Social Media Compliance: A Guide to the Comments, DMs and Replies Your Brand Receives

Social media compliance from the inbound perspective

Most social media compliance programs center around a brand's published content, a focus reflected in the abundance of guides dedicated to pre-publication reviews, disclosure practices, and archiving efforts. Yet, a brand's social channels foster a two-way exchange, and the inbound flow of customer communications (comments, direct messages, and reviews) introduces unique compliance challenges. Somebody on the brand’s team reads these interactions and makes quick decisions about what to keep, what to remove, and whether to respond, often without immediate compliance oversight.

Over the past two decades, I’ve seen even well-managed companies stumble on this inbound side. The relevant regulations don’t always make themselves clear. A seemingly innocuous comment can trigger compliance obligations and deleting a message might create a record-keeping issue. A helpful response can inadvertently disclose something that shouldn't be shared.

This guide focuses on navigating that inbound space, covering the comments, direct messages, reviews, and replies your brand receives and how to handle them. It's aimed at brands managing their own social channels (banks, insurers, healthcare providers, and consumer brands) rather than the social platforms themselves, whose responsibilities constitute a separate, far larger matter.

The short answer: Remove, Retain, Respond

Compliance risks related to inbound social media messaging (comments, DMs, reviews, and replies) ultimately hinge on a few key questions regulators, plaintiff’s attorneys, or journalists might pose about what unfolded in your channels.

Answering all three of these confidently, and being able to demonstrate the reasoning behind those answers, suggests your inbound social media compliance is sound. The rest of this guide will address each question individually, then explore what matters within your specific industry and what a solid, effective program looks like.

Social media moderators should address daily spam, scams, slurs, and harassment, because most of that kind of content can be removed without any issues. The crucial compliance question is how to determine whether or not to remove content that doesn’t cross into those obvious abuse areas.

The FTC's sentiment-neutral standard

The Federal Trade Commission's guidelines, called the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, which went into effect in October of 2024, offer a straightforward explanation of the rules. Specifically, the review-suppression section prohibits businesses from misleading customers by suggesting that the reviews displayed reflect the majority or all of the submissions, when they’ve actually suppressed some reviews based on ratings or negative feedback.

The rule also says what is okay to delete. Reviews containing trade secrets, personal information, or defamatory material, along with those considered harassing, obscene, vulgar, or sexually explicit, or which are demonstrably false or misleading can be removed. It also allows removal of reviews reasonably believed to be fake or wholly unrelated to the products a business offers.

The core standard is that any criteria used for removal "applied equally to all reviews submitted without regard to sentiment.” So, it’s okay to moderate content, you just can’t let “negative” be the reason. (To be clear, we’re equating the word “review” with “content” for anything consumers post on your social channels or direct messages. More on that below.)

Fashion Nova: the precedent that predates the rule

The FTC didn’t wait for the new rule to take action, issuing a settlement with Fashion Nova of $4.2 million against a practice that appears almost routine: reviews scoring below four out of five stars vanished, presenting a curated, and misleading, picture to consumers. The agency brought this under the FTC Act's general prohibition against deception, marking it as their first case specifically addressing the suppression of negative reviews.

Does this reach your social media comments?

Here's the honest qualification most guides skip. The rule defines a consumer review as one posted on a website or platform dedicated in whole or in part to receiving and displaying such evaluations. A review page on your site plainly qualifies. The FTC's guidance specifically addresses reviews on websites and platforms.

So the rule may or may not directly affect ordinary social comments. Our recommendation is to run your comment moderation as though it did anyway, for three reasons.

1. The FTC acts against deceptive suppression under its general authority, as Fashion Nova shows.
2. Comment sections under product posts function as reviews whether or not anyone designed them to, and
3. A customer who notices their complaint has disappeared may report it. Other consumers pile on to these kinds of posts, and comments like "this brand deletes criticism” take off faster than the original complaint ever would.

Filter drift

Sentiment filtering may be inadvertent, just the result of an employee thinking they are doing the right thing. Platforms allow automatic hiding of comments with specific words, and these lists initially contain sensible entries (slurs, spam phrases, scam links) but over time, other words accumulate: "scam,", "refund,", "lawsuit,", "fraud,", "cancel." Each addition seemed reasonable at the time, but together they construct a filter that unintentionally suppresses genuine complaints.

The straightforward solution is to regularly review these hidden-word and keyword-filter lists, examining each entry to determine if it truly captures abuse or merely hides expressions of unhappiness.

The second way content removal can come back to haunt you is when the comment or DM is considered a notice or the start of a dispute. You must retain these.

Banking: your obligation is based on the content of the message, social media included

Federal banking regulations now directly address this issue. The FFIEC’s Social Media: Consumer Compliance Risk Management Guidance, released on behalf of the OCC, the Federal Reserve, the FDIC, the NCUA, and the CFPB, acknowledges that customers are increasingly using social media to raise concerns directly with financial institutions, and cites an error dispute under Regulation E and a billing error under Regulation Z as examples.

For example, a customer makes the following complaint on one of your social channels: "You charged me twice and nobody will fix it.” You can’t blow this off as a simple complaint. Depending on its content and timing, this message might be a notice requiring an investigation and a resolution. Deleting it is akin to discarding something regulators expect you to have acted upon.

The guidance also clarifies the boundaries of responsibility. Institutions aren't required to monitor every online communication or respond to it, but they are obligated to handle messages sent through their official channels. A message sent to an official account is clearly the institution’s responsibility to retain and handle.

Also, the same guidance makes a clear point about retention, that is, institutions should retain comments posted on sites run by or on behalf of the institution that specifically relate to its performance in helping meet community credit needs under the Community Reinvestment Act.

Broker-dealers: if it's business, it's a record

FINRA's stance on record retention for broker-dealers has been clear for quite some time. Regulatory Notice 17-18 states that retention requirements do not depend on the technology used. A direct message related to business, and its replies, constitute business records that must be retained.

That same principle extends to automated systems. According to FINRA’s guidance, 2026 oversight report firms using generative AI to create or help with chatbot conversations with investors must make sure those communications are properly supervised and retained, specifically the retention of those chat sessions themselves. If a chatbot answers customers through direct messages, those conversations become records, too.

What this means operationally

Retention failures on social usually come from a gap between the people moderating and the systems archiving. Three questions that help close the gap:

• Does your moderation tooling write to your archive before taking action? The system must capture/archive the message before a moderator can remove it.
• Do you hide or delete? On most platforms one is reversible and the other isn't. Default to the one you can walk back.
• Is there a defined route for anything that looks like a dispute, acknowledge, move it to a private channel, capture it, hand it to the team that resolves it?

A reply on social media is a public communication, in writing, which may take on specific meaning for regulated industries.

Healthcare: be careful if you can't confirm someone is already a patient

HIPAA regulations generally prohibit covered healthcare providers from disclosing patient information in responses to comments or reviews. Even a seemingly innocuous reply that references a visit, treatment, or the simple fact of having "looked into their case" can inadvertently violate those rules. The instinct to offer a natural, empathetic response to an unhappy patient often presents a significant challenge.

The Office for Civil Rights within the Department of Health and Human Services has taken action against providers who disclosed protected health information while addressing negative reviews. In one such case, the OCR's director stated plainly that "Simply put, this is not allowed." The agency also reports that it continues to receive complaints about providers sharing patient details on social media when replying to negative feedback.

A practical strategy involves limiting responses to statements about general processes (something like, “we take every concern seriously. Please reach out to our patient relations team at…”) with carefully vetted language and staff trained to avoid explaining specifics.

Financial services: a reply is a public communication

Broker-dealers must recognize that replies on social media are communications directed to the public, falling under FINRA's content standards and requiring supervision. As Regulatory Notice 17-18 clarifies, a firm can essentially claim another’s post as its own through adoption, either explicitly or implicitly endorsing it. For example, a representative liking or sharing favorable comments subjects those posts to the communication rules.

This rule represents a crucial operating rule for a social media team. Liking a customer’s enthusiastic comment about a successful investment is an active action.

AI-generated replies: you own what the bot says

Brands are increasingly relying on software to draft and send replies, yet the responsibility for those communications ultimately rests with the brand itself, as the EU has ruled on. Article 50 of the EU AI Act, effective since August 2, 2026, mandates that customers be informed when they’re interacting with an AI system unless the nature of the interaction makes that clear, while US regulations regarding bot disclosure vary considerably, often hinging on issues of deception or the nature of the interaction.

The disclosure requirement understandably grabs headlines, but a more pressing concern is accountability. Claiming a machine made an error isn't a viable excuse when an automated reply contains inaccuracies. Someone within the company must be able to explain the content and the reasoning behind it, addressing any potential issues that arise.

Social media compliance by industry

Here is a brief breakdown of compliance matters by industry.

Regarding insurance, unlike banking and broker-dealers, there isn't a commonly referenced federal framework specifically addressing social media comments and direct messages. Instead, expectations stem from state insurance departments' advertising and unfair-practices rules, alongside their market-conduct reviews of complaint handling, these vary considerably by state. It's generally safest to assume that any statement about a policy or claim should adhere to the same standards as other communications, and a complaint received on social media should be processed similarly to one arriving through conventional mail.

For public institutions, managing accounts belonging to government entities (including public universities, hospitals, and utilities) demands careful consideration of First Amendment implications when moderating comments. In Lindke v. Freed (2024), the Supreme Court unanimously determined that an official’s social media activity constitutes state action only when the official possesses the authority to speak on behalf of the government and actively presents themselves as doing so. The Court also differentiated between deleting a particular comment and blocking a user entirely, which restricts access to the whole page. Should your organization be public, a legal professional's review of your moderation policy becomes especially important.

Beyond the US: the DSA, the UK Online Safety Act and the EU AI Act

For a US brand with audiences in Europe, you have to pay attention to three rules.

The EU Digital Services Act. The DSA's content moderation requirements fall on intermediary services and online platforms, the companies operating the services, not on businesses that run pages on them. A US brand's Facebook page designates the brand as a DSA platform. The impact on you is indirect, because how platforms handle notices, appeals and ad transparency could change what happens to content on your pages.

The UK Online Safety Act. The Act applies to user-to-user services with links to the UK, including non-UK companies. But it exempts "limited functionality services" where users can only communicate by posting comments or reviews on the provider's own content, sharing them, or reacting with likes, ratings or emojis. That likely covers the comments under your blog posts and the reviews on your product pages. A standalone community where users post and talk to each other is a different question, and worth checking with counsel.

The EU AI Act. If you use an AI system to talk to people in the EU, Article 50 requires that they be told, unless it's obvious, from the start of the interaction.

Where automation can help

Tools and automation is valuable for practical compliance. You can leverage automation for archiving and capture, routing, keyword flags for obvious abuse, queues ensuring nothing sits unread. Many regulated brands we work with run their own tools and we work within their systems.

However, automation can’t always provide the necessary judgment or accountability. A filter can’t distinguish a Regulation E dispute from someone simply venting, nor can a drafting tool know that a sympathetic response to a patient confirms they are indeed a patient. Keyword lists fail to differentiate between abuse and unhappiness, and often drift over time. And, none of these tools can explain a decision to an examiner.

The real strength lies in a clear division of labor: software manages volume, capture, and routing, while accountable people address the risk-laden interactions. We wrote about the risks of relying purely on automated accuracy scores, because they tell you less than you'd think about the safety of leaving a tool unsupervised.

What a compliance-ready moderation program looks like

If you're building or auditing a compliance program for social media, these are the elements that hold up under scrutiny:

1. A written moderation policy with sentiment-neutral removal criteria. Built on categories like the FTC's (harassment, abuse, spam, fraud, personal information, clearly false content) and applied the same way to positive and negative comments. Publish a version as community guidelines.
2. A reason code for every removal. When someone asks why a comment disappeared, "abusive, logged at 2:14 a.m." is an appropriate answer. "Someone hid it” isn't going to fly.
3. A defined route for disputes, complaints and service issues. Acknowledge publicly without specifics, move to a private channel, capture, hand off to the team that resolves it.
4. Capture before removal. Moderation tools and your archive should be connected so you record items before/if they are deleted.
5. Pre-approved response language for regulated topics, cleared by compliance, so the safest reply is also the easiest one.
6. Trained people on the queue who know what a dispute, a disclosure risk and an adoption risk look like, with clear escalation paths and the authority to use them.
7. Scheduled audits of hidden-words lists, automated filters and a sample of what they removed.

How we help regulated brands with social media compliance

Online Moderation has moderated brand communities for more than twenty years, and the regulated work has always been part of it. Over the years our financial-services clients have included MassMutual, Fiserv and SunTrust Bank, alongside brands like ESPN, ABC News and American University. Our clients trust our work and our relationships average seven years.

The model is simple. Human moderators work from written, client-specific guidelines; log what they remove and why; route anything that looks like a dispute rather than deleting it; and use pre-approved language where the topic calls for it. Our moderators average more than eight years with us and tend to stay on the same accounts for years, which is how they come to know your compliance boundaries as well as your brand voice. We cover accounts 24 hours a day, every day of the year, in English, German, French, Spanish and Japanese, because the message that turns out to matter tends to arrive at the least convenient time.

Frequently asked questions