Safe and secure online marketing: the controls that protect your data, your accounts and your budget

Safe and secure online marketing is two jobs done at the same time: handling customer data lawfully and carefully, and keeping the accounts, scripts and budgets that run your marketing out of other people's hands. Both jobs sit with the marketing team rather than with IT, because marketing is the function that collects the data, installs the tracking and holds the logins with a payment card attached. The work is a short list of controls, most of them free, and a review you run every quarter.

This page covers the five places a marketing operation is exposed, the controls that close each one, the rules that apply when you hold somebody's contact details, and the scams that target marketing staff specifically.

The five places the exposure actually sits

• The advertising accounts. A live card, a spend history and, in many businesses, more administrators than anybody can name.
• The website. Forms that collect personal details, a content system with plugins, and whatever the last agency left behind.
• The email platform and the sending domain. Your whole customer list in one login, and a domain other people can forge if it is not configured.
• The tag layer. Every third party script on a page can read what is on that page. Most sites carry several nobody remembers adding.
• The people with access. Agencies, freelancers, the intern who ran the campaign in March, and the staff who have left.

Lock the accounts before anything else

Account takeover is the fastest way for a marketing operation to lose money, and the fix is routine. Turn on two step verification for every account that touches advertising, analytics, email or the website, and require it of agency users too. Then do the part most teams skip: open each platform's user list and read it out loud. Remove everybody who has left, everybody from a supplier you no longer use, and every second administrator who does not need to be one.

Three structural decisions are worth making once. Own your own assets: the ad account, the business profile and the analytics property should be created under your business, with the agency added as a user, so ending a relationship is an access change rather than a negotiation. Keep marketing spend on a card with a limit. And use individual named logins, because a shared password that three people know cannot be revoked when one of them leaves.

The website side

Serve the whole site over HTTPS, including every form and every redirect, and let nothing load over plain HTTP inside a secure page. Google's own guidance on enabling HTTPS covers the server side. Then look at what your forms ask for. Collect the fields you will actually use, keep card and identity details out of forms entirely and let a payment provider handle them, and send form submissions to a system with access controls rather than to a shared inbox. Keep the content system and its plugins updated on a schedule, delete plugins you stopped using, and take a backup you have tested by restoring it once.

Customer data: collect less, then prove you may use it

The safest record is the one you never kept. Write down which fields you need for the next twelve months of marketing and stop collecting the rest. For what you do keep, three questions settle most of it: how did this person come to be on the list, what did they agree to, and can you show it.

In the UK, electronic marketing by email, text and telephone sits under PECR alongside data protection law, and the regulator's guide to electronic and telephone marketing sets out when consent is needed and what counts as consent. The broader duties on holding personal data are summarised by the government's data protection page. Businesses marketing to people in India work to the Digital Personal Data Protection Act, 2023, and the practical consequences are the same shape: a lawful basis, a record of it, a way to withdraw, and a stated purpose you stay inside. Wherever you operate, keep the unsubscribe honest and immediate, and keep a dated record of how each contact arrived.

Tags are part of this. Where consent governs analytics and advertising cookies, the tag has to respect the answer rather than fire anyway, which is what consent mode exists to do.

The tag inventory, which almost nobody has

Open your tag manager and list every tag with three columns: what it is, who asked for it, and what it reads. Anything without an owner gets removed. It is a twenty minute job that reduces how many companies can see your visitors and tells you which vendors to name in your privacy notice.

Exposure	What it looks like in practice	The check that catches it
Dormant administrator	A former agency still has full access to the ad account	Read the user list in every platform, once a quarter
Forged sender	Somebody sends invoices as your domain	Publish SPF, DKIM and DMARC records and check the reports
Over collecting form	Date of birth on a brochure request	Field by field review of every live form
Unknown script	A tag from a tool cancelled two years ago	The tag inventory above
Shared login	One password in a spreadsheet for the whole team	Named users plus a password manager

The scams written specifically for marketing teams

Marketing inboxes receive a distinctive class of fraud, and all of it relies on urgency. The common shapes are a warning that your advertising account is suspended and will be deleted within twenty four hours, somebody claiming to be platform support asking you to confirm a login, an invoice from a supplier whose bank details have changed, a notice that your domain is about to expire, and a brand collaboration offer with an attachment. The defence is a habit rather than a tool: never act from a link in the message, open the platform yourself and look for the same notice inside the account, and confirm any change of bank details by phoning a number you already had. The UK's National Cyber Security Centre publishes a plain guide to spotting and reporting phishing that is worth circulating to everyone with an ad account login.

The quarterly review, in half an hour

• User lists in advertising, analytics, email, the website and the business profile, with leavers removed.
• Two step verification confirmed on every one of those accounts, including suppliers.
• Card and spend limits on the advertising accounts still correct.
• Tag inventory refreshed and unowned tags deleted.
• Live forms checked field by field, and one test submission followed to where it lands.
• Email authentication records present, and the unsubscribe tested from a real inbox.
• Privacy notice naming the tools currently in use, not last year's.

Ownership, agency access, privacy notices and search

Who owns this work, marketing or IT?

Marketing owns the decisions and IT owns the infrastructure. Marketing chooses what data to collect, which vendors get a script on the site and who holds an administrator seat, and those three decisions create most of the exposure. Ask IT for the server configuration, the backups and the password manager.

Is a privacy notice enough on its own?

A notice describes what you do. The protection comes from doing it: collecting fewer fields, honouring consent in the tags, keeping access lists short and deleting data you no longer need. Write the notice last, from what is actually true, and update it whenever a tool changes.

How much access should an agency have?

Enough to do the work it is paid for, on accounts you own, with named individual users rather than a shared login. Review the list when the contract changes, and remove access on the last day of the engagement rather than the week after.

What is the single most valuable control for a small team?

Two step verification on every marketing login, followed by a short administrator list. Those two together stop the losses that are both common and expensive, and neither one costs anything.

Does any of this affect how the site performs in search?

Some of it does, directly. HTTPS, a site that is not serving injected content, and a patched content system all affect how a search engine treats the site. Spam injected into an unmaintained site has cost businesses their visibility far more often than any marketing decision has.

What buyers now ask about whether you are safe to deal with

There is a second half to this subject that has appeared quite recently. A cautious buyer used to type "is this company legitimate" into Google and read a page of results. Now they ask ChatGPT, Gemini or Perplexity, and the answer arrives as a short verdict assembled from reviews, forum threads, news items and whatever your own site makes clear. Nothing on the page tells them which of those sources it leaned on unless they ask.

That makes the trust material on your own site load bearing in a way it was not before: a real registered address, named people, a clear returns and refunds position, a privacy notice written in plain words, and visible proof that payments and forms are handled properly. It is also worth knowing what the assistants currently say when somebody asks whether your business is safe to buy from. Type it in a buyer's words into each of them, and read what comes back as a security finding rather than a marketing one. AI Knows Us keeps that reading, including the pages each verdict was drawn from. It is the cheapest review on this page.