The Federal Trade Commission wants to know whether the companies that sell the ad tools should answer for the impersonation scams those tools deliver.
On September 24 the Commission announced a 2-0 vote to send the Federal Register an advance notice of proposed rulemaking on its Rule on Impersonation of Government and Businesses. That rule, finalized in March 2024, already bans posing as a government agency or a business. The new question is about the platforms: search engines, social media and other digital marketplace platforms that, in the notice's words, "profit from optimizing online ads for third parties, regardless of whether the third parties are legitimate". The notice names Google.com, Facebook.com, Amazon.com, Apple App Store and LinkedIn.com as examples.
Its diagnosis fits in one line:
Platforms internalize the revenue but externalize the risk.
A shelved provision, back in narrower form
During the original rulemaking, the FTC also proposed making it a violation to provide goods or services "with knowledge or reason to know that those goods or services will be used to" impersonate. Commenters objected that it was overbroad and should have begun with an advance notice. In December 2024, as this notice quotes it, the Commission said it "has decided not to proceed with the SNPRM's proposed means and instrumentalities provision at this time."
This time the Commission starts with an advance notice. Any such provision now "will focus on ad-optimization practices by digital marketplace platforms and will therefore necessarily be narrower than the 2024 SNPRM's proposed provision covering any means and instrumentality."
What it asks, and what it floats
There is no rule text. The questions come in six groups. They ask how each tool writes or targets an ad, whether platforms verify an advertiser before handing over the tools, and whether revenue from impersonation ads shapes the criteria platforms use to police them.
The notice sketches possible requirements: evaluate ads before posting, stop optimizing for impersonators, run a detection program, give consumers a reporting tool, investigate, remove confirmed impersonation ads and discipline the advertiser. Or those steps could work as a shield:
Instead of serving as affirmative requirements, these measures may form the basis of a safe harbor provision by which Platforms' compliance could provide a defense to liability under any new regulations.
It also asks whether liability should require "some level of knowledge of, or participation in, the Impersonation Ad".
Why a rule: it would let the FTC seek consumer redress in a single federal court action instead of a two-step process. "A rule could realign those incentives by subjecting Platforms to court-imposed monetary sanctions for their involvement in furthering those ads."
On Section 230, the FTC reads the law as a defense for liability "that arises from merely hosting third-party content", not necessarily for services that make an ad more effective. It says the line "involves a fact-intensive inquiry", and it cites a 2024 Third Circuit ruling on its side and a 2026 Ninth Circuit ruling that followed precedent immunizing algorithmic recommendations.
The numbers
- More than 1 million imposter-scam reports to the FTC in 2025, with nearly $3.5 billion in reported losses.
- Nearly 30% of people who reported losing money in 2025 said the contact started on social media; their reported losses reached $2.1 billion.
- All fraud: consumers reported losing approximately $16 billion in 2025, "a 25% increase compared to 2024". The FTC's own estimate of the true 2024 cost, adjusted for underreporting, "may be as high as $195.9 billion".
What a reader can do, and when
Not yet. Comments are due "60 days after the notice is published in the Federal Register", and as of September 27 it had not been. Watch for RIN 3084-AB90. Once it prints, comments can be filed at Regulations.gov or on paper, marked Matter No. R207000. Each goes on the public record with the commenter's name and State.
Last time, the advance notice came in December 2021 and the final rule in March 2024.
What the record does not say
- When the notice will print, and so the actual comment deadline.
- What a rule would require. Every measure is something the Commission "may" consider.
- That any named company broke the law. The lawsuits and press investigations the notice cites, including a Reuters report on Meta's internal documents, are allegations or reporting; the notice makes no finding against any platform.
- Whether the printed text will match the pre-publication version this desk read.