For social admins
Social media guidelines
Social media sites offer opportunities to engage individuals, institutions and organizations through an interactive process that has the potential to foster recognition, enhance creativity, build stronger relationships and contribute to the success of VCU by sharing information and dialogue. Content posted to social media sites is public and permanent and, therefore, has associated risks.
The purpose of the VCU Social Media Guidelines is to ensure proper portrayal, promotion and protection of the institution. These guidelines apply to all social media sites that are managed by VCU (“VCU Social Media Accounts”) (including accounts for individual VCU units or programs) and administrators of those accounts who engage in social media usage as part of their assigned VCU responsibilities. Administrators are responsible for ensuring that anyone who posts or otherwise uses a VCU Social Media Account, including guests and “takeovers,” follows these guidelines.
Policies governing university employee conduct apply in the social media context just as they do in person. Improper disclosures, use of information, or acts of unprofessional behavior are not tolerated and will be addressed by university disciplinary procedures. VCU will report suspected unlawful conduct to appropriate law enforcement authorities.
VCU employees and students using social media are subject to the VCU Code of Conduct and/or the VCU Student Code of Conduct. Employees are also subject to the following policies, standards, and state and federal laws, as applicable:
- Social Media Acceptable Use Policy
- VCU Web Standards and Guidelines
- VCU Brand Standards
- VCU Outgoing Sponsorships, Advertising and Endorsement Policy
- VCU Closed Captioning Guidelines
- University Trademarks and Licensing Policy
- Intellectual Property Policy
- Computer and Network Resources Use Policy
- Records Management Policy
- Preventing and Responding to Discrimination Policy
- Title IX Sexual Harassment Policy
- Sex-Based Misconduct Policy - Interim
- Violence Prevention and Threat Assessment and Management Policy
- Duty to Report and Protection from Retaliation
- Reservation and Use of Space Policy
- Commonwealth of Virginia state employee policy, 1.75 Use of Electronic Communications and Social Media
- Commonwealth of Virginia state employee policy, 1.6 Standards of Conduct
- VCU Health Systems Policy for Social Media Use (web link not publicly available; please use VCUHS Policies and Procedures Library on the intranet or contact Policy Coordinator at (804) 828-2571)
- First Amendment to the U. S. Constitution
- Copyright Law of the United States
- VCU FOIA Information and Requests, Virginia Freedom of Information Act
- Family Educational Rights and Privacy Act (FERPA)
- Health Insurance Portability and Accountability Act (HIPAA)
Guidelines for Creating and Managing an Account
If you manage a VCU Social Media Account for any program or unit of VCU or are thinking of starting one, review these social media guidelines and visit our Social Media Request Center to complete an account approval form, update account information, or for any other questions regarding VCU social media.
Once your accounts are approved and administrators are registered, they will be added to the VCU Social Media Administrators Group, a shared google drive of resources and will receive communications on events, best practices and key issues facing the use of social media channels for university business.
Expectations for VCU Social Media Accounts and VCU social media administrators include:
Your VCU Social Media Accounts are authorized through VCU Enterprise Marketing and Communications and included in the university’s social media directory. All VCU academic and administrative departments engaging in social media activity should have a social media strategy and plan approved by the unit’s communications leadership team member and academic/administrative department head for review and assessment prior to the debut of any social media program. VCU social media administrators are required to:
- Obtain authorization through VCU Enterprise Marketing and Communications by submitting a VCU Social Media Account Approval Form.
- Review and be familiar with all policies, procedures and best practices outlined in these guidelines. Employees engaging in social media activity as part of their official duties are governed by the same policies that govern all other electronic communications. Read the policies and be familiar with all applicable state and federal laws before engaging in any social media campaign as part of your official duties at VCU.
- Use an official VCU email when creating or logging into VCU social accounts. Register all official accounts that need an email login with a shared or generic VCU email account that is accessible by more than one person. To set up a university group or generic account, go to https://itsupport.vcu.edu and log in to Service Desk to fill out the request form.
- During the social media site registration process, indicate your specific department or unit is establishing and entering into the account agreement, not an individual. Create accounts through business page managers or multi-user logins when possible.
- Renew the Social Media Update Account Form whenever administrative or account changes occur. If an assigned social media administrator of a VCU account leaves the university or the administrator role, it is the responsibility of the academic or administrative department head to designate another VCU employee to be an administrator on the account and remove the former employee’s administrative permissions to the account.
- For your VCU Social Media Account, assign at least three designated social media administrators, at least one of whom should be a full-time faculty or staff member. We recommend that a minimum of three full-time faculty or staff members have administrator access or access to the login information and passwords to a Social Media Account, including each unit’s identified social media team leader.
- All assigned social media administrators should have defined social media duties in their official job descriptions.
- Student workers and interns may provide creative support. However, due to their short-term roles, they should not be considered as an administrator of the account. All content submitted by student workers must be reviewed, approved and posted by a VCU faculty or staff social media administrator.
- Obtain account verification. If verification is not possible, include a phrase in the descriptions or bios to indicate that the site is an official VCU site. Most government agency accounts can be verified through the links below.
- Complete all descriptions and bio information on social sites. Descriptions and bios should always provide a link to your VCU website and pertinent information about your VCU department. Always provide links to your VCU Social Media Accounts on your VCU website.
- Enterprise Marketing and Communications has the authority to control the use of VCU’s name and logo as per the University Trademarks and Licensing Policy. Any unauthorized or outdated sites or pages referencing VCU are subject to amendment or removal. You should update or remove/close any sites or pages that have been inactive for more than six months. Notify VCU’s Social Media Team prior to removing pages or closing sites.
All VCU Social Media Accounts must follow VCU identity and brand standards.
VCU’s social media branding requirements are:
- All policies, procedures and guidelines regarding university trademarks, names and symbols are followed for all VCU Social Media Accounts.
- VCU Enterprise Marketing and Communications must approve logo usage. Additional requirements for VCU’s identity standards are listed at https://brand.vcu.edu/.
- Review and follow the social media identity section in the VCU brand standards guidelines.
- Passwords must be strong and can be achieved by a combination of the following factors:
- At least 12 characters in length
- Contain at least one uppercase, one lowercase letter
- Contain at least one number
- Contain at least one special character
- Password best practices
- A password should not be related to any personal information or phone numbers.
- Do not use the same password for VCU social media sites as for other non-work-related or personal account access.
- Always store passwords in a secure fashion. Do not store passwords in electronic documents without encryption and physical storage should be avoided.
- A password should not be a recognizable word out of a dictionary.
- Avoid simple variants or permutations of words (e.g., replacing S’s with 5’s, your name or department name backwards or repeated)
- Passwords should be unique. Never reuse passwords across social media channels, third-party applications used to access social channels or email.
- Never share passwords for VCU accounts with anyone outside of the immediate social media team and never share passwords for personal accounts used to access VCU accounts.
- All passwords for VCU Social Media Accounts should be changed at least annually or upon any account administrator change.
- If supported, multi-factor authentication (MFA) must be implemented (e.g., reception of one-time token via text message or other MFA apps such as DUO).
Social media administrators must be aware of these guidelines and adhere to them. Administrative specifications are as follows:
- All usage of third-party social media platforms must comply with applicable terms and conditions of the platform.
- Administrators engage in communications that are acceptable in the VCU workplace and respect copyrights and disclosures. Proprietary financial, intellectual property, student information, patient care or similar sensitive or private content must not be posted.
- If it is not clearly obvious that the material was intended for public sharing on social media sites, it is the responsibility of the administrator to gain the express written consent of all involved parties, including students, for the right to distribute or publish recordings, photos, images, video, text slideshow presentations, artwork and advertisements whether those rights are purchased or obtained without compensation. VCU and VCU Health subjects photographed or videotaped for promotional purposes, including those in image background, must complete a model release or permission to record. Model releases and their terms of use are available on the shared google drive of resources for Social Media Administrators.
- Administrators are responsible for maintaining an accurate, active and up-to-date social media presence. If a site is inactive for six months, the administrator should consult with VCU’s Social Media Team regarding closure of the account.
- Administrators are responsible for regularly monitoring posts and comments to social media sites and required to report to university officials:
- Any requests for records to the VCU FOIA office at FOIAvcu@vcu.edu, and complying with the obligations of VCU’s Duty to Report policy.
- All allegations of prohibited conduct defined in the university’s Title IX Sexual Harassment Policy - Interim and Sex-Based Misconduct Policy - Interim to the Title IX Office at titleix@vcu.edu.
- All administrators on VCU Social Media Accounts must complete accessibility training. Accessibility Training is available:
- Within Talent@VCULearning section (Under VCU Social Media Accessibility)
- On our website for those not able to access through Talent@VCU (VCU Health employees and students)
- If you complete the training through our website, please submit a ticket so we can update our files (We are automatically sent notification of completion for those who complete training in Talent@VCU)
- If you complete the training through our website, please submit a ticket so we can update our files (We are automatically sent notification of completion for those who complete training in Talent@VCU)
- Administrators must understand the Virginia Public Records Act requirements of social media and when needed, retain proper records of communication to their social networking sites, including records of posts made by the general public. VCU’s social media team will need to be notified when a VCU site will be decommissioned in order to submit a deletion form to VCU Record Management. Please submit a ticket for decommissioning here.
- Administrators should contact their social media leadership team member if an active or potential communication crisis occurs on their accounts.
- Administrators should always use VCU accounts and not personal accounts when responding to inquiries and postings on behalf of VCU.
- Administrators should always place their VCU Social Media Account links on an official VCU website.
- All usage of third-party social media platforms must comply with applicable terms and conditions of the platform.
- Posts on social media are communications that should be consistent with other forms of communication in the workplace. At all times, posts, comments, and other usage of social media must comply with applicable VCU policies.
- Social Media Administrators may guide conversations on VCU social media pages but are not authorized to screen comments or posts made to those pages. Social Media Administrators are not authorized to hide or delete a post or block a user unless authorized in writing by the Chief of VCU Police, VCU legal counsel and/or the VCU Threat Assessment Team to mitigate an imminent threat.
- VCU is committed to fostering a safe and inclusive environment that ensures equal access to education and related services to everyone affiliated with the VCU community. The university is continually making efforts to reduce barriers to access for individuals with disabilities and this includes university information shared on VCU social media sites.
- Content posted to a VCU social media site by a VCU social media administrator must follow these accessibility guidelines:
- Anything spoken on videos shared to VCU accounts must be captioned.
- Useful information about VCU programs, activities and services on graphics or images shared to VCU accounts will need to be accessible to assistive technology (e.g., infographics, text on photos and flyers).
- VCU social media administrators are prohibited from posting content that:
- Violates local, state or federal laws and regulations,
- Violates the applicable terms and conditions of the third-party social media platforms,
- Denotes personal opinions as if such opinions were endorsed by VCU,
- Is confidential university information,
- Harasses, threatens, or otherwise causes harm to individuals in violation of university policy or state or federal law,
- Contains “sexually explicit content” except to the extent required for bona fide, agency-approved research, innovation, creativity and scholarship, or other agency-approved undertaking, approved in writing by the university president or the president’s delegate, as set forth in VA Code § 2.2-2827.
- Is related to pending VCU or VCU Health System legal matters
- Endorses companies, goods or services as outlined in the VCU Endorsement Policy
- As a public university, VCU embraces and encourages freedom of speech, upholding the First Amendment and its related laws. Posts/comments on a typical VCU social media site cannot be limited based on the content or viewpoint of the speech/expressions, with the exception of posts that violate applicable laws or do not contain speech protected by the First Amendment (i.e., speech inciting imminent violence). No VCU employee or agent may remove a user comment other than as required to mitigate an imminent threat upon the written advice of the Chief of VCU Police and/or legal counsel.
VCU Social Media Accounts may contain a disclaimer statement conspicuously placed in the “About” section as follows:
“We welcome your opinions and encourage civil discussion about the topics we post. Messages, comments or posts containing the following are prohibited on VCU social media, and we reserve the right to remove them:
- Advertising not authorized by the University
- Unauthorized commercial solicitations including those selling products or services and/or providing links that may contain malicious software and/or phishing tactics to obtain personal identifiable, financial account information and/or other means of defrauding University employees, students and/or others,
- Violation of applicable law or University policy, including but not limited to the policies on Preventing and Responding to Discrimination, Title IX Sexual Harassment, Sex-Based Misconduct, Reservation and Use of Space, Student Code of Conduct, Computer and Network Resources Use.”
Notes:
While such a disclaimer allows the University to define a specific topic or subject matter to be discussed on an issue-specific social media page, it does not allow the University to delete, edit or censor posts based on the post’s viewpoint regarding that topic.
Unprotected Expression: VCU prohibits expression that is not protected by law. The U.S. Constitution, its First Amendment, and the Code of Virginia do not protect certain expression, such as that expression described by the following legal terms: defamation, incitement to unlawful conduct, imminent threats of actual violence or harm, obscenity, fighting words, copyright or trademark violation, criminal or civil harassment, sexual harassment, trespass, and false advertising. Determining whether VCU can regulate any specific expression based on one of these categories requires careful analysis of applicable legal precedent as interpreted by relevant Virginia and federal courts.
- Where appropriate, if the site allows comments or posts by others, community guidelines for the social media page may encourage productive dialogue. These guidelines and statements encourage speech, and should not be used to restrict speech unless the administrator will consistently enforce a clearly defined purpose of the site. For example, only on a particular academic topic, such as African film or organic chemistry. In a forum limited to a particular topic, however, VCU must permit all comments on that topic regardless of their viewpoint, for example, including vulgar, profane or offensive comments on the particular topic.
- All advertising by university entities must be expressed in writing to Enterprise Marketing and Communication in order to ensure that it is consistent with the VCU brand identity standards and image.
- VCU units must review VCU’s Outgoing Sponsorships, Advertising and Endorsement Policyand submit a Request to Advertise form for review and approval by the Associate Vice President for Public Relations. Advertising materials must meet VCU brand identity standards before they can be placed. Enterprise Marketing will confirm that advertising materials meet VCU brand identity standards. All media purchases must be made in compliance with applicable procurement policies and procedures.
- Emergency communications, including inclement weather closings or delays, should always originate through VCU Police, VCU News, VCU’s Alert page or VCU’s central Social Media Accounts. Never share information that has not been issued by central university administration on any VCU social media.
- In the event of a major announcement, information should not be mentioned on social media until it has been made official and posted on vcu.edu. Once official, information may be shared through other university social media channels.
- If you suspect a security breach on a VCU account or personal account used to access a VCU account, contact your unit’s social media leadership team representative and also the VCU social media central administration immediately at socialmedia@vcu.edu.
- Best practices for avoiding security breaches
- Secure your passwords. Do not share passwords with anyone for VCU-owned accounts or personal passwords for accounts that are linked to VCU-owned accounts.
- Consider setting personal profiles linked to VCU accounts as private. Be cautious about accepting friend requests from strangers. Avoid connecting to online applications through personal social media channels linked to VCU accounts.
- Do Not Be A Phishing Victim. Exercise caution when opening links on social media sites. Hover your mouse over links to see the actual destination, and never submit your user name and password over email.
- Do not leave a computer, tablet or mobile device unattended if VCU accounts are accessible.
- Regularly change passwords on personal accounts that are linked to VCU accounts.
- Be wary of “official” communication from social channels sent through unusual channels. For example, Facebook will never send official communication via Messenger.
- Always check that you are logging into official social channel URLs. Scammers often set up fake pages that look like login pages.
- Turn on login approvals or two-factor authentication for an additional layer of security if someone attempts to log in from an unrecognized device. Consider using a social media manager system like Facebook Business Manager or password management system.
- If password management is needed, VCU’s Information Security Office recommends using KeePassXC.
- For more details visit http://phishing.vcu.edu, and go to VCU IT Support Centeror call (804) 828-2227 to report a phishing scam
- If a threat is known or suspected to be an emergency situation, call VCU Police immediately at (804) 828-1234 to report the situation.
- Threats, harassment or personal information trolling, must be report to socialmedia@vcu.edu. If a threat appears to be urgent, you are encouraged to report this to VCU Police. All emergencies are to be reported to VCU Police immediately at (804) 828-1234. If a threat appears to involve only VCU employees or students, then consult the VCU Threat Assessment Team information available at tat@vcu.edu as described in VCU’s policy on Violence Prevention and Threat Assessment and Management.
- If the situation does not seem to be a threat, then consult with the site administrator and supervisor in your area to determine whether to reply with an invitation to discuss the matter with the posting individual through official VCU communication methods, such as VCU email or phone. Reference the Social Media Response Tree for further guidance.
Effective July 1, 2023, the use of TikTok, WeChat, and other products from ByteDance, Ltd. or Tencent Holdings, Ltd. will not be permitted on networks used by VCU employees and contractors or on university-issued devices.
The university is taking this measure to comply with a new Virginia Law that prohibits access to and use of apps or websites from the above entities on state-issued devices or on state-maintained networks. The Virginia General Assembly passed this law earlier in 2023, and the bill was signed by the governor in April. The restriction takes effect on July 1, 2023.
Restrictions set forth in the new law will impact the university community the following ways:
- Beginning July 1, access to these apps and websites will be restricted on all VCU and state-managed networks used by employees and contractors.
- TikTok, WeChat, etc. may not be used on any university-issued device, regardless of what network is being used at the time. Apps should be deleted from university-issued devices.
- VCU managed TikTok accounts, including any paid/sponsored content, such as those administered by colleges and departments, may not be used in any manner after July 1, 2023. Social media managers are advised not to delete accounts, but simply to stop using them - this will protect the accounts from being spoofed in the future.
Please reference:
Code of Virginia amendment to restrict ByteDance, Ltd. or Tencent Holdings, Ltd. products | Technology Services | VCU for full details.
SB 1459 App Restrictions | Technology Services | VCU for additional information and FAQs
Social Media App Privacy Advisory | Technology Services | VCU for Mobil App Personal Privacy Risks Awareness
The Division of Enterprise Marketing and Communications will provide input and assist in outreach on these guidelines and best practices for social media. Please direct policy questions to Public Relations within the Division of Enterprise Marketing and Communications.
Questions regarding implementation of these guidelines or reports of unacceptable behavior on VCU social media, may be sent to the VCU Social Media team at socialmedia@vcu.edu.