Federal AI rules for small business marketing

The short version

As of October 15, 2026, no federal law requires a business to label AI-generated content or to announce that a chatbot is a bot. Bills exist. None has passed.

That does not leave you free to do anything. The Federal Trade Commission's core power is a ban on deceptive practices, and it applies whether a person or a model wrote the words. So the federal question is never "did I label it?" It is "would a reasonable customer be misled?" If leaving out the fact that something is AI would mislead people, you have to say it. If an AI claim you make is not true, a label will not save you.

Four FTC tools do most of the work for small businesses: Section 5 of the FTC Act, the fake reviews rule, the Endorsement Guides and the Impersonation Rule. One FCC ruling covers AI voices on phone calls. Each is below, with what it means in practice.

Section 5: the truth rule

Section 5 of the FTC Act (15 U.S.C. 45) bans unfair or deceptive acts in commerce. It has applied to nearly every US business that advertises or sells since long before AI; banks, common carriers and a few other sectors are carved out. Applied to AI, it boils down to four rules:

1. Do not overstate what an AI product can do, and have evidence before you make the claim. "Our AI catches 99% of errors" needs testing behind it.
2. Do not say you use AI if you do not. Calling a spreadsheet "AI-powered" to sound current is a false claim.
3. Do not use AI-made people, testimonials, cloned voices or altered images to create a false impression. An AI "customer" praising your service is a made-up customer.
4. Disclose when silence would mislead. If a reasonable buyer would be misled by not knowing that, say, the person in your ad is AI-generated, the fact has to be disclosed clearly and conspicuously.

What a violation costs

When the FTC brings a Section 5 case, the usual outcome is an injunction or consent order (often lasting 20 years) and, in some cases, money back to customers. Civil penalties come in three situations: violating an FTC order you are already under; knowingly violating an FTC rule (like the fake reviews rule below); or knowingly repeating a practice the FTC has already ruled unlawful in a litigated order, the route the agency uses through "notices of penalty offenses."

The penalty cap is $53,088 per violation. That is the 2025 figure. An FTC notice published September 15, 2026 (FR Doc. 2026-18853) says the amounts stay the same for 2026, because a White House budget office memo cancelled this year's inflation adjustment.

Sources: 15 U.S.C. 45 (Cornell LII copy of the US Code); FR Doc. 2026-18853; FTC AI resources.

What the FTC has actually punished

In September 2024 the FTC announced Operation AI Comply, a sweep of cases against AI marketing claims. The cases since then show a clear pattern: the FTC goes after AI promises that are not true, not AI use itself.

• DoNotPay marketed a "robot lawyer" it said could replace a human lawyer. Settlement: $193,000.
• Ascend Ecom, Ecommerce Empire Builders and FBA Machine sold AI-driven online-store schemes promising passive income.
• Workado overstated how accurately its AI content detector could spot AI-written text.
• Air AI was charged over earnings, profitability and refund promises tied to its AI business offering. The proposed settlement announced March 24, 2026 includes an $18 million judgment, mostly suspended, with $50,000 paid, plus bans on selling business opportunities and on unsupported earnings claims.
• Cox Media Group, MindSift and 1010 Digital Works marketed an "Active Listening" ad product they falsely said targeted local ads using voice data from smart devices, with consumer opt-in. The orders were finalized August 27, 2026: $880,000 from Cox and $25,000 each from the other two, used to refund customers.

The lesson for a small business: every claim about what your AI does, how accurate it is, or what customers will earn from it needs to be true and backed by evidence. That goes for the vendor tools you resell or recommend, too.

One case went the other way

The original 2024 sweep also included Rytr, an AI writing tool that could generate reviews. On December 22, 2025 the FTC voted 2-0 to set that order aside, saying the facts did not show a Section 5 violation and the order unduly burdened AI innovation. It pointed to the January 2025 AI executive order (EO 14179) and the July 2025 AI Action Plan. Read that narrowly. It is about selling a writing tool. A business that posts or buys fake reviews, AI-written or not, is still liable under the rule in the next section.

Reviews and testimonials: the fake reviews rule

The FTC's Consumer Reviews and Testimonials Rule (16 CFR Part 465) took effect October 21, 2024. Because it is a rule, knowing violations carry civil penalties of up to $53,088 each. When the FTC announced it, the agency named AI-generated fake reviews specifically, though the text itself is technology-neutral. In plain terms, it bans six things:

1. Writing, buying, selling or spreading fake reviews or testimonials, including ones from people who do not exist, when you knew or should have known they were fake.
2. Paying for or rewarding reviews on the condition that they are positive (or negative about a competitor).
3. Reviews by your officers, managers, employees or their relatives without clearly disclosing the connection, with extra duties when managers ask staff for reviews.
4. Running an "independent" review site you actually control.
5. Suppressing negative reviews through baseless legal threats, intimidation or false accusations, or presenting a filtered set as if it were all your reviews.
6. Buying or selling fake followers or views to make your business look more influential.

What it means for you: do not have AI write reviews or testimonials, ever. Do not offer a discount "for a 5-star review"; asking for an honest review is fine. If your nephew reviews your shop, he says he is your nephew.

In May 2026 the FTC and Illinois sued a home-services company over thousands of business listings and fake reviews, including reviews from employees and relatives. That case is pending and the allegations are unproven, but it shows the rule being used against a local-services business.

Influencers, endorsements and AI people in ads

The FTC's Endorsement Guides (16 CFR Part 255, revised in 2023) are guidance, not binding law, but the FTC uses them to decide what counts as deception. Three points matter for AI:

• The definition of an endorser now covers a party that could be or appear to be a person, group or institution. The FTC said this covers virtual influencers. An AI persona that praises your product is an endorser.
• Endorsements must reflect honest opinions and real experience. An AI avatar has no experience with your product, so do not present it as a customer who does.
• Any material connection (payment, free product, employment) must be disclosed clearly and conspicuously. The FTC warns that a platform's built-in "paid partnership" tag may not be enough on its own.

If you use an AI spokesperson, the safe approach is to make it obvious it is a presenter, not a customer, and to say it is AI-generated. New York now requires that disclosure in commercial ads that use synthetic performers; see the state guide.

Impersonation and voice clones

The FTC's Impersonation Rule (16 CFR Part 461) took effect April 1, 2024. It bans falsely posing as a government agency or a business, or falsely claiming an affiliation with or endorsement by one, including through AI-cloned voices, deepfake video and lookalike websites. Penalties reach $53,088 per violation plus refunds to consumers.

For a small business, that means not using AI to imitate another company, a brand's representative or a government official. Faking a celebrity's voice, face or endorsement is not covered by this rule yet (see the next sentence), but it is still deceptive under Section 5 and banned by Google's and TikTok's ad policies. A proposal to extend the rule to impersonating individuals was published in February 2024 and has not been finalized. In September 2026 the FTC also asked for public comment on the role platforms and ad tools play in impersonation scams, according to a law-firm summary; nothing binding has come of it yet.

Ad platforms enforce this harder than the law does. Google Ads suspends accounts without warning for ads that impersonate public figures or fake their endorsement. See platform rules.

Chatbots: no federal label rule, but your bot speaks for you

There is no federal law requiring a chatbot to say it is a bot. The GUARD Act (S. 3062), which would require chatbots to say they are not human and do not hold professional credentials, cleared the Senate Judiciary Committee on April 30, 2026 but has not passed. Several states already require disclosure; see the state guide.

The federal risk is simpler: anything your chatbot tells a customer is your statement under Section 5. If it invents a refund policy, promises a delivery date you cannot meet or claims a product does something it does not, that is your deceptive claim. Keep bots on a short leash, give them your real policies, and give customers a path to a person.

On July 1, 2026 the FTC proposed a policy statement saying that altering or suppressing accurate AI output to serve undisclosed goals may be deceptive. In the same document the FTC argued that Colorado's AI law appears to push companies to alter AI output and is preempted to the extent it conflicts with federal law. Comments closed July 31, 2026, and we found no final version. If you configure a chatbot to favor certain products, the safest course is to say so.

AI voice calls: the FCC's TCPA ruling

On February 8, 2024 the Federal Communications Commission ruled (FCC 24-17) that AI-generated and cloned voices are "artificial" voices under the Telephone Consumer Protection Act. That puts AI voice agents, voice-cloned sales or appointment calls and AI voicemail drops under the same rules as robocalls:

• Consent first. You need the person's prior express consent, unless the call is an emergency or otherwise exempt. Telemarketing and advertising calls need prior express written consent.
• Say who you are at the beginning. State the name of the business responsible for the call at the start of the message.
• Give your number. State that business's phone number during or at the end of the message.
• Offer an opt-out on telemarketing and advertising messages, through the automated mechanism the rules require.

The FCC said there is no exception for technology that claims to be the equivalent of a live agent. People can sue for $500 per call, up to $1,500 if the violation was willful or knowing; state attorneys general can sue too, and the FCC can fine.

What the rule does not yet require is saying "this call uses AI." The FCC proposed that in August 2024 (FCC 24-84), along with AI-specific consent language, but has not adopted it. A separate petition to let political callers use AI voices on cell phones without consent is pending and would not change the rules for businesses. Even without a federal duty, we would say it on the call. Maine's chatbot law covers voice, and a caller who later learns they were talking to software they thought was a person has a reason to complain. Sample scripts are on the examples page.

Sources: FCC 24-17 declaratory ruling; 47 U.S.C. 227 (Cornell LII copy); FCC 24-84 proposal.

Deepfakes and user uploads: the TAKE IT DOWN Act

The TAKE IT DOWN Act (Public Law 119-12, enacted May 19, 2025) is the main federal deepfake statute. It is not a labeling law. It makes it a federal crime to knowingly publish nonconsensual intimate images of real people, whether authentic or AI-generated.

The part that can reach a small business is the platform duty, in force since May 19, 2026. A "covered platform" is a public website, service or app that mainly hosts user-generated content. If you run a forum, a photo-sharing community or another site built around user uploads, you may qualify. Covered platforms must post a clear, plain-language notice explaining how to request removal, run a request process, and take down the content and known identical copies within 48 hours of a valid request. The FTC enforces it, and failure to comply is treated like breaking an FTC rule, so penalties up to $53,088 per violation apply. Broadband providers, email, and sites where user chat or comments are incidental to the provider's own content are excluded.

Sources: Pub. L. 119-12; FTC release on enforcement.

Will federal law override the state AI laws?

Not yet, and you should plan as if state laws apply. Here is where the fight stands as of October 15, 2026:

• Executive order. EO 14365, signed December 11, 2025, directs the Justice Department, Commerce, the FCC and the FTC to push back on "onerous" state AI laws. The order itself preempts nothing. Implementation is running behind its own deadlines.
• Litigation. The Justice Department set up an AI Litigation Task Force in early 2026 and moved to intervene in xAI's challenge to Colorado's AI Act in April 2026. Colorado agreed not to enforce that law for now and has since passed a replacement that starts January 1, 2027.
• White House recommendations. A March 2026 framework asks Congress to preempt state AI laws that unduly burden AI, but not states' general consumer-protection, anti-fraud and child-protection laws. It binds no one.
• Congress. The Senate struck a 10-year moratorium on state AI laws 99-1 on July 1, 2025. A later attempt through the defense bill failed. A House discussion draft released June 4, 2026 had not been formally introduced. The NO FAKES Act, which would create a federal right against unauthorized AI replicas of a person's voice or likeness, was reported out of the Senate Judiciary Committee on June 18, 2026 and has not passed.

Notice what even the preemption push would leave alone: general consumer protection and fraud laws. Whether AI-specific state rules, like Maine's chatbot law, would survive a future federal statute is an open question. Until Congress or a court says otherwise, they apply.

A one-page checklist for your marketing

1. Every claim about your AI (accuracy, savings, results, "replaces a professional") is true and you can show evidence.
2. No AI-written reviews or testimonials. No review rewards tied to a positive rating. Staff and family reviews say who they are.
3. AI-generated people in ads are not presented as real customers, and are labeled as AI where a viewer could be misled.
4. No AI imitation of other businesses, officials or real people's voices and faces without permission.
5. Your chatbot uses your real policies, does not invent promises, and offers a way to reach a person.
6. Outbound AI voice calls have the right consent, name your business at the start, give your number, and include an opt-out where required.
7. If you host user uploads, you have a posted removal process that can act within 48 hours.

For the state rules that add specific labels on top of this, see the state-by-state guide. For wording, see the examples.