# SOCIAL MEDIA AND CONGREGATIONAL IMAGE POLICY **[CHURCH NAME]** Adopted by [ELDERS / DEACONS / BOARD / SESSION] on [DATE] Next scheduled review: [DATE, one year after adoption] Policy owner: [ROLE, not a person's name] Everything in square brackets is yours to fill in or strike. Nothing else in this document needs rewriting to be usable. Blank the brackets, read it aloud in a meeting, vote, and file the signed copy with your bylaws. Source: churchposting.com/resources/communications/church-social-media-policy/ --- ## 1. SCOPE This policy governs every account, page, group, channel, and profile that speaks as [CHURCH NAME] or appears to. That includes the main page, any ministry or group page, any account created for a single event, and any account created by a member or volunteer that carries the church's name, logo, or address. It also governs what staff and volunteers post from their own personal accounts about the work of the church, the people of the church, and conversations they had because of their position here. It does not govern the rest of their personal accounts, and this church claims no authority over a member's private speech. Three separate questions are answered in three separate places, and confusing them is the most common reason a policy fails: - **Accounts** (sections 2 to 4): who may speak as the church. - **Images** (sections 5 to 8): whose picture may appear. - **Conduct** (sections 9 to 12): what may be said, by whom, about whom. ## 2. WHO MAY POST AS THE CHURCH Only a person named on the current Authorized Poster list may publish to a church account. The list is maintained by [ROLE] and reviewed at every [QUARTERLY] staff meeting. Being on staff does not put a person on the list. Being a volunteer does not keep a person off it. A person joins the list when all four of these are true: 1. [ROLE] has asked them to. 2. They have read this policy and signed the acknowledgment at section 14. 3. Their background check is current, if they work with children or youth. [STRIKE IF NOT APPLICABLE.] 4. Their access has been granted through the church's own account, not by sharing a password. A person leaves the list the day they resign, the day their term ends, the day they move away, or the day [ROLE] removes them. Removal requires no reason and no meeting. ## 3. WHO HOLDS THE CREDENTIALS The church owns its accounts. A volunteer holds access to them. - Every church account is registered to an email address on the church's own domain, controlled by [ROLE]. No church account is registered to a personal address. - The recovery phone number on every church account belongs to [ROLE or the church office line], not to a volunteer's cell phone. - Passwords live in the church's shared password vault. They are not written on a card in the office, not stored in one person's browser, and not sent by text. - Two-factor authentication is turned on for every church account, with recovery codes printed and stored [WHERE]. - Access is granted person by person through each platform's own access controls. A shared password is not an access control and it is not permitted. **Offboarding, within 24 hours of a person leaving.** [ROLE] removes their access from every platform, removes them from the vault, rotates any password they could have read, checks the account's active login sessions and ends any the church does not recognize, and confirms the recovery email and phone number are still the church's. This happens whether the departure was friendly or not, and it is not a statement about the person. ## 4. WHAT NEVER GETS CREATED No one starts a new account, page, or group in the church's name without written approval from [ROLE]. A dormant page nobody can log into is a liability: it will still be the first result somebody finds, and it cannot be corrected, closed, or claimed. If a page in this church's name exists and nobody here controls it, [ROLE] reports it to the platform and records the date of the report. ## 5. THE IMAGE STANDARD A recognizable person's picture is theirs, not the church's. This church posts pictures of people who have agreed to it, and does not post pictures of people who have not. Three consent levels, and every image falls into one of them. **Level 1, no consent needed.** No one is recognizable. Backs of heads, hands, a full room shot from behind, an empty building, an object, a page, a plate of food, a whiteboard with no names on it. **Level 2, general consent.** A recognizable adult appears in an ordinary picture of ordinary church life, posted where the church ordinarily posts. Covered by a signed general release on file, or by a plainly posted notice at the event and the person's opportunity to decline, at the church's option. [PICK ONE AND STRIKE THE OTHER.] **Level 3, specific written consent.** Required, every time, for: - Any recognizable person under 18. Signed by a parent or legal guardian. - Any image used to ask for money, promote a campaign, advertise the church, or appear in paid promotion of any kind. - Any image of a person in a moment of visible distress, prayer for a named need, a hospital or care setting, a baptism candidate's testimony, a recovery group, or a counseling context. - Any image identifying a person as a first-time guest. - Any image of a person whose situation is legally sensitive: an active custody matter, a protective order, a witness, a person in a shelter, a person whose address is confidential by court order. Level 3 consent is specific to one use. It does not roll forward to the next campaign. ## 6. MINORS No recognizable image of a person under 18 is posted to any church account without a signed parent or guardian release naming that child, dated within the last [12] months, on file with [ROLE]. Additionally, and with a release in hand: - No first name plus last name of a minor. First name only, or no name. - No school, team, bus route, house number, street sign, or license plate visible in the frame. - No check-in tag, name badge, or class roster legible in the frame. - No location tag on any post containing a minor. - No image of a minor in a swimsuit, in athletic clothing that a stranger would read as revealing, or in any state of undress, at any age, for any reason, including camp and baptism. Photograph baptism from behind or after, robed. - No direct message from an adult worker to a minor on any platform, ever. Communication with minors goes through a parent or through a group thread that a second adult can read. [REVISE TO MATCH YOUR CHILD PROTECTION POLICY.] **A parent's no is final and needs no reason.** It is recorded on the No-Photo list within one business day and it applies until the parent changes it in writing. ## 7. THE NO-PHOTO LIST [ROLE] maintains a single written list of every person, adult or minor, whose image is not to be posted. It is stored [WHERE], it is available to every Authorized Poster before they post, and it names no reasons. A person is added on request, by any means, from the person or from a parent or guardian, and no justification is asked for. Anyone who cannot check the list before posting does not post. ## 8. TAKEDOWN ON REQUEST Any person may ask this church to remove any image of themselves or of their minor child, at any time, for any reason or none. - The request is honored. It is not negotiated, delayed pending a meeting, or answered with a copy of the release they signed. - The image is removed within [24] hours of the request reaching any staff member. - [ROLE] also removes it from any other place the church controls: the website, the printed newsletter's next run, the slide loop, the annual report, the app. - The person is told when it is done, in writing. - The removal is recorded in the incident log with the date and nothing else. A signed release is permission, not a transfer of ownership. It is revocable. ## 9. WHAT IS NEVER POSTED By any Authorized Poster, from any account, at any time: 1. Anything a person said in a pastoral conversation, a counseling session, a confession, a hospital visit, a prayer request, or a members' meeting. No paraphrase. No anonymized version. No sermon illustration with the details changed. The fact that a conversation happened is also not posted. 2. A screenshot of a private message, comment, email, or text from a member, including one sent to the church's own account. 3. A person's health, employment, finances, immigration status, criminal history, marital difficulty, or addiction, named or plainly implied. 4. Anything about a personnel matter, a disciplinary process, an allegation, or an investigation, including its existence, including a denial. 5. Any accusation against a named person or a named church. 6. Anything about a giving record, an amount, or an individual's giving. 7. A member's home address, phone number, or email address. 8. A minor's location at a stated future time. Announce that youth group meets; do not announce where a group of named children will be on Friday at 7. 9. Political endorsement of a candidate for public office, from a church account, at any time. [KEEP: this is also a condition of the church's tax exemption. VERIFY WITH YOUR OWN COUNSEL.] 10. Recorded audio or video of a conversation captured without the knowledge of everyone in it. ## 10. COMMENT AND MESSAGE MODERATION The comment section under a church post is the church's front step. It is moderated on purpose, by a named person, on a schedule. **Checked** at least once every [24] hours by [ROLE], and within [2] hours of publishing anything about a contested subject. **Left alone.** Disagreement. Criticism of the church, its leadership, a sermon, or this policy. Hard theological questions. A complaint about a real thing. Removing these teaches the congregation that the page is a stage, and it moves the conversation somewhere the church cannot see it. **Hidden** (visible to the author, not to others), with no announcement: promotion and spam, off-topic argument, a comment naming a private person's situation, a comment repeated more than [3] times. **Deleted**, immediately, and the author blocked: sexual content, sexual approach to any person, content involving a minor that would fail section 6, threats, slurs, doxxing, a named accusation against an individual, and anything a reasonable person would call harassment. [ROLE] screenshots the comment and the profile before deleting, stores it [WHERE], and logs it. This is the one time the church keeps a copy of something it removes. **Reported to law enforcement, before anything else, and preserved rather than deleted:** any credible threat of harm to a person or the building, and any content involving the sexual exploitation of a minor. Deleting it destroys evidence. [ROLE] contacts [LOCAL LAW ENFORCEMENT NUMBER] and does not investigate internally first. **Direct messages.** The church's inbox is not pastoral care and it does not pretend to be. Standing reply: an acknowledgment, one named person to contact, and a phone number. A message that describes a crisis, an abuse disclosure, or a threat of self-harm is escalated to [ROLE] by phone within [1] hour, at any hour, and is answered by a person rather than by a message. **Mandatory reporting is not suspended by a platform.** A disclosure of abuse received in a comment or a message is handled exactly as it would be if it had been said in a hallway, under this church's child protection policy and under [STATE] law. [CONFIRM YOUR STATE'S REPORTING RULES AND WHO IS A REPORTER.] ## 11. MUSIC, MOVIES, AND OTHER PEOPLE'S WORK Posting a recording of the worship service, in whole or in part, means publishing someone else's song. A congregational singing license that covers projecting lyrics in the room does not cover posting the recording. - Before any recording containing congregational or performed music goes online, [ROLE] confirms the church holds a current streaming license covering the platform in question, and that every song in the recording is inside that license's catalog. - A song that is not covered is cut from the recording, or the recording is not posted. - No commercial recording is used as background music on a church post. - No movie or television clip is posted without a license that covers it. - No stock photograph is used without a license naming this church. - Credit for a photograph taken by a member is given to that member unless they ask otherwise. ## 12. PERSONAL ACCOUNTS Staff and volunteers keep their own accounts and their own opinions. Four limits apply because of the office they hold, not because of the platform: 1. Sections 9 and 6 apply to a personal account exactly as they apply to a church account. A pastoral conversation is confidential wherever it is retold. 2. A person who is publicly identifiable as [CHURCH NAME] staff states, once, in their profile, that they speak for themselves. 3. No personal account is used to argue with a critic of the church on the church's behalf, and no anonymous account is created for that purpose. 4. No adult worker sends a private message to a minor from a personal account. See section 6. Nobody is disciplined here for a position, a vote, or a disagreement. People are answerable for breaking confidence, for content involving a minor, and for conduct toward a person. ## 13. WHEN SOMETHING GOES WRONG The rule is take it down first. Every Authorized Poster has standing authority to delete any church post, hide any comment, and take any church account offline without asking permission and without waiting for a decision. No one is ever disciplined here for taking something down too fast. 1. **Now.** Remove it. Delete, do not edit. 2. **Within 5 minutes.** Call [ROLE] by phone. Not a text, not an email, not a group chat. If unreachable, call [SECOND ROLE]. 3. **Within 15 minutes.** Write down what was posted, when, from which account, by whom, who it named, who saw it, and whether it was shared or screenshotted. Facts only, in the incident log. 4. **Within 30 minutes.** Decide whether a person has to be called tonight. If the post named or pictured someone, or if a minor is involved, the answer is yes, and [ROLE] makes that call rather than the person who posted it. 5. **Within 24 hours.** Decide whether a correction is published. A correction is published when the original made a factual claim other people repeated. It is not published to apologize in public to a person who would rather be called. 6. **Within 7 days.** [ROLE] brings the log entry to [BOARD], who decide what in this policy or in the access list changes. Every entry is either closed or assigned a change. **Suspected account compromise.** Rotate the password, end every active session, check the recovery email and phone, check for added access, and post nothing from the account until [ROLE] confirms it is clean. ## 14. ACKNOWLEDGMENT I have read the Social Media and Congregational Image Policy of [CHURCH NAME]. I understand what I may post, whose picture I may use, what is confidential, and that access to a church account is granted to me and is not mine. Name (printed): ____________________________ Role: ____________________ Signature: _________________________________ Date: ____________________ Accounts and access granted, listed by [ROLE]: ______________________________ Access removed on: __________________ Removed by: __________________________ --- ## 15. REVIEW This policy is reviewed once a year by [BOARD] and rewritten whenever a platform changes what it lets the church control, whenever the state law cited in it changes, and whenever an incident log entry says it should be. The review date prints at the top of this document. A policy with a review date more than two years old is treated as unadopted. --- Written by Church Posting and free to copy, adapt, and adopt. This is not legal advice and no lawyer wrote it. Sections 5, 6, and 9 turn on state law that differs by state. Before adoption, have counsel in your own state read sections 5 through 9 against your statutes on the use of a person's likeness, your recording consent rules, and your mandatory reporting rules.