Truth, Lies, and Algorithms: A Guide to the FTC's AI Crackdown

An Authoritative Report on FTC AI Enforcement and Corporate Risk Management

Introduction

The rapid commercialization of Artificial Intelligence (AI) has presented a formidable challenge to regulatory bodies worldwide. In the United States, the Federal Trade Commission (FTC) has emerged as the nation's principal regulator of AI in the commercial domain, adopting a proactive and muscular enforcement posture. The agency has made it unequivocally clear that it will not wait for new congressional mandates to police this burgeoning technology. Instead, it is vigorously applying its century-old authority under Section 5 of the FTC Act, which provides a broad prohibition against "unfair or deceptive acts or practices in or affecting commerce," to the novel risks and harms introduced by AI systems.

The FTC's strategy is best characterized as technology-neutral in principle but enforcement-forward in practice. The agency's public statements and legal actions convey a consistent message: while the technological tools may be new, the fundamental legal standards of truth-in-advertising, data security, and consumer fairness are immutable. The FTC is not regulating the technology itself but rather its application and the claims made about it, ensuring that innovation does not come at the cost of consumer protection. This report provides a detailed analysis of the FTC's regulatory framework, beginning with its foundational principles for AI risk management across the product lifecycle. It then proceeds to a detailed, case-by-case dissection of the agency's AI-related enforcement actions, revealing distinct patterns of regulatory concern. Finally, it synthesizes these findings into a practical compliance framework designed to guide corporations in navigating this complex and evolving legal landscape.

1. The FTC's Foundational Principles for AI Risk Management:

A Lifecycle Approach

The FTC's guidance on AI risk management is not a prescriptive checklist but a principles-based framework that emphasizes proactive diligence and accountability at every stage of a product's life. The agency expects companies to anticipate, assess, and mitigate consumer harm from the earliest stages of development through deployment and ongoing maintenance. This lifecycle approach is a critical lens through which companies must view their compliance obligations.

1.1 The Pre-Deployment Stage: Development and Testing

The Commission's guidance establishes an unambiguous mandate for companies to engage in rigorous due diligence before an AI product ever reaches the market. The core expectation is that companies will test, assess, measure, and meticulously document the accuracy and potential for harmful bias in their AI models prior to deployment. This is not a mere suggestion but a baseline requirement for responsible innovation.  

The FTC's enforcement action against Rite Aid serves as a powerful and instructive cautionary tale regarding the consequences of failing to meet this standard. The agency's complaint alleged that Rite Aid deployed a facial recognition technology (FRT) system in its stores without taking reasonable steps to test its accuracy. This failure allegedly led to the system falsely and repeatedly identifying consumers as known shoplifters, with a demonstrably disproportionate impact on women and people of color. This case sets a crucial precedent, the failure to adequately test an AI system for accuracy and bias before deployment can, in itself, constitute an unfair practice under the FTC Act, particularly when it leads to significant consumer injury such as reputational harm, emotional distress, and public humiliation.  The FTC's guidance is not a set of detailed technical standards; it is principles-based, calling for "reasonable steps" and "necessary steps" to prevent harm. This can create ambiguity for businesses seeking clear compliance directives. The Rite Aid enforcement action, however, provides clarity by defining what is unreasonable through a negative example. The complaint details precisely what Rite Aid failed to do, test, assess, measure, document, or even inquire about the accuracy of the technology it was deploying. By penalizing the company for these specific omissions, the FTC has effectively signaled to the market that such a lack of diligence falls below the "reasonableness" threshold. For corporate counsel and compliance officers, the Rite Aid complaint is therefore as vital a compliance document as the agency's formal guidance, as it gives concrete form to abstract principles.   

Furthermore, the FTC's pre-deployment expectations extend beyond the direct actions of a consumer-facing company. The guidance states that companies offering AI models as a service must assess and mitigate potential downstream harm. This has profound implications for the entire AI supply chain. Historically, liability for consumer harm has often rested with the final, consumer-facing entity. However, the FTC's language explicitly targets the developers and providers of AI components, not just the final implementers. This suggests a model of shared responsibility where a B2B company that develops a biased algorithm and sells it to a client could share in the liability for harms that result from its use. This creates a new and urgent imperative for comprehensive due diligence, robust contractual warranties, and clear indemnification clauses in all B2B technology transactions involving AI.  

1.2 The Post-Deployment Stage: Maintenance and Ongoing Monitoring

The FTC's framework makes clear that a company's responsibility for its AI system does not conclude at the moment of launch. There is an ongoing obligation to ensure the system remains fair, accurate, and secure throughout its operational life. Companies must engage in regular, continuous monitoring and testing to detect and correct for issues such as performance degradation, accuracy drift, or the emergence of new, unforeseen biases.  

Once again, the Rite Aid case is illustrative. The FTC's complaint specifically faulted the company not only for its lack of pre-deployment testing but also for its failure to "regularly monitor or test the accuracy of the technology" after it was in use. The company allegedly had no procedures in place for tracking the rate of false positive matches or the actions taken based on those erroneous identifications. This establishes ongoing monitoring as a distinct and critical compliance duty. This stage also encompasses a proactive duty to defend against the malicious use of AI. The FTC expects companies to implement robust guardrails and preventative measures to detect, deter, and halt the use of their technologies for harms such as AI-generated deepfakes used for impersonation, fraud, the creation of child sexual abuse material, and non-consensual intimate imagery. The agency's actions, such as finalizing a rule to combat impersonation and launching a Voice Cloning Challenge to spur innovation in detection tools, underscore its focus on these rapidly emerging threats.

1.3 The Application Stage: Responsible Use and Truthful Marketing

The bedrock of FTC law is the prohibition of deceptive advertising, and this standard applies with full force to AI products. All claims made about an AI tool's capabilities, benefits, performance, or sophistication must be truthful, non-deceptive, and substantiated by what the agency terms "competent and reliable evidence". The FTC has taken a particularly strong stance against "AI-washing", the practice of making exaggerated or false claims about the use of AI to make a product seem more advanced or effective than it is. The agency's "Operation AI Comply" initiative is a clear signal of its intent to aggressively police this form of deception. This principle is vividly illustrated by a broad swath of the FTC's enforcement portfolio. Cases have been brought against companies for deceptive claims related to:   

• Security screening products, where Evolv Technologies allegedly made unsubstantiated claims about its AI weapon scanner's accuracy.  

• Facial recognition software, where IntelliVision Technologies allegedly made unsubstantiated claims that its technology was free of racial and gender bias.  

• Professional services, where DoNotPay allegedly made false claims that its "AI lawyer" could provide services equivalent to those of a human attorney. 

• Business opportunities, where schemes such as Ascend Ecom and FBA Machine used the lure of "AI-powered" systems to make false promises of guaranteed income.  

1.4 Foundational Layer: Privacy and Security by Default

Underpinning the entire AI lifecycle is the FTC's long-standing and non-negotiable expectation that companies protect consumer data. AI models, especially large language and generative models, are notoriously data-hungry, often requiring massive datasets for training and fine-tuning. The FTC has made it clear that companies have a steadfast obligation to ensure the security of this data and to respect consumer privacy choices. 

The FTC's lawsuit against Amazon regarding its Alexa service serves as a landmark example. The agency alleged that Amazon misled users about their ability to delete their voice recordings and geolocation data and then unlawfully retained and used this data to improve its Alexa algorithm. This case is critical because it establishes that data used for model training and improvement is not exempt from privacy and data protection laws. Companies cannot treat user data as a free resource for R&D without regard to the promises made to consumers.  Reinforcing this point, FTC staff have explicitly advised companies against quietly or surreptitiously changing their terms of service to grant themselves new rights to use consumer data for AI training, emphasizing the need for clear and conspicuous consent. The agency's comprehensive Policy Statement on Biometric Information further solidifies its stringent expectations for the collection and use of sensitive data, which is often a key input for AI systems.   

2. Anatomy of FTC Enforcement:

A Thematic Analysis of AI-Related Cases

An examination of the FTC's public enforcement actions reveals the agency's primary areas of concern and its strategic priorities. While the legal foundation is often the same—a violation of Section 5 of the FTC Act—the specific harms and deceptive practices fall into several distinct themes. These cases, taken together, provide a clear roadmap of the conduct the FTC is most focused on preventing.

Table 1: Summary of Key FTC AI Enforcement Actions

2.1 Theme 1: "AI-Washing" and Deceptive Business & Investment Opportunities

A significant portion of the FTC's AI-related enforcement activity has targeted a pernicious form of fraud where "AI" is used as a marketing buzzword to add a veneer of legitimacy to what are, at their core, classic fraudulent schemes. In these cases, the AI is often vaguely described, if it exists at all, and serves primarily to entice consumers with false promises of easy, automated, and substantial passive income.

The cases against FBA Machine / Passive Scaling ,  Ascend Ecom , and Empire Holdings Group (Ecommerce Empire Builders) all follow a similar pattern. The defendants promised consumers that by purchasing their expensive programs or "done for you" services, they could leverage sophisticated "AI-powered" systems to create highly profitable online stores on platforms like Amazon or Walmart. They made specific and unsubstantiated earnings claims, such as earning $10,000 per month, and used deceptive testimonials to bolster their pitches. The reality was that for the vast majority of consumers, the promised profits never materialized, leading to devastating financial losses totaling tens of millions of dollars across these schemes. In some cases, such as Ascend Ecom and Empire Holdings, the defendants also used illegal non-disparagement clauses in their contracts to threaten and silence consumers who attempted to post truthful negative reviews online, a direct violation of the Consumer Review Fairness Act.

2.2 Theme 2: Unsubstantiated Performance, Efficacy, and Professional Equivalence Claims

This second theme moves from outright fraud to cases involving companies with potentially legitimate products that make specific, measurable claims about their AI's performance which they cannot substantiate with competent and reliable evidence. This is a critical distinction, as it goes beyond vague marketing to the failure of a product to deliver on its central, advertised promise.

The FTC's action against Evolv Technologies is a prime example. Evolv marketed its AI-powered security screening system as a high-tech solution for detecting weapons, making explicit claims that it was more accurate and efficient than traditional metal detectors and could distinguish weapons from harmless personal items. The FTC's complaint, however, alleged these claims were deceptive and unsubstantiated. It cited real-world failures, including an instance where an Evolv scanner failed to detect a seven-inch knife that was later used in a school stabbing, as well as high false alarm rates that contradicted the company's marketing. 

Similarly, the case against DoNotPay focused on claims of professional equivalence. The company aggressively marketed its service as "the world's first robot lawyer," promising it could generate "perfectly valid legal documents" and effectively substitute for the expertise of a human attorney. The FTC alleged that DoNotPay had not conducted adequate testing to determine if its AI chatbot's output was equivalent to that of a human lawyer and that the service was, in fact, not effective, producing flawed and unusable documents. 

These cases demonstrate that the FTC is treating the "AI" label not as harmless puffery but as a material claim that creates specific consumer expectations of sophistication and performance. When a company links the "AI" descriptor to a concrete outcome, "AI will keep you safe" or "AI will be your lawyer", it triggers the FTC's full substantiation requirements. The burden of proof shifts squarely to the company to provide rigorous, objective evidence that the AI is a meaningful and effective component of the promised functionality. The agency's complaint against Evolv, for instance, noted the company made "a very deliberate choice" to market its system as using AI, indicating that this claim was a central part of the sales pitch and thus subject to intense scrutiny. 

2.3 Theme 3: Algorithmic Bias, Discrimination, and Inaccuracy

This third theme addresses one of the most critical societal risks of AI: the potential for automated systems to produce discriminatory or dangerously inaccurate outcomes. This includes not only the direct harm caused by biased systems but also the deceptive practice of marketing an algorithm as "bias-free" without substantiation. As discussed previously, the Rite Aid case is the FTC's flagship enforcement action in this area. The alleged use of an untested FRT system that resulted in false accusations disproportionately harming women and people of color is a clear example of an unfair practice leading to direct discriminatory impact.  The case against IntelliVision Technologies tackles the issue from a different angle: deceptive marketing. IntelliVision allegedly made bold, unsubstantiated claims that its AI-powered facial recognition software performed with "zero gender or racial bias". The FTC's complaint asserted that the company possessed no evidence to support this powerful claim. This action signals that companies cannot simply wish away the well-documented problem of algorithmic bias. Making affirmative claims of fairness is a high-stakes proposition that requires equally high standards of proof.   

A close examination of the outcomes in these cases reveals a nuanced and strategic approach to remedies. The FTC is not using a one-size-fits-all penalty but is carefully tailoring the remedy to the nature of the violation and the underlying business model. For businesses such as FBA Machine, Ascend Ecom, and Empire Holdings, which were found to be built on a foundation of fraud, the remedy was a "corporate death penalty", a permanent ban from selling business opportunities. The core business was deception, so the FTC sought to eliminate the business itself.   

In contrast, for companies like Evolv and DoNotPay, which offered tangible products or services but allegedly made unsubstantiated claims about them, the remedies were more surgical. These companies were not banned from operating entirely. Instead, the FTC imposed strict prohibitions on the specific misleading claims and, in Evolv's case, created a mechanism for harmed customers (schools) to exit their contracts. This demonstrates a clear distinction: the agency is targeting the unlawful behavior, not necessarily the existence of the business, when the business itself is not inherently fraudulent. This distinction is crucial for companies assessing their own risk, as the potential penalty is directly proportional to the nature and severity of the transgression.

Section 3: A Practical Compliance Framework for AI Development and Deployment

Translating the FTC's guidance and enforcement precedents into corporate practice requires a proactive, structured, and deeply integrated approach to risk management. A compliance strategy that treats these issues as a last-minute legal check-box exercise is destined to fail. The following framework outlines a more robust path forward.

3.1 Foundational Governance and Accountability

Effective AI risk management begins with a strong governance structure. The FTC's focus on the entire product lifecycle necessitates a departure from siloed decision-making.

• Establish an AI Governance Committee: Companies should create a formal, cross-functional body comprising senior leaders from Legal, Compliance, Product, Engineering, Marketing, and other relevant departments. This committee should be tasked with overseeing the company's AI strategy, setting risk tolerance levels, and ensuring accountability for compliance across the organization.

• Appoint a Chief AI Ethics/Compliance Officer: To ensure that AI governance has teeth, companies should consider designating a senior leader with clear authority, resources, and responsibility for overseeing AI-related compliance and ethical considerations.

• Documentation is Defense: The Rite Aid case makes it abundantly clear that a failure to document testing, assessment, and monitoring activities is a critical vulnerability. Companies must implement and enforce a rigorous documentation policy that creates a defensible record of the due diligence performed at every stage of the AI lifecycle. This record should detail the methodologies used for testing accuracy and bias, the results of those tests, the rationale for deployment decisions, and the plan for ongoing monitoring.  

• Adopting an AI Risk Framework: There are several industry frameworks  (e.g., NIST AI RMF,  ISO/IEC 42001, HITRUST AI) that can be  leveraged by organizations to guide them through the development and implementation of  trustworthy AI systems and also obtain a certification to demonstrate adherence to best practices.   

3.2 Pre-Launch Diligence: A "Substantiation-First" Approach

The most effective way to avoid the pitfalls of FTC enforcement is to build compliance into the product development process from the very beginning.

• Marketing Claim Substantiation: Legal and product teams must collaborate before any marketing materials are drafted. The process should begin not with a desired marketing slogan, but with the "competent and reliable evidence" that has been generated through testing. Only claims that are directly and robustly supported by this evidence should be considered for use. Any claims of specific efficacy (as in the Evolv case ), professional equivalence (DoNotPay ), or lack of bias (IntelliVision ) must be backed by objective, well-documented, and scientifically valid testing. 

• Bias and Fairness Audits: The lessons from the Rite Aid and IntelliVision cases are unequivocal, pre-deployment audits for algorithmic bias are non-negotiable, especially for AI systems that make critical decisions about consumers or impact protected classes. These audits should be conducted by qualified internal or external experts and their results and any mitigation steps taken must be documented.  

• Data Provenance and Rights: Before any data is used for model training, a clear line of sight must be established to its origin. Companies must verify that the data has been lawfully sourced and that its use for AI training is fully consistent with the privacy policies, terms of service, and specific consumer consents in place at the time of collection. This diligence is essential to avoid the data misuse issues highlighted in the FTC's action against Amazon's Alexa service. 

The FTC's lifecycle approach fundamentally reframes compliance as a core product design feature rather than a peripheral legal review. The agency's guidance and enforcement actions focus heavily on activities that occur deep within the product development process—such as selecting training data, designing testing protocols, and building monitoring dashboards. These are primarily engineering and product management functions. The Rite Aid case demonstrates that the absence of these technical steps is what created the legal violation. Therefore, to effectively mitigate legal risk, legal and compliance requirements must be translated into concrete technical specifications. Fairness, transparency, and substantiability must be treated as core product requirements, embedded in design documents, user stories, and quality assurance testing protocols. In this new paradigm, robust legal risk mitigation becomes an outcome of excellent engineering and product management.

3.3 Post-Launch Vigilance: Continuous Monitoring and Adaptation

As established, a company's obligations do not end at launch. A state of constant vigilance is required.

• Ongoing Performance Monitoring: Companies must implement a combination of automated and manual systems to continuously monitor the AI's real-world performance. This is crucial for detecting accuracy drift, performance degradation in new environments, or the emergence of new biases that were not present in the initial training data, as mandated by the FTC's guidance.  

• Complaint and Redress Mechanism: A clear, accessible, and responsive channel for consumers to report issues, appeal automated decisions, and seek redress is essential. The attempts by companies like Ascend Ecom and Empire Holdings to use illegal non-disparagement clauses to silence consumer complaints were a major focus of the FTC's enforcement actions and a direct violation of the Consumer Review Fairness Act.  

• Responsible Model Updates: The process for updating or retraining models must be as rigorous as the initial development. Any updated model should be re-tested for fairness and accuracy before deployment. Furthermore, companies must remain transparent with consumers and avoid surreptitiously changing their terms of service to expand data usage rights for training new models.

The requirement for ongoing monitoring creates an implicit "duty to correct." The purpose of monitoring is to identify problems. Once a problem is discovered (e.g., monitoring reveals that a security scanner's false positive rate has spiked), rendering prior accuracy claims invalid, then the company is officially on notice. To continue operating the now-known-to-be-flawed system could be considered an unfair practice, as it knowingly exposes consumers to harm. To continue marketing the product with the old, now-false claims would be a clear deceptive practice. This creates a new operational imperative for an AI "fire drill" protocol. Companies must have the technical capabilities and business processes in place to rapidly retrain, patch, or even pull a failing AI model from the market, and to manage the associated communications with customers and regulators.

3.4 Marketing and Communications:

The "Truth, Not Hype" Doctrine

All external communications about AI products must be subjected to intense scrutiny to ensure they are truthful, accurate, and not misleading.

• Scrutinize Every Claim: Marketing teams must be trained to avoid hyperbole and absolute claims. Statements like "detects all weapons" (Evolv ) or "zero bias" (IntelliVision ) are virtually impossible to substantiate and create immense legal risk. All comparative claims, such as "more accurate than traditional methods," must be based on rigorous, well-designed, head-to-head testing.   

• Avoid "AI-Washing": If the term "AI" is used in marketing, the company must be prepared to explain precisely and truthfully what the AI component does and how it provides a meaningful benefit to the consumer. The FTC's crackdown on fraudulent business opportunity schemes shows its profound intolerance for using AI as a deceptive lure to part consumers from their money.  

• Embrace Clear Disclosures: Transparency about an AI system's limitations can be a powerful risk mitigation tool. The DoNotPay settlement, which requires the company to notify past customers about the limitations of its service, sets a clear standard for this type of transparent communication.   

Conclusion: The Path Forward in a Regulated AI Ecosystem

The Federal Trade Commission's recent enforcement actions and public guidance have definitively reshaped the legal landscape for Artificial Intelligence in the United States. The agency has successfully demonstrated that its existing authority under the FTC Act is a potent and flexible tool for addressing the consumer harms posed by irresponsibly developed or deceptively marketed AI. A synthesis of the FTC's activities reveals a clear and coherent regulatory framework built on timeless principles: companies must substantiate their claims, design and test for fairness, protect the vast amounts of data that fuel their models, and be transparent with consumers about what their technology can and cannot do.

The key takeaway for all commercial actors in the AI ecosystem is that the era of unregulated, "move fast and break things" development is over. The FTC's actions against a wide range of companies, from fraudulent business opportunity schemes to providers of sophisticated security and legal tech—show that no sector is immune from scrutiny. Proactive, evidence-based, and ethical AI governance is no longer simply a reputational asset or a matter of corporate social responsibility; it is a fundamental legal and commercial necessity.

The path forward requires a paradigm shift within organizations. Compliance can no longer be a siloed function or a final check-off before a product launch. The principles articulated by the FTC must be woven into the very fabric of product design, engineering, and marketing. The most successful and durable companies in the AI era will be those that move beyond a reactive, compliance-driven mindset. They will be the ones that embrace fairness, transparency, and substantiation not as regulatory burdens, but as core components of their product strategy and brand identity. In a world of increasing consumer skepticism and regulatory scrutiny, building and maintaining consumer trust will be the ultimate competitive advantage.

Connect with our subject matter experts to learn how we help organizations prepare their AI strategy.