The FTC Wants to Know What Your Ad Tools Do for Scammers. Its Definition of 'Platform' Is Wide.

Footnote 14 is where to start. The FTC’s new notice on impersonation scams names Google.com, Facebook.com, Amazon.com, the Apple App Store and LinkedIn.com as examples of a “Platform.” The definition the examples illustrate is much shorter and much wider: “public-facing websites or apps on which third parties offer goods, services, or opportunities through paid advertisements or other listings” [1].

If you run a marketplace with sponsored listings, a niche app that sells promoted placements, or an ad product with automated creative, read that sentence twice. Then read the rest of the notice, because the questions are about you too.

What the FTC published

The Commission voted 2-0 on September 24 to issue an advance notice of proposed rulemaking, and announced it the same day [2]. It published in the Federal Register on October 1 as FR Doc. 2026-20143, under 16 CFR part 461 [1]. Comments are due November 30, 2026 [1]. The Office of Management and Budget designated it a significant regulatory action [1].

The notice asks whether the FTC should amend its Rule on Impersonation of Government and Businesses, write a new rule, or do something short of regulation, to address platforms whose ad-optimization tools further impersonation scams [1]. Those tools, in the FTC’s description, include ad copy creation, image and video generation, product listing creation and audience targeting built on consumer data [1].

The FTC’s case rests on numbers and on incentives. Consumers reported losing about $16 billion to fraud in 2025, up 25 percent from 2024, and the FTC received more than 1 million imposter reports with nearly $3.5 billion in losses [1]. Almost 30 percent of people who lost money said the contact began on social media, with $2.1 billion in reported losses [1]. The notice argues that platforms earn money on every paid ad, scam ads included, without bearing the cost when consumers are defrauded. Its own summary: platforms “internalize the revenue but externalize the risk” [1].

The notice gives examples: Medicare-impersonation ads aimed at seniors, fake McCormick Spice giveaway ads that send people to fraudulent sites, and sponsored search placements that imitate hotels and banks [1]. It also cites a Reuters investigation alleging that Meta earned an estimated 10 percent of its 2024 revenue, about $16 billion, from scam ads [1].

How we got here

This is the second pass at platforms. The FTC opened the impersonation proceeding with an advance notice in December 2021, proposed a rule in October 2022, and finalized it in March 2024 [1]. Alongside the final rule, a supplemental proposal would have made it a violation to provide goods or services with “knowledge or reason to know” they would be used for impersonation [1]. Commenters called that overbroad, and in December 2024 the Commission dropped it [1]. A separate proposal covering impersonation of individuals went to an informal hearing in January 2025 and is still under evaluation [1].

The new notice says any provision it considers now will focus on ad-optimization practices and will “necessarily be narrower” than the 2024 version [1]. It also starts over at the advance-notice stage, which answers one of the procedural complaints about the last attempt [1].

Who counts as a ‘Platform’ under the FTC’s impersonation proposal?

Anyone fitting footnote 14 [1]. The notice doesn’t set a revenue floor or user count. Instead it asks commenters which platforms are small businesses and whether a platform’s duties should depend on how much it knows about, or takes part in, a given impersonation ad [1].

The question list goes deep into product design [1]:

• Creative tools. To what extent does each tool “create, develop, or modify the content” of an ad?
• Delivery. How much does the tool control when, where and to whom an ad appears?
• Brand terms. Does the platform restrict use of other companies’ trademarks or trade names when it optimizes content or delivery, including targeting search queries that contain a business or agency name?
• Advertiser vetting. Is the advertiser’s identity verified before it gets the tools, and by what criteria?
• Revenue. Does money from impersonation ads play a role in how those criteria are set?

What a rule could require

Section E of the notice sketches the menu [1]. The FTC could require platforms to evaluate ads before posting and bar them from optimizing ads for impersonators. It could require a detection program, a “clear and conspicuously placed” reporting tool for consumers, investigation of reports, removal of confirmed impersonation ads, an end to optimization services for them, and discipline for the advertiser [1]. Those same steps could instead form a safe harbor, a defense to liability for platforms that follow them [1]. Recordkeeping is on the list too [1].

The FTC also asks whether platforms could scale the systems they already run under the DMCA, the TAKE IT DOWN Act and the INFORM Consumers Act, and whether any requirement would discourage innovation in AI-based ad tools [1]. And it floats industry information sharing, pointing to the MATCH database that banks and payment processors use to flag high-risk merchants [1].

On Section 230, the notice’s position is that the statute protects merely hosting third-party content but not content a platform materially helped develop [1]. It cites the Third Circuit’s 2024 decision in Anderson v. TikTok and goes further: “any Platform service that enhances the effectiveness of ads may fall outside” the activity Section 230 protects [1]. It calls the line “a fact-intensive inquiry” [1].

The case against moving this fast

Daniel Gilman of the International Center for Law & Economics accepts that fraud on platforms is within the FTC’s remit, but calls the notice premature [5]. His argument is that the agency should have issued a request for information first and learned more about the problem, the tradeoffs and its own ability to enforce a fix before signaling a rule [5].

Lawyers at Mayer Brown make a timing point: rules under this part of the FTC Act take considerably longer than ordinary rulemaking, so no new obligations are imminent, though the advance-notice stage is often where the record gets shaped [4]. IPWatchdog’s summary reaches the same reading of where the notice stands [3].

What it means if you build ad products

This part is opinion.

The definition is the story. The headline examples are giants, but the text covers any public-facing app that sells a paid listing [1]. A rule that copies footnote 14 would put a two-person marketplace and a search engine under the same verbs. The FTC asks about small businesses, which is the right question [1]. Answer it with numbers if you run one.

Generative ad tools are the exposure. The Section 230 theory turns on “material contribution” [1]. A platform that only hosts an advertiser’s upload sits on one side of that line. A platform whose model writes the copy and picks the audience is the case the FTC is describing [1]. If you ship automated creative, keep logs that show what the advertiser supplied and what your system generated. That ties to the FTC’s AI accuracy statement I covered in July, where a 2-0 Commission said that steering a model’s outputs can be deception under Section 5.

A safe harbor beats a mandate for small teams. A list of steps that buys a defense is legible. A duty to prevent impersonation ads, with a fuzzy knowledge standard, is the kind of rule big companies resolve with lawyers [1]. If you comment, say which one you can actually run.

Brand-term targeting is in scope. Question C.1.b asks whether tailoring ads to searches for a business or agency name is itself an unfair practice [1]. Keyword bidding on competitor names is ordinary marketing. Watch that question.

What I’m watching

• November 30. The comment deadline [1]. The record will show whether the large platforms argue Section 230 or argue cost.
• The individual impersonation provision. The FTC says it is still evaluating options after the January 2025 hearing [1]. It is a separate track from this notice.
• A proposed rule. If one comes, the first thing to check is whether footnote 14 survives unchanged [1].