FTC Proposes New Protections to Combat AI Impersonation of Individuals

The Federal Trade Commission is seeking public comment on a supplemental notice of proposed rulemaking that would prohibit the impersonation of individuals. The proposed rule changes would extend protections of the new rule on government and business impersonation that is being finalized by the Commission today.

The agency is taking this action in light of surging complaints around impersonation fraud, as well as public outcry about the harms caused to consumers and to impersonated individuals. Emerging technology – including AI-generated deepfakes – threatens to turbocharge this scourge, and the FTC is committed to using all of its tools to detect, deter, and halt impersonation fraud.

The Commission is also seeking comment on whether the revised rule should declare it unlawful for a firm, such as an AI platform that creates images, video, or text, to provide goods or services that they know or have reason to know is being used to harm consumers through impersonation.

“Fraudsters are using AI tools to impersonate individuals with eerie precision and at a much wider scale. With voice cloning and other AI-driven scams on the rise, protecting Americans from impersonator fraud is more critical than ever,” said FTC Chair Lina M. Khan. “Our proposed expansions to the final impersonation rule would do just that, strengthening the FTC’s toolkit to address AI-enabled scams impersonating individuals.”

The supplemental notice of proposed rulemaking is being issued in response to comments received during the public comment period on the government and business impersonation rule that pointed to the additional threats and harms posed by impersonation of individuals. As scammers find new ways to defraud consumers, including through AI-generated deepfakes, this proposal will help the agency deter fraud and secure redress for harmed consumers.

Final Rule on Government and Business Impersonation

In addition to the supplemental notice, the FTC has finalized the Government and Business Impersonation Rule, which gives the agency stronger tools to combat scammers who impersonate businesses or government agencies, enabling the FTC to directly file federal court cases aimed at forcing scammers to return the money they made from government or business impersonation scams. This is particularly important given the Supreme Court’s April 2021 ruling in AMG Capital Management LLC v. FTC, which significantly limited the agency’s ability to require defendants to return money to injured consumers.

Government and business impersonation scams have cost consumers billions of dollars in recent years, and both categories saw significant increases in reports to the FTC in 2023. The rule authorizes the agency to fight these scams more effectively.

For example, the rule would enable the FTC to directly seek monetary relief in federal court from scammers that:

• Use government seals or business logos when communicating with consumers by mail or online.
• Spoof government and business emails and web addresses, including spoofing “.gov” email addresses or using lookalike email addresses or websites that rely on misspellings of a company’s name.
• Falsely imply government or business affiliation by using terms that are known to be affiliated with a government agency or business (e.g., stating “I’m calling from the Clerk’s Office” to falsely imply affiliation with a court of law).  

The publication of the final rule comes after the two rounds of public comment in response to an advance notice of proposed rulemaking issued in December 2021, a notice of proposed rulemaking issued in September 2022, and an informal hearing in May 2023.

The Commission vote to issue the final rule and the supplemental notice of proposed rulemaking and to publish them in the Federal Register was 3-0. Chair Lina M. Khan issued a separate statement that was joined by Commissioners Rebecca Kelly Slaughter and Alvaro M. Bedoya.

Both items will appear in the Federal Register shortly. The final rule on government and business impersonation will become effective 30 days from the date it is published in the Federal Register. The public comment period for the SNPRM will be open for 60 days following the date it is published in the Federal Register, and instructions for how to comment will be included in the notice.