Safety Norms: Marketing, Advertising and Public Relations

1Purpose, Scope and Safety Principles

This document sets out safety norms for teams that plan, create, approve and publish marketing, advertising and public relations activity. Its purpose is to prevent harm to audiences, creators, models, employees, customers and bystanders, and to reduce the chance that communications mislead people, expose personal data, infringe rights or damage the organization. Safety in this context includes psychological, financial, physical and reputational harm, not only workplace injury.

Scope covers paid media, owned channels such as websites, email and social accounts, earned media and press relations, influencer and creator partnerships, events and product activations, and crisis communication. Advertising codes, consumer protection laws, data protection rules, endorsement disclosure requirements and platform policies are jurisdiction-dependent and change over time. Verify current versions with the relevant regulator, legal counsel or a qualified professional before launch.

• Mandatory: no campaign launches without a named owner, a documented risk level and the approvals listed in this document.
• Mandatory: no material is published that the team knows or suspects to be false, misleading or unlicensed.
• Recommended: run a short risk huddle before any campaign touching minors, health, finance, alcohol, gambling, politics or identifiable individuals.

2Roles, Competence and Accountability

The campaign owner is accountable for the brief, target audience, claims, creative approval and the go-live decision. Legal or compliance review is mandatory for regulated product categories, comparative claims, testimonials, health or financial messages, political content and anything directed at children. The privacy lead approves data collection, tracking tags, audience lists and data sharing with vendors. The communications lead approves spokesperson statements and crisis messaging.

Competence means documented training on advertising standards, endorsement disclosure, privacy basics, copyright and licensing, platform policies and crisis procedures. Training is refreshed when rules change and recorded in each person's file. Staff who handle health, finance or children's content work only within approved templates and under qualified sign-off. Creators and agencies are contractually responsible for following the approved brief, labeling partnerships and reporting incidents promptly.

• Campaign owner signs the risk record before publication.
• Only staff trained on disclosure rules may approve endorsements or influencer posts.
• Agencies provide written confirmation of licenses for every third-party asset.
• Spokespeople receive a briefing and may state only approved key messages and supporting facts.
• Nobody approves their own work alone where a second reviewer is available.

3Realistic Hazards and Risk Levels

Typical activities include writing copy, producing video, commissioning creators, buying media, running email and social programs, hosting launch events, pitching journalists and managing customer complaints. Typical tools include content management systems, ad platforms, analytics and tracking tags, customer databases, design software, stock libraries, scheduling tools and event equipment. Each carries specific hazards that the team should name before work begins.

Use three risk levels. Low means routine owned content with substantiated facts, licensed assets and no personal data beyond business contacts. Medium means paid promotion, creator partnerships, comparative claims or new audience segments. High means minors, health, finance, alcohol, gambling, politics, live public events, sensitive personal attributes, crisis communication or any stunt. High activities require legal review and a documented control plan before work begins. Risk levels are judgments, so reassess them when scope, channel, audience or partner changes.

• Misleading claims: exaggerated results, unverifiable superlatives, fake or incentivized reviews, undisclosed sponsorship and hidden fees.
• Audience harm: targeting vulnerable people, diet or body image content aimed at young users, promotion of gambling or alcohol to minors, and scam ads that impersonate brands.
• Creator harm: unsafe stunts, unpaid or unclear exposure, harassment after posting, pressure to reveal home locations and unsafe filming conditions.
• Privacy harm: unlawful tracking, scraped contact lists, leaked customer data and identifiable people shown in photos without consent.
• Rights harm: unlicensed music, images, fonts, footage and likenesses used without release forms.
• Reputational harm: tone-deaf campaigns, insensitive humor, inaccurate statements during a crisis and personal posts by staff that reflect on the organization.
• Physical harm: event rigging, power distribution, crowd movement, late travel and long periods of screen work.

4Preventive Controls and Safe Practices

Truthfulness is the first control. Every factual claim needs a substantiation file that names the source, the test or data behind it, the period covered and the person who confirmed it. Performance claims must match the conditions shown to the audience. Testimonials must come from real customers who have given permission and must not be edited into a meaning they did not express. Before-and-after imagery must be representative and disclosed where it has been altered.

Creators and talent must not be asked to perform stunts, drive, climb, handle pyrotechnics, enter water or work with animals unless the production uses qualified providers, a documented hazard assessment and written consent. Location shoots need a site survey, emergency contacts and a trained first aider on site. Minors on set require guardian consent and any permits or work restrictions required by local law, verified before the shoot. Product sampling requires supplier documentation, allergen labeling, temperature control and a named food safety person. Do not claim medical or therapeutic benefits unless qualified evidence and approval support them.

• Mandatory: keep a substantiation file for each factual claim, comparison and testimonial.
• Mandatory: disclose paid partnerships, free products, affiliate links and material connections using the labels that platforms and local rules require.
• Mandatory: obtain signed releases from every identifiable person, including staff and creators, before use in paid or public material.
• Mandatory: exclude minors from gambling, alcohol, tobacco, vaping, weight loss and cosmetic procedure promotions where such restrictions apply, and verify age rules locally.
• Mandatory: label synthetic or altered likenesses and AI-generated voices where a law or platform policy requires it, and never imitate a real person without written consent.
• Recommended: avoid targeting based on sensitive characteristics even where lawful, because it creates reputational and fairness risk.
• Recommended: give creators a written brief covering safe filming conditions, prohibited locations, their right to stop filming and an escalation contact.

5Privacy, Copyright and Platform Rules

Collect only the personal data needed for the stated purpose. Obtain consent where law or platform rules require it, honor opt-outs promptly and keep records of consent. Tracking tags, pixels and audience uploads need privacy review before launch. Lead lists must come from people who opted in to that type of contact; purchased or scraped lists are prohibited. Store personal data in approved systems, limit access to people who need it and delete it when the retention schedule says so. Privacy impact assessments are required where local law or internal policy says so.

Maintain an asset register recording source, license type, permitted uses, territory, duration and attribution requirements. Music, fonts, stock images, footage and user generated content each need written permission for the intended use, including paid reuse. Do not assume that content found online is free to use. Competitor trademarks may be referenced only where permitted and must never imply endorsement.

Platform rules change frequently. Check branded content tools, restricted categories, political advertising verification, prohibited claims and sponsored content labels before submission. Ad rejections are signals to review, not obstacles to route around. Never use fake accounts, bot engagement, purchased followers or deceptive redirects. Verify current policies with each platform and with counsel.

• Recommended: keep a separate consent log for email, text and push contact.
• Mandatory: remove any asset whose license expires or whose permitted use no longer matches the campaign.

6Workspace, Equipment and Event Safety

Office work involves long periods at screens. Set workstations so the top of the screen sits near eye level at a comfortable viewing distance, keep cables secured and take regular breaks at intervals set by local occupational rules. Report recurring discomfort to the line manager and the workplace health contact. Lone working late for launches or travel requires a check-in plan and a safe route home.

Live events and activations need a documented plan covering layout, capacity, emergency exits, crowd flow, queueing, weather and first aid. Rigging, staging, power distribution and lighting must be installed, inspected and operated by qualified and authorized contractors. Staff must not climb structures, run cables across walkways or move heavy equipment without training and suitable lifting aids. Walk the venue's emergency routes with the crew before doors open.

Use managed devices, multi-factor authentication on all marketing platforms, unique credentials and prompt removal of access when people change roles or leave. Never share platform passwords in messages or leave them on screens or whiteboards. Avoid account administration over unsecured public networks.

7Incidents, Escalation and Corrections

Report any suspected misleading claim, data breach, copyright complaint, creator injury, harassment, accessibility failure or crisis to the campaign owner and the relevant specialist immediately, and in any case within the same working day. Do not wait to confirm every detail. Internal reporting targets are recommended practice. External notification deadlines for data incidents, regulators and affected individuals are jurisdiction-dependent, so the privacy lead or counsel must be contacted at once.

Crisis communication requires a holding statement that acknowledges concern, states only verified facts and says when the next update will come. Do not speculate about causes, blame individuals or argue in comments. Escalate to the executive owner when the issue involves a regulator, death or serious injury, a data breach, a formal legal complaint or media attention beyond routine inquiries.

• Pause paid spend and scheduled posts on the affected asset while the issue is assessed.
• Preserve evidence: captures, messages, analytics and asset versions. Do not delete content without logging it first.
• Remove content that is unsubstantiated, unlicensed or exposes personal data, unless counsel advises preserving it.
• Issue corrections in the same channel with comparable prominence where a published claim was wrong.
• Injury or immediate danger: call local emergency services and follow instructions from trained responders. Communications staff do not attempt medical or physical rescue.

8Records, Training, Review and Improvement

Keep a campaign file containing the brief, risk level, substantiation, approvals, releases, licenses, disclosure records, creator contracts, data assessments where required, final approved versions and performance reports. Retention periods are set by policy and law, so verify them with counsel. Personal data inside these files must be access restricted.

Training is delivered before first use of a tool or role and refreshed at least annually as a recommended interval, with briefings after rule changes or incidents. Track near misses such as a rejected ad, a disclosure label caught before publication or a mistargeted segment. Review these records regularly for trends and share lessons learned without blame.

Post-campaign review should compare complaints, corrections, rejected assets, privacy requests and creator feedback against the risk plan. Update templates, checklists and this document when a gap is found. Ownership of the review sits with the campaign owner and the compliance lead.

Implementation checklist

• Confirm the campaign owner and risk level are recorded before work starts.
• Hold substantiation files for every factual, comparative and testimonial claim.
• Check disclosure labels on all creator and affiliate content before publication.
• Verify signed releases and written licenses for every image, track, font and clip.
• Confirm consent and a lawful basis for any personal data, tracking tag or audience list.
• Review targeting settings to exclude minors and restricted groups where rules apply.
• Brief creators on safe filming conditions and their right to stop.
• Confirm the event safety plan, qualified contractors and emergency contacts are in place.
• Log incidents within the same working day and pause affected paid spend.
• Archive the campaign file and schedule the post-launch review.