Center for Federal Accountability

FTC asks whether search, social media and shopping platforms should answer for ad tools that spread government and business impersonation scams

The Federal Trade Commission has opened an advance notice asking whether to extend its 2024 Impersonation Rule to platforms whose ad-creation and targeting tools help impersonation scams reach consumers. The notice relies heavily on press reports and gives no figure for losses tied to platform ads specifically, which it asks commenters to supply. Comments close November 30, 2026.

2026-10-02 · Federal Trade Commission · Information · Docket FTC-2026-1552

On October 1, 2026, the Federal Trade Commission published an advance notice of proposed rulemaking asking whether it should write rules for "search engine, social media, and other digital marketplace platforms" whose advertising tools further scams that impersonate government agencies and businesses (91 FR 62347). An advance notice is the first step in an FTC rulemaking under section 18 of the FTC Act: it proposes no rule text and asks for information. The notice carries RIN 3084-AB90 and Matter No. R207000; regulations.gov lists it as docket FTC-2026-1552. Comments close on November 30, 2026. No comments had been posted when CFA's refresh checked the docket on October 1. The Office of Management and Budget determined the notice is a significant regulatory action under Executive Order 12866 (91 FR 62357).

## What the FTC is considering

The Impersonation Rule, 16 CFR part 461, was finalized in March 2024 (89 FR 15017). It bars posing as a government entity or business, but, the notice says, it "does not, however, expressly address Platform conduct that furthers impersonation scams" (91 FR 62351). The Commission now asks whether to amend that rule, write a new one, or rely on alternatives such as consumer education and voluntary industry efforts (91 FR 62353).

The notice defines Platforms as public-facing websites or apps where third parties offer goods or services through paid ads or listings, and names Google.com, Facebook.com, Amazon.com, the Apple App Store and LinkedIn.com as examples (note 14). Its focus is "ad-optimization" services: tools that write ad copy, generate images and video, and use "detailed consumer data--including the consumer's demographic profile, websites visited, and search history" to decide who sees an ad (91 FR 62348).

The Commission's stated theory is economic. Platforms earn revenue from every paid ad, including scam ads, but do not bear the losses that follow. In the notice's words, "Platforms internalize the revenue but externalize the risk" (91 FR 62349).

Section VI.E lists measures a rule could include: requiring Platforms to review ads before posting; barring optimization services for impersonation ads; detection programs; a consumer reporting tool; investigation, removal and discipline of offending advertisers; verifying advertisers' identity; and keeping compliance records. These could be mandatory or could form a "safe harbor" that gives Platforms a defense to liability (91 FR 62355).

## How this differs from the 2024 attempt

This is the Commission's second attempt at what it calls "means and instrumentalities" liability. A 2024 supplemental proposal would have made it a violation to provide any goods or services "with knowledge or reason to know" they would be used for impersonation (89 FR 15072, 15083). In December 2024 the Commission said it would not proceed with that provision (89 FR 104905). The notice records that commenters had called it overbroad and objected that it skipped the advance-notice stage, and says the new effort answers both points because it is limited to Platform ad optimization and starts with an advance notice (note 12). A separate proposal to cover impersonation of individuals, the subject of a January 2025 hearing, is still under evaluation.

The notice also explains why a rule matters to the FTC. Since the Supreme Court's 2021 decision in AMG Capital Management v. FTC, section 19 of the FTC Act is the Commission's only route to consumer refunds. With a rule in place, the FTC can seek redress in a single federal court case; without one, it must first win an administrative case and then prove "objectively fraudulent or dishonest conduct" in a second case (91 FR 62353, notes 63 and 64).

## Section 230

The notice addresses the main legal obstacle directly. Section 230 of the Communications Decency Act protects platforms from being treated as the publisher of third-party content. The Commission's position is that this protection is an affirmative defense that does not cover content a platform "materially contributed to developing," and that "any Platform service that enhances the effectiveness of ads may fall outside" it (91 FR 62352). It relies on the Third Circuit's 2024 decision in Anderson v. TikTok, and acknowledges that the Ninth Circuit in Doe 1 v. Meta Platforms (2026) and the Fifth Circuit in a July 2026 decision took different approaches (note 54). These are the Commission's legal arguments; courts are divided on them.

## The numbers in the record

The notice cites FTC data showing consumers reported losing about $16 billion to fraud in 2025, 25 percent more than in 2024; more than 1 million impostor reports with nearly $3.5 billion in losses; and $2.1 billion in losses from scams that started on social media, reported by almost 30 percent of people who lost money (91 FR 62347, 62349). An FTC estimate adjusted for underreporting puts the 2024 cost of fraud as high as $195.9 billion.

CFA checked how these figures fit together. Impostor losses are about 22 percent of the $16 billion total. The notice does not give a figure for losses from impersonation scams delivered through Platform ads, the conduct a rule would address. Its closest statement is that victims lose "hundreds of millions" a year to online impersonation scams (91 FR 62351). Question C.6 asks commenters to supply data on how often consumers see such ads and what they lose, which the Commission will need for the "prevalence" finding that section 18 requires before it can propose a rule (15 U.S.C. 57a(b)(3)).

Several of the most specific figures come from news reports and advocacy studies rather than FTC data. They include Reuters' reporting, based on internal Meta documents, that Meta earned an estimated 10 percent of its 2024 revenue, about $16 billion, from scam ads and showed users about 15 billion "higher-risk" scam ads a day, and a Center for Countering Digital Hate estimate that 30 Medicare scam advertisers drew about 215 million impressions in 2025 (notes 31 to 34). The notice presents these as reported or alleged, and several lawsuits it cites against Meta are pending.

## CFA's observations

These are CFA's observations from the published notice. Several of the measures under consideration involve personal data the notice does not discuss: verifying advertisers' identity (question E.3), keeping compliance records, and industry sharing of information about suspected scam advertisers, modeled on Mastercard's MATCH database of high-risk merchants (question D.2). The notice does not ask what data verification would collect, how long it would be kept, or how a legitimate advertiser wrongly flagged in a shared list could correct the record.

The scope may widen. Questions C.2 and D.1.a ask whether a rule should also cover non-advertising posts, such as sham profiles, and deceptive advertising that does not involve impersonation.

Footnote 7 cites the FTC Act as "45 U.S.C. 41 et seq."; the Act is codified at 15 U.S.C. 41 and following, as the notice's own text elsewhere states.

## CFA's records on the FTC

The Federal Trade Commission is not among the agencies CFA grades. CFA's crawl of agency privacy impact assessments found 46 published by the FTC, including one for its Sentinel Network Services, the complaint system behind much of the data in this notice. CFA's missing-assessment report lists the FTC's consumer.gov education site with no privacy impact assessment found. Consumer education is one of the alternatives the notice raises.

## What to watch

Whether the Commission makes a prevalence finding specific to Platform ad optimization, and what data supports it beyond the press reports cited here.

Whether a proposed rule imposes duties directly or offers a safe harbor, and what level of knowledge would trigger liability (question E.1.n).

If advertiser verification or industry information-sharing is proposed, how the rule handles the personal data involved and how advertisers can contest a listing.

How courts resolve the section 230 questions the notice relies on, including the pending cases it cites.

Comments can be filed on regulations.gov (docket FTC-2026-1552) or on paper by overnight service to the FTC's Office of the Secretary, marked "16 CFR part 461--Impersonation Rule, Matter No. R207000." The FTC posts each comment with the commenter's name and state, so personal and confidential business information should be left out unless filed under the confidentiality procedure in FTC Rule 4.9(c).

Authorities