Social media recruitment: three different activities, and the two legal risks nobody covers

"We should do more on social" gets said about recruitment constantly without anyone saying which thing they mean. Three different activities hide inside the phrase, they cost different amounts, and two of them carry legal duties that most writing on the subject skips.

This article separates the three, says what each is good for, shows how to write a vacancy post that survives a feed, handles the employee advocacy question, and then spends real time on the two parts that matter legally: looking at candidates' profiles, which is processing personal data, and targeting a job advert, which can be unlawful discrimination.

Hiring is a process with stages, criteria and approvals wherever the candidate first saw the vacancy. See how New Dynamics workflows let you define that process yourself rather than keep it in a mailbox and a spreadsheet.

We name no platforms, rank none and compare none: this site does not publish rankings of recruitment platforms or tools. Where the channel question is really about budget, our post on free job posting sites covers the places a vacancy can go for nothing.

Social recruiting is three activities, not one

Separate them before planning anything. They consume different resources and answer to different rules.

1. Broadcasting a vacancy. You publish the advert to people who already follow you, or to a group that allows vacancies. One post, and the reach is whatever your audience happens to be.
2. Building an employer presence. You publish ordinary material about the work over months, so that when a vacancy appears there is something to look at. The work is continuous and the payoff is slow.
3. Sourcing individuals. You identify specific people who are not looking, and contact them one at a time. The work is per person and does not scale.

The ICO's draft guidance on recruitment and selection draws the same line in data protection terms. Broadcasting is the cheap case: posting the vacancy so "everyone who goes there can see it", or broadcasting "details of your vacancy to everyone who follows your account", is "not direct marketing as you are not targeting particular candidates on the basis of their personal information". Contacting named individuals is the expensive case.

Most disappointment comes from doing the first activity and expecting the results of the third.

What each one costs, and what it is for

Broadcasting costs twenty minutes, and works only where your audience overlaps the labour market: local roles where people know you, roles your staff's networks reach, repeat hiring in one job family. It fails invisibly, because a post with eleven likes looks like activity.

Presence costs somebody a recurring slot in their week, indefinitely. It helps where candidates are cautious about moving and where a small employer needs to look real. It fails when run as a campaign with no month four, and when it oversells, which our post on employer branding covers.

Sourcing costs fifteen to thirty minutes per credible candidate: finding them, reading their background, writing something that is not a template. For a specialist role with forty qualified people in the country it is the only one that works, and it is a week of somebody's time.

Screening, the fourth thing people mean, is not marketing at all. It has its own two sections below.

Writing a vacancy post that works in a feed

A feed is not a job board. The reader is not looking for work, the post has one line to earn a second line, and nobody reads a pasted job description.

• First line, the job title people would type. Not the internal grade, not a slogan.
• Second line, location and working pattern, then the pay or a range. Withholding either wastes their time and yours, and in an unpaid post a stated salary is one of the few things that makes somebody stop.
• Two or three lines on what the person does. Specific work, not adjectives about the team.
• One link, to the full advert on your own site. Write it once and point every channel at it. Our post on how to write a job ad has the structure, and recruitment SEO covers making that page findable.
• A named person for questions about adjustments.
• No applications in the comments. A public thread puts candidates' personal information in front of every visitor.

Two things that feel like formalities and are not. You owe the reader privacy information from the moment you invite an application. The ICO is explicit: "If you invite people to apply for a vacancy, you must provide them with privacy information, including when you are advertising vacancies on behalf of another organisation", and notes you can advertise "using any method", social media included. Acas, in its guidance on advertising a job, says it in a line: "You must tell applicants how you'll use their personal information." A link to your privacy notice in the post, or on the advert page it points at, does the job.

A social post is also one channel, not the advert. Acas advises advertising "in at least 2 different ways or places" and names the online problem directly: "an online job advert might only be seen by specific groups of people".

One published figure makes the point, and it is older than we would like. In Internet users, UK: 2020, released on 6 April 2021, the Office for National Statistics reported that "Almost all adults aged 16 to 44 years in the UK were recent internet users (99%), compared with 54% of adults aged 75 years and over". The ONS discontinued that series on 3 May 2023, so 2020 is its last reference period: treat it as the shape of the problem, not today's number. See our HR statistics hub for other published figures. As for what share of UK employers recruit through social media, we could not find an official UK source that publishes it, and we will not borrow a vendor survey instead.

Social media recruitment tools, and why there is no ranking here

Searches for social media recruitment tools and social recruiting tools usually want a league table. This site does not publish rankings of platforms or tools: coverage, pricing and terms change constantly and vary by employer size and sector, so a ranked list is wrong within months, and a table from a performance management vendor would be opinion dressed as research.

The categories are worth knowing, because the category decides which legal duty comes with the tool.

• Publishing and scheduling tools queue posts and report engagement. Lowest risk: you are broadcasting, not processing candidates' information.
• Advertising and targeting tools from the platforms carry the discrimination risk covered below. The ICO warns that "the activities in social media targeting are complex".
• Sourcing and contact tools find individuals and message them, which puts you into direct marketing rules. Employee advocacy tools raise consent and pressure instead. Screening and monitoring tools search or score a candidate's online presence, and the ICO's position on those, quoted below, is blunt.
• Applicant tracking systems are where the application should land. Our post on what a job board is separates the advertising layer from the system that runs the process.

Three questions beat a ranking: which of the three activities does it serve, whose personal data does it touch, and can you turn its targeting off and delete what it keeps. The second matters most. If you use publicly available information for your own purposes, the ICO says "you are a controller and are fully responsible for how you use it", so a tool that tells candidates nothing has handed you a transparency failure.

Asking your own staff to share a vacancy

A share from a real employee reaches people a company page never will, which is why every social recruiting plan ends up here. How you ask decides whether it helps.

You can tell people a vacancy is open and why it matters, make the link easy to share, give credit, and build an opt-in group of people who want to post. What you cannot do is require it. Posting must not be a condition of anything, nobody should be required to use a personal account, posts should not be counted, and refusal has to be visibly costless. Twenty near-identical posts in one morning read as a campaign anyway.

The reason is not only tone. In the United Kingdom, if you use an employee's name, image or words, that is their personal data, and agreement obtained by a manager from their own team is weak agreement. The ICO makes the general point in a recruitment context: "as there is likely to be an imbalance of power between the candidate and the employer or recruiter, consent is unlikely to be an appropriate lawful basis to use at most stages of the recruitment process". The same logic reads across to your own staff, and our post on employer branding sets out the employment-records side of it.

So: ask in writing, record who agreed to what, allow withdrawal with the content taken down, and keep a policy on what must not be shared. Fewer people will post, and the posts will be worth more.

Sourcing individuals: a direct message is direct marketing

This is the part people do without realising a rule exists. The ICO separates broadcasting from messaging in one sentence: "Direct messaging on social media constitutes direct marketing and electronic mail under the Privacy and Electronic Communications Regulations (PECR)." It follows that "you must comply with the rules around direct marketing and PECR". Sending a vacancy to one named person is not the same activity as posting it to your followers, however similar it feels.

On finding those people, the guidance is permissive about the professional case. It says "Yes, you can search for candidates manually online using appropriate public social media platforms", and that "It may be reasonable to manually search for information using recruitment-based social media platforms, as candidates are reasonably likely to expect their information to be used in this way".

Then the limit, which applies to sourcing and screening alike. The ICO says you "should not search for candidates on their personal social media profiles, even when these are public-facing", because "People are unlikely to expect employers to obtain information about them in this way." It gives three reasons: "You risk obtaining information about them which is detrimental or reveals special category information. You should avoid this as it is intrusive, high risk, and not likely to reveal relevant information."

There is also a timing duty. Where you obtain someone's information from a source other than the person, you must give them your privacy information, in the guidance's words, "as soon as possible, and by no later than one month of obtaining it". So the first message says who you are and where their details came from, links the privacy notice, and makes it easy to be left alone. Delete the list when the vacancy closes.

Looking at a candidate's profiles is processing personal data

Now the activity most employers do casually and nobody documents: somebody in the team looks the candidate up.

In the United Kingdom, under the UK GDPR and the Data Protection Act 2018, reading a candidate's profile and using what you see to make a selection decision is processing their personal data. It needs a lawful basis, and it has to be fair and transparent. None of that changes because the information was public, or because it took ninety seconds. This is general information, not legal advice.

The ICO's framing of fairness sets the standard: "It's important that you collect and use information about candidates in ways that are fair and proportionate", and you must "only collect information that is relevant and necessary for recruitment". The guidance names three things you should not do with candidates' information: use it "in ways the candidate would not reasonably expect", use information "which you have not told them about", or use information "which may have adverse effects for them". A casual profile check usually fails all three at once. The candidate did not expect it, nobody told them, and it affected whether they got an interview.

Where a check can be justified, and what it then requires

The ICO's guidance on pre-employment vetting of candidates holds the practical test. It says vetting "is particularly intrusive and goes beyond verification or simply checking the accuracy of the information candidates have provided about themselves", and sets the default: "You should not routinely vet all candidates, unless you are legally required to do so."

On social media specifically: "If you want to check the candidate's public social media profiles as part of your pre-employment vetting, you must be able to justify why this is necessary. This means you should identify and document a specific risk." Then the sentence that should end most casual checks: "However, in doing these checks, you are also likely to find information that is not relevant to the role. It's important that you carry out these checks fairly."

Transparency is not optional either. The ICO requires employers to tell candidates if they intend to use social media in vetting, so it belongs in your privacy information and in the advert. Our post on background checks covers the wider screening picture.

The decision cannot rest on what you found, either. The ICO says it "is unlikely to be fair and lawful to make a decision about the candidate based on this information alone", and that you "should give the candidate an opportunity to provide further information or comment on the accuracy of the information you have obtained".

Acas arrives in the same place. Its guidance on choosing who to interview, last updated on 30 June 2026, says "You should only use online information if you've already checked that it's appropriate", and warns you might be breaking the law if "you looked at some applicants' social media profiles, but not others". That is the most common version of this mistake: one candidate gets searched because something felt off.

Retention is the forgotten step. The ICO says you "must securely and permanently destroy" vetting information "as soon as it is reasonably practicable to do so". Screenshots in a shared drive are what an access request finds.

What you cannot unsee, and what the ICO says to do about it

This is the hard part, and it is why we would advise most employers not to screen social media at all.

The Equality Act 2010 lists nine protected characteristics: "age; disability; gender reassignment; marriage and civil partnership; pregnancy and maternity; race; religion or belief; sex; sexual orientation." A personal profile displays several of them within the first screen: a pregnancy announcement, a place of worship, a wedding photograph, a march, a hospital appointment, a date of birth.

Several are also special category data. The ICO lists special category information as personal information revealing or concerning, among other things, "racial or ethnic origin", "religious or philosophical beliefs", "trade union membership", "health or disability" and "sexual orientation". If you process it, "you must have a special category condition as well as a lawful basis". Nobody acquires a special category condition by scrolling.

The practical problem is that you cannot put it back. Once a hiring manager knows a candidate is pregnant, or disabled, or observant, every later decision is open to the argument that the knowledge played a part, and the employer has to explain the decision. Under section 39 of the Equality Act 2010, an employer must not discriminate against a person "in the arrangements A makes for deciding to whom to offer employment" or "by not offering B employment". Section 13(1) defines direct discrimination: "A person (A) discriminates against another (B) if, because of a protected characteristic, A treats B less favourably than A treats or would treat others." Intention is not required, and "I saw it but ignored it" is a difficult thing to prove.

So if you do have a documented reason to check, the ICO's own worked example shows the shape of a defensible process. In its care home example the employer tells candidates it will check the successful candidate's public profiles against a specific identified risk, and then "asks one member of staff to do the social media checks, and screen the information for relevancy against the specified interview criteria. This member of staff passes only the relevant information to the recruitment panel." The general rule behind that appears elsewhere in the same guidance: "You should ensure that decision-makers are not presented with irrelevant information about the candidate before they make their decision."

Automated searching is out either way: "It's unlikely to be lawful, appropriate or necessary to conduct intrusive or targeted checks of candidates on social media or online", including with specialist software. Acas adds that "Ideally 2 or more people should be involved in choosing who to interview."

If you cannot write down the risk, the criteria, the separation of duties and what candidates were told, you are not running a check. You are browsing, and then deciding.

Targeted job adverts and discrimination risk

The other underwritten risk is the mirror image of screening. Instead of seeing too much about one candidate, you decide in advance which kinds of people will ever see the vacancy.

Platform advertising tools exist to narrow an audience, which is what makes them dangerous in recruitment. The ICO says you "must make sure that your use of these tools complies with data protection law as the activities in social media targeting are complex", and must ensure "that what you want to do is fair, lawful and transparent". The discrimination question sits alongside that, and it produces the claims.

In Great Britain the Equality Act 2010 governs this. Northern Ireland has separate equality legislation. This is general information, not legal advice.

The two ways targeting goes wrong

Targeting a protected characteristic directly. Setting an advert to be shown to one age band, or to one sex, is the clearest case. GOV.UK's guidance on discrimination in recruitment states that "You must not state or imply in a job advert that you'll discriminate against anyone", then adds the channel point most employers miss: "Where you advertise might cause indirect discrimination". The example GOV.UK gives is advertising only in men's magazines. An audience setting that excludes women is that decision with a dashboard in front of it.

Targeting a proxy. This is the version that catches careful people. An audience built from graduation years, from interests that correlate with age, from a list of universities, from one neighbourhood, or from job titles that exist in one demographic, narrows the pool by a protected characteristic without naming one. Section 19 of the Equality Act 2010 covers it: a person discriminates if they apply "a provision, criterion or practice which is discriminatory in relation to a relevant protected characteristic", which includes where it "puts, or would put, persons with whom B shares the characteristic at a particular disadvantage", and the employer "cannot show it to be a proportionate means of achieving a legitimate aim".

The wording rules apply to the audience too. GOV.UK says to "Only use phrases like 'recent graduate' or 'highly experienced' when these are actual requirements of the job". An employer who deletes "recent graduate" from the text and then sets the audience to 21 to 27 year olds has made the discrimination harder to see, not lawful.

Outsourcing does not help. GOV.UK warns that "You might be breaking the law if any discrimination happens during their recruitment process, even if you use a recruitment agency". That covers an agency's advert, an in-platform optimisation you did not configure, and a tool that picks an audience for you. Under section 39 the duty attaches to "the arrangements A makes for deciding to whom to offer employment", and a targeting setting is an arrangement.

Widening reach without narrowing it

There is a lawful version of deliberate reach, and it is the opposite shape. Section 158 of the Equality Act 2010 permits positive action where a person reasonably thinks that "participation in an activity by persons who share a protected characteristic is disproportionately low", among other triggers. It allows action that is "a proportionate means of achieving the aim of" (among other things) "enabling or encouraging persons who share the protected characteristic to participate in that activity".

Acas's guidance on using protected characteristics makes it usable. It says "When recruiting, in some circumstances you can use protected characteristics to help a disadvantaged or an underrepresented group", with one condition stated immediately: "Your action must not cause 'detriment' to another protected group." Its own example is an employer placing the advert in a national newspaper, on social media, and in a magazine with a largely LGBT+ readership. The reasoning is the whole point: "It does not cause detriment to any group of people who are less likely to read that magazine. This is because you're also advertising in other places."

The test is addition, not subtraction. Adding a channel that reaches an under-represented group, while the vacancy stays openly advertised elsewhere, is the lawful pattern. Restricting the audience so that only certain people can see the vacancy at all is the unlawful one.

So: advertise to the broadest sensible audience; never set age, sex, relationship status, parental status or any proxy as an audience condition; screenshot the settings; and keep the vacancy openly advertised in at least one channel with no audience restriction. GOV.UK adds a duty worth building in: "You must provide information about the vacancy in alternative formats (for example, large print) on request if this is reasonable."

A social media recruitment strategy on one page

A social media recruitment strategy does not need a deck. It needs five decisions written down, which is also what makes it auditable.

1. Which of the three activities you are doing, and who owns each. If nobody owns presence, you are not doing presence.
2. Where the advert lives. One page on your own site, with every channel pointing at it, so you write once and take it down once.
3. Your targeting rule: broad audience, location and role only, no characteristic and no proxy, settings screenshotted.
4. Your screening rule. For most employers it is that the hiring team does not search candidates' personal profiles. If you do, name the role, the risk, who searches, the criteria, and what candidates are told.
5. Your advocacy rule. Voluntary, opt-in, no counting, no personal accounts required, withdrawable.

Keep the social channel as one of at least two, and choose the second for the people who do this job.

Then measure four things: applications by source recorded rather than guessed, shortlist rate by source, reply and complaint rates on direct messages, and who applied in aggregate. The last comes from diversity monitoring collected separately from selection. Acas's list of what to give applicants includes "an equality and diversity monitoring form".

Jurisdiction and limits

The discrimination rules here come from the Equality Act 2010, which extends to England, Wales and Scotland; Northern Ireland has separate equality legislation. The data protection rules come from the UK GDPR and the Data Protection Act 2018, across the United Kingdom. The ICO's recruitment and selection guidance is still draft: the consultation has closed, the ICO says the final version "will be published in due course", and a notice says it "is under review and may be subject to change".

This article is general information, not legal advice. New Dynamics sells performance management software, not recruitment advertising, and this article names, ranks and compares no platforms or tools.

Frequently asked questions

What is social media recruitment?

It is three activities under one phrase: broadcasting a vacancy to an audience you already have, building an employer presence over months, and sourcing individuals one at a time. They carry different duties. Posting to your followers is not direct marketing under ICO guidance, but messaging a named person is.

Can an employer look at a candidate's social media profiles?

Only with care, and for most roles the better answer is no. The ICO says employers should not search candidates on their personal profiles even when public, because people do not expect it and you risk seeing special category information. Where a documented risk justifies a check, tell candidates in advance, keep the person who searches out of the decision, and pass on only relevant information. This covers the United Kingdom and is general information, not legal advice.

Is it unlawful to target a job advert by age on social media?

In Great Britain, targeting a vacancy advert at an age band, or at a proxy for a protected characteristic, risks unlawful discrimination under the Equality Act 2010. Section 39 covers the arrangements an employer makes for deciding to whom to offer employment, and GOV.UK warns that where you advertise might cause indirect discrimination. Using an agency or a platform tool does not transfer the responsibility.

Can you require employees to share vacancies on their own accounts?

No, and it is unwise to try. Sharing must be voluntary, nobody should be required to use a personal account, posts should not be counted, and refusal must carry no consequence. The ICO notes the imbalance of power between an employer and the people it recruits, which is why agreement obtained under a manager's eye is weak. Ask in writing, allow withdrawal, and take content down on request.

What are the best social media recruitment tools?

We do not publish rankings of platforms or tools, because coverage, pricing and terms change constantly and we sell performance management software rather than recruitment advertising. Judge any tool on which of the three activities it serves, whose personal data it touches, what candidates are told, and whether you can turn its targeting off. The category decides the legal duty you inherit, so it matters more than the brand.

Your next step: write down the three rules

1. Decide which of the three activities you are doing for your next vacancy, and who owns each.
2. Write the targeting rule in one sentence, broad audience with location and role only, and screenshot the settings.
3. Write the screening rule in one sentence. For most employers it should say the hiring team does not look at candidates' personal profiles.
4. Record the source of every application, and compare shortlist rates rather than reach.

For the process after the advert, including criteria, shortlisting, scoring and a decision you could defend, read and download our recruitment and selection guide. The guide is free to read, and the PDF uses our short download form.

Once someone accepts, the question is whether their first ninety days and first review actually happen. Book a New Dynamics demo and bring the hiring process you run today. You can also email contact@new-dynamics.com.