What goes into a brand safety policy that agencies can follow?
Part of Brand suitability
The short answer
A brand safety policy is the advertiser's written rulebook for where its ads may run. It states the scope, the floor no campaign may cross, where each brand's tolerances are kept, who owns each decision, how exceptions are approved, how incidents are escalated and when the document is reviewed. Agencies and partners apply it to each buy.
Key takeaways
- A policy covers the whole advertiser; each brand's detailed tolerances sit in a separate suitability profile the policy points to.
- Every section should name an owner and a decision, not only a principle.
- Exceptions need a requester, an approver, an end date and a record, or they quietly become the rule.
- An escalation section with response times and a named contact is the part read on the day something goes wrong.
- Review the policy on a fixed date and keep a version log, so anyone can see which rules applied to a past campaign.
What should a brand safety policy include?
Definition
- Brand safety policy
- A dated document, owned by the advertiser, that sets the rules every campaign and every partner must follow to keep the advertiser's ads away from harmful or unsuitable content, and says who decides what when those rules are tested.
Brand safety settings and a brand safety policy are different things. The settings live in buying tools; the policy explains why they exist, who may change them and what happens when they fail. The outline below has ten sections. A policy for a single brand can merge some of them, but none should be missing.
| Section | What it states | Sample line |
|---|---|---|
| 1. Purpose and scope | Which brands, markets, languages, channels and buying routes the policy covers | Applies to all paid media for every brand in the United States and Canada, including direct, programmatic and creator deals |
| 2. References and definitions | Which standards and taxonomies the policy uses, with dates | Categories follow IAB Tech Lab Content Taxonomy 3.1; GARM's framework is cited as a legacy reference only |
| 3. The floor | Content no campaign may fund, and that no one can waive | No exceptions to the floor may be approved at any level |
| 4. Brand tolerances | Where each brand's suitability profile is kept and how it is approved | Each brand keeps a one page profile, signed by its brand lead |
| 5. Controls and tools | Staff, tools and lists used to apply the policy, with required accreditations | Content level verification must be accredited for the environments bought |
| 6. Owners | Who owns, approves, applies and is informed for each section | The head of media owns the policy; agency leads apply it |
| 7. Exceptions | How a campaign may depart from a tolerance, for how long, and who approves | Exceptions expire at the end of the flight unless renewed in writing |
| 8. Incidents and escalation | What counts as an incident, who is told, how fast and what is paused | Agency confirms receipt within one business hour and pauses the placement |
| 9. Publisher and partner reviews | How a publisher can ask for a classification or block to be reviewed | Disputed blocks are reviewed within ten business days by someone outside the campaign team |
| 10. Review cycle and version log | When the policy is reviewed, what triggers an early review and the change history | Reviewed every January; each version is dated and kept |
The tolerance detail itself belongs in the brand suitability profile, one per brand. Keeping it out of the policy lets a house of brands share one rulebook while a family product and an adult product keep different lines. Section 3 should be short and shared by every brand; the brand safety floor guide explains what sits there.
Who owns a brand safety policy?
The advertiser owns it. Agencies and verification partners apply it, but the decisions in it are the brand's. The TAG Brand Safety Certified guidelines (opens in a new tab), version 5.0 dated July 2026, put the same split into rules for certified companies. Principle 3 says direct buyers, meaning advertisers or the agencies that directly represent them, "must define the criteria to be met in order for digital advertising to be presented on digital media property(ies)" and communicate those criteria to their intermediary partners. Principle 4 says intermediaries must honor them.
| Role | Owns | Approves | Applies or is informed |
|---|---|---|---|
| Head of media or marketing | The whole policy and its review | Floor, scope, changes to owners | Informed of every incident |
| Brand leads | Their brand's suitability profile | Exceptions for their brand | Informed of incidents on their brand |
| Legal and compliance | Rules from law and industry codes | Any line touching regulated products or audiences | Informed of incidents with legal exposure |
| Agency lead | Applying the policy on every platform | Nothing; proposes exceptions | Runs the incident steps and the list reviews |
| Verification and planning partners | Accurate classification and reporting | Nothing | Reports scope limits and incidents |
Write names, not only job titles, into an appendix that is updated when people change roles. A policy whose owner left the company two years ago can become a policy nobody is allowed to change.
How detailed should a policy be for agencies to apply it?
Detailed enough that two agency teams reading it separately would set up the same campaign. The test is hardest to pass in section 5, where a policy can name a goal without the controls that deliver it. The TAG guidelines are a useful model for that section: certified companies must document the staff or tools used to review and flag content, the technology and procedures used to build and maintain inclusion and exclusion lists, and how items are added to and removed from those lists.
Is the policy ready for an agency to apply?
- Every channel in the scope has a named control, such as a verification setting, an inclusion list or a platform setting.
- Required accreditations name the metric and environment, not only the accrediting body.
- Each rule says whether it applies before the bid, after serving, or both.
- Language coverage is stated for every market, for example English and French in Canada.
- Any exclusion based on a publisher's viewpoint is written as the advertiser's own express direction.
- The policy says which document wins when it conflicts with a brief or a platform default.
- Contact details for incidents work outside office hours.
How should a brand safety policy handle exceptions?
Exceptions are one place where a policy can erode. A campaign asks to run beside content its brand profile excludes, the request is approved in a chat message, and a year later the exception is the setting nobody remembers changing. A written process keeps exceptions useful and visible.
Five steps for every exception
- Request in writing. The agency or brand team names the rule, the campaign, the content it wants to reach and the reason.
- Check the floor first. Any request that touches floor content is declined without further review; the floor has no exceptions.
- Approve at the right level. The brand lead approves changes to their own profile; legal approves anything touching a regulated product or audience.
- Set an end date. Every exception expires with the flight or on a stated date, and the platform setting is reverted on that day.
- Log it. Record the request, the approver, the dates and the settings changed in the policy's exception log, which is read at each review.
Fictional example
A hospital network's policy and one exception
An unnamed hospital network with facilities in Houston, Dallas and San Antonio writes a policy covering its main brand, its urgent care brand and its charitable foundation, in English and Spanish. Section 3 is shared by all three. Section 4 points to three profiles: the main brand accepts factual health news, including reporting on disease and injury, while the foundation's profile excludes tragedy coverage during donation drives.
Before a stroke awareness campaign, the agency asks for an exception so the main brand can appear beside news reports about strokes and other medical emergencies that its profile places in a medium risk group. The brand lead approves it for the six week flight, legal confirms that no patient stories are involved, and the exception goes into the log with its end date. When the flight ends, the agency reverts the setting and records the date. At the January review the head of media sees the exception, its result notes and its closure in one line.
How should a brand safety policy handle incidents and escalation?
An incident is any placement that breaks the policy or that the brand would not want to defend in public. The escalation section is the part read under pressure, so it should fit on one screen: what counts as an incident, who reports it to whom, how quickly, and what is paused while the facts are checked.
The same section should cover the reverse case, when a publisher believes it was blocked wrongly. The TAG guidelines say participating companies should have "an objective review and evaluation process" for claims that a property or its content was wrongly scored or designated as unsafe. A policy that names who reviews such claims, and within what time, protects news and independent publishers from errors that might otherwise stay uncorrected.
How often should a brand safety policy be reviewed?
Review the whole policy at least once a year on a fixed date, and review its lists more often. TAG requires certified buyers, sellers and intermediaries to run their documented procedures for inclusion and exclusion lists as part of an internal quarterly review, and certified companies must apply for recertification by January 31 each year. An advertiser that is not certified can borrow the same rhythm: lists every quarter, the policy every year.
Some changes justify an early review. A reference the policy relies on may end, as GARM did when the World Federation of Advertisers discontinued it in August 2024 (opens in a new tab); its framework is now a legacy reference, not an operating standard or certification. An accrediting body may change what a term means, as the MRC did for the words brand safety in October 2025. Each review should end with a new version number, a dated change log and the owner's sign off, so a past campaign can be checked against the rules that applied at the time.
How does PlacementGraph support the approvals a policy requires?
Frequently asked questions
Is a brand safety policy the same as a brand suitability profile?
No. The policy is the advertiser wide rulebook: scope, floor, owners, exceptions, escalation and review. The profile is one brand's tolerance for each content category, with examples. The policy points to the profiles and says who approves them, so one policy can hold several brands with different lines.
Should the policy name specific verification or planning partners?
Name the requirement in the policy and the partners in an appendix. Writing the accreditation, environments and languages a partner must cover keeps the policy valid when a contract changes. The appendix can then list current partners with the date their scope was last checked.
Does a brand safety policy cover direct deals with publishers?
It should. Scope that stops at programmatic leaves direct sponsorships, newsletters, podcasts and creator deals without rules. For direct deals the controls differ, such as contract clauses and approval of the sections or episodes the ad will appear in, but the floor and the brand profiles still apply.
Whose policy applies when an agency has its own brand safety standards?
The advertiser's policy sets the rules for its campaigns, and the agency's standards apply where the advertiser's policy is silent. State this order in section 1, and ask the agency to flag any of its defaults that are stricter or looser than the policy so the brand can decide which to keep.
Sources
- Brand Safety Certified Guidelines, version 5.0 (July 2026) (opens in a new tab)TAG (Trustworthy Accountability Group)
- FTC Alters Final Consent Order in Response to Public Comments, Preventing Coordination in Global Advertising Merger (September 26, 2025) (opens in a new tab)Federal Trade Commission
- WFA discontinues GARM (opens in a new tab)World Federation of Advertisers, August 9, 2024
- Content Taxonomy (opens in a new tab)IAB Tech Lab
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.