The Federal Trade Commission published an advance notice of proposed rulemaking on Thursday that reopens a question it closed two years ago, and the notice is candid about why it can. In March 2024 the Commission finished the Rule on Impersonation of Government and Businesses and declined, in the same proceeding, to adopt a companion provision that would have made it unlawful to supply the means and instrumentalities of an impersonation. In December 2024 it said it would not proceed with that provision at all. Any version it now considers, the agency writes, "will focus on ad-optimization practices by digital marketplace platforms and will therefore necessarily be narrower than the 2024 SNPRM's proposed provision covering any means and instrumentality."
The provision the Commission withdrew is back, in a smaller shape
The history explains the form. The Commission opened the rulemaking with an advance notice in December 2021 and proposed a rule in October 2022 that would have covered impersonation of individuals and, separately, the provision of goods or services used in a prohibited impersonation. The final rule adopted in March 2024 covered government and business impersonation and left both additions out.
A supplemental proposal in March 2024 revived the means-and-instrumentalities text, making it a violation to provide goods or services "with knowledge or reason to know" they would be used to pose as a government entity, a business, or an individual. Commenters objected that the language reached any means and instrumentality and that the Commission had introduced it through a supplemental notice rather than an advance notice. In December 2024 the Commission wrote that it "has decided not to proceed with the SNPRM's proposed means and instrumentalities provision at this time."
Today's notice answers those objections by conceding them. It takes no position on whether the earlier proposal was overbroad, and says the point is moot because an ad-optimization provision is narrower by construction and because this proceeding begins with an advance notice. Whether the rule should also reach impersonation of individuals remains open after a January 2025 informal hearing.
The theory now turns on what the platform does to the ad
The difference the Commission is drawing is between holding an advertisement and doing something to it. The notice defines platforms as public-facing websites or apps on which third parties offer goods, services, or opportunities through paid advertisements or other listings, naming Google, Facebook, Amazon, the Apple App Store and LinkedIn. The tools at issue develop the advertisement, through ad copy creation, image and video generation, and product listing creation, and control its delivery, using demographic profiles, browsing history and search terms to decide who sees it.
The notice quotes Meta's description of Advantage+, which it says uses artificial intelligence "to optimize campaigns in real-time and match ads to the people most likely to take action," and Google's description of a system that will "find the best performing ad combinations" from advertiser-supplied assets. It cites a recent case for the mechanics: in litigation against Doxo, a search engine's expert described an advertiser submitting up to fifteen headline elements of which "three of which are dynamically assembled by the search engine platform." That sentence carries the theory. If the platform chooses which words appear together above which search result, the Commission's framing goes, it is not only hosting.
The economic argument is stated in the vocabulary of externalities. Platforms, the notice says, "internalize the revenue but externalize the risk," earning fees when their tools help build the ad, when the ad is posted, and when a consumer engages with it. Victims report the crime to the agency and blame the impersonated brand, so the platform faces little market discipline. Commission staff, the notice adds, has reviewed Consumer Sentinel complaints about scams advertised on platforms in which the complainants never mention the platform's role in optimizing the ad.
Precedent for reaching a party that supplies the instrument rather than making the misrepresentation is established under Section 5. The notice cites Five-Star Auto Club for the proposition that "one who places into the hands of another a means of consummating a fraud" is liable under the Act, along with the Second Circuit in FTC v. LeadClick Media and the Tenth Circuit in FTC v. Accusearch.
Section 230 is the defense the Commission has to get past
The notice devotes several pages to immunity, and the treatment is an argument rather than a conclusion. Section 230 provides that no provider of an interactive computer service "shall be treated as the publisher or speaker of any information provided by another information content provider." The Commission reads that language as covering the passive hosting of third-party content and nothing further, and notes that immunity is an affirmative defense a platform must plead and prove.
From there it assembles the authority it would rely on. Material contribution to the development of unlawful content takes a platform outside the immunity, under the Ninth Circuit's decision in the Roommates.Com case. The Third Circuit held in Anderson v. TikTok that a platform's recommendation or curation of third-party content is the platform's own expressive conduct, and in Moody v. NetChoice the Supreme Court described the presentation of "a curated compilation of speech originally created by others" as expressive conduct for First Amendment purposes. The Court has not addressed Moody's implications for Section 230; the Third Circuit read the two together, and two justices have signaled they would take the same approach.
The countervailing authority is real, and the notice names it. The Fifth Circuit held in July 2026 that the argument requiring a choice between Moody and circuit precedent on Section 230 "presents a false choice," and the Ninth Circuit in Doe 1 v. Meta Platforms followed its own precedent immunizing algorithmic recommendations without applying Moody. The Commission's own conclusion is measured: whether a given practice falls outside the immunity, it writes, "involves a fact-intensive inquiry," which is why it is asking rather than asserting. Read practically, a rule resting on this theory would not end the argument so much as move it into discovery, where a platform's internal documents about how its ad systems work become the evidence.
What a rule could require, and what the safe harbor would replace
The notice sets out a menu of measures without committing to any of them. The Commission could require platforms to evaluate advertisements before they are posted and bar them from providing optimization services to advertisers engaged in impersonation. It could require an affirmative program: detecting suspected impersonation ads, giving consumers a clear and conspicuous tool to report them, investigating reports, removing confirmed ads, cutting off optimization for confirmed ads, and disciplining the offending advertiser. It could add recordkeeping duties to make enforcement practical.
Then the notice offers the structural alternative that may prove the more important one. The same list, it says, could serve "as the basis of a safe harbor provision by which Platforms' compliance could provide a defense to liability under any new regulations." A safe harbor would convert the list from a floor every platform must meet into a set of steps a platform can take to insulate itself, which changes who bears the cost of an uncertain standard. Industry commenters who objected to the 2024 provision as vague have a clearer path here than they did before.
The questions attached to the menu preview the disputes ahead. Should platforms verify an advertiser's identity before granting access to optimization tools, and how? Should they screen and monitor for impersonation ads? Should complaints trigger a duty to investigate, and if so, what types and what volume of complaints from consumers, competitors, or the impersonated parties? How much time should a platform have to remove a confirmed ad or terminate optimization for it? Should liability attach only with some level of knowledge or participation, and what level? Would the requirements chill innovation in artificial intelligence tooling, and could platforms satisfy them by scaling the processes they already run under the DMCA, the TAKE IT DOWN Act and the INFORM Act? The notice also asks for the cost of each requirement, disaggregated by component and by whether it lands on platforms, on advertisers, or on small businesses.
Prevalence is the finding the record has to carry
The statutory gate explains the shape of the notice. Under Section 18 of the FTC Act, the Commission may define unfair or deceptive acts or practices by rule when it "has reason to believe" the practices "are prevalent," either from previous cease-and-desist orders or from "any other information" indicating "a widespread pattern." An advance notice that solicits market studies and warns that comments "may be more persuasive when substantiated with evidence, particularly economic data" is a record-building instrument as much as a policy statement.
The Commission stacks what it already has. Consumers reported losing about $16 billion to fraud in 2025, a 25 percent increase over 2024. Imposter scams were the most reported fraud category, with more than one million reports and nearly $3.5 billion in reported losses. The Protecting Older Consumers Report estimated that the true cost of fraud in 2024, adjusted for underreporting, may have been as high as $195.9 billion. Nearly 30 percent of consumers who reported losing money to a scam in 2025 said the contact began on a social media platform, with reported losses of $2.1 billion, and an April 2026 data spotlight put reported social media scam losses at eight times their 2020 level.
The notice also leans on reporting it did not produce. It cites a Reuters investigation published in late 2025 that described internal Meta documents and estimated that the company earned about 10 percent of its 2024 revenue, or $16 billion, from running scam advertisements, and that Meta had been reluctant to impair that revenue with stricter enforcement. It cites academic commentary describing Meta's ad tools as potent instruments for scammers. Those citations do not supply the prevalence finding on their own, which is what the comment period is for.
November 30 is the only date the notice fixes
Comments are due November 30, 2026, sixty days after publication, and will be posted to Regulations.gov under docket FTC-2026-1552. The rulemaking carries RIN 3084-AB90 and matter number R207000, and any amendment would land in 16 CFR part 461 alongside the existing rule. The Commission vote to publish the notice was 2-0, according to the announcement accompanying it.
The notice also invites comment on not regulating. It asks whether consumer and business education about impersonation scams on platforms would work, and whether the Commission should instead encourage voluntary industry efforts. One question proposes the model of the payments industry, where banks and payment processors use the MATCH database that Mastercard maintains to flag merchants posing a high risk to the system, and asks what prevents platforms from sharing information with each other about confirmed impersonation ads and the advertisers behind them.
What the notice does not do is propose text, commit to a rule, or resolve whether the impersonation rule should reach individuals as well as governments and businesses. Three things will decide the answer: whether the comment record produces evidence of prevalence specific to ad optimization rather than to impersonation scams generally, whether a provision aimed at how a platform assembles and targets an ad survives Section 230 and the First Amendment arguments that accompany it, and whether the affirmative duties on the menu survive as requirements or are filed down into a safe harbor platforms can choose to follow.
Primary sources
- Federal Trade Commission, Rule on Impersonation of Government and Businesses, advance notice of proposed rulemaking, 91 FR 62347 (Oct. 1, 2026), for the procedural history, platform definitions, tool descriptions, Section 230 authority, proposed requirements and safe harbor alternative.
- Federal Trade Commission, press release, Sept. 24, 2026, for the 2-0 vote and the statement of Bureau of Consumer Protection Director Christopher Mufarrige.
- Federal Trade Commission, FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams in 2025, June 15, 2026.
- Federal Trade Commission, Reported losses to scams on social media eight times higher than in 2020, data spotlight, April 27, 2026.
- Federal Trade Commission, Protecting Older Consumers Report 2024-2025, Dec. 2025, for the $195.9 billion estimate.
- Federal Register, Rule on Impersonation of Government and Businesses, 89 FR 15017 (Mar. 1, 2024), and supplemental notice of proposed rulemaking, 89 FR 15072 (Mar. 1, 2024).
- Federal Register, Rule on Impersonation of Government and Businesses, notice of informal hearing, 89 FR 104905 (Dec. 26, 2024).
- Reuters, investigation into fraudulent advertising on Meta platforms, Dec. 28, 2025, as cited in the notice.
- Decisions cited in the notice: Anderson v. TikTok, Inc., 116 F.4th 180 (3d Cir. 2024); Doe 1 v. Meta Platforms, Inc., 174 F.4th 1159 (9th Cir. 2026); Computer and Communications Industry Ass'n v. Paxton, No. 24-50721 (5th Cir. July 24, 2026); Moody v. NetChoice, LLC, 603 U.S. 707 (2024); FTC v. LeadClick Media, LLC, 838 F.3d 158 (2d Cir. 2016); FTC v. Accusearch, Inc., 570 F.3d 1187 (10th Cir. 2009).
- Regulations.gov docket FTC-2026-1552, for the comment record as it develops.