Strong AI Ad Tools, Known Advertisers: Why We're Commenting on the FTC's Impersonation Notice
On 1 October 2026 the Federal Trade Commission published an advance notice of proposed rulemaking asking whether its Impersonation Rule should reach the ad tools that platforms offer advertisers (Federal Register, FR Doc. 2026-20143; FTC announcement). Comments are due Monday 30 November 2026. Sirveil plans to file one. Here is why, and what we will say.
What changed: the tools now make the ad
The notice describes platform tools that write ad copy, generate images and video, assemble headline combinations and choose the audience. A few years ago, a convincing fake government, bank or brand ad took skill and time. Now a platform's own tool can produce, test and deliver variants at scale, and it optimizes toward whatever performs.
The Commission's figures show what is at stake. The notice reports that consumers lost about $16 billion to fraud in 2025, that impersonation was the most reported fraud type, with more than a million reports and about $3.5 billion in reported losses, and that almost 30% of people who reported a loss said it started on social media.
Fair dealing, in four requests
Verify the advertiser before granting the tools. Every advertiser using generative creative or automated audience tools should have a verified legal name and a working contact. Where an ad names a government program, a regulated service such as banking, health or benefits, or another company's brand, verification should be stronger, for example proof of domain control. Marketplaces already verify high-volume sellers under the INFORM Consumers Act, which the notice itself points to.
Gate AI-generated ads that claim to be someone else. When a platform's tool generates or rewrites an ad that presents itself as, or on behalf of, a government agency or a business other than the verified advertiser, the ad should wait for proof of authorization or human review. Ordinary comparative and referential ads would pass as they do today.
Limit targeting where scams concentrate. The notice reports that about 73% of impressions from the top Medicare scam advertisers on one platform reached people over 65. Automated audience expansion toward age or health signals, for ads that invoke benefit programs, should require the same authorization.
Make "we removed it" checkable. When a platform confirms an impersonation ad, it should keep a dated record of the complaint, the confirmation, the removal and whether the advertiser's tool access ended, available to the Commission and summarized publicly.
Why a privacy verification company cares
Two reasons. First, these scams run on exposed personal information: publicly available profiles that list age, address and relatives make the people these ads target easier to find. Second, we spend our days on the difference between a claim and a record. In California's data broker deletion system, a consumer can see "Record deleted" without being told what was done (our comment to California's privacy Board; Your DROP Status, Decoded). A removal that can be checked is a result. One that has to be taken on trust is a promise.
Also on file: Colorado's AI decision and chatbot rules
The same idea runs through a comment Sirveil filed on 26 October 2026 with Colorado, on the proposed rules implementing its Automated Decision-Making Technology Act and Chatbot Safety Act (4 CCR 904-6): people should be able to see who is speaking to them and where the information about them came from.
We supported Rule 7.6(A)(5), which would require a business using an automated decision system to name each source of the personal data it considered, including the original source and any intermediary or vendor. We asked that the disclosure also give the date the data was obtained, where known, because commercial profiles change and a consumer needs to know which version to dispute. We asked that the list of third parties holding a consumer's data under Rule 8.4(C) include a contact or request channel for each one. And for chatbots, we supported a clear, continuing statement that the service is AI and on whose behalf it operates, which narrows the room for impersonation.
The case the other way
Verification adds friction for honest small advertisers, and any gate will sometimes hold a legitimate ad. Platforms also argue that their automated screening already removes most scam ads before anyone sees them, and that a rule written for today's tools may age badly. Those are fair concerns. Risk-based verification done once and reused, a narrow gate that applies only to ads presenting as someone else, and published removal records are how we would try to meet them, while leaving the tools themselves free to improve.
How to comment
Anyone can file: businesses whose names get borrowed, consumer advocates, families who have been targeted. Go to regulations.gov, and write "16 CFR Part 461—Impersonation Rule, Matter No. R207000" on your comment. The Commission says comments carry more weight with specifics: what you saw, when, on what kind of platform, and what it cost. Leave personal information out, because comments are public.
Sources, read 26 October 2026: Federal Trade Commission, advance notice of proposed rulemaking, FR Doc. 2026-20143, and press release of 24 September 2026; Sirveil's comment on Colorado's proposed rules, 4 CCR 904-6, filed 26 October 2026.
Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.
Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.
Sirveil for business: sirveil.ai/for-business
NONE OF THIS CONSTITUTES LEGAL ADVICE.