What the FTC published
An impersonation scam ad uses a real company's name, logo or look to take money from people who think they are dealing with that company: a fake airline refund page bought at the top of search results, a counterfeit brand “giveaway” in a social feed, a lookalike hotel booking site. The scammer is the obvious culprit. The question the FTC has now formally opened is whether the platform that sold, optimised and delivered the ad should share the liability.
The vehicle is an advance notice of proposed rulemaking, published in the Federal Register on 1 October 2026 under the title “Rule on Impersonation of Government and Businesses”. It proposes “to commence a rulemaking proceeding to prevent certain unfair or deceptive acts or practices by search engine, social media, and other digital marketplace platforms that further government and business impersonation scams to defraud consumers”, and invites comments until 30 November 2026.
The existing rule, 16 CFR part 461, was finalised in March 2024 and prohibits impersonating a government agency or business. During that rulemaking the FTC also proposed a broader “means and instrumentalities” provision that would have covered anyone supplying goods or services knowing they would be used to impersonate. It dropped that in December 2024 after commenters called it overbroad. The new notice revives the idea in narrower form: it is aimed at platforms' ad-optimisation tools and services, and starts at the advance-notice stage the critics had asked for.
The FTC's case against the platforms
The notice's argument is that platforms are paid for scam ads like any others and bear almost none of the cost. In its words, “Platforms internalize the revenue but externalize the risk.” It adds that because victims tend to blame the impersonated business or the scammer, “digital platforms face little to no market discipline to correct the problem”.
Losses reported by consumers to the FTC for 2025, as cited in the advance notice
Source: Federal Trade Commission, Rule on Impersonation of Government and Businesses, advance notice of proposed rulemaking, 91 FR 62347, 1 October 2026, read in full 1 October 2026.
Reported losses only; the notice cites an FTC estimate that the true cost of fraud in 2024, adjusted for under-reporting, may be as high as $195.9 billion. The three rows overlap and are not additive. Almost 30 per cent of people who reported losing money in 2025 said the contact began on social media.
The notice names examples. Scammers use Meta's targeting to push Medicare-impersonation ads to older people; brands such as McCormick have been impersonated in fake “giveaway” ads on Meta platforms; and in what it calls search-engine malvertising, scammers buy “high-ranking sponsored placements” that use a business's name to send users to impostor sites, a tactic it says is common in travel and banking. It cites recent FTC cases over search ads impersonating billers, addiction clinics and government health marketplaces.
It also cites, without adopting, a Reuters investigation reporting that Meta earned an estimated 10 per cent of its 2024 revenue, about $16 billion, from scam ads, and that under its policies advertisers were typically banned only when automated review reached 95 per cent certainty of fraud, with lower suspicion triggering higher ad prices rather than removal. The notice treats these as allegations; Meta's response to them is not part of the notice and we have not assessed it.
The Section 230 question
Any rule that makes platforms answer for third-party ads runs into Section 230 of the Communications Decency Act, which says no provider of an interactive computer service “shall be treated as the publisher or speaker of any information provided by another information content provider”. The FTC's position is that this is narrower than platforms usually argue.
The notice makes three points. Section 230 is an affirmative defence for “merely hosting third-party content”; it does not cover content the platform “materially contributed to developing”. The Third Circuit has held that a platform's algorithmic curation is its own expressive conduct, which may fall outside the immunity, though the Fifth and Ninth Circuits have taken different approaches since. And “any Platform service that enhances the effectiveness of ads may fall outside the ‘publisher or speaker’ categorization”. An ad whose headline the platform assembled from up to 15 advertiser-supplied options, as one court record cited in the notice describes, or delivered to the people its model judged likeliest to respond, is on this reading partly the platform's own work.
The notice concedes that where the line falls “involves a fact-intensive inquiry”, and asks commenters for the facts. The circuit split it describes is real, and a rule built on this reading would almost certainly be litigated.
What a rule could require
The notice does not propose rule text. It lists measures the FTC “may consider” and asks about each.
- evaluating advertisements before they are posted;
- not providing ad-optimisation services to those running impersonation ads;
- a programme to detect suspected impersonation ads;
- a clear and conspicuous tool for consumers to report them;
- investigating suspected ads, removing confirmed ones and stopping optimisation services for them;
- disciplining the offending advertiser;
- verifying advertisers' identity before giving them optimisation tools, raised as a question;
- record-keeping to show compliance; and
- using some or all of the above as a safe harbour, a defence for platforms that comply, rather than as requirements.
It also asks whether liability should depend on a platform having “some level of knowledge of, or participation in” the ad.
It pairs each with questions about cost, especially to small advertisers, and about whether platforms could scale processes they already run under the Digital Millennium Copyright Act, the TAKE IT DOWN Act and the INFORM Consumers Act. The notice points out what each of those leaves out: the copyright takedown process does not cover the trademarks that impersonation scams typically use, and the INFORM Act's seller verification applies only to high-volume sellers on online marketplaces.
In all, the notice asks 21 numbered questions across six sections — the advertising market, platforms' role in optimisation, prevalence, regulatory alternatives, specific rule provisions and a closing section on evidence — most of them broken into lettered sub-questions. The question most relevant to a company is E.5.a: “What types of complaints (e.g., consumer complaints, competitor complaints, complaints from those being impersonated), and what volume of complaints … should trigger a duty for Platforms to investigate a suspected Impersonation Ad?”
What this means for a company that is impersonated
Nothing changes for platforms today. An advance notice gathers evidence; the FTC must then publish a proposed rule and take comments again, and its procedures for rules of this kind can add an informal hearing, as happened in January 2025 on part of the current rule, before anything is final. Its last pass at the Impersonation Rule took from 23 December 2021 to 1 March 2024. On a similar timetable a platform rule would not arrive before late 2028, and court challenges could follow. That projection is ours and the FTC gives no timetable.
What a company can do now is practical.
Keep a record. Every impersonation ad found, with screenshots, the platform, the dates, what was reported and how long removal took, is evidence. It is useful in a crisis, useful in a complaint to the platform and, before 30 November, the kind of “economic data” and “empirical evidence” the FTC says will make comments more persuasive.
Consider commenting. Comments go through regulations.gov, marked “16 CFR part 461—Impersonation Rule, Matter No. R207000”, and are published. The notice specifically asks how impersonation affects the impersonated business and what complaint process should trigger platform action. Companies that have been impersonated are among the few parties with first-hand answers.
Make the real company easy to verify. Impersonation works when the genuine company is hard to tell apart from the fake. A consistent name, a clear official domain, a verified profile on each major platform and a page that tells customers how the company will and will not contact them all narrow the gap. Our guides on owning page one for your name and fixing entity confusion cover the search side; reputation signals covers the rest.
Plan the response. When customers are defrauded in a company's name, they usually blame the company first, which is the notice's own point. A holding statement, a known route for reporting fakes and a named person to own platform takedowns turn a reputational incident into a managed one.
Methodology and limitations
This guide is based on the full text of the FTC's advance notice of proposed rulemaking, 91 FR 62347–62357, published 1 October 2026, read from the Federal Register's text edition on the day of publication, together with its metadata from the Federal Register API. Figures attributed to Reuters, Pew, the Better Business Bureau and others are taken from the notice's own citations and were not checked against the originals; the Meta estimates are Reuters's and are described in the notice as allegations. We counted questions by numbered item in sections VI.A to VI.F of the notice; lettered and roman-numeral sub-questions were not counted separately. The rulemaking history of the 2024 Impersonation Rule is taken from the notice's account (86 FR 72901, 23 December 2021; 87 FR 62741, 17 October 2022; 89 FR 15017, 1 March 2024), and the 26-month interval and the late-2028 projection are our arithmetic, not an FTC estimate. The report that prompted this guide, on Yahoo News, was not relied on. We did not seek comment from any platform named. None of this is legal advice.
Conclusion
Not yet, and not soon. Today a platform that sells and optimises an ad impersonating a real business is, at most, exposed to the general prohibition on unfair and deceptive practices and to whatever Section 230 lets through. The FTC's 1 October notice proposes to change that with a rule aimed squarely at ad-optimisation tools, built on the argument that platforms keep the revenue from scam ads while victims and impersonated businesses bear the cost, and that Section 230 does not protect a platform that helps build or target the ad. It is the first step of a process that took 26 months last time and would face a contested legal question at the end. For companies, the useful window is the next eight weeks: the FTC is asking, in terms, what complaints from impersonated businesses should oblige a platform to act, and companies with records of being impersonated are the people best placed to answer.
Frequently Asked Questions
What did the FTC publish on 1 October 2026?
An advance notice of proposed rulemaking under its Impersonation Rule, asking whether to make search engines, social media and other digital marketplace platforms liable for unfair or deceptive practices that further government and business impersonation scams, especially through their ad-optimisation tools. Comments are due by 30 November 2026.
Is this a new rule?
No. An advance notice is a request for comment. The FTC would next need to publish a proposed rule and take further comment, possibly with an informal hearing, before finalising anything. Its existing Impersonation Rule took about 26 months from advance notice to final rule.
Which platforms would it cover?
The notice defines platforms as public-facing sites or apps where third parties offer goods or services through paid ads or listings, and gives Google.com, Facebook.com, Amazon.com, the Apple App Store and LinkedIn.com as examples.
Doesn't Section 230 protect platforms from liability for ads?
The FTC argues it protects only passive hosting. It says Section 230 does not cover content a platform materially contributed to developing, and that services which enhance an ad's effectiveness, such as AI-assembled headlines or targeting, may fall outside it. Courts are divided on related questions, so this would likely be litigated.
What could a final rule require of platforms?
The notice lists options including evaluating ads before posting, refusing optimisation services to impersonation advertisers, detection programmes, a conspicuous reporting tool, investigating and removing confirmed impersonation ads, disciplining advertisers, verifying identity, keeping records, and a safe harbour for platforms that comply.
What can a company that has been impersonated do?
Keep dated records of every impersonation ad and takedown, consider filing a comment by 30 November 2026 at regulations.gov under Matter No. R207000, since the FTC asks what complaints from impersonated businesses should trigger platform action, and make its genuine channels easy for customers to verify.
Sources
- regulator Federal Trade Commission, Rule on Impersonation of Government and Businesses, advance notice of proposed rulemaking, 91 FR 62347, 1 October 2026. Scope, rationale, Section 230 analysis, options and 21 numbered questions; comment deadline 30 November 2026. Read in full 1 October 2026.
- regulator Federal Register, full text edition of FR Doc. 2026-20143, pages 62347–62357. Used for quotation and the question count. Read 1 October 2026.
- secondary, via the notice Reuters, Jeff Horwitz, Meta is earning a fortune on a deluge of fraudulent ads, documents show, as cited in the notice at footnotes 17, 32 and 33. The $16 billion and 95 per cent figures. Not read directly.
- press Yahoo News, FTC wants social media and search sites to answer for scam ads. The headline that prompted this guide; not relied on above.