Standard Operating Procedures

Campaign Playbooks & SOPs

Step-by-step procedures for all BMS campaign operations

🔎
Google Ads Election Verification Identity verification for political advertising on Google
⌄
Key facts before you start Verification takes 5–7 business days. Requires government-issued ID. Done per-client — not per-business. Must be completed before any political ads go live.

1
Create a Google Ads account for the candidate
Use the candidate's campaign email (not personal). Set billing to the campaign credit card. Account name: "[Candidate Last Name] for [Office] [Year]"
2
Navigate to Identity Verification
Google Ads → Tools & Settings → Account Access → Verification. Or search "election ad verification" in the Google Ads help center to find the current URL.
3
Select "Elected official or candidate" as advertiser type
Do NOT select "political party" or "issue-based advertising." The candidate type triggers the correct verification flow.
4
Submit government-issued ID
Driver's license or passport. The name must match the campaign account registrant exactly. Upload a clear, well-lit photo of both sides if a DL.
5
Submit EIN or campaign committee registration
If the campaign has a registered committee, use that. Otherwise, use the candidate's personal EIN or SSN (Google verifies identity, not the business).
6
Wait 5–7 business days
Google will email the account registrant when verification is complete. Do not submit duplicate applications — this resets the clock.
7
Confirm “Verified” status and begin campaign build
Once verified, all election ads will display the "Paid for by [Name]" disclosure automatically. Start campaign structure per runbook.
Common failure point The #1 cause of rejection: mismatch between the account registrant name and the name on the submitted ID. Verify exact name spelling before submitting.
💬
Meta Political Ad Authorization Facebook Page setup, political ad authorization, business verification
⌄
Two separate processes Business Verification (for BMS as advertiser) is separate from Political Ad Authorization (per-candidate, per-US state). Both must be complete before running ads.

1
Create a Facebook Page for the candidate
Category: "Politician." Name: "[Full Name] for [Office]." Use the candidate's personal Facebook account as the Page admin. Add BMS as an Editor or Analyst.
2
Add the Page to BMS Meta Business Suite
Meta Business Suite → Settings → Pages → Add → Request access to an existing Page. The candidate's admin account must approve the request.
3
Create an Ad Account for the candidate
Meta Business Suite → Settings → Ad Accounts → Add → Create new. Currency: USD. Time zone: candidate's local zone. Name: "[Candidate] Campaign [Year]"
4
Initiate Political Ad Authorization
facebook.com/id/verify → Select "Ads about social issues, elections or politics" → Choose the candidate's Page. This is per-Page and per-state.
5
Submit government ID and last 4 SSN
The candidate must complete this step themselves — it requires their personal identity verification. BMS cannot do this on their behalf.
6
Submit "Paid for by" disclaimer text
Required disclosure that will appear on all political ads. Format: "Paid for by [Candidate Name] for [Office]" — must match campaign finance registration.
7
Link ad account to the candidate Page
Ad account must be explicitly linked to the authorized Page. All political ads must run from the authorized Page — cannot use a generic BMS Page.
📷
Instagram Business Address Removal Remove home address from public Instagram profile — MOBILE APP ONLY
⌄
Mobile app only — not available on web The "Contact Options" setting that allows removing a Business Address is only accessible through the Instagram mobile app. The Instagram web interface does not expose this option.

1
Open Instagram on mobile (iOS or Android)
Ensure you are logged in to the correct account — personal or campaign profile where the address is visible.
2
Go to your Profile → Edit Profile
Tap your profile photo or name in the bottom nav → tap "Edit Profile" button at the top of your profile page.
3
Scroll down to "Contact Options"
This section only appears for Creator or Business accounts. If you don't see it, the account may be a Personal account (no address field exists).
4
Tap "Business Address" and clear the field
Delete all text in the address field. Leave it completely blank. Do not replace with a P.O. Box unless the campaign explicitly wants that visible.
5
Also clear "Phone" and "Email" if personal
While in Contact Options, verify that no personal phone number or personal email address is exposed. Campaign contact info only, or leave blank.
6
Save → verify profile from another account or incognito
Open the profile in an incognito browser or from a different account to confirm the address is no longer visible publicly. Screenshot for audit record.
Privacy setting also recommended Profile → Settings → Privacy → "Show account suggestions on profiles" — turn OFF. Prevents connecting candidate's personal account to campaign account via Instagram's suggestions.
🧥
Social Media Hygiene Audit 5-phase process for candidate social media security and scrubbing
⌄

The Social Hygiene Audit is a structured 5-phase process run for every new client before campaign launch. Uses the BMS Social Hygiene Scanner with 238 keyword patterns.

Phase 1
Data Export Request
Request full data exports from all platforms (Instagram, Facebook, X, TikTok). Allow 24–72 hours for processing. See "Data Download Requests" playbook for per-platform steps.
Phase 2
Automated Scanner Pass
Run python sanitize.py scan ~/Downloads/export/ --name "Client Name" --deep across all downloaded exports. Review the JSON report for flagged items.
Phase 3
Manual Review of Flagged Items
Every item flagged by the scanner requires human judgment. Not all flags are actionable. Categorize as: Delete, Archive privately, or Clear (false positive).
Phase 4
Privacy Settings Lockdown
Review and harden privacy settings on all platforms: remove home address, hide contact info, audit tagged photos, restrict check-in history, review connected apps.
Phase 5
Audit Report Generation
Generate client-facing summary report. Document: what was found, what was deleted, what was secured, and any ongoing monitoring recommendations. Store in client file.
Scanner commands reference See the OPSEC Audit Center for full CLI command reference and current scanner status.
🔑
Client Account Creation Checklist Setting up all campaign accounts from scratch with proper security
⌄

Use this checklist when a candidate needs new campaign accounts created. All accounts should be created fresh — do not use personal accounts for campaign purposes.


Campaign email address — Create a dedicated Gmail or campaign domain email. Format: [name]for[office]@gmail.com or contact@[nameforoffice].com
Password manager setup — Install Bitwarden or 1Password. Generate a unique, 20+ character password for every account. Never reuse passwords.
MFA on all accounts — Use an authenticator app (Google Authenticator, Authy) — NOT SMS when possible. Store backup codes in the password manager.
No home address on any account — Use the campaign P.O. Box, registered agent address, or leave blank. Never use the candidate's home address.
Facebook Page (not personal profile) — Create as "Politician" category. Connect to BMS Business Suite. Do not friend people from a Page.
Instagram Business account — Switch to Creator or Business type. Remove Business Address. Verify privacy settings.
X / Twitter account — @handle format: [Name]For[Office][Year] or [Name][Office]. Set location to district/city — not home address.
YouTube channel — Linked to campaign Gmail. Channel name: "[Full Name] for [Office]". Set up About page with campaign site link.
Google Ads account — New account under campaign email. Add BMS as admin. Begin election verification process immediately (5–7 business days).
Meta Ads account — Created in BMS Business Suite, linked to candidate's Page. Begin political ad authorization process.
Google Analytics 4 — New GA4 property linked to campaign website. Share access to BMS service account.
Recovery options — All accounts must have a recovery email AND phone set. Document in secure client file. Never use personal recovery contacts.
💾
Data Download Requests Per-platform steps for requesting full data exports
⌄

Request data exports before running the Social Hygiene Scanner. Exports typically take 24–72 hours. Download in JSON format when available for scanner compatibility.


Instagram & Facebook (via Accounts Center)
1
Open Accounts Center
Facebook or Instagram → Settings → Accounts Center. This is a unified interface — one request covers both platforms.
2
Your information and permissions → Download your information
Select the account(s) to include. You can include both Facebook and Instagram in a single request.
3
Select "Download or transfer information"
Choose "Download to device." Select date range: "All time." Format: JSON (not HTML). Quality: Low (for posts/text — we don't need full-res photos).
4
Submit and wait for email notification
Meta will email when the download is ready (typically 24–48 hours). Link expires after 4 days — download promptly.
X / Twitter
1
Settings → Your Account → Download an archive of your data
On X web (not app). May require password re-entry and 2FA verification.
2
Request archive
X will email when the archive is ready. Typically 24–72 hours depending on account age and volume. Download immediately — link expires.
3
Extract and run scanner on the "tweets.js" file
The archive is a ZIP. Extract it. The scanner looks at data/tweets.js and data/like.js primarily.