Safety Norms: Marketing Strategy Development

1Purpose, Scope, and Safety Principles

The purpose of these norms is to make marketing strategy decisions safe, truthful, and lawful before any message reaches the public. Strategy shapes who is targeted, what is promised, which data is used, and which creators or partners are involved. Errors at this stage are expensive to reverse, so controls belong in planning, not only in creative review.

The scope covers market research, audience segmentation, positioning, messaging frameworks, channel selection, budgeting, influencer and partner planning, data sourcing, and performance measurement. It applies to employees, contractors, agencies, and any tool or AI system used to draft strategy material.

Jurisdiction matters. Advertising, consumer protection, privacy, data transfer, copyright, and platform rules differ by country, state, and sector, and they change over time. Where this document refers to a rule, read it as a prompt to confirm the current requirement with competent authorities or qualified professionals, not as a statement of current law.

• MUST: Put people before reach. Strategy cannot target or exploit people in ways that would be unacceptable if disclosed publicly.
• MUST: Make no claim that cannot be substantiated with a retained evidence file.
• MUST: Collect and use only the personal data needed for a stated, approved purpose.
• SHOULD: Record assumptions, decisions, and reasons so reviewers can challenge them later.

2Roles, Competence, and Accountability

Every strategy has a named owner, usually the marketing lead, who is accountable for the plan and its outcomes. Supporting roles include a legal or compliance reviewer who checks claims and disclosures, a privacy lead who approves data sources and retention, a creative lead who checks that imagery and copy are accurate, a media or channel manager who confirms platform rules, and an executive sponsor who approves budgets and risk acceptance. Contractors and agencies are bound by the same norms through contract terms and must provide evidence of their training on request.

Competence matters. Anyone who approves claims, targets audiences, or handles personal data must complete role-based training on applicable advertising, privacy, and platform policies before taking that responsibility. Staff without training may contribute ideas but may not approve or launch. Specialist decisions, such as health, financial, or children-directed messaging, must be signed off by a qualified professional recognized in the organization.

• MUST: Each strategy document names one accountable owner and one compliance approver.
• MUST: Individuals do not approve their own claims, audience exclusions, or data requests.
• SHOULD: Review role assignments when team members change or new channels are added.

3Course-Specific Hazards and Risk Assessment

Marketing strategy hazards are rarely physical, but they can cause real harm. Common hazards include misleading or unsubstantiated claims, targeting vulnerable people such as children, people in financial difficulty, or people with health concerns, unlawful use of personal data, discriminatory targeting in housing, employment, or credit where restricted, undisclosed sponsorship, copyright infringement in images or music, platform policy violations, and reputational damage from insensitive or culturally careless messaging.

Rate each hazard before work begins using a simple matrix. Likelihood is rated low, medium, or high based on how often the situation arises. Severity is rated low, medium, or high based on harm to people, legal exposure, and reputation. High-severity items, or any item rated high on both scales, require executive and compliance review before proceeding. Document the rating and the residual risk accepted. Budget and timeline overcommitment can also create pressure to skip checks, so treat schedule risk as a hazard too.

• High risk example: a strategy that uses health anxiety themes to promote a product with no clinical evidence.
• Medium risk example: a plan that uses purchased contact lists without confirmed consent records.
• Low risk example: a seasonal social post that reuses a licensed stock image with a retained license.
• Review the risk rating whenever the audience, channel, budget, or claim changes.

4Preventive Controls and Safe Working Practices

Preventive controls should be built into the strategy workflow. Start with an audience definition that excludes sensitive targeting unless approved. Build a claim register listing every factual statement, its source, its evidence owner, and its approval status. Claims such as best, fastest, clinically proven, or guaranteed require documentary evidence reviewed by qualified staff before use. Competitor comparisons must be accurate, current, and fair.

Disclosure rules require clear and conspicuous identification of paid relationships, free products, affiliate arrangements, and employee posts where applicable. Disclosures should appear where the audience sees the message, not only in a profile bio or a hidden link. Confirm local advertising rules before drafting disclosure language, because requirements differ by jurisdiction. Verify current requirements with qualified advertising counsel.

• MUST: No targeting of minors with ad categories or data sources that are restricted for that age group under applicable rules.
• MUST: Every influencer or partner brief states required disclosures, prohibited claims, and the right to decline content.
• MUST: No purchase of fake followers, reviews, or engagement. This breaches most platform policies.
• SHOULD: Pre-approve a template for responding to comments that raise safety or accuracy concerns.

5Audience and Creator Protection, Consent, and Rights

Audiences and creators are people, not only reach metrics. Strategy should consider emotional effects, including fear appeals, body image, debt pressure, and social comparison. Creators should not be asked to make claims they cannot personally verify, disclose private information, reveal their location, or appear in situations that expose them to harassment. Give creators a clear escalation contact and an option to pause a campaign if they receive threats.

Consent and likeness rights must be documented before any real person appears in strategy materials. Keep signed releases for images, video, voice, and testimonials, and record the scope, duration, and permitted channels. Reuse beyond that scope requires new consent. Copyright must also be respected: license photography, music, fonts, and illustrations, and keep license records with the campaign file. Confirm that AI-generated images or copy do not reproduce protected material without rights.

• MUST: No testimonial is published without written consent and a verifiable record that the person had the experience described.
• MUST: Keep license evidence for each third-party asset in the campaign folder.
• SHOULD: Offer creators a safety review before public launch when topics are sensitive.

6Equipment, Data, Tools, and Workspace Safeguards

Strategy work relies on analytics platforms, customer relationship systems, survey tools, ad managers, spreadsheets, and generative AI tools. Access should follow least privilege: staff see only the customer records they need. Use multi-factor authentication on all accounts that can publish or spend budget. Store personal data in approved systems, not in personal email, personal cloud storage, or unmanaged messaging apps.

Privacy safeguards include data minimization, defined retention periods, and a data inventory showing the source, purpose, and consent or other lawful basis for each dataset, where applicable. Do not paste confidential customer data or unpublished financial results into public AI tools unless the tool is approved for that data class. Verify AI output for factual accuracy before use. Workspace practices include locked screens, clean desks for printed materials, privacy screens in public places, and regular breaks with ergonomic seating for long analysis sessions.

• MUST: Only approved tools may hold personal or confidential strategy data.
• MUST: Shared folders are reviewed at a defined interval for permissions and stale access.
• SHOULD: Label AI-assisted content internally and disclose externally where rules require.

7Incident Reporting, Emergency Response, and Escalation

Incidents include publication of a false claim, a data breach, a misdirected campaign that targets the wrong people, a copyright takedown notice, a platform suspension, harassment of a creator, or a sudden backlash. Near misses, such as a draft claim caught before launch, must also be logged because they reveal weak controls. Anyone who notices an incident must report it to the campaign owner and compliance lead immediately, without waiting to confirm fault.

Initial response: pause paid and scheduled activity linked to the issue, preserve evidence such as screenshots, ad settings, consent records, and logs, and do not delete posts or records until legal advice is obtained. Use the pre-approved holding statement while facts are established. Personal safety emergencies, including threats of violence against a creator or staff member, must be reported to local emergency services. Do not confront harassers or post responses that escalate the situation. Escalation timing should be defined in local procedure. Where privacy or consumer rules set notification deadlines, the privacy lead must confirm them immediately so that the organization can meet them.

• MUST: Regulator, press, or legal contact is routed to legal before any reply.
• MUST: Data breach reporting follows the organization's privacy incident procedure and applicable notification rules.
• SHOULD: Hold a short lessons-learned review after each significant incident and update controls.

8Records, Training, Inspection, and Review

Records make safety verifiable. Each campaign file should contain the strategy version, assumptions, risk rating, claim register with evidence, disclosure approvals, consent and release forms, license records, data inventory entries, approval signatures, and the post-campaign review. Retain records according to organizational retention rules and applicable law, and confirm retention periods with qualified advisers.

Training should cover privacy, advertising standards, platform policies, creator protection, and incident reporting. Refresh training whenever rules change or a new channel is adopted. Inspection occurs at three points: before launch, during the campaign through spot checks of live content and targeting, and after closure through a review of results against the approved risk assessment. Use findings to revise these norms. This document itself should be reviewed at a defined interval and whenever a serious incident occurs.

• MUST: Pre-launch checklist signed by the owner and compliance approver before any paid or public activity.
• SHOULD: Sample a set of completed campaigns each review cycle to test whether controls worked as written.
• SHOULD: Track compliance findings and near misses to spot repeated weaknesses.

Implementation checklist

• Name one accountable owner and one compliance approver for the strategy.
• Confirm every audience exclusion, especially minors and sensitive categories.
• Log every claim in the claim register with evidence and approval.
• Check that disclosures are clear, visible, and included in all creator briefs.
• Verify written consent and license records for every person and third-party asset.
• Confirm data sources are approved, minimized, and have defined retention rules.
• Confirm platform policy compliance and that no fake engagement is involved.
• Pre-approve holding statements and escalation contacts before launch.
• Report incidents and near misses immediately and preserve evidence.
• Complete a post-campaign review and update controls based on findings.