The World Cup has started and every brand wants to join the conversation. Some of what you are seeing is legal. Some of it will end in a cease-and-desist letter.
What you cannot use
The tournament name, the official emblem, the mascot, the trophy image, the official ball name and the phrase combinations FIFA has registered are protected trademarks. So are the participating federations crests. Using them without a licence, including in a "harmless" social post, is infringement. Adding "we are not affiliated" does not fix it.
What you can do
Football is not owned by anyone. You can talk about the sport, celebrate a result, run a promotion around match days, use your own creative around the theme, and reference the host cities. The test is whether an ordinary consumer would think you are an official sponsor.
The grey zone
Ambush marketing lives here: campaigns that evoke the event without naming it. Some of it is defensible, some is not, and the answer depends on how close you get. If your campaign only works because people assume you are a sponsor, you are on the wrong side of the line.
If you are planning a campaign around the tournament, have the creative reviewed before it runs. Pulling a campaign mid-flight costs more than the review.