Safety Norms: Advertising Strategy and Media Planning

1Purpose, Scope, and Safety Principles

These norms set minimum expectations for people who develop advertising strategy, select media channels, negotiate placements, brief creators, and report results. They apply to agency staff, in-house marketers, freelancers, media buyers, analysts, and creators working on paid, owned, and earned campaigns across broadcast, out-of-home, print, search, social platforms, programmatic display, connected television, audio, and influencer partnerships. In this context, safety means preventing harm to audiences, creators, and the public; protecting personal data; avoiding deceptive or unlawful claims; and protecting the organization from financial and reputational loss.

Three principles apply to every task. Protect people before reach. Substantiate claims before publishing. Escalate uncertainty instead of guessing. Mandatory rules are written with must or must not. Recommendations are written with should and are expected unless a documented reason approves a different approach.

2Roles, Competence, and Accountability

Every campaign needs named accountability. The campaign lead owns objectives, audience definitions, budget, and final risk sign-off. The media planner owns placement decisions, frequency settings, brand safety configuration, and vendor selection. The compliance or legal reviewer owns claim review, disclosure requirements, and rights clearance. The data protection lead approves any audience data source, tracking pixel, or data matching process. The creative lead owns originality, licensing evidence, and talent consent.

Competence is a condition of access. Before running live campaigns, staff must complete training on applicable advertising codes, platform policies, privacy requirements, and copyright basics. Access to sensitive audience categories, minor-related targeting, and paid influencer programs requires written authorization from the accountable owner. Staff without authorization must hand the task to a qualified colleague or escalate it. Verify current rules with competent authorities, legal counsel, or qualified compliance professionals, because requirements vary by jurisdiction.

• Mandatory: no campaign launches without a named accountable owner and a documented approval.
• Mandatory: no one enables sensitive or minor-related targeting without written authorization.
• Recommended: maintain a responsibility matrix for each campaign showing owner, reviewer, and approver.

3Course-Specific Hazards and Risk Assessment

Advertising work creates hazards that often remain hidden until a complaint, regulator inquiry, or platform takedown occurs. Common hazards include misleading claims about health, finance, environmental benefit, price, or performance; targeting that exploits vulnerable people or infers sensitive characteristics; collection or misuse of personal data through tracking tools, customer lists, or data partners; unlicensed use of music, images, footage, or a person's likeness; undisclosed paid partnerships; creator harassment or unsafe filming; ads placed beside harmful content; invalid traffic and made-for-advertising sites that waste budget; and creative that imitates emergency alerts, government notices, or official symbols.

Rate each hazard before launch. High risk includes potential for serious harm, unlawful data processing, health or financial claims, use of minors or vulnerable groups, and cross-border data transfers. High-risk items require compliance sign-off and may require external professional advice. Medium risk includes likely complaints, platform rejection, moderate brand damage, or contract disputes, and requires documented peer review. Low risk covers routine creative with cleared assets, established channels, and no sensitive audience, and requires standard checks. Score likelihood and severity in writing.

The assessment must describe the activity, identify each hazard, state who could be affected, rate likelihood and severity, list controls, name the control owner, and set a review point. Repeat it whenever the audience, channel, creator, data source, or claim changes.

• Example: a weight-loss claim in a social video is high risk because it makes a health claim and may reach young adults. It cannot launch until substantiation and compliance sign-off are on file.
• Example: a music track taken from a personal playlist is high risk for copyright and must be removed or licensed before use.

4Preventive Controls and Safe Work Practices

Controls must be in place before media is booked. Every factual or comparative claim needs a substantiation file linking to source evidence, study scope, and sample description. Creative must be checked against that file, and any claim that cannot be substantiated must be removed. Paid partnerships require clear disclosures that appear before audiences engage, using platform tools and the rules that apply in each market.

Audience targeting needs the strongest controls. Do not target or exclude people using sensitive categories such as health conditions, religion, or sexual orientation unless platform policy and local law permit it and the data protection lead approves it. Do not target children or teenagers through tactics not designed and approved for that audience. Recommended practice is to use aggregated audiences, contextual targeting, and minimum audience sizes, and to document why each segment is necessary. Dark patterns are prohibited, including fake countdown timers, hidden fees, confusing opt-outs, and consent prompts disguised as content.

Creator and talent safety requires written agreements. Contracts must define deliverables, usage rights and duration, approval steps, disclosure obligations, and the right to withdraw content that becomes unsafe or misleading. Creators must not be asked to make unsafe claims, perform stunts without a site risk assessment, or post from hazardous locations. For on-location shoots, the producer must confirm permits, insurance, emergency contacts, first aid, and supervision, and must stop filming when conditions become unsafe. Testimonials and likeness require signed consent covering the specific use, channel, and term. Reviews must be genuine.

Brand safety settings should exclude unsuitable content categories, apply inventory quality filters, set frequency caps, and define stop-loss rules. Recommended practice is to review placement reports weekly during active flights and investigate anomalies such as sudden click spikes from unknown sources. Music, images, fonts, footage, and stock assets must be licensed for the intended media, territory, and duration, with license records kept alongside each asset. Public-facing video should include captions, and designs should meet accessible color contrast standards.

• Mandatory: no claim goes live without a substantiation file approved by compliance.
• Mandatory: no sensitive-category targeting without written data protection approval.
• Mandatory: no fake reviews, purchased engagement, or bot-generated traffic.
• Recommended: run a pre-flight checklist covering claims, disclosures, targeting, licensing, links, and accessibility.

5Tools, Workspace, Information, and Protective Safeguards

Advertising platforms, demand-side platforms, customer data platforms, analytics dashboards, and clean rooms hold sensitive information and can cause harm when misconfigured. Access follows least privilege: staff receive only the permissions their role requires, multi-factor authentication is enabled on every account, shared logins are prohibited, and access is removed promptly when roles change or people leave. Store credentials in an approved password manager. Personal devices used for campaign work must meet the organization's security standard.

Personal data must be minimized, used only for stated purposes, and deleted or anonymized according to the retention schedule. Unreleased creative, media rates, and client budgets must be shared only through approved access-controlled systems, never through personal messaging or public links. Reports should use aggregated results and suppress small audience groups where the tool allows.

Workspace safety also matters. In open offices, use screen privacy filters, lock screens when away, and avoid discussing unreleased campaigns in public areas. On location, the production lead must control trip, electrical, heat, and crowd hazards and must not allow crews to exceed limits set by a qualified safety professional or local rules.

• Mandatory: no shared logins for advertising accounts or data tools.
• Recommended: restrict printing of audience lists and label confidential documents.

6Incident Reporting, Escalation, and Response

Incidents include a live ad making a false claim, a data exposure, an unlicensed asset takedown, a creator being harassed or endangered, ads appearing beside harmful content, suspected click fraud, and public backlash over creative. Anyone who notices an incident must report it to the campaign lead and compliance within the same working day. Suspected personal data breaches must be escalated immediately to the data protection lead, who determines notification duties under applicable law. Near misses, such as a claim caught in review, must also be logged because they reveal control weaknesses.

The first response is containment. The responsible owner should pause the affected ad set, asset, or campaign; preserve evidence including screenshots with URLs, platform IDs, audience settings, and correspondence; and avoid deleting content until legal or compliance confirms preservation requirements. Regulator inquiries, rights holder notices, and legal claims must be routed to the named reviewer, and no employee may respond without approval. Public statements must come from an approved spokesperson.

If a creator or any person faces immediate danger, contact local emergency services first. This guidance does not replace emergency services. Document harassment, report it to the platform, and involve the creator's designated safety contact. After containment, complete a short review that identifies root cause, corrective actions, owners, and deadlines.

• Mandatory: pause any live asset making an unsubstantiated claim until compliance clears it.
• Mandatory: report suspected personal data incidents immediately to the data protection lead.
• Recommended: record response times and outcomes in the incident log for trend review.

7Records, Training, Review, and Improvement

Records prove that norms were followed. Keep approved briefs, audience definitions, launch-time targeting settings, claim substantiation files, consent forms, license certificates, creator disclosure evidence, approval emails, incident logs, and post-campaign reports. Retention periods must follow the organization's records policy and applicable law, which varies by jurisdiction. Store records in controlled repositories with access logs.

Training must be role specific and refreshed when advertising codes, privacy rules, platform policies, or copyright practices change. Use worked examples, such as an influencer post lacking a clear disclosure, a lookalike audience built from sensitive data, or a music track licensed only for organic posts but used in paid media. Record completion and link it to access for high-risk tools.

Monitoring is continuous. Sample live ads on a scheduled basis, confirm that disclosures and claims still match approved versions, review brand safety and invalid traffic reports, and track complaints. Complete a post-campaign review comparing results with objectives and recording control failures. Feed lessons into updated norms, checklists, and training.

• Recommended: audit a sample of live creative and targeting settings on a scheduled basis.
• Mandatory: retain consent and licensing evidence for the full period of use.

Implementation checklist

• Confirm a named accountable owner and written approval exist before launch.
• Check every claim against a substantiation file approved by compliance.
• Verify paid partnership disclosures are visible on each post and placement.
• Confirm sensitive-category and minor-related targeting has written authorization.
• Verify music, images, footage, and likeness are licensed for the exact use and term.
• Review brand safety exclusions, frequency caps, and stop-loss limits before going live.
• Confirm advertising accounts use named users, multi-factor authentication, and least privilege.
• Log incidents and near misses, preserve evidence, and escalate suspected data breaches immediately.
• Schedule a post-campaign review and update these norms with lessons learned.