1 of 29

SOCIAL MEDIA COMPLIANCE IN WISCONSIN’S PUBLIC SECTOR��2025 WISCONSIN TECHNICAL COLLEGE COMPLIANCE COLLABORATIVE

ATTORNEY GEOFFREY LACY�GLACY@LAW-RLL.COM

2 of 29

Social Media – The Good, The Bad, and the Ugly

The use of social media has become omnipresent in all aspects of life, it is not surprising that this proliferation has not only brought opportunities but also presents challenges relative to the legal status of content, and for public sector entities an added challenge of free speech implications as well as public records and open meetings compliance.

What is “social media” – web content that is principally driven by user created content (used to be called Web 2.0).

Value of social media:

Reach a wide audience to disseminate information
Reaches a target audience that is not reachable effectively through other means
Ready made platforms for distributing information
Allows for ease of spreading message across platforms with different target audience

3 of 29

Compliance Best Practices

Clear, written policies (comments, content, account use)
Regular training for staff managing accounts
Consistent enforcement of rules
Coordination with legal counsel, IT, and records managers
Prohibit disclosure of confidential information (FERPA, etc.)
Adhere to copyright laws
Provide for retention of public record content
Specify that unauthorized use may lead to possible discipline or termination (students and employees).

4 of 29

Public Records Considerations

5 of 29

Wisconsin Public Records & Retention

Wis. Stat. 19.31-19.39 (Public Records law): social media content may be a “record” – defined as any documentation created or maintained by a public entity.
According to the State Public Records Board, social media content is a public record in the following contexts:

Posted externally (for public access)
Communicated internally via the use of online collaborative tools
Posted to a government site by the public

Meets the definition of record in retention statutes (i.e. Wis. Stat. Chapter 16)
Retention obligations apply to posts, comments, even deletions

Wisconsin Public Records Law Compliance Guide: “Electronic records include content posted by or on behalf of authorities to social medial sites, such as Facebook and Twitter (now commonly known as “X”), to the extent that the content relates to government business. If an authority uses social media, the content must be produced if it is responsive to a public records request. This includes not only currently “live” content, but also past content . . . If an authority makes use of social media, or if employees use mobile devices to conduct government business (whether the device is personal or provided by the authority), the authority should adopt procedures to retain and preserve all such records consistent with Wis. Stat. 16.61 (state authorities), Wis. Stat. 19.21 (local authorities), and applicable records disposition authorizations.”

“Wisconsin Statute 16.61, which governs retention, preservation, and disposition of state public records, includes ‘electronically formatted documents’ in its definition of public records.”

Record is defined broadly under Wis. Stat. 19.32(2) and includes “any material on which written, drawn, printed, spoken, visual, or electromagnetic information or electronically generated or stored data is recorded or preserved, regardless of physical form or characteristics, that has been created or is being kept by an authority.” Under Wis. Stat. 19.35(5), “no authority may destroy any record at any time after the receipt of a request for inspection or copying of the record under sub. (1) until after the request is granted…” If a record was once in existence and is deleted without proper retention, the agency may be found to have illegally destroyed a public record. Agencies are expected to document or archive content before removal. The general statutory requirements for records retention by state agencies, Wis. Stat. 16.61, and local units of government, Wis. Stat. 19.21, apply equally to electronic records. Although the public records law addresses the duty to disclose records, it is not a means of enforcing the duty to retain records, except for the period after a request for particular records is made. Gehl, 2007 Wi App 238, paragraph 15 n. 4 (citing Wis. Stat. 19.35(5)). The fact that an authority has violated its own retention policy is irrelevant to whether the record must be disclosed under public records law.

Issues related to records retention that are exclusive to electronic records often derive from their relative fragility, susceptibility to damage or loss, and difficulties in insuring their authenticity and accessibility.

Wisconsin Department of Administration (DOA) has promulgated Wis. Admin. Code ch. Adm 12 which governs the management of records stored exclusively in electronic format by state and local agencies, but does not require an agency to maintain records in electronic format. Wisconsin Amin. Code ch. Adm 12 defines terms of art relating to electronic records, establishes requirements for accessibility of electronic records from creation through use, management, preservation, and disposition, and requires that state and local agencies must also comply with the statutes and rules relating to retention of non-electronic records.
State agencies are required by law, Wis. Stat. 35.81, et seq., to provide copies of agency publications to the Wisconsin Reference and Loan Library for distribution to public libraries through the Wisconsin Document Depository Program. The Wisconsin Digital Archives has been established to preserve state agency web content for access and use in the future, and to provide a way for state agencies to fulfill their statutory obligations to participate in the Document Depository Program with materials in electronic formats.

Other examples include:

Information regarding government business kept or received by an elected official on their personal website, more likely than not constitutes a record. OAG I-06-09, at 2-3.
Email sent or received on an authority’s computer system is a record. This includes personal email sent or received on an authority’s computer system by officers or employees of the authority. Schill, 2010 WI 86, paragraph 152.
Email conducting government business sent or received on the personal email accounts of officers or employees of an authority.
IN CONTRAST, purely personal emails (e.g., emails unrelated to government business) found on the personal email accounts of officers or employees of an authority are not “records” subject to disclosure. Wis. DOJ Public Records Compliance Guide.

6 of 29

Public Records – Retention Requirements

Conveys official government unit information.
Contains evidence of the government unit’s policies, procedures, or mission.
Has been authorized by the government unit or contains information for which there is a business need.
Contains feedback, such as public comments or posts, received via social media.
Contains intra-office communication needed to document decisions made or actions taken. Information and posts typically NOT considered a public record are those that are access/reference copies, or duplicates of official records already being retained elsewhere.
Period of retention – based on content (i.e. personnel records, etc.) otherwise, General Administrative table of the public records board is generally a 3 year retention

7 of 29

Policy Development

Incorporate recordkeeping practices and requirements into terms of service with third-parties when possible.
Be aware of and keep track of third-party terms of service on social media platforms that may affect the ability to effectively management.
Train internal users on practices and record management expectations for users
Establish clarity on who is responsible for managing social media account records.

8 of 29

Open Meetings Considerations

9 of 29

Open Meetings Law – Inadvertent Quorum

Wisconsin Statutes, 19.81 – 19.89 – a quorum of a government body gathered for the discussion of business pertaining to the body, is a meeting subject to public notice and access.
Social media activity can:

Create a meeting – active post/comment discussions pertaining to government business

Create a walking quorum – different individual engagements on issues among smaller groups of board members that are in the aggregate sufficient to create a majority.

10 of 29

Data Privacy Considerations

11 of 29

Data Privacy Considerations - Generally

Avoid disclosure of Certain Information both in official content and employee-driven content:

Personally Identifiable Information (PII) – any combination of data that uniquely defines someone (name, date of birth, social security number, driver’s license number, email address, home phone, student ID)
FERPA – protects student data, including health data

Opt-out – assure mechanism to check opt-outs of directory data

Sensitivity to Hacking

Who manages accounts
Limited access – few passwords, multi-factor authentication
Phishing scams using social media

PII is defined as “information that can be associated with a particular individual through one or more identifiers or other information or circumstances.” Wis. Stat. 19.32(1r), 19.65(5). Note: there is generally a greater right to obtain records containing personally identifiable information about the requester himself or herself, subject to exceptions specified in Wis. Stat. 19.35(1)(am). The “record subject” is “an individual about whom personally identifiable information is contained in a record.” Wis. Stat. 19.32(2g). Typically an entity is not a “record subject” because the statute references “an individual.” (J. Sentinel, Inc. v. Milwaukee Cnty. Sheriff’s Off., 2022 WI App 44, paragraph 16, 404 Wis. 2d 328, 979 N.W.2d 609.

Personally identifiable information contained in student records (applicable to school districts receiving federal funds, with certain exceptions) are exempt from disclosure by federal statutes (unless authorized by an exception or other provision in the statutes themselves). FERPA, 20 U.S.C. 1232g. Note: students and parents (unless parental rights have been legally revoked) are allowed access to the student’s own records and may allow access to third parties by written consent. Wis. Stat. 19.35(1)(am).

Many patient health care records, pursuant to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) are exempt from disclosure by federal statutes. 42 U.S.C. 1320d-2, 45 C.F.R. pts. 160 and 164.

Violations of HIPAA and FERPA can trigger federal penalties.

Personnel matters are generally confidential and shouldn’t be disclosed online. Wis. Stat. 19.36(10). Citizens have no expectation of privacy regarding the emails they send to elected officials in an attempt to influence public policy. MacIver Inst., 2014 WI App 49, paragraph 29. However, public entities should consider the repercussions of posting any of these complaints on social media and the impact it might have on their community appearance.

12 of 29

Wisconsin Internet Privacy Law (Wis. Stat. 995.55) - Employment

“Employer” includes state, local government, agencies, courts, etc.
Employers cannot:

Request or require personal login information
Demand access to private accounts
Discriminate against employees/applicants for their refusal

Exceptions:

Employer-provided devices (laptop/tablet/phone)
Access if company information/financial data was shared via a personal account
Restrict sites on work networks
View public accounts
Request personal email address

13 of 29

Wisconsin Internet Privacy Law (Wis. Stat. 995.55) - Students

Prohibits educational institutions from the following conduct relative to student personal social media accounts:

Request or require a student or prospective student, as a condition of admission or enrollment, to disclose access information for the personal Internet account of the student or prospective student or to otherwise grant access to or allow observation of that account.
Expel, suspend, discipline, or otherwise penalize any student for refusing to disclose access information for, grant access to, or allow observation of the student’s personal Internet account, or for filing a complaint or attempting to enforce any right of the law or testifying or assisting in any action or proceeding to enforce any right under the law
Refuse to admit a prospective student because the prospective student refused to disclose access information for, grant access to, or allow observation of the prospective student’s personal Internet account.

Does not prohibit an educational institution from doing any of the following:

Requesting or requiring a student to disclose access information to the educational institution in order for the institution to gain access to or operate an electronic communications device supplied or paid for in whole or in part by the institution or in order for the educational institution to gain access to an account or service provided by the institution, obtained by virtue of the student’s admission to the educational institution, or used for educational purposes.
Viewing, accessing, or using information about a student or prospective student that can be obtained without access information or that is available in the public domain

14 of 29

Speech /Content Moderation

15 of 29

Speech – Entity Managed Accounts

The First Amendment of the U.S. Constitution limits government action: “Congress shall make no law respecting an establishment of religion or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances.“
Government speech vs. public forums on agency pages.

Use of social media often includes opportunity for public input, comment, content sharing
At best a limited public forum, but often an open forum – least ability to regulate

Risk of viewpoint discrimination:

Deleting undesirable or critical content that is on topic
Deleting tagged or re-posted content
Creating privacy settings that require approval to join

Public entities are state actors – restrictions on speech must meet constitutional standards. This is applicable to all levels of government, including public colleges and universities. Furthermore, government entities have greater authority to regulate school-sanctioned social media.

Government Speech example: official posts by the agency – entity retains full control.

Public Forum example: Comment sections may be treated as “limited public forums.”

Certain speech is always unprotected:

True threats
Defamation/libel

Employees may have free speech rights on matters of public concern. The Pickering Balancing Test must be considered if:

(1) The employee spoke as a Private Citizen AND did so on a Matter of Public Concern; OR

(a) Private Citizen –

Speaking pursuant to OFFICIAL DUTIES, speech IS NOT insulated from discipline

(b) Public Concern –

If Employee was speaking as a private citizen, consider public concern

personal grievances ARE NOT matters of public concern and ARE NOT insulated from discipline

typically involves political, social, or other matters of concern to the community

(2) the employee’s speech was neither at work nor about work AND the employee took no deliberate steps to link their speech to the employer

The Pickering Balancing Test Factors:

Would the speech create problems in maintaining discipline or harmony among co-workers?
Was the employment relationship one in which personal loyalty and confidence are necessary?
Did the speech impede the employee’s ability to perform the employee’s responsibilities?
What were the time, place, and manner of the speech?
What was the context of the underlying dispute?
Was the matter one on which debate was vital to informed decision making?
Should the speaker be regarded as a member of the general public?

ER’s interest in maintaining an efficient and disruption free workplace outweighs EE’s interest in engaging in said speech

16 of 29

Content Moderation Policies

Importance of viewpoint-neutral moderation

Murthy v. Missouri, 603 U.S. 43 (2024) – allegations that the CDC worked with social media platforms to suppress “false or misleading” statements regarding COVID-19 and vaccines.
Suit failed due to the inability to connect suppression to actions of the CDC or other government agency
Illustrates the risk of content moderation based on “fact-checking”

Moody v. NetChoice, LLC., 603 U.S. 707 (2024)

State law restricting social media algorithms – remanded for further analysis
Interesting to follow in that it relates to government efforts to curtail social media platform censorship through algorithms.

Public entities may ban threats, obscenity, spam, irrelevant commercial content, but they must allow criticism if they have opened up a public forum through their social media accounts.

The public entity’s written policies regarding content moderation should be applied consistently across all users.

If the public entity decides to remove a post on the entity’s social media, they should document said reasons for removal. They should archive deleted or hidden comments for legal compliance with the public records law discussed previously.

A nonpublic forum is a setting in which public speech is not traditionally invited, nor did the government express any intention of inviting speech. Generally, courts uphold government regulation of speech in a nonpublic forum if the regulation is “reasonable.” However, even in a nonpublic forum, government regulation of speech must be applied neutrally as to viewpoint.

17 of 29

Content Moderation Policies

Krasno v. Mnookin, Fourth Circuit Court of Appeals (August 1, 2025)

UW-Madison Social Media Statement:

While UW–Madison does not regularly review content posted to social media sites, it shall have the right to remove any content for any reason, including but not limited to, content that it deems threatening, profane, obscene, a violation of intellectual property rights or privacy laws, off-topic, commercial or promotion of organizations or programs not related to or affiliated with the university, or otherwise injurious or illegal. Users are fully responsible for the content they load on any of UW–Madison's social media sites.

comment threads were limited public forums
Case involved animal rights advocate posting comments about use of animals in laboratories at the university
university's off-topic rule for social media comments was not viewpoint neutral as applied to advocate
university's failure to provide objective, workable standards for off-topic rule rendered rule unreasonable
university's use of inflexible and context-blind keyword filters to implement off-topic rule rendered rule unreasonable

18 of 29

Lindke v. Freed (2024) – U.S. Supreme Court Test

Lindke v. Freed, 601 U.S. 187 (2024)

Determination of whether government official’s deletion of comments is state action
City Manager’s private Facebook account
Posted about City issues and comments were related
Deleted comments he did not like

Two-part test:
Did the official have authority to speak on behalf of the government?
Did they exercise that authority in the post/thread?
Example: Mayor posting city updates = state action.
Example: Employee posting personal opinion = private speech.
Implications: Blocking/deleting comments may be a violation of Constitutionally protected rights and create exposure to §1983 claims.

“Under the new test, actions relating to a post that falls within the test's bounds may be subject to challenge, even if the post appears on an account or page that purports to be private. Lower courts have generally applied "Public Forum Analysis" to evaluate those cases. Under public forum analysis, the level of government regulation allowed under the First Amendment depends, in part, on the context in which constitutionally protected speech occurs. Courts have identified three types of "forums" in which speech might occur: (1) a "traditional" public forum; (2) a "designated" public forum; and (3) a nonpublic forum.” “For example, in a 2022 decision, Krasno v. Mnookin, 638 F. Supp. 3d 954, the U.S. District Court for the Western District of Wisconsin concluded that comment threads on the University of Wisconsin Madison’s Facebook and Instagram pages are nonpublic fora. The court concluded that the university’s policy of removing certain “off-topic” comments was reasonable and viewpoint neutral.” “In practice, one approach to minimize legal risk may be to establish clear, viewpoint neutral policies regarding the scope of comments that will be allowed in comment threads, and to then ensure that such policies are implemented in a viewpoint neutral manner.”ib_social_media_ah_2025_02_25.pdf

Best Practices for WI Public Officials (Post-Lindke)

Keep personal, campaign, and official accounts separate.
Disclaimers must align with actual conduct.
Adopt clear, viewpoint-neutral policies for moderation.
Ensure ordinances define who can speak for the municipality.
Blocking/deleting = high legal risk → use with caution.

19 of 29

�Policy Considerations Controlling Business Usage�

20 of 29

Professional Use of Social Media

The State of Wisconsin Human Resources Handbook provides an excellent resource of template employee policies, including regarding use of social media.

Chapter 480.040

Agencies must establish procedures for review and approval of requests from an employee to use social media, social networking, or services or tools to support or enhance activities being undertaken by the agency in its official capacity.
When an employee is representing an agency in an official capacity, the agency is responsible for the content published on any forms of social media.
Employees are expected to communicate professionally and comply with all applicable workplace conduct policies and rules.
Not all social media platforms conform to government accessibility standards for persons with disabilities. Therefore, social media should not be the only means of providing critical information.

21 of 29

Personal Use of Social Media

Handbook Section 480.50:

Personal use outside work, for strictly personal use, does not require agency approval.
Employees are personally responsible for any information they communicate online.
BUT:

Gov’t-related content may still be subject to public records law.
Confidential/private info (PII, PHI, FERPA, etc.) must not be shared.
State equipment use governed by workplace internet policy.

22 of 29

Wisconsin’s Internet Protection Act (Wis. Stat. 995.55)

Review of social medica in hiring decisions is common – many people’s personal accounts are not private.

Sometimes, social medica activity may come to employer’s attention from others who are inside the privacy settings (i.e. “friends”)

– Internet Privacy Protection Act

Employers may NOT demand:

Login credentials.
Social media “friends/follow” access.
Private DMs, emails, or personal content.

Employers MAY:

Investigate for workplace violations/illegal activity (with cause).
Enforce confidentiality protections.
Restrict internet on company devices.

23 of 29

�Intellectual Property�

24 of 29

Intellectual Property Rights

Copyright risks: reposting photos, videos, articles

Third party content creators – be sure to identify ownership (i.e. work for hire, creator owned)
Clarify ownership of employee-created media
Law firms troll online content for use of copyrighted images (often pulled off the internet) and demand daily licensing fees. Employees create content to promote programs or the institution in general, but use images pulled of the internet without thinking about the potential for copyright issues. Culpability goes to the institution.

Licensing and Creative Commons (site that provides assistance to non-profits and public entities in securing licensure)
Trademarks & avoiding endorsement implications

Control of marks is critical – permitting usage of logos, mascots, etc. that represent the institution must be consistently applied and deliberate.

25 of 29

�Other Things to Consider�

26 of 29

Accessibility & Non-Discrimination

ADA & Rehabilitation Act requirements: captions, alt-text, plain language
Language access for LEP populations
Inclusive communications as a compliance requirement (inclusive – content can be consumed by persons with disabilities, including hearing impaired, visually impaired, etc.
DOJ Final Rule: Website Accessibility

State & Local Governments must make their websites and mobile applications accessible for people with disabilities.
The DOJ adopted WCAG 2.1 Level AA – which includes 50 accessibility criteria requirements.
Examples include alt-text and screen-reader compatibility for images and documents, along with captions for live and prerecorded video.

27 of 29

Ethics & Political Restrictions

Wisconsin Ethics Code: Wis. Stat. chp. 19
No use of government accounts/resources for campaigning.
Avoiding partisan posts or endorsements
Separation of personal vs. official accounts

28 of 29

Emerging Risks

AI-generated content & deepfakes: verification challenges
Cybersecurity: hacked accounts & liability exposure

Extensive training in cybersecurity recommended – social media usage, use of AI, email/app/IM security

Defamation/harassment concerns in interactive spaces

High standard if claim by a “public official” – actual malice

29 of 29

�QUESTIONS?�