Social Media Compliance for Regulated Industries

It’s time for you to use social media to get the message out about your organization. There are laws to follow for all types of organizations but when you’re in a regulated industry, it’s imperative to get educated, plan carefully, and deploy best practices before jumping into the deep end of digital and social media. If you and your digital media consulting firm aren’t mindful in this process, your team will break laws, violate regulations, incur fines or worse. Industries such as healthcare, banking and finance, insurance, government, defense, alcohol, tobacco and many more must perform due diligence before marketing or advertising on the internet. Here’s what you need to know about social media compliance for regulated industries.

Know the Laws & Regulations Relevant to Your Industry

There are laws and regulations unique to your industry. Visit the website of your regulator to learn the ropes. Make sure you understand what is and isn’t allowed in advertising, social media, and general communications.

The role of compliance officer grows in importance depending on your field, the size of your organization, and the size of the fines you’ll incur for violations. One person in this role may be enough or you may need multiple people to manage it. It could be their sole responsibility but likely it will be in conjunction with other duties. Another option is to have a vendor manage this for you. Make sure they are diligent about staying up-to-date with current regulations and best practices as the laws move quickly in this space.

The compliance officer(s) and the marketing team should have, at minimum, annual meetings in order to review strategy, any new channels to be deployed, and get approval for third party vendors used in marketing. This is the time for the officer to review any changes to regulations and ad disclosure rules. These two teams, compliance and marketing, will be communicating throughout the year as issues arise but my recommendation is to set an annual meeting, close to the beginning of the year when new laws go into effect, and stick to it. This the most important step to take to ensure social media compliance for regulated industries.

Comply With Privacy & Data Protection Laws

Your compliance officer can be a help in this but your marketing team needs to know these laws like the back of their hand. These laws are specific to industry, your location, the location of your clients or target audience, and if you are reaching minors with your communications. This is where there is the most amount of change for regulated and non-regulated industries alike. These laws can be state-specific, federal, and/or international. Investigate the resources available to you on your regulator’s website.

A few we all need to know about:

My blogs: Understanding the California Consumer Privacy Act | How to be GDPR Compliant

Create Policies

You will need to manage the expectations of behavior for several audiences, both staff and the general public. You’ll want policies for each of the following: acceptable staff social media use, the marketing team (covering strategy, posting, comment moderation, and violation reports), privacy, data protection, website cookies, influencers, and public comments on social media.

Creating your public comment policy (also called engagement policy) is necessary but so is making sure it’s posted in conspicuous places and that you regularly post policy to your social channels so no one can argue that they didn’t know.

There are several options to achieve what’s needed. The first is to hire an attorney that has experience with technology and communications. The less expensive option is to buy templates that cover each of these categories and adjust them to your needs. You’ll still want to pay an attorney to review the policies you create from the templates annually (the laws can and do change often) to make sure nothing is missing. Additionally there are automated compliance vendors that can manage the creation of the policies, the frequent updates to locations you’ve chosen, and push those updates to your website. This last option is the fastest and can track changes more effectively than any human lawyer can. The laws change so often, it’ll make your head spin. Don’t get caught without these policies or using ones that are years old.

My blog: Why You Need a Public Comment Policy

Control Access to Social Accounts

Make sure that everyone that has access to your social media accounts or website is current and approved to be there. Employees that have left the organization, vendors that previously managed services for you, and those that simply don’t need access should be removed. The fact that they can access these important assets is a much bigger risk than you realize. I’ve been in social since 2006 and every client account back-end I’ve worked on fails this test. I’m called in to solve compromised account issues more and more often and the culprit is always a previous admin whose personal account was compromised.

Your organization has an off-boarding process. When employees leave, take their physical keys as well as their digital ones. Best practice is that you know exactly who has access to your digital assets but that rarely happens. Build a task into your marketing team’s responsibilities to review administrator access to all digital channels once per year.

While the team is reviewing administrators on all accounts, this is a good time to change passwords. Data breaches happen daily so practice good digital hygiene and update your login information regularly. Additionally if someone that shouldn’t be there still has admin access, the access will be cut off when the account is assigned a new password. If your team isn’t already using the best practice of two factor authentication, now is the time to start. In fact, many industries require 2FA.

My blogs: You Need a Digital Asset List | Two Factor Authentication Keeps Your Assets Safe

Create a Content Library

A pre-approved content library ensures that your team is using appropriate messaging and media. It meets compliance requirements and your marketers are also more efficient because it removes the constant back and forth need for legal approval. Marketers that don’t have a content library go looking for media they can use and often get into copyright trouble which is another legal headache.

Include a section that covers the do’s and don’ts, any disclaimers necessary, required messaging, and how to avoid misleading language.

My blogs: The Importance of Understanding Copyright

Archiving & Record Keeping

All of your communications on social media need to be archived. Your records should include posts, ads, and user engagement. All of this may be required in the event of a social media audit or investigation. Government in particular is subject to the Freedom of Information Act (FOIA) and is regularly required to provide these records. I personally have developed evidence files of this information on behalf of government clients. Behave like you’ll have to defend your actions in court and you’ll be multiple steps ahead should that ever happen.

The editorial calendar your team uses to plan out their content is a great starting point for record keeping. It’s purpose is to create a plan for the future but at the end of the month, review the content that actually went out (things change and move all the time) so that you have a chronological record of your posts.

Archiving to regulatory standards is difficult and time consuming to do manually. Investigate the vendors that provide this service and your industry specifications matter in this selection. Do your research and ask your colleagues at other organizations what they use. Yes, it’s expensive to pay for this service but the fines for violations are even more so.

My blog: Use An Editorial Calendar to Boost Your Content Workflow (among other benefits)

Build a Social Media Compliance Monitoring Plan

You’re definitely going to need a monitoring tool to supplement your manual efforts. Your team will need to monitor comments, spoofing of your social media accounts, and your partner’s social posts for regulation violations or misleading claims. There may be a requirement for you to report on those violations.

Make a point of performing vanity searches 1-2 times per year on your brand or organization’s name, products, taglines, etc. Include auditing your brand’s published content in case something non-compliant slipped through.

My blog: How to Perform a Social Media Audit

My 1st book: What You Don’t Know About Social Media CAN Hurt You: Take Control of Your Online Reputation (my books)

Disclose Sponsored Content

Informing your audience that content is sponsored and clarifying material connections is a standard requirement by the Federal Trade Commission (FTC) for all industries. It’s your responsibility to train your staff, influencers, selling partners and others that are posting on your behalf that they must disclose.

We most commonly see sponcon compliance with those using hashtags such as #ad or #sponsored. When advertising is purchased through digital ad exchanges (example Google, Meta, Amazon, etc.) they insert language such as “sponsored” to stay in compliance. When you’re creating content that isn’t run through an exchange, you must manually disclose and the disclosure needs be easily and quickly visible rather than at the end of a long caption.

Ask me about compliance consulting in advertising!

Invest in Regular Training

New employee training is standard. Add compliance to the items your team needs to learn at the beginning of their employment. But compliance and regulations change quickly so you’ll need to ensure your team gets training on a regular basis. Your marketing team, content creators, and partners will need an annual refresh.

Ask me about staff training!

Create a Crisis Management Plan

You have fire alarms and first aid kits, it’s time for you to create an emergency kit that encompasses all risks to your business. Crisis management plans cover all the potential dangers your organization could face, a plan of action on how to respond, and who needs to be involved.

When I build a crisis plan for a client, I insist on an annual review. Part of the plan is how you’ll communicate with the public when something happens. We expect that the regular marketing team will be doing the communicating but what if they’re not available and the emergency operations coordinator has to do it? The instructions for releasing vital information on each channel, traditional and new media, should be in your plan and the process to use channels changes over time. Additionally, the staff listed in the plan is extremely likely to change. Confirm the accuracy of emergency team members’ names, phone numbers, emails etc.

Then practice it. Just like in elementary school when we did fire drills. No matter how well you think you’ve designed, a crisis plan will fail if you don’t practice it. You’ll discover ways it needs to be adapted or elements that have changed. Muscle memory matters in an emergency.

My blogs: The Crisis Will Come: Are You Ready? | Process & Legacy Management: Steps to Take

Final Thought

It can feel overwhelming to work through social media compliance for regulated industries but just like anything else that’s complicated, it’s a process you can work through. Research, plan, find vendors to solve problems, train, and update.

Reach out to me if you’d like assistance in any of the listed areas. This topic is important to me and I want to help you get compliant.