The Federal Trade Commission voted 2-0 on September 24 to open a public comment process on whether it should hold social media platforms, search engines and online marketplaces responsible when their own ad-optimization tools help scam ads impersonate real businesses. Nothing about the vote changes what a platform can run today. It only starts a clock on whether the agency eventually will.
The question matters because of where scam contact is actually happening. Nearly 30% of consumers who reported losing money to a scam in 2025 said they were first contacted through social media, and those cases alone accounted for $2.1 billion of the $3.5 billion in total impersonation losses the FTC logged that year.
The rule this would actually amend
The FTC is not writing from scratch. It already has a Rule on Impersonation of Government and Businesses, finalized in 2024, that lets the agency go after scammers directly for posing as a real company or agency. What that rule has never reached is the platform hosting the ad. According to the Federal Register notice covering that earlier proceeding, the FTC had already floated extending liability to third parties whose products or services were knowingly used in impersonation schemes, then chose not to adopt that provision when the rule was finalized. This new advance notice revives essentially the same question, just aimed specifically at the advertising machinery platforms run rather than at third-party vendors generally.
The questions the ANPRM puts to platforms
An advance notice of proposed rulemaking, or ANPRM, is a request for information, not a draft rule. The ANPRM itself, filed under RIN 3084-AB90, asks whether platforms profit financially from ads that turn out to be impersonation scams, how their ad-targeting and delivery systems actually work, and what verification or takedown steps they already apply before an ad runs. It also asks the harder legal question directly: whether liability should depend on a platform’s knowledge of, or participation in, a specific impersonation ad, and where that threshold should sit.
Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, put the goal in plain terms in the agency’s own announcement: “Free markets depend on trust, transparency and consumers’ ability to make informed choices.” In a separate assessment of the same notice, an advertising-law analysis from Frankfurt Kurnit Klein & Selz quoted him describing the exercise more narrowly, asking “whether the Commission should require platforms to take concrete steps to prevent impersonation ads from ever reaching consumers.” That same analysis flags the central legal obstacle the FTC has to work around: Section 230 of the Communications Decency Act still shields platforms from liability for third-party content in most circumstances, and any rule here would need to rest on the argument that a platform’s own conduct in building and running its ad tools falls outside that shield.
Section 230’s protection is broad but not absolute, and the FTC’s theory rests on treating platform ad-optimization decisions as the platform’s own conduct rather than merely hosting someone else’s speech, a distinction courts have accepted in narrower contexts before. The scale of the underlying problem is part of what gives that theory room to breathe: the FTC logged more than 1 million imposter scam reports in 2025 alone, a volume large enough that the agency has repeatedly called impersonation fraud its single most-reported category of complaint, ahead of online shopping fraud and investment scams combined in some years’ tallies.
A record that closes before any rule gets written
The FTC’s own docket page lists September 24, 2026, as the notice’s publication date, and the ANPRM sets a comment window of 60 days from Federal Register publication. That timeline puts a public record in place well before winter, but an ANPRM comment period closing is not the same as a rule taking effect. The FTC can decide, after reading the record, to draft an actual notice of proposed rulemaking, to narrow its questions and ask again, or to drop the platform-liability idea entirely the way it dropped the similar third-party provision from the 2024 rule. Each of those paths runs through additional public process before anything binds a platform, which is a slower route than the FTC’s direct enforcement actions against individual scammers, but potentially a far broader one if it succeeds, since a rule reaching ad-optimization tools would apply to every platform running those tools rather than to one scammer at a time.
Until any of that happens, a platform running an ad that impersonates a real bank, retailer or government agency faces the same exposure it does today: potential liability for the advertiser who bought the ad, and none yet for the platform that served it. That leaves the businesses being impersonated, banks and retailers named in ads they never placed, with the same recourse they had before the vote: reporting the fake ad to the platform’s own takedown process and hoping it moves faster than the scam does, rather than any FTC rule they can point to.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
More from Morning Overview
- Early electric-car owners are hitting battery and screen failures no one warned them about
- A magnitude 5.3 quake struck off the Oregon coast this week
- Amazon’s Prime refunds are rising to $200 as millions more customers become eligible
- A handful of car engines are so tough mechanics say they almost never wear out
