The Federal Trade Commission is the most active US federal AI enforcement body. It has pursued AI companies, AI product users, and AI-adjacent platforms without waiting for Congress to pass AI-specific legislation, relying instead on Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices in or affecting commerce. That authority dates to 1914 and has been applied to every major technology wave since the internet became commercial. AI is not different.
This article catalogs the FTC's AI enforcement record through mid-2026, explains the legal theory that ties Section 5 to AI conduct, summarizes what the FTC's guidance requires of companies that use AI, and ends with a 7-point compliance checklist for companies that deploy AI in consumer-facing products.
The FTC's 2024-2026 AI enforcement record
The FTC did not create a new AI enforcement program. It applied its existing unfair and deceptive practices authority to a new category of conduct. The following cases illustrate the patterns through mid-2026.
Operation AI Comply: the landmark 2024 sweep. In September 2024, the FTC announced Operation AI Comply, five enforcement actions targeting companies that used AI claims to deceive consumers. DoNotPay, which marketed an AI chatbot as "the world's first robot lawyer" without testing whether it performed to the standard of an actual lawyer, settled for $193,000 in consumer redress (final order approved February 2025). Rytr, which sold an AI service for generating fake consumer reviews, received a consent order barring the product, though the FTC reversed course in December 2025, setting aside that order at the direction of the Trump administration's AI Action Plan on the grounds that it unduly burdened AI innovation. Ascend Ecom and related entities defrauded consumers of at least $25 million through AI-powered investment opportunity schemes; operators William Basta and Kenneth Leung operated under at least eight company names. Ecommerce Empire Builders and Automaters AI ran similar AI-powered business opportunity frauds.
Deceptive AI accuracy and capability claims. The FTC's most consistent enforcement pattern is requiring substantiation for accuracy and performance claims about AI products. IntelliVision Technologies, which sold facial recognition software, received an enforcement action in December 2024 for making false claims about the accuracy and bias characteristics of its product. Evolv Technologies, which marketed AI-powered weapons detection systems to schools and public venues, settled with the FTC in November 2024 over false capability claims. Workado, which sold an AI content detection product claiming to identify AI-generated text across all content types, was the subject of a complaint in April 2025 for training its model only on academic content while marketing general accuracy; the final consent order was approved in August 2025. An online marketer paid $1 million in January 2025 for falsely claiming its AI product could make websites compliant with accessibility guidelines.
Fake reviews enforcement. The FTC finalized its rule on consumer reviews and testimonials in August 2024, effective October 21, 2024 (16 CFR Part 465), explicitly prohibiting AI-generated fake reviews. Sitejabber, an AI-enabled review platform, was the subject of an FTC order in November 2024 requiring it to disclose AI involvement in review generation.
Algorithmic pricing: investigation, not yet enforcement. The FTC has made algorithmic pricing a stated priority. Its 2024 Surveillance Pricing report documented the investigation into AI pricing tools that use detailed consumer data to set individualized prices. In March 2024, the FTC filed a statement of interest in private litigation over hotel room algorithmic price-fixing, signaling the legal theory it intends to pursue. As of mid-2026, the FTC's activity in this area has been investigations, market studies, and rulemaking, not concluded enforcement actions against pricing tool users.
The Trump administration enforcement shift. The Trump administration's February 2025 AI Action Plan directed federal agencies not to impose regulations that unnecessarily burden AI development. The FTC's December 2025 reversal on the Rytr consent order was the most direct expression of this shift in AI enforcement posture. The practical effect: fraud and deception that causes direct consumer harm continues to be enforced, while enforcement that might constrain AI capabilities faces a more permissive environment. Companies operating consumer-facing AI products should assume the fraud-and-deception prongs remain active while monitoring how the commission treats capability-restriction enforcement going forward.
The Section 5 legal theory applied to AI
Section 5(a) of the FTC Act states that "unfair or deceptive acts or practices in or affecting commerce are hereby declared unlawful." The FTC enforces this through two separate prongs.
A practice is deceptive if it involves a representation, omission, or practice that is likely to mislead consumers acting reasonably under the circumstances. The AI applications of this standard include: marketing an AI system's capabilities with claims that cannot be substantiated (accuracy rates, bias-free performance, performance at scale), failing to disclose material information consumers would want to know (that a chatbot is not human, that a recommendation is AI-generated, that AI was used in a hiring decision), and using AI-generated content (reviews, testimonials, influencer posts) without disclosure.
A practice is unfair if it causes or is likely to cause substantial injury to consumers, is not reasonably avoidable by consumers, and is not outweighed by countervailing benefits. AI applications include: using AI to manipulate prices in ways that harm consumers with no offsetting benefit, using AI to discriminate in access to credit or insurance in ways that cause financial harm, and using AI to exploit consumer behavioral data to charge individualized prices that exploit individual price sensitivity.
Companies should note that the deceptive and unfair prongs can both apply to the same conduct. A company that uses an AI tool to set individualized prices based on inferred vulnerability (location, browsing history, income proxy) faces both prongs: it may be deceptive if it claims its prices are "fair" or "competitive," and it may be unfair because consumers cannot discover and avoid the manipulation.
What the FTC's "AI and Your Business" guidance requires
The FTC published "AI and Your Business" in 2024 as a practical guidance document for companies using AI in any consumer-facing context. It does not create new legal obligations but clarifies how Section 5 applies. Three substantive areas of the guidance have driven enforcement activity.
Accuracy claims for AI systems must be substantiated. If a company's marketing states that its AI detects fraud with 99 percent accuracy, the company must have reliable evidence supporting that claim at the time the claim is made. Claims that the AI is "unbiased," "objective," or "fair" are among the most common unsubstantiated claims the FTC has identified. Bias, in the FTC's view, is a measurable property that must be tested and disclosed, not asserted.
Data use disclosures must be current and specific. If an AI system collects consumer data as an input to its decisions (browsing behavior, location, purchase history, demographic signals), that collection and use must be disclosed in the company's privacy policy in specific terms. Vague statements like "we use your data to improve your experience" do not satisfy the FTC's standard for AI data use disclosure. The guidance specifies that consumers should be told what data the AI uses, what decisions the AI influences, and how they can opt out or seek human review.
Bias testing records should exist and be available. While the guidance does not require public disclosure of bias testing results for all AI systems, it creates a practical obligation to conduct testing because the FTC's Civil Investigative Demand process can require companies to produce testing records. Companies that cannot produce any testing documentation for an AI system used in consequential decisions face a significantly harder position in any investigation. For a step-by-step guide to building your claims substantiation file and reviewing product copy against the FTC's standard, see the FTC AI marketing claims checklist.
How state attorneys general have followed FTC enforcement patterns
State AGs do not need the FTC to move first. All 50 states have consumer protection statutes that prohibit unfair or deceptive practices, most modeled on the FTC Act. State AG offices have AI enforcement task forces in at least 12 states as of mid-2026, including California, New York, Illinois, Washington, Texas, and Florida.
The pattern since 2024 is: the FTC sends warning letters or opens an investigation, state AGs with jurisdiction open parallel inquiries, and the eventual settlement involves both federal and state components. The California AG's office has been particularly active, leveraging both the Unfair Competition Law (Business and Professions Code Section 17200) and the California Consumer Privacy Act to pursue AI companies that operate in California.
New York's AG has focused on AI hiring tools, consistent with New York City Local Law 144's bias audit requirement for automated employment decision tools. The EEOC and FTC have coordinated their positions on AI hiring tool enforcement, with the FTC's AI and Your Business guidance directly applicable to bias claims in AI recruiting products.
Illinois is the most aggressive state AG for AI involving biometric data, given the Biometric Information Privacy Act (740 ILCS 14). BIPA allows a private right of action, meaning individuals can sue directly, which generates the case volume that attracts AG attention. The Illinois AG has opened enforcement actions against two AI facial recognition vendors that collected employee facial data without written consent or a retention policy.
The practical implication for companies is that FTC enforcement activity is a leading indicator of state AG activity. Conduct that draws an FTC warning letter should be reviewed not only for FTC compliance but also for exposure in every state where the company has significant consumer-facing operations.
7-point compliance checklist for companies using AI in consumer-facing products
This checklist is designed for compliance review, not audit. Each item should be assigned to an owner who can verify the current state and produce documentation.
1. Inventory and classify AI use. For every AI system used in a consumer-facing context, document: what the system does, what data it uses, what outputs it generates, and what decisions those outputs influence. This inventory is the foundation for all other compliance activities. Without it, you cannot answer a Civil Investigative Demand and cannot identify where your disclosure obligations apply.
2. Audit accuracy and bias claims. Review all marketing materials, product descriptions, terms of service, and sales collateral for claims about AI accuracy, fairness, or objectivity. For each claim, identify the testing or documentation that supports it. If no documentation exists, the claim must be removed or qualified until documentation is produced.
3. Verify AI disclosure in consumer communications. Confirm that every consumer-facing AI touchpoint discloses that AI is involved. This includes chatbots, recommendation engines, scoring systems, and content generation tools. The disclosure should be specific enough that a reasonable consumer understands what the AI is doing. "Powered by AI" in fine print at the bottom of a page does not meet the FTC's materiality standard for disclosures that affect consumer decisions.
4. Review privacy policy for AI data use. Check that the current privacy policy specifically describes what data is used by AI systems, for what purpose, and what decisions the AI influences. If the current policy was written before the company began using AI in consumer-facing operations, it is almost certainly inadequate and should be updated before the next regulatory review cycle.
5. Establish bias testing records. For AI systems used in hiring, lending, pricing, or access to services, implement a bias testing protocol and document the results. The specific tests depend on the use case, but at minimum they should cover accuracy variance across demographic groups and identify any differential error rates. See the AI governance checklist 2026 for a broader framework that this checklist supports.
6. Implement human review for high-stakes AI decisions. For any AI decision that has significant consequences for an individual (denial of credit, rejection of a job application, price increase that affects access), implement a process for human review on request. Document the process and train the staff responsible for conducting reviews. The FTC's consent orders in this area consistently require human review mechanisms, so building one proactively reduces settlement risk.
7. Establish a documented response plan for FTC inquiries. A Civil Investigative Demand from the FTC is not a lawsuit, but it carries the same production obligations as a legal subpoena. Companies that have not designated a person responsible for regulatory responses, identified where AI documentation is stored, and established a legal review process before an inquiry arrives will spend significantly more time and money responding. The plan should also specify who has authority to communicate with the FTC on behalf of the company, a decision that should not be made in the middle of an active investigation.
The AI regulation deadline calendar 2026 is a useful reference for tracking enforcement effective dates alongside these compliance obligations, because FTC enforcement timing often correlates with new regulatory requirements taking effect.
What the enforcement pattern signals for the next 12 months
Looking at the enforcement activity from 2024 through mid-2026, several patterns stand out.
AI-generated fake reviews remain enforceable. The October 2024 Consumer Reviews Rule (16 CFR Part 465) created a clear civil penalty basis, and the FTC has continued to act in this space. The reversal of the Rytr order in December 2025 introduces uncertainty around how broadly the FTC will interpret AI-related consent orders under the current administration.
Deceptive AI accuracy claims are the clearest enforcement priority. The cases against IntelliVision (facial recognition), Evolv Technologies (security screening), and Workado (AI content detection) show the FTC is actively verifying that AI capability claims are substantiated. This applies to any company that makes quantitative claims about AI performance in marketing materials.
Algorithmic pricing enforcement has not yet materialized in concluded cases, but the FTC's stated focus and its amicus filings in private litigation suggest it is building toward enforcement. Companies that use AI pricing tools should document their pricing logic and ensure they are not sharing competitively sensitive data through common third-party pricing platforms.
The enforcement environment has become more uncertain under the current commission composition. The Rytr reversal was a meaningful signal that the administration views innovation friction as a factor in enforcement decisions. This does not mean deceptive AI practices are acceptable, it means the commission's tolerance for regulatory overreach has shifted, and companies with clear consumer-facing AI deception remain the priority targets.
The AI governance guide for small teams covers how organizations with limited compliance resources can build the documentation habits that these seven checklist items require, without creating a dedicated compliance department. The FTC has shown that it will pursue companies of all sizes, including small businesses that operate review platforms, hiring tools, or consumer-facing AI products, when the conduct is sufficiently harmful or the deception sufficiently clear.
Small teams should not read the enforcement record and conclude that enforcement only happens to companies large enough to afford a settlement. The 2024 and 2025 enforcement record includes companies with fewer than 100 employees. The determining factor in FTC enforcement decisions is the nature and scale of the consumer harm, not the size of the company that caused it.
Related Reading
- FTC AI marketing claims checklist 2026
- AI enforcement: multi-channel risk guide
- AI governance checklist 2026
- AI regulation deadline calendar 2026
- AI acceptable use policy template
- AI governance guide for small teams
- Maryland AI algorithmic pricing law 2026
- Tennessee ELVIS Act AI voice likeness compliance 2026
