Safety Norms: Social Media Marketing and Management

1Purpose, Scope, and Safety Principles

Social media marketing and management means planning brand messages, producing posts and advertisements, engaging with followers, running paid campaigns, handling customer messages, and reporting results across platforms. The purpose of these norms is to prevent harm to audiences, creators, staff, and the organization, and to keep activity within applicable law and platform rules.

Three principles guide every decision: people come before reach, claims must be provable, and rights must be cleared before publication. Where a norm is marked mandatory, it must be followed unless a documented exception is approved. Recommendations describe good practice that teams should adopt or explain why they chose a different approach.

• Mandatory: no content is published until it has passed the approval step.
• Recommended: review these norms at least once per reporting cycle and after any significant incident.

2Roles, Competence, and Accountability

The accountable owner is the marketing lead who signs off the social media plan. A community manager handles replies, direct messages, and escalations. A content creator produces assets, a compliance reviewer checks claims, rights, and disclosures, and a data steward governs audience data and analytics. Small teams may combine roles, but no one should approve their own high-risk content without a second review.

Competence is verified by documented training and supervised practice, not by seniority or platform familiarity alone.

• Account owner: holds platform credentials in an approved password vault and removes access when staff leave.
• Compliance reviewer: trained on advertising, consumer protection, and disclosure rules relevant to each market served.
• Community manager: trained on harassment response, crisis escalation, and data handling before accessing live inboxes.
• Agencies and freelancers: work under written contracts that include these norms, rights warranties, and incident notification duties.

3Course-Specific Hazards and Risk Assessment

Social media work creates risks that are easy to underestimate because publishing is instant and copies persist. Typical hazards include misleading product claims, undisclosed sponsorships, unlicensed music, images, or fonts, personal data exposed in screenshots, inappropriate ads aimed at minors or vulnerable groups, harassment of followers or staff, mishandled crises, and unsafe creator requests such as stunts or hazardous location shoots.

Each hazard should be scored for likelihood and severity on a simple three-level scale of low, medium, and high. High-risk items include health or financial claims, content involving minors, live streams from hazardous locations, responses to deaths or emergencies, and campaigns involving sensitive personal characteristics. High-risk items require documented compliance or legal review before publication.

• Misleading claims: high severity. Control: a substantiation file for every quantitative or comparative claim.
• Undisclosed endorsements: high severity. Control: a clear disclosure label placed where the audience will see it first.
• Copyright infringement: high severity. Control: a license record and source file for every asset.
• Privacy leakage: high severity. Control: remove personal data from screenshots and do not tag private individuals without consent.
• Harassment of staff or creators: medium to high severity. Control: moderation rules and a block-and-report procedure.
• Unsafe creator stunts or location shoots: high severity. Control: a site risk assessment and a stop-work right for the creator.
• Account takeover: high severity. Control: multi-factor authentication and least-privilege access.
• Risk assessments are reviewed whenever a new platform, market, or product line is added.

4Preventive Controls and Safe Work Practices

Preventive controls work best when they are built into the workflow rather than added at the end. A content calendar should include a rights and claims check during drafting, a second-person review before scheduling, and a recorded approval for every paid promotion. Scheduling tools should only publish items that carry an approved status.

A caption checklist helps teams confirm disclosure, evidence for claims, accessibility text, and correct links before each post goes live. Live content needs a named moderator and a plan for disruptive comments before the broadcast starts.

• Mandatory: record a named approver before any post, story, or advertisement is scheduled or published.
• Mandatory: disclose paid partnerships, gifted products, affiliate links, and AI-generated or heavily altered content where platform rules or applicable law require it.
• Mandatory: make no health, safety, financial return, or environmental claims without a substantiation file held by the compliance reviewer.
• Mandatory: use music, footage, images, logos, and fonts only under a written license that covers the intended channel, territory, and duration.
• Mandatory: obtain written consent before filming, publishing, or tagging identifiable people, and store the consent record with the asset.
• Mandatory: follow platform terms for automation, bulk following, and data collection. Do not buy followers, fake engagement, or scrape personal data.
• Mandatory: do not target paid audiences using sensitive categories or restricted features, and exclude minors from targeting where platform rules require it.
• Recommended: schedule sensitive posts for review during working hours rather than late at night.
• Recommended: for live streams, use a moderator, a broadcast delay where the platform offers one, and pre-approved responses.
• Creator safety: never ask a creator to film in unsafe locations, drive while recording, or perform stunts. Provide a stop-work right and pay for time lost to safety concerns.
• Community management: reply using approved templates, move personal or legal matters to private channels, and never argue publicly with users.
• Paid promotion: set daily spending limits and review placements within an agreed period after launch to catch harmful ads.

5Equipment, Environment, Information, and Protective Safeguards

Social media work is mostly desk-based, but it involves devices, accounts, networks, and public spaces. Safeguards cover digital security, secure workspaces, and the handling of personal information. Where filming takes place, physical safety comes first, and production teams must follow site rules and local law.

Privacy and data protection laws vary by jurisdiction. Confirm retention, access, and deletion obligations with a qualified privacy adviser before setting up data collection.

• Accounts: use unique passwords, multi-factor authentication, and shared credentials stored only in an approved password manager.
• Devices: enable screen locks, encrypted storage where available, and automatic security updates. Avoid logging into admin accounts on unsecured public networks.
• Workspace: keep screens out of sight of visitors and avoid photographing badges, documents, or whiteboards that show private information.
• Filming equipment: inspect cables, batteries, drones, and lighting before use. Drones may only be flown where local aviation rules allow, and operators must hold any authorization those rules require.
• Analytics: collect only data needed for reporting, anonymize results where possible, and handle opt-out and deletion requests within the timelines set by applicable law.
• Wellbeing: rotate staff away from high-volume abusive comment queues, provide breaks, and offer access to support services.

6Incident Reporting, Emergency Response, and Escalation

Incidents include publishing errors, rights complaints, data exposure, account compromise, harassment campaigns, threats, and reputational crises. The rule is to report first and correct second. Anyone who sees an incident must notify the escalation contact immediately, even when the cause is unknown.

This guidance does not replace professional legal advice, platform security support, or emergency services. Where a person is in immediate danger, contact local emergency services first.

• First hour: pause related scheduled posts and paid campaigns, preserve screenshots and logs, and notify the account owner.
• Account compromise: change passwords, revoke active sessions, and report through the platform's official security channel.
• Personal data exposure: contain the exposure, record what data was involved, and notify the privacy lead so notification duties can be assessed.
• Threats of violence or self-harm: do not reply. Escalate to the designated safety lead and contact local emergency services if danger is imminent.
• Harassment campaigns: follow the approved block, restrict, and report steps, and do not engage with harassers publicly.
• Corrections: when a claim is wrong, correct it visibly on the same channel and record the correction.
• Regulator contact, media inquiries, or litigation threats go to legal or executive leadership without exception.

7Records, Training, Inspection, and Review

Records prove that controls operated. Keep approval logs, substantiation files, license and consent records, disclosure evidence, incident reports, and training completion. Retention periods depend on local law and contract terms, so confirm them with qualified advisers.

Review is continuous. Findings from inspections and incidents should change the norms, the training, or the tools, and each change should record its reason.

• Training: all staff complete onboarding on these norms before receiving account access, and refresh training when platforms or laws change.
• Inspection: a compliance reviewer samples published posts and paid ads at regular intervals and records findings.
• Access audits: compare account access lists against current staff and remove stale or unnecessary access.
• Metrics: track incident counts, correction rates, complaint volumes, and time to escalation to reveal trends.
• Review triggers: update these norms after a significant incident, a platform policy change, or a new market launch.

8Conclusion and Adoption

These norms are a starting point rather than a complete compliance program. Local teams should convert them into approved procedures with named owners, tested escalation paths, and records that match their markets and platforms.

Where a situation is unclear, pause and escalate. Speed matters in social media, but a short delay to confirm rights, facts, or safety is almost always less costly than a public correction, a complaint, or a harmed person.

Implementation checklist

• Confirm a named approver and disclosure label before every scheduled post.
• File substantiation for each claim, including comparative, health, and financial statements.
• Hold a written license for every music track, image, video, and font used.
• Obtain and store written consent before identifiable people appear or are tagged.
• Remove personal data from screenshots and keep customer data in approved tools only.
• Enable multi-factor authentication and remove access for departed staff and freelancers.
• Pause related posts and ads and report incidents to the escalation contact immediately.
• Respond to complaints with approved templates and move private matters off public threads.
• Give creators a stop-work right and avoid unsafe locations and stunts.
• Review these norms with qualified advisers when platform policies or laws change.