. Monitoring staff online engages data protection obligations, and the Information Commissioner's Office has published detailed guidance on monitoring workers that expects monitoring to be justified, proportionate and, in all but the rarest cases, transparent. Covert monitoring is a last resort, not a default.
What changes this autumn and next January
Three dated developments matter.
From 30 October 2026, the Employment Rights Act 2025 strengthens the duty to prevent sexual harassment from taking reasonable steps to taking all reasonable steps and introduces liability where a worker is harassed by a third party such as a customer, client, contractor or visitor, and the employer cannot show it took all reasonable steps to prevent it. That third-party liability covers harassment related to any protected characteristic, not only sexual harassment, and can arise from a single incident. Where a harassment claim succeeds and the preventative duty has been breached, compensation can be uplifted by up to 25 per cent on awards that are not capped.
This reframes the social media question entirely. Abuse of your staff by a customer on a public page, or in a comment thread under your own post, becomes your liability unless you can show you took all reasonable steps to prevent it.
Since 1 October 2026, the time limit for bringing most employment tribunal claims rises from three months to six.
From 1 January 2027, the qualifying period for ordinary unfair dismissal falls from two years to six months, and the statutory caps on the compensatory award are removed altogether. Anyone with six months' service on that date is protected immediately. It is worth correcting a widespread misunderstanding here: the proposed day-one right to claim unfair dismissal was dropped shortly before the Act received Royal Assent. Six months is the settled position.
Taken together, a far larger group of employees will be able to challenge a social media dismissal, they will have twice as long to do it, and the financial ceiling on what they recover has gone.
What a policy has to do now
A policy sitting unread in a handbook has never been much of a defence. From this autumn it is close to worthless. The shift is from having a policy to being able to prove it works.
A workable policy says what conduct is prohibited, gives examples, states plainly which behaviour is capable of amounting to gross misconduct, and explains that conduct outside working hours can be covered where there is a genuine connection to work. It addresses who owns work-related accounts, followers and contacts when someone leaves. It sets out how concerns are reported, and it is supported by training that is recorded, refreshed and actually delivered to managers.
The evidence trail is the point. Risk assessments, training records, reporting routes and prompt action all become the material you rely on when asked what else you could reasonably have done.
Investigate before you react
Acas published a redrafted Code of Practice on disciplinary and grievance procedures on 30 July 2026, the first full revision since 2009, with consultation running to 23 September 2026. It remains a draft and is not yet in force, but its direction of travel is informal resolution first, with greater use of mediation and facilitated conversations. That is sound instinct for social media disputes, most of which are better resolved by a conversation and a deleted post than by a disciplinary hearing.
Where formal action is needed, the basics still decide cases. Establish who actually posted the material. Preserve it properly. Consider context, tone and audience. Put the allegations to the employee and let them respond. Consider mitigation, length of service and lesser sanctions. Treat comparable cases consistently.
If you are the employee
Responsibilities run both ways, and employees underestimate theirs.
Anything you post can be read by people you did not intend to reach, and screenshots outlive deletions. A closed group is not private. Naming or identifying your employer raises the stakes considerably. Confidential information about your employer, colleagues or clients does not stop being confidential because you shared it socially and disclosing it may breach both your contract and data protection law. Posting about a colleague in terms connected to their race, sex, religion, disability, age, sexual orientation or gender reassignment can expose both you and your employer to a harassment claim.
None of that means you have no protection. Beliefs are protected, and so is the expression of them, within limits of proportionality. If your employer moves straight to dismissal over a post that caused no demonstrable harm, that decision is open to challenge.
Where the criminal law bites
A short factual note, because the position has changed and older summaries are unreliable.
- Communications Act 2003, section 127(1): sending a grossly offensive, indecent, obscene or menacing message over a public electronic communications network. Still in force. The false message provisions in section 127(2)(a) and (b) were repealed for England and Wales in January 2024.
- Malicious Communications Act 1988, section 1(1)(a)(i): sending an indecent or grossly offensive message. Still in force. The provisions covering threats and false statements were also repealed in January 2024.
- Online Safety Act 2023: created a false communications offence and a threatening communications offence, both in force since 31 January 2024. The Act itself regulates platforms rather than individual users, and Ofcom does not adjudicate individual complaints about a post.
- Protection from Harassment Act 1997: a course of conduct amounting to harassment, which carries both criminal penalties and a civil remedy, including injunctions and damages.
- Sexual Offences Act 2003 (as amended), sections 66E and 66F: creating, or requesting the creation of, a purported intimate image of an adult without consent. In force since 6 February 2026, and it applies whether or not the image is ever shared.
- Sexual Offences Act 2003 (as amended), section 66I: making, adapting, supplying or offering to supply a tool for generating purported intimate images, the so-called nudification apps. In force since 29 June 2026.
If you are on the receiving end
Preserve the evidence before it disappears, including URLs, timestamps and full-screen captures rather than crops. Report the content to the platform. Where a course of conduct is involved, the Protection from Harassment Act offers both a criminal route through the police and a civil claim. Where a post contains a damaging false statement of fact, defamation may be available, though the serious harm threshold is real and the limitation period is one year.
Whichever side of this you are on, the position usually turns on detail: what was said, who could see it, what connection it had to work, and what was done next. If a post has put your business or your job at risk, get in touch with your solicitor before you act, and certainly before you dismiss.
