Marketing and creative agencies: the numbers, the rules, the AI picture.

• FTC Act and advertising substantiation (claims about results)

  The FTC states that advertising must be truthful and non-deceptive, that advertisers must have evidence to back up their claims, and that a reasonable basis means objective evidence that supports the claim. An ad is deceptive if it contains a statement, or omits information, that is likely to mislead consumers acting reasonably, and the claim is material. The FTC has also acted against sellers who deceived small businesses: its 2018 Point Break Media case alleged false claims of Google affiliation and false promises of top search results, and a 2020 case concerned small businesses sold "exclusive" ad placements that the FTC alleged were misrepresented.

  What it means: Hold evidence before you publish any claim about what you achieve for clients: the measure, the period, the client type and what else changed. Never promise rankings, leads or revenue, and never claim a special relationship with Google. The FTC pages we opened do not state whether the consumer wording covers every business-to-business sale, but its small-business cases show it acts when businesses are misled. Treat B2B claims as covered and ask counsel about edge cases.

  [8] ftc.gov

• FTC Endorsement Guides and the Consumer Reviews and Testimonials Rule

  The FTC revised its Endorsement Guides in 2023. They say a material connection, such as payment or a free service, must be disclosed clearly and conspicuously when many people would not expect it, and that hiring an outside firm does not remove the advertiser's responsibility. Intermediaries that create or spread endorsements can be liable. If an endorser reports unusual results, the advertiser needs proof people will generally get them, or must say what people will generally achieve. The FTC's rule on consumer reviews and testimonials took effect on October 21, 2024. It covers fake reviews, buying reviews tied to a sentiment, undisclosed insider reviews, company-controlled sites posing as independent reviewers, review suppression and purchased fake social media indicators.

  What it means: Do not write your own reviews, pay or discount for praise, or hide that a quote came from a client you employ or a partner. If a review site is yours, do not present it as independent. Do not threaten reviewers or make false accusations against them. When you manage reviews for clients, you are the intermediary, so build a written process that asks every customer, not only the happy ones. The FTC page does not say how far the rule reaches into purely business-to-business reviews, so treat the honesty principles as binding.

  [6] ftc.gov

• FTC enforcement on AI claims (Operation AI Comply)

  On September 25, 2024 the FTC announced Operation AI Comply, a set of actions against companies that used AI claims to deceive. Cases included sellers of "AI-powered" income schemes and an AI writing tool whose "Testimonial and Review" use case let paid users generate reviews that the FTC said would likely be false. The FTC chair said there is no AI exemption from the laws on the books. The proposed order barred that tool from marketing any service dedicated to generating reviews or testimonials.

  What it means: If you sell AI services, such as AEO, AI content or automation, describe only what the work does and hold evidence for performance claims. Do not use AI tools to produce reviews, testimonials or case studies that did not happen. Do not sell AI-generated reviews to clients. Disclose AI use to clients where it affects the work or their data, and check that your contracts say who owns the output.

  [9] ftc.gov

• CAN-SPAM Act and Google bulk sender rules (outbound email)

  The FTC lists eight requirements for commercial email, including accurate header information, a non-deceptive subject line, a clear disclosure that the message is an ad, a valid physical postal address and a clear opt-out that is honored within 10 business days and works for at least 30 days. Responsibility cannot be contracted away when another company sends for you. The FTC states the law makes no exception for business-to-business email, and each violating email can carry penalties of up to $53,088 (figure edited January 2024). Separately, Google requires bulk senders of 5,000 or more messages a day to authenticate with SPF, DKIM and DMARC, support one-click unsubscribe and keep the spam rate below 0.30%.

  What it means: Cold outreach is commercial email. Put a postal address and a working unsubscribe in every message, remove people promptly and keep the suppression list in one place. If you run outreach for clients, your contract should say who is the sender and who is responsible. If you send volume, set up authentication on a separate sending domain and watch the spam rate. Do not buy lists without knowing how the contacts were collected.

  [7] ftc.gov

• United Kingdom: PECR electronic mail marketing rules

  The UK Information Commissioner's Office says organisations generally need prior consent before sending unsolicited email marketing to individual subscribers, a group that includes sole traders and ordinary partnerships, unless a soft opt-in applies. Corporate subscribers can be emailed without consent. In every case you must not disguise or hide your identity, and you must give a valid way to opt out in every message. Bought-in lists cannot rely on the soft opt-in.

  What it means: Many small agency prospects are sole traders or small partnerships, so the corporate exception covers fewer of your targets than you expect. Use consent for newsletters, keep a record of who consented, when and how, and remember that named business addresses are still personal data under data protection law. If you send outbound email into the UK for yourself or for clients, check each segment's legal status before you send.

  [10] ico.org.uk

• GDPR and UK GDPR Article 28: agencies as processors of client data

  When an agency handles personal data on a client's behalf, such as customer lists, analytics data, CRM exports or ad audiences, it is usually a processor under Article 28 of the GDPR, and the client is the controller. A processor acts only on documented instructions, works under a written contract, binds its staff to confidentiality, applies security measures, engages sub-processors only with the controller's prior written authorisation, helps with data subject requests and deletes or returns the data when the service ends. If a processor decides the purposes and means of processing, it is treated as a controller for that processing.

  What it means: Put a data processing agreement in every engagement that touches personal data, and keep a list of the sub-processors you use, including AI tools, reporting platforms and freelancers. Do not feed a client's customer data into a tool without the client's authorisation. Set a return or deletion step at offboarding. The UK GDPR mirrors this structure, so UK work needs the same contract terms. Ask a data protection adviser to review your template.

  [11] gdpr-info.eu

• California Consumer Privacy Act (CCPA) and CPRA: agencies as service providers

  The California Attorney General says the CCPA treats service providers differently from the businesses they serve, and that a consumer who submits a request to a service provider may be turned away and told to go to the business. The CCPA applies to for-profit businesses in California that meet a threshold: more than $25 million in annual revenue, buying, selling or sharing the data of 100,000 or more residents or households, or earning 50% or more of revenue from selling or sharing personal information. The exemptions for business-to-business and employment data expired on December 31, 2022.

  What it means: Whether you are a service provider depends on your contract and what you do with the data. If a client uses you to run ad audiences or analytics, expect them to ask for service-provider terms. Do not use client data for your own purposes without checking. Your own website, newsletter and lead forms may be in scope if you meet a threshold, and B2B contact data is no longer exempt. The page does not set contract terms, so take legal advice on the wording.

  [12] oag.ca.gov

• Google platform rules: spam policies and the Maps review policy

  These are platform rules, not laws, but they decide whether your clients stay visible. Google's spam policies cover scaled content abuse (many pages made mainly to manipulate rankings), link spam (buying or selling links to manipulate rankings), expired domain abuse and the site reputation policy, which covers third-party content hosted on a site mainly to borrow its ranking signals. Sites that violate them may rank lower or not appear. The Google Maps contributed-content policy bans fake engagement, paid reviews, rewards for reviews, conflict-of-interest reviews and selective solicitation of positive reviews.

  What it means: Do not sell or run tactics that these policies name, for yourself or for clients. You are responsible for what a hired firm does to your site, and a clean report that hides spam is a liability. Ask clients for reviews without incentives and ask every customer. If a client's staff, family or contractor wrote the review, it is a conflict of interest. Check the current wording before you build a process on it, because platform rules change.

  [13] developers.google.com

This is general information, not legal advice. Rules differ by country and state and they change. Confirm testimonial, results and AI claims, outbound email practice and client data contracts with your own lawyer or data protection adviser before you publish or send.