Safety Norms: Programmatic and Data-Driven Advertising

1Purpose, scope, and safety principles

These norms protect people affected by programmatic and data-driven advertising: audience members whose data and attention are used, creators whose images or voices appear in ads, and staff who operate buying platforms and data pipelines. Programmatic advertising means buying impressions through automated auctions, often through demand-side platforms, supply-side platforms, and ad exchanges. Data-driven advertising means using first-party, second-party, or third-party data to select audiences, set bids, or personalize creative.

The scope covers campaign setup, audience building, targeting, bidding, creative trafficking, measurement, and data handling across brands, agencies, and vendors. Safety in this field means preventing privacy harm, deception, discriminatory targeting, exposure of minors to unsuitable content, intellectual property infringement, and security breaches, as well as protecting staff from account compromise and harassment.

• Mandatory: no campaign launches without a documented purpose, a lawful basis or consent record, and brand safety settings approved by the accountable owner.
• Recommended: treat these norms as a minimum baseline and add stricter local controls where risk is higher.

2Roles, competence, and accountability

Accountability must be named, not assumed. The accountable owner, usually a brand or marketing director, approves objectives and accepts residual risk. A privacy reviewer checks data sources, consent records, and sensitive categories. A campaign manager configures bids, audiences, and budgets. A creative lead checks rights and claims. A security administrator manages access and credentials. Agencies and vendors remain bound by written contracts that require them to follow these norms.

Competence means the person has completed role-specific training on platform policies, privacy requirements, and the tools they use. Authority to build or change audiences based on sensitive categories, such as health, financial hardship, employment, housing, or credit, should be limited to trained staff with legal or compliance sign-off. Educational guidance in this document does not replace that professional authorization.

• Mandatory: every campaign has one named accountable owner and one named privacy reviewer recorded before launch.
• Mandatory: admin rights on demand-side platforms and access to raw audience exports are limited to named individuals.
• Recommended: rotate approval duties so that one person does not both build and approve a sensitive audience.

3Course-specific hazards and risk assessment

Realistic hazards include unlawful collection or sharing of personal data, consent signals that downstream partners ignore, sensitive-category targeting that excludes or exploits vulnerable groups, ads shown to minors where rules prohibit it, misleading claims in dynamic creative, unlicensed images or music, invalid traffic such as bots and made-for-advertising sites, and placements beside hateful, violent, or dangerous content. The tools themselves carry hazards, including exposed API keys, shared logins, spreadsheets of identifiers emailed around, and tracking pixels that transmit data to unexpected parties.

Risk should be rated by likelihood and severity before launch. A three-level scale works well: low, where harm is unlikely and reversible; medium, where a complaint or platform policy violation is plausible; and high, where personal data, minors, health, finance, or regulated categories are involved. High-risk campaigns require documented review and sign-off by privacy and legal functions before activation. Record each finding in a risk register with an owner and the control assigned.

• Treat every audience built from sensitive inferences, such as health conditions, religion, or financial distress, as high risk.
• Apply brand safety exclusion lists to every inventory source, not only the primary exchange.
• Review dynamic creative combinations, not only the templates, because automated assembly can produce claims no reviewer approved.

4Preventive controls and safe campaign practices

Preventive controls begin before any bid is placed. Maintain a data inventory listing each source, its origin, permitted uses, retention limit, and consent basis. Do not ingest data whose provenance cannot be confirmed. Apply data minimization by building audiences only from fields needed for the stated purpose. Configure platform consent settings and confirm that partners receive and honor the same opt-out and consent signals across the supply chain.

Creative controls require rights clearance for every asset: written licenses or proof of ownership for images, footage, music, fonts, and talent likeness. Performance and comparative claims need substantiation on file before going live, and health, financial, or safety-related claims need legal review. Creators whose likeness appears in ads must sign consent that covers the specific placements, duration, and territory, and must be paid on the agreed terms.

Operational controls include locked campaign templates, pre-launch quality checks of tags and landing pages, and written stop-loss thresholds. Delivery pauses automatically or manually when complaint rates, brand safety flags, or spend anomalies exceed limits set by the accountable owner. Thresholds must be documented in advance and not improvised during a live incident.

• Mandatory: no audience may be built from a sensitive category without privacy and legal approval recorded in the campaign file.
• Mandatory: do not deploy pixels or software development kits that send personal data to a third party without a documented assessment.
• Mandatory: exclude minors from targeting and personalized ads wherever the platform or applicable rules prohibit it; verify current rules with the platform and qualified counsel.
• Mandatory: do not use scraped data, purchased lists of unknown origin, or fingerprinting techniques that bypass user controls.
• Recommended: run small holdout tests to detect discriminatory delivery patterns before scaling spend.

5Tools, workspaces, and information safeguards

Programmatic work is largely screen-based, but it still has physical and digital safety needs. Workstations should use automatic screen lock, supported browsers, and multi-factor authentication for ad platforms, data warehouses, and tag managers. Staff reviewing dashboards that show individual-level data should position screens away from public view and avoid printing those views. Remote work requires managed devices and secure networks, and sensitive exports must never be stored in personal cloud accounts or messaging apps.

Long monitoring shifts also carry ergonomic and eye strain risks. Set monitors at a comfortable height, take scheduled breaks, and report recurring pain or visual symptoms to a supervisor who can arrange an assessment. Medical concerns should be referred to a qualified health professional; this document does not provide medical instruction.

• Mandatory: use unique named accounts and never share platform or data warehouse logins.
• Mandatory: store API keys and credentials in an approved secrets manager, never in spreadsheets or code repositories.
• Mandatory: encrypt exports in transit and at rest, and delete them when the stated purpose ends.
• Recommended: review access periodically and remove access on the same business day when someone changes role or leaves.

6Incident, complaint, and escalation procedures

An incident is any event that exposes personal data, serves an unapproved or unlawful ad, places an ad beside harmful content, misrepresents a product, or misuses a creator's likeness. A near miss is an event caught before harm occurred and must still be reported. Report incidents immediately to the accountable owner and privacy reviewer. For suspected data breaches or account compromise, notify the security administrator at once and follow the organization's approved breach response plan.

Containment comes first: pause affected line items, revoke compromised credentials, and preserve logs and screenshots without altering them. Do not attempt to recover data from unauthorized sources. Decisions about notifying regulators, affected individuals, or platforms belong to legal and privacy leads, because deadlines and obligations vary by jurisdiction and contract. Threats to life or physical safety, such as harassment of a creator at a physical location, must be referred to local emergency services immediately.

• Mandatory: pause any ad making unverified health, financial, or safety claims until it has been reviewed.
• Mandatory: answer user complaints about targeting or data use through the process described in the published privacy notice.
• Recommended: hold a short blameless review after each significant incident and record corrective actions with named owners.

7Records, training, monitoring, and review

Records make these norms auditable. Keep the campaign file, data inventory, consent records, creative rights documentation, approvals, and incident logs together. Retention periods should be set by legal counsel under applicable rules. Training should cover platform policies, privacy basics, brand safety, and the escalation path, with acknowledgment from each person who holds access. Refresh training when platform policies or laws change.

Monitoring should track complaint rates, brand safety reports, invalid traffic indicators, consent signal match rates, and policy disapprovals. Review these norms periodically and after any significant incident, regulatory change, or platform policy update. Improvements must be assigned to owners and verified in practice, not only written down.

• Mandatory: maintain audit logs for audience creation, consent changes, and bid rule changes.
• Mandatory: keep proof of creative rights and creator consent for as long as the asset remains in use.
• Recommended: hold a regular cross-functional review of metrics, incidents, and open corrective actions.

Implementation checklist

• Confirm each campaign has a named accountable owner and privacy reviewer before launch.
• Verify the lawful basis or consent record for every audience segment.
• Block sensitive-category targeting unless privacy and legal approval is on file.
• Clear image, video, music, font, and likeness rights for every creative asset.
• Substantiate claims and send health, financial, or comparative claims for legal review.
• Apply brand safety exclusions across all inventory sources and check dynamic creative combinations.
• Use named accounts with multi-factor authentication and store credentials in an approved vault.
• Set written stop-loss thresholds and pause delivery when they are exceeded.
• Report incidents and near misses immediately to the accountable owner and security administrator.
• Record approvals, consent changes, and bid rule changes in audit logs.
• Schedule regular review of these norms and verify local requirements with qualified professionals.