FTC AI Disclosure Requirements for Advertising and Marketing: Three Risk Areas Marketers Must Understand in 2026

Why FTC AI Enforcement Shifted from Guidance to Consent Orders

For years, the FTC's posture on AI in advertising was mostly guidance documents and blog posts. That changed on September 25, 2024, when the agency launched Operation AI Comply with five simultaneous enforcement actions. By mid-2026, the agency had resolved or filed more than a dozen cases targeting AI-related deception across capability claims, fake review tools, and AI-powered income schemes.

There is no standalone federal AI advertising statute. Every enforcement action runs through Section 5 of the FTC Act — the prohibition on deceptive acts and practices — and the Endorsement Guides revised in October 2023. The FTC does not need a new AI law to act. It applies existing consumer protection authority to whatever AI claims happen to be in front of it.

"Using AI tools to trick, mislead, or defraud people is illegal. The FTC's enforcement actions make clear that there is no AI exemption from the laws on the books."

That framing came from then-Chair Lina Khan at the launch of Operation AI Comply. In September 2025, Chairman Andrew Ferguson — appointed under the current administration — reinforced the continuity of this approach, stating that the agency had 'repeatedly deployed its consumer-protection authority to protect consumers from false and misleading claims about AI products' capabilities.' The enforcement record since then backs it up: new cases were filed into 2026 under Ferguson's leadership.

What most compliance summaries miss is that the FTC's AI enforcement covers three structurally different risk areas. Each has its own legal hook, its own enforcement record, and its own required team response. Treating them as a single vague obligation is how marketers end up exposed in the area they did not think applied to them.

Risk Area 1: AI-Washing — When Capability Claims Outrun the Product

AI-washing is the advertising equivalent of overpromising. If your marketing claims that AI automates a task, achieves a specific accuracy level, or replaces a human function, the FTC expects you to have competent and reliable evidence backing that claim before it runs. This is not a new standard invented for AI — it is the same substantiation requirement that applies to any advertising claim. AI does not get a softer threshold.

The enforcement record through mid-2026 makes the pattern clear. Each of the following cases involved a specific type of AI capability claim that the FTC determined was unsubstantiated or outright false.

The CMG case introduced a theory that extends liability beyond the brand making the claim. MindSift and 1010 Digital Works — vendors who supplied CMG with the marketing tools and infrastructure — were also charged, on the grounds that they provided the 'means and instrumentalities' to deceive consumers. A vendor who hands a partner the tools of deception can be liable alongside the brand that deploys them.

Demo videos carry the same risk as written claims. When Apple pulled a Siri ad after the features it depicted were delayed, and when Google unlisted a Gemini demo following an NAD inquiry, both situations illustrated the same principle: showing an AI capability in a video implies that capability is currently available. Curated prompts, cherry-picked outputs, and edited response times are all implicit claims. The Apple $250 million settlement in Landsheft v. Apple — a consumer class action alleging that Apple marketed Apple Intelligence features before they were available — illustrates that private litigation risk runs on the same theory as FTC enforcement.

The operational implication is direct: if a claim about your AI product or feature would require substantiation for any other advertising claim, it requires the same substantiation here. Disclaimers buried in fine print do not save a headline claim that is materially misleading. As one analysis of the Growth Cave case put it, 'if a product requires significant manual effort, an AI-powered headline won't be saved by easily-missed disclaimers.'

Risk Area 2: AI-Generated Content in Advertising — The Double Disclosure Framework

When AI generates or substantially modifies sponsored content, practitioners generally need to satisfy two separate disclosure obligations: one for the paid or sponsored relationship, and one for AI involvement. This is sometimes called the 'double disclosure' framework — but that label is practitioner shorthand, not a codified rule. There is no standalone federal AI disclosure statute. What applies is the FTC's existing consumer protection framework, including Section 5 and the 2023 Endorsement Guides, interpreted to cover AI-generated content.

The practical question for any piece of sponsored content is: did AI generate or substantially modify this? If yes, the disclosure obligation is triggered in addition to whatever sponsorship disclosure already applies. The harder question is where the trigger boundary sits.

Platform mechanics matter because the disclosure has to be clear and conspicuous — a hashtag buried among a dozen others does not meet that standard. Each major platform has its own disclosure tooling, and using it correctly is part of compliance.

• Instagram: Use the Paid Partnership tag for the sponsorship disclosure. Add an explicit AI disclosure in the caption — something like '#AIGenerated' or 'This content was created with AI assistance' — positioned prominently, not buried after multiple lines of text.
• YouTube: Check both the 'Includes Paid Promotion' box in video settings and the 'Altered or Synthetic Content' checkbox where AI-generated or AI-modified content is involved. Both disclosures must be active.
• TikTok: Toggle the Paid Partnership label for sponsorship and include an explicit AI disclosure in the caption. TikTok's own content policy increasingly requires disclosure for AI-generated realistic content.

The practical implication: disclosure compliance cannot be delegated to the influencer or the agency and then forgotten. Brands need a review checkpoint that confirms both the sponsorship disclosure and the AI disclosure are present before content goes live — not after.

Risk Area 3: AI-Generated Fake Reviews and Testimonials

The third risk area is distinct from the first two in an important way: it has its own rule. The Consumer Review Fairness Act Rule, finalized August 14, 2024 and effective October 2024, gives the FTC explicit civil penalty authority to pursue AI-generated fake reviews. The rule was passed 5-0. It covers not just the brand publishing fake reviews, but the tools and services that enable their creation.

The prohibited practices under the rule include creating or selling reviews that misrepresent that they are by someone who does not exist — including AI-generated fake reviews — buying reviews conditioned on positive sentiment, posting insider reviews without disclosing the material connection, operating company-controlled review sites misrepresented as independent, suppressing negative reviews through legal threats or intimidation, and purchasing fake social media indicators such as bot-generated followers or views.

The Rytr Case: What Happened and What It Means Now

The founding enforcement case in this area was Rytr, included in the original September 2024 Operation AI Comply actions. The FTC charged Rytr with providing subscribers the means to generate false and deceptive written content for consumer reviews — establishing that offering a service specifically designed to produce fake reviews is itself a Section 5 violation, regardless of whether the brand using it is the one being reviewed.

However, on December 22, 2025, the current FTC reopened and set aside the Rytr consent order. The Commission's stated reason was that the original complaint 'failed to satisfy the agency's standards.' This is a procedural vacatur — not an exoneration of the underlying theory. The fake-review rule remains in effect, and the Section 5 theory that providing the means to generate fake reviews constitutes a violation has not been repudiated. Rytr should not be cited as settled precedent for either side of the question.

In December 2025, the FTC sent warning letters to ten companies flagging potential Consumer Review Rule violations. Practices flagged included generating or purchasing fake reviews, offering incentives only for positive reviews, failing to disclose insider relationships, and suppressing negative feedback. Warning letters are not enforcement actions, but they signal that the agency is actively monitoring and that recipients who do not correct flagged practices face escalated risk.

The per-violation civil penalty for Consumer Review Rule violations is $53,088 in 2026. That figure applies per individual piece of non-compliant content. A campaign that publishes 100 non-compliant posts could in theory generate exposure exceeding $5 million. That is a theoretical maximum, not a standard enforcement outcome — context, proportionality, and whether the conduct was knowing all factor into what the FTC actually pursues. But the scale of potential exposure is real enough that it should inform how marketing teams think about AI-assisted review generation.

• Do not use AI tools to generate consumer reviews or testimonials, even for internal testing purposes if the output could be published.
• Do not purchase reviews conditioned on positive sentiment, regardless of whether the reviewer is a human or an AI-assisted service.
• Disclose any material connection — employment, compensation, free product — when employees, contractors, or paid affiliates post reviews or testimonials.
• Do not operate a review aggregation site or widget that presents company-selected reviews as independent consumer opinion without disclosure.
• Audit third-party review management tools and agencies for practices that could violate the rule on your behalf — brand liability applies.

State Laws Layering on the Federal Floor

Federal FTC exposure is the primary compliance concern for most US marketing teams, but two state-level developments in 2026 create additional obligations — and in some cases, they apply to campaigns that never involved a single FTC-regulated act.

New York A8887-B: Synthetic Performer Disclosure

New York's synthetic performer disclosure law (A8887-B), signed December 11, 2025, took effect June 9, 2026. It requires that any person who produces or creates an advertisement conspicuously disclose the use of a synthetic performer — defined as a digitally created human likeness generated by AI or software that is not recognizable as any identifiable natural person — where the producer has actual knowledge of its use.

The obligation runs to the producer or creator of the ad, not to media outlets that publish or disseminate it. The law covers visual and audiovisual advertisements distributed to New York audiences, including online and social media campaigns. It does not apply to audio-only ads, language translation of a human performer's existing content, or advertisements for expressive works.

Five Process Changes Marketing Teams Can Implement Now

The following changes are designed to be implemented at the team level — they do not require outside counsel to execute, though specific situations may warrant legal review. Each addresses one of the three risk areas.

1. Add an AI use flag to the creative brief. Before any piece of sponsored content or product claim enters production, the brief should include a field asking: 'Was AI used to generate or substantially modify any element of this content?' A 'yes' answer automatically routes the brief to a legal or compliance review checkpoint before the content goes live. This prevents the most common failure mode: AI-generated content that ships without anyone asking the disclosure question.
2. Build a two-question disclosure check into the content approval workflow. For every piece of content that touches an external audience: (1) Is this sponsored, paid, or part of a material relationship that requires disclosure? (2) Did AI generate or substantially modify any part of what the audience sees or hears? If both answers are yes, both disclosures are required. Make this a literal checklist item in whatever tool your team uses for content approval — not a verbal reminder.
3. Require substantiation documentation before any AI capability claim ships. If your marketing claims that AI automates a task, achieves a specific accuracy rate, or replaces a human function, that claim needs documented evidence before it runs. Assign ownership of the substantiation file to a specific person — product, legal, or marketing ops — and make that file a required attachment to the ad approval. The Growth Cave and Workado cases both turned on claims that could not be supported when examined.
4. Audit third-party agency and tool contracts for liability allocation. Brands are liable for their agents' non-compliant conduct. Review your agency agreements and AI tool vendor contracts to confirm: who is responsible for ensuring AI disclosure requirements are met in content they produce on your behalf? Does the contract allocate liability if the agency or tool generates non-compliant content? The CMG 'means and instrumentalities' theory shows that vendors can also be held liable — but that does not eliminate brand exposure.
5. Establish a platform disclosure checklist for each channel where AI-generated sponsored content is published. Different platforms have different disclosure mechanisms, and using the wrong one — or placing a disclosure where it will not be seen — does not satisfy the clear-and-conspicuous standard. Document the correct disclosure method for each platform your team uses (Instagram, YouTube, TikTok, LinkedIn, Meta Ads, Google Ads) and make that checklist part of the pre-publication review for any AI-assisted sponsored content.

Editorial Caveat: What This Article Cannot Tell You

This article reflects the state of FTC enforcement and related law as of June 2026. The regulatory environment is actively evolving. Chairman Ferguson's FTC has continued filing new cases while also vacating at least one prior order on procedural grounds — a combination that signals ongoing activity without a clear directional shift. The three risk areas described here are grounded in named enforcement actions and finalized rules, but the FTC's priorities, penalty calculations, and interpretive positions can and do change.

Nothing in this article constitutes legal advice. Specific situations — a particular campaign, a specific AI tool, a contract with an agency — require qualified legal counsel who can assess the facts against current law and enforcement posture. The framework here is designed to help marketing teams ask better questions and build better processes, not to substitute for that assessment.