Safety Norms: Marketing Strategy and Brand Positioning

1Purpose, scope, and safety principles

These norms apply to anyone who researches markets, defines target audiences, writes positioning statements, selects channels, briefs creators or agencies, approves messaging, or measures brand performance. The safety concern is not only physical. Strategy work can cause harm through targeting vulnerable people, making misleading claims, mishandling personal data, exploiting creators, and publishing content that infringes rights.

Scope covers internal planning, consumer research, paid and organic campaigns, influencer partnerships, sponsorships, events, and brand reputation monitoring. Positioning is a promise the organization must be able to keep in its products, service, and conduct, so every strategy decision should be tested against that promise.

• Mandatory: no campaign may launch without a documented review of claims, audience consent basis, data use, and rights clearance.
• Mandatory: strategy must not target or exclude people using sensitive characteristics or vulnerabilities unless a qualified legal and ethics review has approved it.
• Recommended: treat every positioning statement as a commitment that operations, customer support, and product teams must be able to deliver.

2Roles, competence, and accountability

The marketing executive or equivalent leader owns the brand's risk appetite and approves high-risk campaigns. Brand and strategy leads own positioning documents and maintain the claims register. Legal, privacy, and compliance staff review claims, consent language, and data flows. Creators, agencies, and vendors work under written contracts that set obligations for disclosure, content rights, data handling, and conduct.

Competence matters. Staff who approve claims about health, finance, environmental benefit, or safety outcomes must be trained in the relevant advertising standards and must escalate to qualified specialists when unsure. Training does not create legal authority to sign off on regulated claims.

• Mandatory: name one accountable owner for every campaign, claim, and audience segment in the brief.
• Mandatory: only staff trained in advertising standards and data handling may approve paid targeting that uses personal data.
• Mandatory: contractors must sign terms covering disclosure, content rights, data handling, and conduct before receiving brand assets.
• Recommended: require a second reviewer for any claim touching health, finance, environmental benefit, or safety.

3Course-specific hazards and risk assessment

Realistic hazards in this subject include market research that collects personal information without a clear basis, segmentation that targets minors or people in financial or personal crisis, positioning that overstates performance, influencer briefs that hide paid relationships, and brand imagery that uses unlicensed photographs, music, fonts, or trademarks. Other hazards include creator harassment following campaign backlash, and reputational harm from tone-deaf messaging during public events or sensitive news periods.

Assess each campaign using a simple three-level scale for likelihood and impact. Record the rating before creative production begins. Re-rate whenever the audience, channel, claim, or creator changes. High-risk items must be escalated before launch and cannot be approved by the campaign team alone.

• High risk: claims about health, safety, finance, environmental benefit, or comparative performance. These require a substantiation file and legal review.
• High risk: targeting based on health conditions, financial distress, age, or inferred sensitive traits.
• High risk: any content featuring minors, which requires verified parental or guardian consent where law requires it and an internal approval record.
• Medium risk: influencer campaigns with limited disclosure controls or unclear usage rights for creator content.
• Medium risk: customer data imported from third-party lists without documented provenance.
• Low risk: internal positioning workshops using anonymized competitive research.

4Preventive controls and safe work practices

Preventive controls work best when built into the planning cycle rather than added at launch. Start every strategy with a claims inventory listing each statement, its source, and the evidence owner. Require a consent and data map for each audience segment showing what data is collected, where it is stored, who can access it, and what purpose it serves. Maintain a rights tracker for images, music, fonts, talent likeness, and trademarks.

Before publication, run a disclosure check so that paid, gifted, or otherwise compensated relationships are visible in the content itself rather than buried in profiles or hashtags. For creators, set clear expectations about feedback, revision limits, and what happens if a campaign is paused. Creator wellbeing is part of campaign safety.

• Mandatory: every factual or comparative claim must link to current substantiation in the claims register, with the owner's name and the most recent review record.
• Mandatory: paid or compensated relationships must be disclosed clearly on the content, in a place the audience sees before engaging.
• Mandatory: no use of images, voices, music, or talent likeness without a written license or release covering channel, territory, and duration.
• Mandatory: audience research with human participants must follow an approved consent process, allow withdrawal, and collect no more data than the study requires.
• Mandatory: check platform rules before setting up targeting, and exclude sensitive categories wherever law or platform policy restricts them.
• Mandatory: no competitor disparagement and no use of competitor trademarks that implies affiliation without legal review.
• Mandatory: creator briefs must not require unsafe stunts, unsupervised minors, or unsafe travel without a documented risk assessment.
• Creator safety: provide harassment support, including platform reporting tools, a right to step back from comments, and no requirement to share home addresses or private accounts.
• Recommended: test positioning statements with a small, consenting panel before scaling, and record any signs of unintended harm.
• Recommended: prepare a crisis holding statement, named spokespeople, and a pause rule before launch. Any campaign receiving credible reports of harm, false claims, or rights complaints is paused until reviewed.

5Equipment, environment, information, and protective safeguards

Marketing work relies on laptops, shared drives, analytics tools, customer relationship systems, and, for some teams, filming studios, pop-up events, and public venues. Workspace ergonomics matter during long review sessions. Use screens at eye level, adjustable seating, and scheduled breaks. Keep cables and equipment out of walkways during shoots and events.

Information safeguards protect audiences, creators, and the brand. Access to personal data should follow the minimum necessary principle. Shared passwords and tokens create hidden exposure, so they must be stored only in an approved secrets manager.

• Mandatory: store personal data only in approved systems with role-based access and multi-factor authentication where the organization supports it.
• Mandatory: remove personal data from exports, slides, and shared files unless the stated purpose requires it.
• Mandatory: use approved accounts for brand social channels, with no personal devices holding shared admin credentials.
• Mandatory: on location shoots and events, follow venue rules, site safety instructions, and permit conditions, with a designated safety lead present.
• Mandatory: where filming involves heights, water, vehicles, pyrotechnics, or animals, use qualified specialists under site rules. Marketing staff must not improvise such scenes.
• Recommended: minimize tracking tags and review analytics settings against current consent requirements in each market.
• Recommended: keep a brand asset library showing license expiry records and use watermarked previews for drafts.

6Incident reporting, emergency response, and escalation

Incidents in this subject include a misleading claim going live, a data exposure, a copyright takedown, a creator being harassed, a campaign widely perceived as offensive, or a safety problem at an event. Report every incident immediately through the internal incident channel. Preserve evidence such as posts, comments, messages, and analytics before deleting anything, because the record is needed for review.

For physical emergencies at shoots or events, call local emergency services first, stop the activity, and notify the event lead. Staff must not attempt rescue beyond their training. This guidance does not replace an organization's emergency response plan or professional advice.

• Mandatory: report suspected data exposure to the privacy lead as soon as it is identified, following internal procedure and any notification timeline confirmed by the privacy team.
• Mandatory: pause paid spend on any campaign with a confirmed false claim until legal approves the correction.
• Mandatory: for a rights complaint, remove the disputed asset from active channels pending review and preserve records.
• Mandatory: for harassment of a creator or staff member, escalate to the platform's trust and safety contact and the accountable executive within the same working day.
• Recommended: prepare correction language that states what was wrong, what is corrected, and where audiences can get help.
• Recommended: log near misses, such as content or targeting caught before publication, because patterns reveal control gaps.

7Records, training, inspection, and review

Records make safety and compliance visible. Keep the claims register, consent and data maps, rights tracker, disclosure checklist, risk ratings, approval records, and incident log. Retention periods depend on law and contract, so confirm them with privacy and legal teams rather than assuming a standard period.

Training should be role-based and refreshed whenever advertising rules, privacy requirements, or platform policies change, which happens often. Review these norms at least once per planning cycle and after any significant incident, then update controls based on what was learned.

• Mandatory: complete training on advertising standards, disclosure, privacy basics, and rights clearance before approving campaigns.
• Mandatory: record who approved each high-risk item and which evidence was reviewed.
• Recommended: run a periodic sample audit of published content against the claims register and disclosure checklist.
• Recommended: hold a short post-campaign review asking where harm, complaints, or near misses occurred and what control would have prevented them.
• Jurisdiction note: advertising, consent, privacy, copyright, and retention rules vary. Verify current requirements with qualified counsel or the relevant regulator before relying on any norm here.

8Practical checklist and conclusion

Use the checklist below as a planning aid, not a substitute for approved procedures. Strong brand positioning earns trust only when it is honest, lawful, respectful of people, and supported by operations. Treat every campaign as a chain of decisions, and make sure each decision has an owner, evidence, and a way to pause or correct it if something goes wrong.

Implementation checklist

• Confirm every claim has substantiation in the claims register and legal review where required.
• Record the consent basis and data map for each audience segment before targeting is set up.
• Check that all images, music, fonts, and likenesses have written licenses covering the intended use.
• Confirm paid or compensated relationships are disclosed clearly on the content itself.
• Exclude sensitive or restricted targeting categories unless a qualified review has approved them.
• Verify that contractor agreements cover disclosure, rights, data handling, and conduct.
• Assign a named accountable owner and a recorded risk rating to the campaign.
• Prepare a crisis holding statement and a pause rule before launch.
• Confirm creators have harassment support and are not required to share private details.
• Log incidents and near misses within the same working day.