Brands in the healthcare, finance, cannabis, alcohol, tobacco, iGaming and wellness sectors are now operating according to a marketing strategy that bears little resemblance to that of two years ago. Platform restrictions have tightened, AI-powered search has even changed the very meaning of visibility, and the cost of a poorly worded statement has never been higher. The brands that have adapted most quickly have rebuilt their entire approach around these rules, rather than looking for ways to circumvent them.
Compliance starts with the product
The most significant change in regulated marketing concerns the stage of the process at which legal considerations come into play. For years, legal review has been situated at the end of the workflow, as a final check before a campaign is launched. This model breaks down the moment a channel, a claim or a jurisdiction proves ineligible after the creative material has already been produced.
The regulatory threshold, for its part, has not been lowered. The Federal Trade Commission’s (FTC) guidelines on advertising for health products are based on two principles, which apply far beyond supplements and pharmaceutical products. The original text formulates them as follows: advertising must be truthful and not misleading, and advertisers need adequate substantiation for objective product claims before an advert ever runs. The standard covers more than just the literal wording of an advert: images, testimonials, the product name and the surrounding context can give rise to implied claims, which are subject to the same substantiation requirements as an explicit claim. It is precisely this kind of detail that is lost when compliance is treated as a final hurdle, even though its natural place is in the campaign design.
Compliance as a ritual and compliance as a practice
The mechanism explaining the failure of end-of-process verification was formulated in 1977 by sociologists John W. Meyer and Brian Rowan, in a study published in the *American Journal of Sociology* under the title ‘Institutionalised Organisations: Formal Structure as Myth and Ceremony’. Starting from the observation that organisations adopt formal structures (departments, procedures, control functions) largely because the institutional environment rewards them with legitimacy, the authors showed that these structures often become decoupled from the actual technical work. The procedure exists and is invoked before auditors and the authorities, whilst the actual work is carried out according to different rules. The legal verification at the end of the process is, in these terms, an almost classic form of ceremonial compliance, since the lawyer’s signature certifies a campaign whose key decisions – from the choice of channel to the promise made to the public – were taken without him.
Shifting compliance to the beginning of the process can therefore be interpreted as a realignment of the formal structure with actual practice. It is worth noting that subsequent literature has considerably nuanced the initial thesis. Patricia Bromley and Walter W. Powell, in a review published in 2012 in the *Academy of Management Annals*, observed that, as audits and reporting have become more widespread, the classic gap between policy and practice has become increasingly difficult to maintain. It has been replaced by a more subtle form, termed by the authors ‘means-ends decoupling’, in which procedures are effectively implemented but remain disconnected from the purpose for which they were created. For regulated marketing, this distinction has an immediate practical consequence: a compliance meeting scheduled at the start of a project can, in turn, become a ritual if it does not alter what is actually produced. The relevant indicator remains the proportion of claims that reach the market with the supporting documentation already in place, regardless of when the verification takes place.
When applied to the FTC’s requirements regarding implied claims, this distinction becomes operational. An implied claim, conveyed through a laboratory image or a product name, escapes verification that merely examines the text of the advert, as it arises from the combination of visual, verbal and contextual elements – that is, precisely from the decisions taken during the design phase. A compliance procedure linked to practice must therefore have access to the brief, the brand direction and the product name before these are finalised.
The theory has limitations that must be acknowledged. Christine Oliver, in a 1991 article published in the *Academy of Management Review*, criticised the institutional approach for portraying an organisation as relatively passive, absorbing the myths of its environment without negotiating them. Empirically measuring the degree of decoupling has, since then, remained a recurring challenge in the field. Meyer and Rowan’s model therefore functions as an interpretative lens, the conclusions of which must be verified on a case-by-case basis. Its usefulness lies in the fact that it shifts the focus from the existence of a procedure to its effect on what actually reaches the consumer.
Why first-party data and SEO now carry more weight
Eligibility for paid advertising varies enormously from one category to another and, in some cases, from one product to another within the same company’s portfolio. A financial services provider may face different rules for a loan product compared to a savings account. A cannabis company may operate legally in a US state, yet remain restricted on the advertising platforms it would normally use to reach precisely that market. When paid access narrows, two channels tend to take over: organic search and direct customer relationships, built on the basis of consent.
Educational content works particularly well in this context, as it gains visibility without making the sort of promotional claims that attract stricter scrutiny. First-party data, collected via consent-based email, loyalty programmes and contractual relationships, provides the brand with a channel that does not depend on the advertising policy of any single platform. Neither approach exempts a brand from the rules governing claims, but both offer a regulated business greater scope for customer engagement when an acquisition channel narrows or disappears entirely.
When the law redefines a category: the case of hemp
The example of a cannabis company – legal in one state but restricted on platforms – now has a more drastic federal counterpart, which directly affects how businesses are classified. Public Law 119-37, signed on 12 November 2025 as part of the Farm Bill for the 2026 financial year, amended the federal definition of hemp. The 0.3 per cent threshold is now calculated based on total THC content, rather than delta-9 THC, and finished hemp-derived products containing more than 0.4 milligrams of THC per container are excluded from the definition. According to a note from the Congressional Research Service (CRS) dated December 2025, the new definition comes into force on 12 November 2026.
The implications go far beyond simply rewording some advertisements. A shop may publicly describe itself as a retailer of THC-containing hemp products on its own website, in its map listings and in the registers with which it is registered. After that date, the same description will either no longer correspond to its offering or will refer to an activity that falls outside the legal framework governing hemp. A business’s classification – that is, the label under which it can be found – thus depends on a legal definition over which the business has no control, and maintaining this classification becomes a compliance obligation with the same status as verifying the advertising text.
For agencies operating in this sector, the deadline of 12 November 2026 requires an inventory of all instances where the client is described: category pages on their own website, product listings, profiles in registers and directories, email sequences and loyalty programme materials. These are precisely the organic and first-party channels that the strategy has established as an alternative to paid advertising. The paradox, if it can be called that, is that these channels, whilst more resilient to changes in platform policies, are more vulnerable to changes in the law, as they contain permanent descriptions that are indexed and reposted by third parties, and which do not disappear when a campaign ends.
The same reasoning applies, on a less dramatic scale, in the financial sector, where the financial services section of the Jasmine Directory distinguishes between commercial lending, leasing and investment services. Each of these activities is subject to a different licensing regime, and the example of lending compared with a savings account illustrates precisely this difference.
What, in practical terms, does a modern strategy for regulated sectors look like?
Brands that successfully implement this approach treat paid advertising, SEO and email as parts of the same effort. Herb Agency, which works in cannabis, hemp, nicotine, wellness and other restricted categories, provides a useful example of what an interconnected system looks like in practice. According to its own statement, the agency reports more than 11 years’ experience in regulated industries, a combined monthly audience reach of over 14 million, and works with more than 1,000 brands. Its activities cover paid media, SEO, email, first-party data and content, coordinated as a single system, without separate providers for each stage.
This structure matters because a client in a regulated sector rarely converts following a single point of contact. Someone might discover a brand through a search, then read educational content explaining a product they do not yet understand, subscribe via email, and only later respond to a paid campaign. A strategy that treats each of these channels in isolation loses the ability to see, or optimise, the entire journey.
Why specialist partners are replacing generalist agencies
For the same reason, more and more regulated brands are moving away from generalist marketing agencies altogether. A campaign that would be routine for a standard consumer brand may involve genuine exposure to regulatory risks in a restricted category. A partner without direct experience of that category’s specific regulations is more likely to uncover a problem after launch than before it. Working with a digital agency for regulated industries means that the verification of claims, channel eligibility and audience checks are integrated into the strategy from the outset, rather than being added later, once the campaign has already been run.
How can a specialist partner be assessed from the outside
The recommendation to work with a specialist raises an issue that every marketing director in a regulated sector faces. An agency’s claimed specialisation cannot be verified before the contract is signed, and the consequences of a poor choice usually only become apparent after launch, in the form of a suspended campaign or a notice from the regulatory authority. The figures that agencies publish about themselves – from years of experience to the number of brands they serve – are useful pieces of information, but they remain statements from an interested party and should be read as such.
A recent legal development illustrates why the independence of the source describing an agency matters. The FTC’s rule on consumer reviews and testimonials (16 CFR Part 465), finalised in August 2024, came into force on 21 October 2024. Among other things, it prohibits fabricated or paid-for reviews, the suppression of negative reviews, and review sites controlled by a company that present themselves as independent; at the time of adoption, civil penalties amounted to $51,744 per violation. The rule applies to the US market, but its rationale is universally applicable, as a review is only informative to the extent that the publisher is not a party to the transaction.
This is where the editorial role of a business director comes into play, a role that is more modest than is often attributed to it. A director with human editorial oversight, such as the internet marketing category of the Jasmine Directory, verifies that the agency exists as an entity and that its stated activity corresponds to the category in which it is listed. It also checks that the identification and contact details remain consistent over time, so that the agency can be located and compared with other providers in the same category.
The verification process ends here, and its limitations must be explicitly stated. A listing does not guarantee the quality of the work, does not constitute a recommendation, and does not certify compliance with the rules of the FTC or the financial authority in a particular jurisdiction. Nor does it replace consultation of official registers, such as each state’s cannabis licence records or the financial supervisory authority’s authorisation register, which remain the primary source for any claim regarding authorisation. Assessing a partner therefore involves a series of checks: identity and category are confirmed via an independent register; regulatory competence is tested by requesting examples of supporting documentation for similar claims; and authorisations are verified directly with the issuing authority.
The origin of claims in AI-assisted search
A search engine that generates a summarised response, rather than a list of results, implicitly endorses the claim it reproduces; for this reason, it has every interest in prioritising sources that it can corroborate from multiple independent sources; this logic links compliance with visibility through a common mechanism. A supporting dossier, as defined by the FTC guidelines, and a coherent profile of the entity – in the sense that search engines understand a business – are built from the same material, namely verifiable data attributed to a source. A brand whose name, address, licence and category differ from one register to another gives an automated system grounds for doubt, just as a claim without an attached study gives a lawyer grounds for doubt.
The analysis published on the Jasmine Directory blog about the E-E-A-T signals that editorial directories can build describes this mechanism from the perspective of author authority and states, with the caution that the subject demands, that the available evidence is correlational and does not demonstrate a direct effect on rankings.
For a regulated business, the practical implication is that compliance efforts and visibility efforts can share the same infrastructure without becoming confused. The consistency of public data does not replace the scientific basis of a claim, nor does that basis, in itself, generate visibility; however, both operate on the same raw material, namely information that can be verified by a third party.
Conclusion
The shift in strategy from 2026 is less about new tactics and more about the order in which decisions are made. Compliance has moved from the end of the process to the beginning, and first-party data and organic content have taken over the territory that paid advertising can no longer reliably sustain. Brands that treat everything as an interconnected system achieve better results than those that continue to manage SEO, paid advertising and email as separate budget lines. Regulated industries could never have bought their way out of these rules, even with larger budgets, and those adapting most quickly are building their strategy around this reality.
For management teams that still budget for compliance and marketing as two unrelated lines, this is the key lesson of 2026. Businesses that are pulling ahead of the competition in restricted categories have stopped asking whether a channel is technically available and have started asking whether the entire system (claims, creative assets, targeting and measurement) was built to withstand scrutiny from day one. This distinction will matter more and more as platform policies continue to tighten, and AI-powered search continues to reward sources able to demonstrate where their claims actually come from.
Viewed from a broader perspective, shifting compliance upstream and maintaining a business’s public records are two sides of the same requirement: the description of an organisation, whether set out in an advert, a legal filing or a listing, must match what the organisation actually does. The discrepancy between the two – which Meyer and Rowan described as an almost structural condition of institutional life – becomes, in regulated markets, a vulnerability that the authorities can measure and penalise.
