FTC Asks Whether Its Impersonation Rule Should Reach Platform Ad Tools

FTC Asks Whether Its Impersonation Rule Should Reach Platform Ad Tools

The Federal Trade Commission has opened the earliest stage of a possible rulemaking on whether search engines, social networks and online marketplaces should answer for the ad-optimization tools that scammers use to run impersonation ads. Written comments are due November 30, 2026.

Information last verified on October 3, 2026.

Status: This is an advance notice of proposed rulemaking (ANPRM), the first and most preliminary step in an FTC trade regulation rulemaking. There is no proposed rule text anywhere in the notice. Nothing in it binds any platform, advertiser or consumer, and no platform owes any new legal duty today. The FTC is asking questions and gathering evidence so it can decide whether to propose something later. The existing Impersonation Rule at 16 C.F.R. Part 461 is unchanged, and the Commission says in the notice itself that the platform conduct it is asking about "is not covered by the current Rule."

Jurisdiction scope: United States, federal. This is an FTC proceeding under the Federal Trade Commission Act, and any rule that eventually came out of it would apply nationwide to conduct in or affecting US commerce. It does not change state consumer protection statutes, state impersonation or deepfake statutes, or the law of any other country. Entities carved out of the FTC Act's reach, including banks, federal credit unions, common carriers acting as such, and air carriers, sit outside Section 5 jurisdiction in the first place.

What Happened

On September 24, 2026 the FTC announced that it is considering whether to update its Rule on Impersonation of Government and Businesses, or take some other action, to address online platforms whose ad-optimization practices may be furthering impersonation scams. The Commission voted 2-0 to send the notice to the Federal Register.

The notice published a week later. It appears at 91 FR 62347 to 62357, dated October 1, 2026, under RIN 3084-AB90 and FTC Matter No. R207000. Its formal action line reads: "Advance notice of proposed rulemaking (ANPRM); request for public comment."

In the agency's own summary, the Commission "proposes to commence a rulemaking proceeding to prevent certain unfair or deceptive acts or practices by search engine, social media, and other digital marketplace platforms that further government and business impersonation scams to defraud consumers."

The theory is an incentives problem rather than a technology problem. The notice argues that platforms profit from optimizing ads for third parties "regardless of whether the third parties are legitimate," while the social cost of the resulting scams lands on consumers and on the businesses being impersonated. Because victims tend to blame the impersonated brand or the scammer rather than the platform, the Commission writes, "digital platforms face little to no market discipline to correct the problem."

The numbers in the notice are the FTC's own complaint data. In 2025 the agency received more than 1 million imposter reports with nearly $3.5 billion in reported losses. The agency's June 15, 2026 announcement breaks that down further, at roughly $920 million to government impersonators and close to $1 billion to business impersonators; those two figures come from the announcement rather than from the notice itself. Total reported fraud losses across all categories were about $16 billion, up roughly 25% from 2024. Almost 30% of people who reported losing money to a scam in 2025 said the contact started on a social media platform, accounting for $2.1 billion in reported losses.

One sourcing note worth making plainly, because it is easy to get wrong: the $3.5 billion figure is not drawn from a 2025 Consumer Sentinel Network Data Book. The notice attributes it to the FTC's June 15, 2026 announcement of 2025 imposter-scam data and to Consumer Sentinel reporting. As of October 3, 2026 the most recent Data Book published on ftc.gov is the 2024 edition. Readers tracking government impersonation scams should cite the June 2026 release rather than a Data Book that does not yet exist.

What the Impersonation Rule Already Covers

The Rule on Impersonation of Government and Businesses is codified at 16 C.F.R. Part 461. The Commission promulgated it on March 1, 2024 at 89 FR 15017, and it took effect April 1, 2024. Its stated authority is 15 U.S.C. 41 through 58.

The operative prohibitions are two sections long. Section 461.2 provides:

It is a violation of this part, and an unfair or deceptive act or practice to: (a) materially and falsely pose as, directly or by implication, a government entity or officer thereof, in or affecting commerce as commerce is defined in the Federal Trade Commission Act (15 U.S.C. 44); or (b) materially misrepresent, directly or by implication, affiliation with, including endorsement or sponsorship by, a government entity or officer thereof, in or affecting commerce as commerce is defined in the Federal Trade Commission Act (15 U.S.C. 44).

Section 461.3 says the same thing for businesses:

It is a violation of this part, and an unfair or deceptive act or practice to: (a) materially and falsely pose as, directly or by implication, a business or officer thereof, in or affecting commerce as commerce is defined in the Federal Trade Commission Act (15 U.S.C. 44); or (b) materially misrepresent, directly or by implication, affiliation with, including endorsement or sponsorship by, a business or officer thereof, in or affecting commerce as commerce is defined in the Federal Trade Commission Act (15 U.S.C. 44).

Section 461.1 defines the terms narrowly and broadly in useful places. "Business" includes not-for-profit entities. "Government" includes federal, state, local and tribal governments and their agencies and departments. "Officer" includes executives, officials, employees and agents. "Materially" means likely to affect a person's choice of, or conduct regarding, goods or services.

What the rule does not do is reach the party that merely supplied the tools. During the original rulemaking the Commission proposed a "means and instrumentalities" provision that would have extended liability to those who provide goods or services knowing or having reason to know they would be used in prohibited impersonations. In December 2024 the Commission said it had decided not to proceed with that provision at that time. That gap is precisely what the new notice is probing, in a deliberately narrower form aimed only at platform ad optimization.

Because Part 461 was issued under Section 18 of the FTC Act, 15 U.S.C. 57a, a violation is not merely a Section 5 problem. It supports civil penalties under 15 U.S.C. 45(m)(1)(A) and consumer redress under 15 U.S.C. 57b. The current civil penalty maximum for Section 5(m)(1)(A) is $53,088 per violation, set in January 2025 and held at that level for 2026 after the Office of Management and Budget cancelled the annual inflation adjustment. The notice says the Commission has brought several recent enforcement actions against scams perpetrated on platforms, and that the FTC and other government agencies have brought law enforcement actions targeting platform-enabled business and government impersonation scams. The notice also explains why a rule matters procedurally: after the Supreme Court's 2021 decision in AMG Capital Management v. FTC, Section 19 is the agency's only route to monetary relief, and an existing rule lets it go straight to federal court rather than running a two-step administrative process first.

A separate piece of this rulemaking remains genuinely unresolved. Alongside the March 2024 final rule, the Commission issued a supplemental notice of proposed rulemaking at 89 FR 15072 that would have added a prohibition on impersonating individuals, which is the provision most relevant to AI voice cloning and deepfake impersonation. Comments closed April 30, 2024 and the Commission held an informal hearing on January 17, 2025. It has not finalized that provision. The federal Unified Agenda entry for that rulemaking, cited in the new notice, says only that "The Commission continues to explore and evaluate potential options for future action relating to this rule." There is no individuals rule in force, and no announced deadline for one.

What the FTC Is Asking About

The notice poses six lettered groups of questions, A through F, and asks commenters to back answers with market studies, economic data or other empirical evidence. The substance falls into these buckets.

The advertising marketplace. How many platforms sell advertising and ad-optimization services, what are their advertising revenues, which of them are small businesses, and what financial incentives do they have to keep deceptive advertisers out.

How optimization actually works. For each tool, the Commission wants mechanics: to what extent it creates, develops or modifies ad content including images, to what extent it controls when, where and to whom an ad is delivered, and what share of advertisers use it. The notice names Meta Advantage+ and Google's ad-combination tools as examples of the category.

What platforms already do. Whether they verify advertiser identity before granting access to optimization tools, whether they restrict use of third-party trademarks and government names, whether they screen or monitor for impersonation ads, what they do to remediate ones already posted, whether they discipline offending advertisers, and whether ad revenue influences any of those thresholds.

Prevalence. Section 18 requires the Commission to have reason to believe the practices are prevalent before it can propose a rule defining them with specificity, so the notice asks for data on how often consumers encounter impersonation ads, how many are affected, and what the resulting harm is in money and in wasted time.

Possible requirements. The Commission floats, without proposing, a list of measures: evaluating ads before they post, prohibiting optimization services for advertisers engaged in impersonation ads, running a detection program, giving consumers a clear and conspicuous way to report suspected impersonation ads, investigating reports, removing confirmed impersonation ads, cutting off optimization for them, disciplining the advertiser, and keeping compliance records. It also asks whether those measures should instead operate as a safe harbor that gives compliant platforms a defense, and whether liability should require some level of platform knowledge or participation.

Alternatives to regulating at all. The notice expressly asks whether consumer and business education, or measures encouraging voluntary industry-wide efforts, would work better than a rule, and what barriers stop platforms from sharing scam-advertiser information with each other the way payment networks share high-risk merchant data.

Section 230 of the Communications Decency Act hangs over the whole exercise, and the notice addresses it head on. The Commission acknowledges that the statute "provides Platforms an affirmative defense for liability that arises from merely hosting third-party content," then argues that immunity does not cover conduct in which a platform materially contributed to developing the content, and points to the Third Circuit's 2024 decision in Anderson v. TikTok treating recommendation and curation as a platform's own expressive conduct. The Commission concedes this is a fact-intensive inquiry and says its questions are partly designed to build a record on it.

How to Comment

Comments must be received on or before November 30, 2026. The FTC encourages electronic filing through regulations.gov, where the proceeding sits on docket FTC-2026-1552. Commenters are asked to label the submission with the rule reference 16 C.F.R. part 461, the Impersonation Rule, and Matter No. R207000.

Paper filing is still available. The notice directs paper comments bearing the same label, on the comment and on the envelope, to the Federal Trade Commission, Office of the Secretary, 600 Pennsylvania Avenue NW, Mail Stop H-144 (Annex P), Washington, DC 20580, sent by overnight service because ordinary postal mail is delayed by security screening.

Two practical cautions from the notice itself. First, comments go on the public record, including the commenter's name and state, so the FTC warns against including Social Security numbers, dates of birth, driver's license or passport numbers, financial account numbers or individually identifiable health information. Once a comment is posted publicly it generally cannot be removed. Second, anyone seeking confidential treatment for commercially sensitive material must file on paper, label it clearly, and meet FTC Rule 4.9(c), 16 C.F.R. 4.9(c); the General Counsel decides.

If you were targeted by an impersonation ad and want to put that experience on the record, the consumer-facing complaint channel at ReportFraud.ftc.gov is separate from the rulemaking docket. Reporting fraud there feeds the Consumer Sentinel data the Commission cites, but it is not a comment. If money is already gone, the recovery steps are a different track entirely, covered in our guide to getting money back after a scam.

What Happens Next

An ANPRM is step one of a long and optional sequence.

First, the comment period closes on November 30, 2026 and staff reads the record. The Commission then decides whether to proceed. It may do nothing. It may pursue a non-regulatory route, which the notice expressly asks about. Or it may issue a notice of proposed rulemaking.

If it goes the NPRM route, Section 18 of the FTC Act, 15 U.S.C. 57a, imposes procedures that are heavier than ordinary notice-and-comment rulemaking. The Commission must have reason to believe the practices are prevalent, publish actual rule text with a statement of reasons, take written comments, and hold an informal hearing at which interested parties can raise disputed issues of material fact and, in defined circumstances, cross-examine. A staff report and a final rule with a statement of basis and purpose follow, and the final rule is subject to judicial review.

That takes years, when it finishes at all. The current Impersonation Rule is the best available yardstick: ANPRM in December 2021, NPRM in October 2022, informal hearing in May 2023, final rule in March 2024, effective April 2024. Roughly 27 months from the first notice to an enforceable rule, and that is the successful example. The companion proposal on impersonation of individuals, which reached the SNPRM stage in March 2024 and had its hearing in January 2025, is still unresolved more than 18 months later, and the broad means-and-instrumentalities provision from the same proceeding was set aside in December 2024, with the Commission saying in this notice that any version it now considers would be narrower and limited to platform ad optimization.

The honest statement of where things stand is that the FTC has asked a question and set a deadline for answers. Everything after that is discretionary.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The framing of this notice is narrower and more interesting than "should platforms be liable for scams." The Commission is not asking about hosting. It is asking about the optimization layer: the targeting engine that decides which grandparent sees a fake Social Security Administration ad, and the generative tooling that writes the copy and builds the image. That distinction is doing legal work, because it is the distinction Section 230 case law has been circling for a decade. Hosting is squarely inside the publisher immunity. Materially contributing to the content is not. The FTC is building a record on which side of that line ad-optimization services fall.

For readers, the immediate practical point is that nothing changed on September 24 or on October 1. An ad that impersonates your bank is already unlawful under Part 461, and it was already unlawful before 2024 under Section 5. What is at stake is whether the entity that sold the targeting gets added to the list of parties the FTC can sue, and whether the agency can seek civil penalties rather than negotiating with an offshore scammer who has already dissolved.

The second practical point is about who actually comments. ANPRM dockets are usually dominated by the regulated industry and by organized advocacy groups, and the Commission notes that comments may be more persuasive when substantiated with evidence, particularly economic data. Individual accounts of impersonation ads still matter, especially from small businesses whose names were used and from families dealing with fraud targeting older adults, because prevalence is a statutory precondition the FTC has to satisfy with record evidence.

There is also a durable effect independent of whether any rule ever issues. Comment files become public evidence. What platforms say about their own screening, verification and takedown practices in response to these questions will be read by state attorneys general and by private plaintiffs for years, in cases that have nothing to do with 16 C.F.R. Part 461. That is a real consequence of an ANPRM that produces no rule at all.

We take no position here on whether the Commission will issue a proposed rule, or what any such rule would say. The record does not exist yet.

This article is legal news reporting, not legal advice. It describes a federal rulemaking proceeding at its earliest stage and does not create an attorney-client relationship or tell you how the FTC will act. If an impersonation scam, an advertising compliance question or a platform liability issue affects you, consult a licensed attorney about your own facts.

Related articles

• Scam and fraud laws in the United States, the hub covering federal and state fraud rules.
• Government impersonation scams, the category this rulemaking is aimed at.
• AI voice scam calls, where the unresolved individuals provision would bite.
• How to report identity theft, if an impersonation scam reached your accounts.

Last updated: 2026-10-03. This is a developing story; details verified as of 2026-10-03.

Frequently Asked Questions

Does this notice create any new obligation for Google, Meta or other platforms?

No. An advance notice of proposed rulemaking contains no rule text and imposes no duty. It is a request for information and comment at the start of a process that may never produce a rule. The existing Impersonation Rule is unchanged, and the FTC states in the notice that the platform ad-optimization conduct it is asking about is not covered by the current rule.

When is the comment deadline?

November 30, 2026. The notice published in the Federal Register on October 1, 2026 at 91 FR 62347, and the Federal Register entry sets comments to close on November 30, 2026. Comments go to regulations.gov docket FTC-2026-1552, labeled with 16 C.F.R. part 461, the Impersonation Rule, and Matter No. R207000.

What does the current Impersonation Rule actually prohibit?

16 C.F.R. 461.2 and 461.3 make it a violation, and an unfair or deceptive act or practice, to materially and falsely pose as a government entity or officer, or as a business or officer, directly or by implication, and to materially misrepresent affiliation with one, including endorsement or sponsorship. The rule took effect April 1, 2024. It targets the impersonator rather than the platform that distributed the ad.

What penalties apply to a violation of the existing rule?

Part 461 was issued under Section 18 of the FTC Act, so a violation supports civil penalties under 15 U.S.C. 45(m)(1)(A) and consumer redress under 15 U.S.C. 57b. The current maximum civil penalty for Section 5(m)(1)(A) is $53,088 per violation, set in January 2025 and kept at that level for 2026 after the annual inflation adjustment was cancelled. The Commission says in the notice that it has brought several recent enforcement actions against scams perpetrated on platforms.

Did the FTC ever ban impersonating an individual person?

Not yet. The Commission proposed that in a supplemental notice on March 1, 2024 at 89 FR 15072, took comments through April 30, 2024, and held an informal hearing on January 17, 2025. The Unified Agenda entry cited in the new notice says the Commission continues to evaluate options. There is no individuals provision in force as of October 3, 2026, and no announced date for a decision.

Does Section 230 block the FTC from regulating platform ad tools?

The FTC's position in the notice is that it does not, at least not categorically. The Commission accepts that Section 230 gives platforms an affirmative defense for liability arising from merely hosting third-party content, but argues that immunity does not extend to conduct in which a platform materially contributed to developing the content, citing cases including the Third Circuit's 2024 Anderson v. TikTok decision. The notice also concedes the analysis is fact-intensive, and that unsettled question is one reason the Commission is collecting a record instead of proposing rule text.

Can an ordinary consumer file a comment?

Yes. The docket is open to anyone through regulations.gov until November 30, 2026. Be aware that a comment and the commenter's name and state become part of the public record, so sensitive personal details should be left out. Reporting a scam at ReportFraud.ftc.gov is a separate channel and does not count as a comment.

How long would a rule take if the FTC decides to proceed?

Section 18 rulemaking is slower than ordinary agency rulemaking because it requires a prevalence determination, published rule text, written comments, an informal hearing with limited cross-examination, a staff report and a final statement of basis and purpose, with judicial review available afterward. The current Impersonation Rule took roughly 27 months from its December 2021 advance notice to its April 2024 effective date. Many advance notices never reach a proposed rule at all.

Where does the $3.5 billion loss figure come from?

From the FTC's own consumer complaint data for calendar year 2025, announced in a June 15, 2026 press release and drawn from Consumer Sentinel Network reporting. It is not from a 2025 Consumer Sentinel Network Data Book; as of October 3, 2026 the most recent Data Book published by the FTC is the 2024 edition.