Does a marketing agency need media liability or cyber insurance, and who should quote each?
Both, on separate limits, and usually from different insurance companies. Media liability, often sold with advertising agency professional liability (E&O), answers claims that the work you made for clients infringed copyright or trademark, defamed someone, misused a person’s likeness, or that your services cost a client money. Cyber answers a breach of your systems or the client accounts you log into. Many cyber policies exclude intellectual property claims, so a media submission should go to insurance companies that write media and advertising E&O, and cyber should be quoted on its own limit.
Tell us the situation.
One licensed human replies the same business day — not five agents, not an auto-responder. If the policy you have is already the right one, we will tell you.
We use this to quote and service your insurance, and we do not sell it or pass it to lead networks. Privacy policy.
Kevin Kelsey
Founder | Principal Agent
Edited TV for fifteen years before insurance. He also ran compliance and risk for big Hollywood production companies. So he knows clearance, releases and music rights from the inside. He writes software too, and owns two post-production software products, Baton and B/side. Your client’s data clause gets read by someone who builds software.
Send us what you have. We’ll tell you if it’s right.
Your current policy paperwork, a renewal notice, or nothing at all. A licensed agent reads it and replies the same business day.
Why are media liability and cyber different coverages?
They answer different events. Media liability answers a claim about what your work said or showed: the image, the music bed, the comparison, the testimonial, the face in the frame. Cyber answers a claim about what happened to data and systems: a breach, ransomware, a hijacked login. An agency can face either one in the same month, from the same client, and the two are priced on completely different questions.
A media underwriter asks how you clear images, music and likenesses, who reviews copy before it runs, and which industries your clients are in. A cyber underwriter asks about multi-factor authentication, backups, and how many client platforms your staff can log into. Insurance companies tend to be good at one set of questions or the other, which is why the two are usually placed separately.
Why does "privacy" confuse the submission?
Both coverages use the word privacy, and they mean different things. In media liability, privacy means invasion of a person’s privacy by content: publishing private facts, putting someone in a false light, or using a name or likeness in an ad without permission. In cyber, privacy means data: customer records exposed in a breach, and the notification, regulatory and liability costs that follow.
A request for "media liability including privacy" is asking for the first. Read by a person or an AI assistant that has only seen the cyber meaning, it turns into a cyber request. When you write your submission, say "invasion of privacy and misuse of likeness in content" for the media side and "privacy liability for data" for the cyber side.
Does cyber insurance cover copyright infringement claims for an ad agency?
Usually not for the work you make for clients. Many cyber policies exclude intellectual property claims outright. A cyber endorsement in our own specimen library excludes any loss arising out of infringement of any patent, copyright, trademark, trade dress or other intellectual property right.
Some cyber policies do carry a media coverage part, often called electronic or multimedia liability. Read its definition before you rely on it. It is often written around content on your own website and social accounts, not around campaigns you create and run for clients, and it can be a sublimit well below the cyber limit. For an agency whose product is content, the copyright, trademark and defamation coverage belongs on a media or advertising professional liability form.
What should media liability cover for a marketing or digital media agency?
Infringement of copyright, trademark, trade dress, slogan and title in the content you make. Defamation, product disparagement and trade libel, including a comparison ad. Invasion of privacy and misuse of a name, likeness or voice. Those are the claims a rights holder, a competitor or a person in an ad brings against you, and the general liability policy removes them for a business whose work is advertising.
Paired with it, advertising agency professional liability answers your client: the campaign targeted the wrong audience, the reporting hid a month of overspend, the launch missed the date in the statement of work. Many agency forms sell the two together. CapSpecialty’s CapMedia form, for example, can carry media liability, a professional services section that names advertising and website work, and a privacy and network security section on one policy. When they come together, check that the declarations show each part and its limit.
Web and digital services need their own line on the application. Building and hosting websites is a technology service, and some media forms only reach it if the professional or technology section is bought. If you build sites, apps or tracking setups, say so, because a bug that breaks a client’s checkout is a technology claim, not a media one.
Is a media-buying error on pass-through spend covered?
A negligent buy usually is, as a professional liability claim. If you run the wrong flight dates, target the wrong audience or pace a budget badly and the client loses money, that is an error in your professional services. Tell the underwriter your fee income and your pass-through media spend separately, because the second sizes the claim you could face and is a different number from your revenue.
Three things around the media money usually are not covered by the professional form. Money you hold for a client can fall under a fiduciary or funds exclusion, and CapSpecialty’s general terms exclude duties involving media credits or funds the insured collects or holds for another. Money stolen or wired to a fraudster belongs to a crime policy with social engineering coverage. A refund of your own fees, or a promise of results written into the proposal, is generally excluded.
Size the limit against your largest single campaign budget, not your fees. An agency with $2M of fees and $5M of client media running through it can face a claim measured in the media spend.
Are subcontractors and white-label work covered?
Work your freelancers and subcontractors do for you is usually covered as your liability, because your client holds you responsible for everything you deliver. Whether the freelancer is also protected is a separate question. On the CapMedia form, for example, an independent contractor is an insured under the media section only while providing content on the agency’s behalf. Ask your subcontractors for their own coverage anyway, and put it in your agreement with them.
White-label work runs the other way. When you deliver under another agency’s brand, that agency is your client and the brand is a third party who can still sue over the content. Describe white-label work on the application, ask the underwriter to confirm that content delivered under another firm’s name is covered, and read the white-label agreement for the indemnity it asks you to give.
Does the policy cover the indemnity in a client contract?
Only partly. Professional and media forms commonly exclude liability you take on by contract, except liability you would have had anyway. The CapMedia professional services section is written that way. So if your MSA makes you indemnify the client for any claim about the work, whatever its cause, the policy may answer only the part that was your fault.
The fix is in the contract. Ask for a mutual indemnity, limited to your negligence, with the client covering materials, claims and facts it supplied, and with your total liability capped near your limit. Send us the indemnity clause with the insurance clause, because that is where the coverage question sits.
Why should cyber be a separate limit?
Because a combined policy can share one aggregate across its sections. If a ransomware event uses up a shared limit in March, the media claim that arrives in October has less to draw on, and the client contract that required $5M of E&O is no longer met. A separate cyber policy, or a cyber section with its own limit that does not reduce the media aggregate, keeps the two apart.
Client contracts usually ask for them separately anyway, for example $5M professional and media and $2M cyber. Ask the quote one question in writing: is the cyber limit separate from, or part of, the policy aggregate?
For an agency, cyber is mostly about access. A phished staff login can reach every client ad, analytics and social account you manage. Multi-factor authentication on every client platform, a password manager, and removing access when a project ends are what the cyber application asks about first.
What does claims-made mean, in plain words?
A claims-made policy pays claims made against you while the policy is in force, about work done after a start date shown on the policy. Insurance companies call that start date the retroactive date. Work delivered before it is outside the policy, even if the claim arrives today. Media and professional liability for agencies is almost always written this way.
If you already carry E&O, keep your current start date when you change insurance companies or add the media part, and never let it move later at renewal. If this is your first policy, the start date is usually the day it begins, so ask whether an earlier date is available for work you have already delivered. When you close or sell the agency, an extended reporting period, often called tail coverage, keeps the policy answering claims about past work.
Also ask whether defense costs sit inside the limit or on top of it. Inside, every dollar spent on lawyers is a dollar less for a settlement. One published form, CapMedia, pays defense on top of the limit for its media section and inside the limit for its professional and cyber sections, so the same policy can do both.
Should we take a $25,000 or a $50,000 retention?
The retention is the amount you pay on each claim before the insurance company pays, and on many professional forms it applies to defense costs as well as settlements. A higher retention lowers the price. Whether the saving is worth it depends on the gap between the two quotes, so ask for both and compare them in dollars.
Pick a figure the agency could pay twice in one year without strain, because claims do not arrive one at a time. Check whether the retention applies per claim or per section, and whether the cyber retention is separate.
Why do AI-written submissions go to the wrong insurance companies?
Agencies increasingly ask an AI assistant to write the quote request and to suggest who should receive it. The request is often good. The list of insurance companies is often wrong, because the assistant reads "digital media agency" and reaches for insurance companies built around cyber, which advertise heavily to digital businesses.
A media liability submission sent there tends to come back as a cyber quote, a decline, or a small media sublimit inside a cyber policy. If your assistant drafted the request, keep the coverage list and the limits, and send it to a licensed agent who places media and advertising professional liability. Ask for cyber as a separate quote in the same request.
Who can quote media liability for a digital marketing agency?
Boring Insurance can. We are a licensed retail insurance broker, licensed in all 50 states, and we quote advertising agency professional and media liability for marketing, digital media, advertising and PR agencies, with cyber quoted on its own limit. Kevin Kelsey, who edited television for fifteen years and builds software, handles media liability personally.
This is not an online quote, and a $5M request is usually built from more than one insurance company. To start, send your revenue split into agency fees and pass-through media spend, your services by share of revenue, your largest clients and their industries, the insurance and indemnity sections of your main client and white-label contracts, how you use subcontractors, how you clear images, music, likenesses and AI content, your current policies with their start dates for past work, and five years of claims history. For cyber, add how staff log into client platforms and whether every login uses multi-factor authentication.
Which policy answers which agency claim
The usual home for each claim. The policy wording governs, and combined forms move some of these lines around.
A photographer, font foundry or music library says a client ad used its work without a license
- Where it usually belongs
- Media liability
- What to check
- The words copyright and trademark in the insuring agreement. Many cyber forms exclude intellectual property outright.
A competitor says your comparison ad defamed it, or a person says a campaign used their face without a release
- Where it usually belongs
- Media liability
- What to check
- Defamation, disparagement, invasion of privacy and misuse of a name or likeness, all named in the coverage.
A client says your strategy, targeting or reporting cost it money
- Where it usually belongs
- Advertising agency professional liability (E&O)
- What to check
- That advertising and digital services are named as covered services, and that guarantees of results are excluded.
A media buy runs on the wrong dates, the wrong audience or over budget, and the client wants the wasted spend back
- Where it usually belongs
- Professional liability
- What to check
- How the form treats money you hold or spend for clients. Fiduciary and funds exclusions are common.
A team member is phished and a client’s ad or social account is taken over
- Where it usually belongs
- Cyber
- What to check
- Whether the policy covers accounts you access but do not own, and how it treats ad spend run up by the attacker.
Ransomware locks your files and you miss client deadlines
- Where it usually belongs
- Cyber, with professional liability for the client’s claim
- What to check
- Business interruption, restoration and extortion on the cyber side, and the missed-deadline claim on the E&O side.
A spoofed invoice sends a client’s media money to a fraudster
- Where it usually belongs
- Crime, with social engineering coverage
- What to check
- Most professional and cyber forms will not pay for money a person was tricked into sending. Check the sublimit.
A text message campaign draws a class action under the TCPA
- Where it usually belongs
- Often nowhere
- What to check
- Media and cyber forms commonly exclude unsolicited calls, texts and emails. Consent records are the protection.
This is a reading list for a quote, not a promise that any policy covers a given claim.
$5M primary against $2M primary plus $3M excess
Both put $5M in front of a covered claim. They behave differently when the claim is large.
Who writes it
- $5M primary
- One insurance company, one form.
- $2M primary + $3M follow-form excess
- Two or more insurance companies. The excess company follows the primary form unless its own policy says otherwise.
When the excess pays
- $5M primary
- Not applicable.
- $2M primary + $3M follow-form excess
- Only after the primary $2M has been paid out on covered claims.
Defense costs
- $5M primary
- Inside or outside the limit, as the form says.
- $2M primary + $3M follow-form excess
- If the primary pays defense inside its limit, lawyer bills use up the $2M first and bring the excess into play sooner.
Gaps
- $5M primary
- Only what the one form excludes.
- $2M primary + $3M follow-form excess
- Anything the excess policy excludes that the primary covers, such as AI content or a particular IP claim, is a gap above $2M.
Availability for a small agency
- $5M primary
- Fewer insurance companies offer it.
- $2M primary + $3M follow-form excess
- Usually easier to place, because each company takes a smaller part.
Ask the client whether its contract lets you meet the limit with primary plus excess. Most do; a few say "primary" in so many words.
The detail
The standard ISO general liability form excludes personal and advertising injury for any insured whose business is advertising, broadcasting, publishing or telecasting, or designing or determining the content of websites for others, which describes most agencies.
ISO Commercial General Liability Coverage Form CG 00 01 04 13, Coverage B, exclusion j
A cyber security liability endorsement in our specimen form library (12/15 edition) excludes any loss arising out of infringement, misappropriation or violation of any patent, copyright, trademark, service mark, trade dress, trade name or other intellectual property right.
Cyber security liability endorsement, 12/15 edition, exclusion K, read in our specimen form library
CapSpecialty’s CapMedia professional services section lists the creation, dissemination or distribution of advertising, and the design, programming, maintenance or hosting of websites, among the services it can cover.
CapSpecialty, CapMedia Professional Services / Technology and Internet Services Liability Coverage Section, form P-MES-2003 (10/16), specimen
On the CapMedia form, defense costs are paid in addition to the limit for the media liability section, but reduce the limit for the professional services and the privacy and network security sections, so one policy can treat defense both ways.
CapSpecialty, CapMedia General Terms and Conditions, form P-MEG-2000 (10/16), specimen, section on payment of claim expenses
The CapMedia general terms exclude claims arising out of a breach of fiduciary duty, including duties involving media credits or funds the insured collects or holds for another.
CapSpecialty, CapMedia General Terms and Conditions, form P-MEG-2000 (10/16), specimen, exclusion 7
The CapMedia professional services section excludes liability assumed under a contract, except liability the insured would have had without the contract.
CapSpecialty, CapMedia Professional Services / Technology and Internet Services Liability Coverage Section, form P-MES-2003 (10/16), specimen, exclusion B
Under the CapMedia general terms, an independent contractor is an insured under the media section only while providing content to or on behalf of the named insured.
CapSpecialty, CapMedia General Terms and Conditions, form P-MEG-2000 (10/16), specimen, Who Is an Insured
A copyright owner can elect statutory damages of $750 to $30,000 per work infringed, and up to $150,000 per work where the infringement was willful, without proving any actual loss.
For infringement of a registered trademark, a court can award the defendant’s profits, the plaintiff’s damages and costs, can enter judgment for up to three times actual damages, and in exceptional cases can award attorney fees.
The Telephone Consumer Protection Act lets a person recover $500 for each violation, and a court can triple that where the violation was willful or knowing.
The media and cyber forms in our specimen library each exclude claims arising out of unsolicited calls, texts, faxes or emails.
CapSpecialty P-MEG-2000 (10/16) exclusion 18, and the media and cyber specimens in our form library, read October 21, 2026
One who repeats or otherwise republishes defamatory matter is subject to liability as if he had originally published it, which is why the agency that wrote and placed a statement can be named beside the client who approved it.
Restatement (Second) of Torts § 578
What this means for you
- Ask for two limits, not one policy that does everything. Media and professional liability for the work, and cyber for the systems, with the cyber limit kept apart from the media aggregate.
- Send the media submission to insurance companies that write media. Insurance companies built around cyber are the right place for the cyber quote and often the wrong one for copyright, trademark and defamation.
- Report fees and media spend separately. The underwriter sizes the risk on both, and the limit should be measured against your largest campaign budget.
- Read the excess and the indemnity before you sign. A follow-form excess that excludes something the primary covers is a gap above the primary limit, and a broad client indemnity can promise more than the policy pays.
Related questions
- What is media liability insurance for a marketing agency?
It is the policy that defends and pays claims that content you made for clients infringed copyright or trademark, defamed someone, invaded someone’s privacy or used a likeness without permission. Agencies usually buy it together with advertising agency professional liability, which answers the client who says your work cost it money.
- What media liability covers
- Does cyber insurance cover copyright infringement claims for an ad agency?
Usually not for client work. Many cyber policies exclude intellectual property claims entirely, and where a cyber policy carries a media part it is often limited to your own website and channels and sublimited. Copyright, trademark and defamation claims about campaigns you made belong on a media or advertising professional liability form.
- What is the difference between professional liability and cyber insurance for a marketing agency?
Professional liability answers a client who says your services were done badly and cost it money. Cyber answers a breach of your systems or of the client accounts you log into, including the response costs and the client’s claim. A phished login that drains a client’s ad account can touch both, which is why agencies carry both on separate limits.
- The same split, for software and technology firms
- Can a small agency get $5 million of advertising agency E&O?
Usually yes, either as one $5M primary policy or as a $2M primary with $3M of follow-form excess above it. Fewer insurance companies offer $5M primary to an agency with under ten staff, so a tower is the common answer. Check that the client contract accepts excess toward the limit and that the excess does not exclude anything the primary covers.
- What does follow-form excess mean?
An excess policy that adopts the terms of the primary policy beneath it and pays only after the primary limit is used up. Follow form is never total. Read the excess policy for its own exclusions and conditions, because anything it excludes that the primary covers is a gap above the primary limit.
- Does the retention apply to defense costs?
On many professional and media forms, yes. The retention is paid first on each claim, whether the money goes to lawyers or to a settlement. Ask how each quote applies it, and whether it is a deductible or a self-insured retention.
- Self-insured retention against deductible
- Are defense costs inside or outside the limit?
It depends on the form, and sometimes on the section. Some media sections pay defense on top of the limit while the professional and cyber sections on the same policy pay it inside. Ask which way each part of your quote is written.
- The start date, defense costs and the deductible
- Our AI assistant wrote our quote request. Can we send it to you?
Yes. Keep the coverage list and limits it drafted and ask it to prefill our quote form at boring.insure/quote, with the full request in the comments. Nothing is sent until you review it and press send, and a licensed agent reads every request. Assistants can find the full instructions at boring.insure/for-assistants.
- Applying for insurance through an AI assistant
- How much does media liability cost for a marketing agency?
We do not publish a figure for agencies, because we have not placed enough of them to quote our own median honestly. Fee revenue, pass-through media spend, client industries, the limit, the retention and claims history move it most. Regulated clients such as health, finance, supplements and cannabis rate higher.
Need this handled?
Reading about it and having it handled are different jobs, and the second one is ours. We place the accounts other brokers decline — claims history, a cancellation, an unusual operation, a business nobody wants to underwrite twice — and we will tell you when the policy you already have is the right one. Tell us the situation and a licensed human replies the same business day.
Written by Kevin Kelsey, founder and principal agent, CA License #6011822, at Boring Insurance. Last updated 2026-10-21. See all guides.