Nonprofits and charities: the numbers, the rules, the AI picture.

• IRS Publication 1771: donation acknowledgments and quid pro quo disclosure

  A donor can deduct a gift of $250 or more only with a written acknowledgment from the charity that states the amount, whether any goods or services were provided and a good-faith estimate of their value. The donor must receive it by the earlier of the date they file their return or the return's due date, with extensions. If a donor pays more than $75 and receives something of value, the charity must give a written disclosure that the deductible amount is limited to the excess over the value received, with a good-faith estimate. The penalty is $10 per contribution, capped at $5,000 per fundraising event or mailing, unless the charity shows reasonable cause. Canada differs: the CRA sets a detailed list of items for an official donation receipt, including the charity's registration number and the eligible amount of the gift.

  What it means: Set your donation platform to send the acknowledgment automatically with your legal name, the gift amount and a no goods or services statement. For events, auctions and premiums, show the fair market value at the point of ask and in the receipt. Never promise a tax deduction on a page without saying that deductibility depends on the donor and the gift. Canadian donors need a CRA-compliant official receipt, not a generic thank-you.

  [8] irs.gov

• State charitable solicitation registration (NASCO, California, New York)

  Most states regulate charitable solicitation, and the rules differ by state. NASCO, the association of state charity offices, says registration and filing requirements differ from state to state. California requires charities holding assets for charitable purposes to register with the Attorney General's Registry of Charitable Trusts within 30 days of first receiving assets in or from California, with Form CT-1 and founding documents, then renew each year with Form RRF-1. New York's Executive Law section 172 requires an organization to file a registration form with the Attorney General before any solicitation, except as section 172-a provides.

  What it means: An online donate button solicits in every state a donor lives in. Before you run a national email, ad or giving-day campaign, check which states you must register in, keep registrations current and show your registration details where states require them. Exemptions exist, for example for some religious organizations and small donors, so confirm rather than assume.

  [9] oag.ca.gov

• FTC Act and the Telemarketing Sales Rule: truthful charitable appeals

  The FTC prohibits false or misleading statements to induce a charitable contribution, including misrepresenting the charitable purpose, how a donation will be used, how much reaches programs or whether a donation is tax deductible. The Telemarketing Sales Rule covers for-profit telefunders calling for charities: calls only between 8 a.m. and 9 p.m., prompt disclosure of the charity and that the call seeks a contribution, and records kept for 24 months. The FTC lists a civil penalty of $53,088 per violation. A charity's own staff and volunteers are not covered by the Rule, but the FTC says charities that hire telemarketers should monitor them.

  What it means: Treat 100% of your gift goes to programs, every dollar and similar lines as factual claims that need proof, and explain the funding behind them. Keep impact and finance claims current and sourced. If you use a paid fundraiser or call center, require scripts, hours and records that meet the Rule, and review what they say on your behalf. Many states also have their own telemarketing and professional fundraiser rules.

  [10] ftc.gov

• CAN-SPAM (US), CASL (Canada) and PECR with the charity soft opt-in (UK)

  In the US, the FTC's CAN-SPAM guide requires accurate sender information, no deceptive subject lines, a valid postal address and a working opt-out honored within 10 business days, with penalties of up to $53,088 per email. The guide covers messages whose primary purpose is commercial and does not address charity appeals directly. In Canada, section 6 of CASL bars commercial electronic messages without consent and requires identification and an unsubscribe mechanism. In the UK, PECR regulation 22(3A), added by the Data (Use and Access) Act 2025, lets charities send some direct marketing emails without prior consent if conditions are met, according to the ICO.

  What it means: Build every email and text list on clear consent, keep a one-click unsubscribe and your postal address in every message, and honor opt-outs quickly. Do not rent or borrow lists. For Canadian and UK supporters, check consent rules and the charity exemptions before you send, because the conditions are narrower than they look.

  [11] ftc.gov

• ADA and WCAG: accessible donation pages

  The Department of Justice says the ADA's Title III requirement of full and equal enjoyment covers goods, services and activities offered on the web by businesses open to the public, and that it has no regulation setting detailed web standards. DOJ names WCAG and the Section 508 Standards as technical standards that give helpful guidance. The W3C published WCAG 2.2 as a Recommendation on 12 December 2024, with levels A, AA and AAA. Whether your organization falls under Title III or another law depends on what it does, so ask counsel.

  What it means: Build and test the donation form against WCAG 2.2 AA: labels on every field, keyboard operation, visible focus, sufficient contrast, clear error messages and no reliance on color alone. An inaccessible form blocks donors and invites a demand letter. Test with a screen reader before launch.

  [12] ada.gov

• PCI DSS: protecting card data on donation forms

  PCI DSS is the payment industry's data security standard for organizations that store, process or transmit payment account data. The PCI Security Standards Council develops the standard but does not enforce it. Compliance is required and validated by the payment brands and the acquirers that run compliance programs.

  What it means: Never store card numbers on your own server. Use a reputable hosted or embedded payment form from your donation platform or processor, ask them for their PCI attestation and know which parts of the standard still apply to you. A card data breach costs trust you cannot rebuild with a thank-you email.

  [13] pcisecuritystandards.org

• Google for Nonprofits and Google Ad Grants program policies

  Google gives qualifying nonprofits up to $10,000 a month in search ads on Google.com. Eligibility requires registration as a charity in the country, verification by Google's validation partner and acceptance of Google's terms. Government entities, hospitals and healthcare organizations, schools and universities are not eligible, though charitable arms may be, and fiscally sponsored organizations do not meet the guidelines. Accounts must keep a 5% monthly click-through rate, have at least 2 ad groups per campaign and 2 sitelink assets, use proper location settings, report at least one conversion a month and answer Google's program survey.

  What it means: Plan the grant as a program with an owner, not a free ad budget. Build campaigns around donate, volunteer and service queries with specific keywords, set up donation and sign-up conversion tracking before launch and review CTR monthly. Missing 5% for two consecutive months can lead to temporary deactivation.

  [14] support.google.com

• Overhead and impact claims: Charity Navigator, BBB Give.org and the UK Fundraising Regulator

  Charity Navigator says overhead ratios do not give a complete picture and warns against boiling finances down to one ratio. BBB Give.org evaluates charities against 20 Standards for Charity Accountability across governance, finances, results reporting and truthful, transparent communications, last updated in 2003, and has begun a revision. In the UK, the Fundraising Regulator's Code of Fundraising Practice, effective 1 November 2025, applies to fundraising by or on behalf of charitable organizations in England, Wales and Northern Ireland and to some fundraising in Scotland.

  What it means: Publish your program, administrative and fundraising costs with context rather than a bare percentage. Make every appeal accurate, specific and consistent with your accounts, because the standards ask for that and donors and regulators will compare your appeal with your Form 990. UK charities should register with the Fundraising Regulator and follow the Code.

  [15] give.org

This is general information, not legal or tax advice. Charity law differs by state, province and country and changes often. Check with your state charity regulator, the IRS or CRA, the Fundraising Regulator and Charity Commission in the UK, and your own counsel or accountant before you rely on any of it.