A study from Proskauer, a business-focused law firm, revealed that companies routinely take action against employees for their behavior in social media channels, even when it’s their own account used on their own devices on their own time.

While the infractions that led to the disciplinary action may have been consistent with the companies’ social media policies, they could be illegal. It’s time for companies to revisit their social media policies.

According to the Proskauer report, more than 70% of companies reported taking disciplinary measures over misuse of confidential information (80%), misrepresentation of the company’s views (71%), inappropriate non-business use of social media (67%), and disparaging remarks about the business or fellow employees (64%).

Read through just about any company’s social media policy and you’ll find that they spell out employees’ obligations in these and other regards. But in a sweeping ruling last week, an administrative law judge with the National Labor Relations Board ruled these and other policy elements could violate workers’ protected speech.

To begin with, the judge found a provision in the Kroger’s policy barring employees from online behavior that would be inappropriate at work and that would reflect negatively on the company to be overly broad. It could, the judge said, bar protected speech such as criticism of the company’s treatment of employees or discussion of wages, hours, and terms of employment.

I always look to IBM’s Social Computing Guidelines for best-in-class policy language. The 8th plank of that policy cautions employees not to engage in any “conduct that would not be appropriate or acceptable in IBM’s workplace.”

Between companies that used IBM’s policy as a template and those with like-minded lawyers and HR staff, a lot of organizations will need to consider whether they can retain this clause. But we’re not done yet.

The third item on IBM’s list instructs employees to “make it clear that you are speaking for yourself and not on behalf of IBM.” Kroger’s—a U.S.-based grocery store chain—had a similar rule, also struck down by the judge. This, according to the ruling, “unduly burdens employees’ rights because it would be likely to chill employees’ willingness to engage in protected communications.” The judge didn’t argue that Kroger’s has a valid interest in not wanting it to appear that employees are speaking on its behalf, but argued that so few employees’ social interactions could be confused with official Kroger’s statements that the company’s interest cannot override employees’ rights.

IBM’s 12th and final policy forbids employees from “misus(ing) IBM logos or trademarks and only use them if you have the authority to do so.”

Not so fast. The judge found this provision overly broad, since it prohibits a lot of nonoffensive uses of the company’s intellectual property that employees may be inclined to use as part of their protected communications.

The final IBM plan you’ll find in almost every social media policy reads, in part, “Don’t provide IBM’s or a client’s, partner’s or supplier’s confidential or other proprietary information.” Again, the judge turned policies upside down by ruling that this restriction violates Section 8 of the national Labor Relations Act because it prohibits employees from having conversations about personnel matters and business plans, which are also protected by Section 7 of the Act.

Each of these four components often serve as the foundation for company social media policies. Each has been found illegal, at least as they apply to Kroger’s policy. If your U.S.-based company’s policy contains any of these elements, it’s time for a meeting to determine if a major rewrite is in the cards.