FTC Rules for AI in Advertising: What's Illegal Now

If you market to US customers with AI anywhere in the pipeline, the rules that bind you are mostly not AI rules. They are the same deception and substantiation standards advertising has lived under for decades, now being applied to AI-generated reviews, AI-written claims and AI hype - sometimes vigorously, sometimes less so, depending on the year. As with my EU AI Act checklist, I am a marketer reading the primary sources, not a lawyer giving advice. What I can offer is the practitioner’s sort: what the FTC has actually banned, what it has actually enforced, what visibly changed in 2025, and the short list I would hold my own work to.

The one principle underneath everything

The Federal Trade Commission’s founding standard, Section 5 of the FTC Act, prohibits unfair or deceptive practices in commerce, and it does not care what tool produced the deception. The agency said this in the plainest possible words when it announced Operation AI Comply in September 2024: “Using AI tools to trick, mislead, or defraud people is illegal. The FTC’s enforcement actions make clear that there is no AI exemption from the laws on the books.”

That sweep charged five companies at once, and the list is a useful map of where AI meets illegality: DoNotPay for marketing an AI “robot lawyer” that had not been tested to do what the ads claimed, Rytr for selling an AI service that generated detailed fake consumer reviews, and three business-opportunity schemes (Ascend Ecom, Ecommerce Empire Builders, FBA Machine) that used AI hype to sell income promises that rarely materialized. Notice what I notice: none of these needed a new law. Untested product claims, fake reviews and invented earnings promises were already illegal. AI just industrialized them.

The fake reviews rule

The one genuinely new instrument is the FTC’s rule banning fake reviews and testimonials, finalized in August 2024 and effective 60 days after its Federal Register publication, in October 2024. It names AI directly: the rule covers reviews and testimonials “that misrepresent that they are by someone who does not exist, such as AI-generated fake reviews.”

For a marketing team, the rule’s practical edges:

No fake or false reviews or testimonials, including ones written by a model in the voice of a customer who does not exist. Prompting ChatGPT for “ten five-star reviews of my product” and posting them is squarely inside the ban.
No buying reviews conditioned on sentiment, positive or negative.
Insider reviews need disclosure. An employee or relative reviewing your product without saying so is covered.
No misrepresenting a company-controlled review site as independent, and no suppressing honest reviews with threats or bogus takedowns.
No buying or selling fake engagement signals - followers, views and the rest, when they misrepresent influence for commercial purposes.

The rule lets the agency seek civil penalties against knowing violators, which is what makes it sharper than a Section 5 case built after the fact. My blunt translation: testimonial content is now the single most dangerous place in marketing to let a model invent anything, and the anti-fabrication rules I use for product descriptions stop being merely good editing there and become a legal control. The design-side cousins of these violations - fake urgency, confirmshaming, trapped cancellations - have their own enforcement record, which I catalogued in the dark patterns guide.

Unsubstantiated claims, in both directions

The second cluster of trouble is substantiation, and AI creates exposure in two directions at once.

Claims about your AI. If your product or service markets itself as AI-powered, every performance number in that marketing needs evidence behind it before it runs. The case I would make every marketing team read is Workado, which advertised its AI content detector as 98% accurate. The FTC’s complaint said the model had effectively been trained on academic content, and independent testing on general content put accuracy at 53% - a coin flip sold as near-certainty. The 2025 order requires competent and reliable evidence before any such accuracy claim runs again. If your own site says “our AI improves conversion by 40%,” the question a regulator would ask is the one I would ask first: measured how, on whom, and can you produce it?

Claims your AI wrote. The mirror image gets less attention and touches more teams. A model drafting your ads will cheerfully supply specific, confident product claims that nobody measured, and shipping one does not become legal because software wrote it. The advertiser owns every claim in the ad. This is exactly why my ad copy prompts fence the model inside proof I supply, and why I treat claim-by-claim fact-checking of AI drafts as a compliance step wearing an editing costume.

What changed in 2025, honestly

Anyone telling you FTC AI enforcement in 2026 looks like 2024 has not read the docket. In December 2025, the Commission reopened and set aside its own Rytr order, concluding the complaint had not satisfied the FTC Act’s requirements and that the order unduly burdened AI innovation, citing the administration’s AI Action Plan, which directed agencies to review orders that burden AI development. The agency’s center of gravity moved from AI-tool-as-defendant toward a lighter touch on the technology itself.

Here is why I have not relaxed anything in my own checklist, and would not advise you to. The fake reviews rule remains on the books, and deceiving actual consumers with actual fake content was never the part anyone declared innovative. Enforcement of AI-washing continued into 2025 and 2026 against companies whose claims outran their evidence. State attorneys general enforce their own consumer protection statutes on their own timetables. Platform rules from Google, Meta and the ad networks bind faster than any of it. And a compliance posture calibrated to the current administration has the shelf life of an administration, while your published claims stay published. The floor moved. The thing I build to - claims we can prove, testimonials from humans who exist - did not.

The checklist I’d actually run

Seven items, in the order I would do them:

Audit every testimonial surface - site, ads, app store, case studies - and confirm each review traces to a real, identifiable customer. Anything generated, composited or “representative” comes down.
Write the testimonial policy in one line: no AI-generated reviews or endorsements, anywhere, ever. This is the clearest legal line in the whole area.
Build an evidence file for performance claims. Every number in live ads gets a source document and an owner. If a claim has no file, the claim comes off until it does.
Put a claims gate on AI-drafted copy. A named human approves every factual claim before an AI-assisted ad ships, with a verification pass as the working method.
Check your own AI marketing claims with Workado in mind. “AI-powered,” fine. “98% accurate,” only with the study in hand.
Mind material connections. Influencer and endorsement disclosure duties did not change because the endorser is synthetic or the deal was brokered by a platform. An AI persona promoting your product is an ad, and dressing it as an organic customer voice is the oldest violation in the book with new rendering.
Diarize a re-check. This area moved twice in two years. I would put a quarterly thirty minutes on the FTC’s press page against the cost of learning about the next shift from an enforcement letter.

FAQ

Do FTC rules require me to disclose that content or creative is AI-generated? As of my reading in September 2026, there is no general federal AI-disclosure mandate for marketing content. The US standard is deception: disclosure becomes mandatory where its absence misleads, with fake reviewers and fake endorsers as the clearest cases. The EU took the opposite road, and if you market into Europe, Article 50’s labelling duties apply regardless of what the FTC does. My full answer to the should-you-disclose question - law, platforms and the trust research together - is in the AI disclosure guide.

Are AI-generated testimonials illegal even if the product is genuinely good? The rule targets the misrepresentation, not the product quality. A glowing review from a customer who does not exist is a fake review whether or not real customers would agree with it. Collect the real ones instead - the prompt work that goes into mining actual customer language produces better copy than invention anyway.

Did the Rytr reversal make AI-generated reviews legal? No, and this is the misreading I most expect to cost someone money. The Commission set aside its order against the tool vendor. The fake reviews rule still prohibits the fake reviews themselves, and the advertiser who posts them is the party wearing the liability.

What about AI voice clones and deepfakes in ads? A cloned voice or synthetic likeness that misleads - a fake celebrity endorsement being the obvious case - lands under the same deception standard, and impersonation has drawn FTC rulemaking attention of its own. My rule of thumb: if the persuasive power of the asset depends on the audience believing a real person said something they did not, it does not ship.

This post is part of the ethics and compliance guides, alongside the EU AI Act checklist for the European half of the map. The verification workflow that keeps AI-drafted claims defensible is in my fact-checking prompts, and the wider practice starts at the complete guide to AI marketing. For anything with real exposure, the reading order is: this post, then your lawyer.