Safety Norms: Performance Marketing Management

1Purpose, Scope, and Safety Principles

This document sets norms for managing paid acquisition campaigns, including search, social, video, display, programmatic, affiliate, and creator-led promotions. Its purpose is to prevent harm to audiences, creators, employees, and the organization, and to keep campaign activity truthful, lawful, and aligned with platform rules. It applies to anyone who plans, buys, edits, approves, tracks, or reports on paid campaigns, including employees, agencies, freelancers, and vendors.

Performance marketing is measured by cost per acquisition, return on ad spend, and conversion volume. Those targets can push teams toward shortcuts. These norms treat safety, consent, and accuracy as conditions of success rather than trade-offs. Mandatory requirements are written as MUST. Recommendations are written as SHOULD and may be adapted only with documented approval from the campaign owner and relevant reviewer. A pixel is a tracking snippet that reports user actions to an ad platform. A custom audience is a list or behavior set used to target known or similar users.

2Roles, Competence, and Accountability

The performance marketing manager owns each campaign from brief to closure. That role approves objectives, audiences, creative, budgets, tracking plans, and the final launch. Channel specialists configure accounts, bids, and placements. Legal or compliance reviewers approve regulated claims, promotions, and sensitive-category advertising. A privacy lead approves new data sources, tracking tags, and audience uploads. Creator managers verify contracts, disclosures, and content rights before any partner post goes live.

Competence means more than platform familiarity. Each person must understand the rules for the channels they operate, the data they handle, and the escalation path when something goes wrong. Access should follow least privilege, with named users rather than shared logins.

• Campaign owners MUST hold written approval authority for budget limits and launch decisions.
• Users MUST NOT upload customer lists, install tags, or edit live ad sets until they have completed required privacy and platform policy training recorded by the organization.
• Agencies and vendors MUST sign data processing, confidentiality, and brand safety terms before receiving account access.
• Access MUST be removed within the time set in the access policy when a person changes role or leaves.
• Anyone who notices an unsafe or unlawful campaign SHOULD be able to pause it or escalate without penalty.

3Course-Specific Hazards and Risk Assessment

Realistic hazards in performance marketing include misleading claims, discriminatory or exploitative targeting, unlawful collection or use of personal data, undisclosed sponsorships, copyright infringement in creative assets, unsafe placements beside harmful content, account compromise, runaway spending, and public backlash from a single post. The people exposed include audience members who see ads, creators who appear in content, employees who handle data and budgets, and customers who may be harmed by inaccurate offers.

Each campaign MUST have a documented risk assessment before launch. Rate each hazard by likelihood and severity as Low, Medium, High, or Critical, record the control, name the owner, and review the rating when targeting, creative, budget, or data sources change. Campaigns that reach minors, people in crisis, or users of addiction-related products need additional review. Where minors may be reached, the applicable platform rules and child protection and advertising laws are jurisdiction-dependent and must be verified with qualified counsel.

• Sensitive categories such as health, credit, employment, housing, insurance, and political or social issue advertising MUST be checked against current platform special category policies and applicable local rules before launch. Treat these as High risk.
• Use of raw personal data, hashed customer lists, lookalike seeds built from sensitive traits, or third-party data brokers MUST be approved by the privacy lead.
• Any product, safety, health, financial, or environmental outcome claim without current substantiation on file is Critical and MUST NOT launch.
• Creator partnerships without written disclosure and content rights terms are High risk.
• Retargeting frequency that could repeatedly expose users to distressing or sensitive purchase content is Medium risk and SHOULD be capped and reviewed.
• Budget increases beyond the approved limit in campaign policy are High risk and require a second approver.

4Preventive Controls and Safe Work Practices

Truthful communication: Every claim in ad copy, landing pages, and creator scripts MUST be traceable to a substantiation file kept by the claim owner. Comparative claims, savings figures, scarcity messages, and testimonials require evidence and a clear basis for the wording. Urgency language such as limited time must be true, and countdown timers that reset are prohibited. Reviewers should compare the landing page against the ad promise before launch, because a mismatch is one of the most common sources of complaints and disapprovals.

Audience and targeting: Targeting should be selected for relevance, not to exploit vulnerability. Exclusion lists SHOULD be used to avoid showing ads to people who already purchased or who have opted out. Audiences built on protected characteristics MUST NOT be used where prohibited by law or platform policy, and proxy attributes such as postal code or interest clusters must be checked for discriminatory effect. Frequency caps SHOULD be set for every prospecting campaign to limit fatigue and repeated exposure.

Consent and data: Tracking tags MUST respect consent choices recorded through the organization's consent management process. Do not fire marketing pixels before required consent in regions where consent is required, since the exact rule is jurisdiction-dependent. Customer list uploads MUST come from a lawful, documented source, be limited to needed fields, and be deleted or retained according to the retention schedule. Do not infer sensitive traits from behavior to build audiences.

Creator safety and rights: Creators MUST receive written briefs that identify required disclosures, prohibited claims, and safety boundaries. Creators must not be asked to perform stunts, use unsafe equipment, film while driving, enter unsafe locations, or disclose private information. Creators SHOULD be allowed to decline content that makes them uncomfortable or puts them at risk. Comments and direct messages aimed at creators should be monitored, and creators should be offered a moderation plan and reporting support. Do not publish a creator's home address, children, or real-time location.

• Sponsored content MUST carry the disclosure that platform and advertising rules require, placed where audiences will see it before engaging.
• Usage rights, term, territory, and paid media permissions MUST be written and signed before creator content runs as an ad.
• Music, stock images, fonts, and user-generated content MUST be licensed for the specific use, duration, and channel. Keep license records with the campaign file.
• Do not use prohibited tactics such as misleading landing pages, cloaking, engagement bait, or unauthorized use of platform logos. Check each platform's current advertising and community policies before launch.
• Set daily and total spend caps on every campaign, and require approval for any change above the set threshold. Test new conversion events with a limited budget first.
• Name conversion events consistently, keep a change log, and do not report unverified results to stakeholders as final.

5Equipment, Environment, Information, and Protective Safeguards

Accounts and devices: Multi-factor authentication MUST be enabled on all advertising, analytics, tag manager, and email accounts. Use a password manager approved by IT, and never share credentials in chat or spreadsheets. Company devices that access ad accounts MUST have current operating system security updates and automatic screen locks. Work on public networks SHOULD use the managed virtual private network the organization provides.

Workspace safeguards: Because screens often show customer data, analysts SHOULD position monitors away from public view, lock sessions when stepping away, and avoid printing audience exports. Long analysis sessions create ergonomic strain. Recommended practice includes an adjustable chair, a monitor at eye level, and regular breaks, following the organization's occupational health guidance and local workplace rules.

Protective safeguards are the equivalent of personal protective equipment in this field. They include two-person approval for high-spend launches, preview and test publishing before going live, spend caps, automated alerts, and a documented kill switch that any authorized person can use to pause a campaign. Information safeguards include data minimization, role-based dashboard access, and secure deletion of exports. Retention periods are set by policy and by legal requirements that vary by jurisdiction.

• Export audience data only to approved secure locations and delete temporary files after use.
• Never paste customer data, unpublished creative, or contract terms into unapproved generative AI tools.

6Incident Reporting, Emergency Response, and Escalation

An incident is any event that may cause harm, unlawful processing, or reputational damage. Examples include a misleading ad that went live after review, a suspected data exposure, an audience complaint about a distressing ad, threats against a creator, a platform account suspension, or a press inquiry about a campaign. Near misses, such as a claim caught in final review, MUST be logged so patterns can be found and fixed.

Response MUST follow a fixed order: protect people first, then preserve evidence, then notify. Pause the affected ads using the kill switch, record the campaign, ad set, ad identifiers, and timestamps, and capture screenshots of live creative and settings before editing. Do not delete ads or audiences without preservation approval from legal. Do not argue publicly with individuals, and do not reply to threats beyond the approved response.

Report to the campaign owner immediately and to the privacy lead or compliance reviewer within the window set by the incident response policy. Suspected personal data breaches may carry statutory notice deadlines that vary by jurisdiction, so legal counsel must be involved at once. If anyone faces an immediate threat to physical safety, contact local emergency services first and then notify the responsible people internally. Platform appeals and regulator contact should be handled only by authorized spokespeople.

• Pause, preserve, notify, then correct. Publish a correction or remove a claim only after legal review confirms the approved wording.
• Record root cause and corrective action in the incident log within the period set by policy.

7Records, Training, Inspection, and Review

Each campaign file MUST contain the objective, risk assessment, approval record, targeting rationale, claim substantiation, consent and data source records, creator contracts, disclosure proof, copyright licenses, and the launch checklist. Records should be kept for the period set by the records policy and any legal hold. Retention periods are jurisdiction-dependent and must be confirmed with the organization's legal or compliance function.

Training MUST be completed before access is granted and refreshed at an interval set by policy and whenever platform rules or applicable regulations change. Training should cover claims, privacy, consent, creator management, incident reporting, and escalation. The learning administrator keeps records of completion.

Campaign owners SHOULD review frequency, complaint rates, disapproval notices, unusual spend, and audience feedback during each reporting cycle. Compliance should audit a sample of live creative against substantiation files and consent records on a periodic basis. After every major campaign, hold a short review and update these norms where lessons show a gap. Strong results do not substitute for safety compliance.

Implementation checklist

• Confirm the campaign owner, approver, and risk rating are recorded before launch.
• Check every claim against a current substantiation file and confirm the landing page matches the ad.
• Confirm consent settings, data source approval, and exclusion lists before enabling tracking or uploads.
• Verify sponsored content disclosures and signed usage rights for every creator asset.
• Confirm copyright licenses cover the exact channel, territory, and duration.
• Set spend caps, frequency limits, and a tested kill switch for each campaign.
• Enable multi-factor authentication and confirm least-privilege access for all users.
• Log near misses and incidents, pause affected ads, preserve evidence, and escalate within the policy window.
• Complete required training and confirm compliance has reviewed current platform rules.
• Run a post-campaign review and update these norms with any lessons learned.