Safety Norms: Growth Marketing and Conversion Optimization

1Purpose, scope, and safety principles

These norms guide people who plan, build, launch, and measure changes meant to increase sign-ups, purchases, renewals, and other conversions. The work covers website and app experiments, landing pages, pricing and offer presentation, email and SMS sequences, paid social and search campaigns, push notifications, referral programs, and personalization. It applies to employees, contractors, agencies, and freelancers working on owned or client properties. It does not cover product engineering decisions unrelated to customer messaging or presentation, which follow their own procedures.

Three principles govern everything in this document. First, the audience is a real person whose money, data, attention, and wellbeing are affected by every test. Second, a result is only valuable if it is true and was produced honestly. Third, speed never overrides consent, legal review, or platform rules. Mandatory rules use the word must. Recommendations use the word should. Items marked jurisdiction-dependent must be verified with current local authorities or qualified professionals.

2Roles, competence, and accountability

The accountable owner for each experiment is the growth lead or campaign owner, who approves its hypothesis, audience, and launch date. Analysts own measurement design and statistical validity. Developers own implementation, tracking code, and rollback. Legal or privacy reviewers own consent language, data sharing, and claims that touch regulated products. Brand or compliance reviewers own disclosures and reputational risk.

Competence is not assumed from job title. Authorization should be recorded and renewed when tools, platform policies, or regulations change. Where this document requires formal training, that requirement is mandatory for the role concerned.

• Every test must have a named owner, a named reviewer, and a named person who holds authority to stop it at any time.
• Staff must complete internal training on truthful advertising, privacy basics, and the policies of each channel they use before running live campaigns.
• Anyone handling health, financial, children's, or other sensitive audience data must hold documented authorization from the data owner and must not proceed without it.
• Agencies must provide written evidence of their training and must follow these norms as if they were employees.
• People without authorization must not install tracking pixels, change payment flows, or message customers directly. They should submit the request to the named owner.

3Realistic hazards and risk assessment

Most harm in this field is financial, informational, and reputational rather than physical. Typical hazards include misleading urgency cues such as fake countdown timers, hidden fees revealed late in checkout, dark patterns that make cancellation hard, invented testimonials, fabricated reviews, and claims about results that cannot be substantiated. Other hazards include collecting more personal data than the test needs, messaging people who opted out, tracking minors, targeting vulnerable groups with high-pressure offers, and reusing competitor or creator content without permission.

Risk assessment must be completed before any new test type or new audience segment is used. Record the hypothesis, affected people, data used, possible harms, likelihood, severity, and controls. Use the risk rating to decide who must sign off. Ratings are internal judgments and do not replace legal classification, which is jurisdiction-dependent.

• High: deceptive pricing, fake scarcity or reviews, unlawful messaging, and collection of sensitive or children's data. Stop and escalate before launch.
• High: copyrighted, trademarked, or likeness material used without a license, including creator images, music, and logos.
• Medium: experiments that reduce accessibility, such as lower contrast or broken keyboard navigation, or that break checkout for one segment.
• Medium: statistical errors such as stopping tests early, which can roll out a worse experience to customers based on noise.
• Low: cosmetic layout tests that do not change price, claims, data collection, or access to products or account settings.

4Preventive controls and safe testing practices

Controls must be applied before traffic reaches a variant. The following rules are mandatory for every experiment and campaign.

Recommendations include starting with a small share of traffic, testing on staging with realistic but anonymized data, and writing a short note after each test explaining what changed for customers. Avoid using conversion tests to exploit urgent personal circumstances such as debt, illness, or bereavement. Schedule high-volume tests where support staff can respond to complaints during the same period.

• Every price, fee, discount, deadline, stock claim, and rating shown to customers must be accurate at the moment it is displayed. Countdown timers must reflect a real deadline, and scarcity messages must reflect real inventory.
• Cancellation, opt-out, and refund paths must be no harder to complete than sign-up or purchase paths. Any variant that makes a user choice harder to exercise must not run.
• Variants must pass a pre-launch review for claims, disclosures, and accessibility, including readable contrast, keyboard operation, and programmatic labels on form fields.
• Each experiment must define stop rules before launch, including a minimum runtime, a maximum exposure limit, and triggers such as error rate, complaint volume, or a rise in refund requests or support contacts.
• Sample sizes and stopping decisions must be set in advance. Checking results repeatedly and ending a test early to declare a win is prohibited.
• Changes to checkout, pricing, or account pages require a tested rollback plan and a second person who verifies live behavior after release.
• Every message must include a working unsubscribe mechanism, and suppression lists must be honored before any send.

5Data, consent, copyright, and platform safeguards

Tag managers, session replay tools, customer data platforms, and ad accounts are high-value systems. Access must follow least privilege, meaning staff receive only the permissions their role requires. Shared logins are prohibited. Multi-factor authentication is mandatory on analytics, advertising, email, and tag management accounts. Credentials must be kept in an approved password manager and revoked immediately when a person leaves or changes role.

Creator and influencer work carries its own risks. Disclosure rules, endorsement rules, and image rights differ by jurisdiction and must be verified with qualified legal counsel. Platform policies can remove ads or suspend accounts, and appeals are slow, so policy review must happen before launch and again whenever a platform announces changes.

• Collect only the data needed for the stated test. Do not capture form field contents, payment details, or health information in session recordings, and mask sensitive fields by default.
• Obtain consent where applicable privacy and electronic communication rules require it. Consent banners must not pre-select optional tracking. Verify the applicable rules with a privacy professional.
• Do not use personal data for a new purpose without a documented privacy review. Customer lists uploaded to ad platforms must comply with the platform terms and the organization privacy notice.
• Use only images, music, fonts, testimonials, and creator content that the organization owns or is licensed to use for the specific channel, territory, and duration. Record the license and credit creators where it requires credit.
• Never imply that a creator, customer, or public figure endorses a product without written permission and a documented review of the claim.
• Influencers and affiliates must disclose material connections inside the content itself, using wording the audience will see without effort. Disclosure wording is jurisdiction-dependent.
• Workspaces should limit ergonomic strain and screen fatigue: adjustable seating, screens at eye level, breaks during long review sessions, and a clean-desk rule for any printed customer data. Remote staff must use encrypted, auto-locking devices and must not review customer records in public places.

6Incident reporting, emergency response, and escalation

An incident includes a published misleading claim, a broken checkout, a data exposure, a failed unsubscribe, a platform account warning, a public complaint about a creator, or a near miss where harm was avoided only by chance. Report all incidents to the growth lead within one working day. Report suspected data breaches or messages sent to opted-out users to the privacy lead immediately. Time matters because continued exposure increases harm and regulatory risk.

Blameless review is recommended after any significant incident. The review should identify the control that failed rather than the person who followed a flawed process. Corrective actions need a named owner and a due date, and the outcome must be shared with everyone running similar tests.

• Immediate action: pause the affected test or campaign, preserve logs, screenshots, and variant code, and notify the growth lead and the relevant reviewer.
• Customer harm: when customers were charged incorrectly, misled, or messaged unlawfully, the privacy and legal reviewers decide on correction, refunds, and any notification duties. Those duties are jurisdiction-dependent.
• Reputational escalation: any public complaint, regulator contact, journalist request, or creator dispute goes to communications and legal before any response is posted.
• Security incidents such as leaked credentials or unauthorized access must follow the organization incident response plan and involve the security team at once.
• Medical, safety, or threat situations involving a user must be directed to local emergency services or the appropriate qualified service. Marketing staff must not attempt to provide medical or crisis advice through campaigns or support messages.

7Records, training, inspection, and review

Every live experiment needs a complete record. Keep the hypothesis, risk assessment, approvals, variant screenshots, audience definition, stop rules, raw results, and final decision in one controlled location. Retention periods depend on local law and contractual terms and must be confirmed with the records or legal team before any deletion.

Continuous improvement means treating a failed test as useful information about risk. Share lessons without blame, and do not reward growth metrics achieved through deception, dark patterns, or privacy shortcuts. Leadership should review whether incentives encourage unsafe testing.

• Maintain a register of active tests, campaigns, and data sources, and review it regularly.
• Require training before access to tag managers, ad accounts, or customer lists. Refresh training when platform policies or privacy rules change.
• Audit a sample of completed experiments in each review cycle for claim accuracy, consent handling, and unsubscribe compliance.
• Track protective indicators such as complaint rate, refund rate, unsubscribe rate, accessibility defects, and support ticket themes, not only conversion lift.
• Update these norms after significant incidents or regulatory changes, and record the revision, the reason, and the approver.

Implementation checklist

• Confirm the named owner, reviewer, and stop authority for the test.
• Verify that every price, deadline, stock claim, and rating is accurate and live.
• Check that cancellation and opt-out paths are as easy as sign-up and purchase.
• Set sample size, runtime, and stop rules before launch.
• Confirm that collected data is necessary and that sensitive fields are masked.
• Verify consent status and suppression lists before any message is sent.
• Confirm licenses and disclosures for all images, music, and creator content.
• Check platform policies and required disclosures for each channel used.
• Test accessibility and keep a tested rollback ready before release.
• Log the test, approvals, results, and any incident within one working day.