Two Small Marketing Firms Paid $25,000 Each Over AI Claims They Helped Market. What the FTC’s Active Listening Orders Mean for Your Agency.

1. What did the FTC decide in the Active Listening cases?

The Federal Trade Commission finalized consent orders resolving its allegations that three marketing companies deceived small business customers by selling an “Active Listening” service as AI that could target ads from conversations captured by smart devices, when, the FTC alleged, the service used no voice data at all. On August 27, 2026, the Commission voted 2 to 0 to finalize the consent orders after receiving two public comments. The combined payment is $930,000, and the money goes to redress for the Cox Media Group customers who bought the service.

The three respondents were CMG Media Corporation, which does business as Cox Media Group and is based in Georgia, and two much smaller firms it worked with: MindSift LLC of Nashua, New Hampshire, and 1010 Digital Works LLC of Wisconsin.

Cox Media Group pays $880,000. MindSift and 1010 Digital Works pay $25,000 each. The complaints were first announced on May 21, 2026, and the final MindSift complaint is dated August 26, 2026. Because the matters ended in consent orders, the facts below are the FTC’s allegations, not findings after a trial. MindSift’s consent agreement states that it “neither admits nor denies any of the allegations in the Complaint,” except as stated in the order.

The FTC’s Active Listening orders are final consent orders, approved August 27, 2026, against Cox Media Group, MindSift LLC and 1010 Digital Works LLC resolving allegations that they falsely marketed an AI ad targeting service as using smart device conversations. The FTC alleged the service was actually resold data broker email lists. The firms pay $930,000 combined and are bound for 20 years.

What the FTC says the service actually was matters more than what it claimed to be. According to the MindSift complaint, the product “did not collect or use voice data in any manner.” The complaint alleges it was consumer email list buying, where data brokers sell lists of addresses for people presumed to share an interest, and that the lists were resold at a significant markup. It also alleges the service promised local targeting, such as a ten mile radius around chosen zip codes, while generating lists of consumers from across the country.

That combination is why this case belongs on every agency owner’s desk. Nobody was charged for using AI. The firms were charged with allegedly describing a product as AI powered when it was not, claiming consumers had consented to something the FTC says never happened, and promising a targeting capability the FTC says the product did not have. Those are the three claims an agency makes every week when it pitches an AI tool to a client.

2. Why were two small firms charged for a service a bigger company sold?

The FTC charged the two small firms because, it alleged, they supplied the marketing language, sales pitch content, and answers to customer questions that Cox Media Group used, and the FTC treats furnishing deceptive material to another company as a deceptive practice in its own right. The MindSift and 1010 Digital Works complaints are nearly identical. The MindSift complaint alleges that in 2023 MindSift, working with 1010 Digital Works and its sole member, offered Active Listening directly to small businesses and on a white label basis to Cox Media Group for resale to its small business customers. That is the most common agency revenue model there is.

The complaint has two counts. Count I is the familiar one: it alleges that MindSift itself misrepresented that the service collected and used voice data, that consumers consented, and that lists were limited to particular geographic areas. Count II is the one to underline. It is titled “Means and Instrumentalities to Engage in Deception,” and it alleges that by furnishing Cox Media Group with language for marketing materials, sales pitches, and responses to customer questions, MindSift “provided the means and instrumentalities for the commission of deceptive acts and practices.”

The complaint quotes the material it relies on. According to the complaint, MindSift’s presentations said the service relied on “the power of voice” and could identify buyers based on conversations happening in real time. One said, “Yes, your devices are listening to you.” The complaint alleges MindSift supplied Cox Media Group with a sales question for prospects, “Where do you want us to listen?”, and ghostwrote a technical answer for skeptical customers claiming that voice related behaviors made up 40 to 50 percent of the behavior volumes it consumed.

Read that from the side of a small agency. If you white label a vendor’s tool, you repeat the vendor’s claims. If you are the vendor, you write the pitch deck your reseller partners use.

An agency can face FTC risk when it authors, supplies, adopts, or materially participates in deceptive AI marketing claims used by another company. How much risk depends on the agency’s role, knowledge, and control and on what it actually provided. An agency that formats a statement its client wrote is in a different position from one that writes and distributes the pitch. The Active Listening complaints show the FTC bringing the two small firms into the same enforcement effort as the company paying $880,000.

One more detail matters for owner operated firms. The 1010 Digital Works complaint identifies the company’s sole member and owner by name, although only the company is a respondent. The orders themselves bind the companies and anyone “in active concert or participation” with them who receives actual notice. If you run a two person agency, the distance between the company’s representations and your own is not large.

3. What counts as an AI capability claim under Section 5?

An AI capability claim is any express or implied statement about what an AI feature does, what data it uses, how accurate it is, or who consented to it, and under Section 5 of the FTC Act it must be truthful and supported by evidence when it is made. The Active Listening complaints make a point that is easy to miss: they allege the misrepresentations were made “including through the use of the service name.” A product name or sales label can contribute to an implied claim when the overall marketing conveys a specific representation about what the service does. That does not make every evocative AI brand name actionable on its own.

The legal standard is old. Under the FTC’s Policy Statement Regarding Advertising Substantiation, objective claims need a reasonable basis before they are made, not a good explanation afterward. Many AI claims are objective and testable: claims about a system’s data sources, capabilities, accuracy, conversion lift, targeting precision, consent, or performance. “Detects buyers in real time,” “predicts which leads convert,” “98 percent accurate,” and “opted in audiences” are examples, and each needs a file. Vague aspirational language may be treated differently, but agencies rarely win by relying on that distinction.

A recent FTC example involving AI accuracy claims is Workado. On August 28, 2025, the Commission approved a final order against Workado, LLC over accuracy claims for its AI Content Detector. The order bars any claim about the effectiveness of an AI content detection product unless the company has “competent and reliable evidence” at the time the claim is made, requires the company to keep that evidence, and requires compliance reports one year after the order and every year for the following three years.

Agencies are unusually exposed to this rule because the claims usually originate somewhere else. A vendor sales sheet says a tool lifts conversion by 30 percent. The agency repeats it in a proposal. If the figure came from a vendor case study with no method behind it, the agency has adopted an unsubstantiated performance claim. The substantiation duty attaches to whoever makes the claim, and in Active Listening the FTC brought separate complaints against the company that resold the service and the firms alleged to have supplied its claims.

Four claim families generate most of the risk for agencies:

• Existence claims. The product uses AI, machine learning, voice, or first party signals. The FTC alleged Active Listening failed here.
• Performance claims. Accuracy, lift, return on ad spend, time saved. The FTC’s Workado complaint alleged a failure here.
• Data and consent claims. Audiences are opted in, data is privacy compliant, nothing is collected without permission. The FTC alleged Active Listening failed here too.
• Targeting claims. Geographic precision, audience match rates, exclusion of certain groups. The FTC alleged Active Listening’s ten mile radius promise failed here.

4. Is the FTC still enforcing AI claims after the Rytr reversal?

Yes, the FTC is still enforcing against false AI claims; what it has narrowed is liability based only on a tool’s potential for misuse. On December 22, 2025, the Commission voted 2 to 0 to reopen and set aside its 2024 final consent order against Rytr, an AI writing service. It concluded that the complaint’s facts failed to support a Section 5 violation and that the order unduly burdened AI innovation, and Rytr consented to vacating the order. We discussed that reversal in our piece on California’s AI Transparency Act and what it means for small agencies.

The Rytr action may indicate greater reluctance to impose liability based solely on a tool’s hypothetical misuse. It does not signal that the FTC has stopped pursuing deceptive claims about what AI products actually do. The same release said the Commission “will continue to hold accountable actors that use AI to violate the law or deceive consumers about the capabilities of their generative AI,” and the Active Listening orders, finalized eight months later, are an example.

Holland & Knight’s September 2026 podcast analysis describes the current posture as a dual approach: reduced enforcement directed at AI innovation itself, coupled with continued enforcement against deception, false advertising, and unsupported performance claims. Both Active Listening and Workado sit squarely in the second category. Neither case turned on whether AI is dangerous. Both turned on whether the seller told the truth about the product.

The votes tell the same story. The Active Listening complaints and consent agreements were approved 2 to 0 in May 2026, and the final orders were approved 2 to 0 in August 2026. The policy direction under the current Commission is not “leave AI alone.” It is “leave AI development alone, and prosecute the sales pitch when it is false.”

One more signal is worth watching. After the Active Listening proposed orders were published, the Center for AI and Digital Policy filed comments asking the Commission to add surveillance prohibitions, algorithmic disgorgement, and mandatory governance programs. In its August 26, 2026 response letter, the Commission said additional provisions were not warranted, explained that, as alleged, no eavesdropping occurred and the practices “were nothing more than consumer email list buying,” called the relief “appropriately tailored” to the deception alleged, and issued the orders without modification. Agencies should expect orders shaped around what they actually said.

5. What does a 20 year FTC order actually require of a small firm?

A 20 year FTC consent order requires a small firm to stop the prohibited claims, prove it is complying through sworn reports, circulate the order to its managers, and create specified business records for two decades. The dollar figure in the headline is usually the smallest cost. For MindSift, the Final Decision and Order spells out the machinery, and 1010 Digital Works’ order follows the same structure.

Here is what the MindSift order requires, provision by provision:

• Provision I. No misrepresentation, express or implied, about the qualities or features of its advertising or marketing services, the collection and use of voice data, consumer consent to that collection, or geographic targeting capabilities. Note how broad the first clause is. It covers every feature of every marketing service, not only Active Listening.
• Provisions II to IV. Payment of $25,000 and delivery of customer information so the FTC can administer redress.
• Provision V. A sworn acknowledgment of the order within 10 days, and for 20 years, delivery of the order to principals, members, managers, and anyone who participates in the covered conduct, with signed acknowledgments collected within 30 days.
• Provision VI. A compliance report, sworn under penalty of perjury, one year after issuance, plus notices of structural changes.
• Provision VII. For 20 years after issuance, the company must create specified records, including accounting records, personnel records, and every consumer complaint and refund request, and it must retain each record for 5 years.
• Provision IX. A 20 year term, or 20 years from the most recent federal court complaint alleging an order violation if that is later, with certain exceptions.

The penalty exposure after the order is where the real money lives. The FTC’s May 21, 2026 release notes that once an order is final it “carries the force of law with respect to future actions,” and each violation may result in a civil penalty of up to $53,088. That is the inflation adjusted maximum in 16 CFR 1.98, and it did not change for 2026 because OMB Memorandum M-26-11 cancelled that year’s adjustment. Penalties are not automatic: the government must bring an action in federal court, and the court decides liability and the amount. Still, a firm under Provision I that later overstates any feature of any marketing service is no longer facing a first offense, and each violation can be counted separately.

For a five to fifty person agency, a 20 year order also becomes a disclosure event. Enterprise clients ask about regulatory actions in procurement questionnaires, insurers ask on renewal applications, and acquirers find it in diligence. We have seen the same dynamic in small manufacturing supply chains, as discussed in our piece on how Tier 1 customers are starting to ask suppliers about AI.

6. What does the FTC’s personalized pricing statement ask for?

The FTC’s proposed statement asks any business that sets prices from consumers’ personal data, where consumers reasonably expect a uniform price, to clearly and conspicuously disclose that the price is personalized, the basis for the personalization, and the types of data used. The Commission voted 2 to 0 on August 19, 2026 to seek public comment, and on September 3 it extended the comment deadline by seven days to September 25, 2026. That window has now closed.

The statement defines personalized pricing as using personal data to set prices according to what a company believes an individual consumer is willing to spend. The statement itself concludes that failing to make the three disclosures “is likely to constitute an unfair or deceptive act or practice in violation of Section 5.” It gives a concrete test case: telling a shopper they received a “specially selected” price would likely be misleading, while a clear disclosure that the price reflects estimated willingness to pay based on the shopper’s previous purchases from the same retailer through the same login account, if accurate and complete, would likely be adequate.

Three limits keep this from being overstated. First, it is a proposed policy statement. The text says it “does not confer any rights on any person and does not operate to bind the FTC or the public,” and in any enforcement action the Commission must still prove a violation of an existing law. Second, Chairman Ferguson’s own statement in the release concedes the FTC “does not have the legal authority to ban personalized pricing in all circumstances.” Third, a footnote says the Commission declines, for now, to take a position on whether some personalized pricing is unfair even when fully disclosed.

A fourth point will surprise readers of the secondary coverage: the statement never uses the words “artificial intelligence” or “algorithm.” Several summaries describe it as an AI pricing rule. It is a personal data pricing rule.

That distinction matters for agencies because the trigger is the data input, not the technology. A rules based or AI driven pricing engine may fall within the proposal if it uses personal data to set an individualized price based on estimated willingness to pay, in a setting where consumers reasonably expect uniform prices. An AI system that does not use personal data to differentiate the price is less likely to implicate it. Whether a given input counts as personal data, and whether shoppers expect a uniform price, will depend on context.

The statement lists seven nonexhaustive examples that would raise Section 5 concerns without disclosure, including a grocery chain charging more for milk to a household data shows has several children, a hotel charging more to a guest it believes is traveling for a funeral, and a retailer charging more online to a shopper its data shows is standing in its own parking lot. DLA Piper’s September 2026 alert and ArentFox Schiff’s analysis both read the statement as a disclosure mandate aimed at the point where the price is shown, not buried in linked terms.

Where does an agency fit? The statement is addressed to businesses that set prices, which usually means your client. But agencies increasingly build the machinery: personalized offer emails, dynamic promo codes, audience specific landing pages, and AI tools that choose which discount each visitor sees.

Our reading, which is an inference and not a holding, is that the Active Listening theory suggests an agency could face risk if it helps create or distribute deceptive claims or inadequate disclosures about a client’s personalized pricing program. That application remains untested. The FTC has not brought a personalized pricing case on those facts, and the statement itself is still a nonbinding proposal.

7. Where do agencies get exposed on data and consent claims?

Agencies face the most data and consent exposure when they make affirmative claims, such as “opted in” or “privacy compliant,” based only on a vendor’s assurance, without evidence of what consumers actually agreed to. According to the Active Listening complaint, MindSift told Cox Media Group that “all data we sell is sourced exclusively from users who have explicitly opted in to share their data,” and argued that consent to microphone access was buried in the terms of service consumers accept when they download apps. The FTC alleged consumers had not consented to the voice data use the service claimed.

The personalized pricing statement points in the same direction and cites the same standard. It says businesses that base personalized prices on personal data “without sufficiently verifying that consumers consented to the collection of those data for that purpose” may violate Section 5. The footnote for that sentence cites then Commissioner Ferguson’s December 2024 statement in the Gravy Analytics and Mobilewalla location data matters.

The phrase to take away is “sufficiently verifying.” A vendor warranty alone may be insufficient where an agency is making affirmative consent or data source claims to a client or the public. The level of diligence should be proportionate to the claim, the sensitivity of the data, the agency’s role, and the evidence available. The FTC has not said every agency must audit every vendor’s consent flows.

This is the part of AI marketing most agencies have never documented. You buy a lookalike audience, an intent data segment, or an enrichment feed. The vendor says it is privacy compliant. You tell the client it is privacy compliant.

If the vendor was wrong, the client’s first question will be what you checked. At many small agencies the honest answer is very little, and the Active Listening complaints quote exactly that kind of vendor language.

Where you plan to make consent or data source claims, four questions are worth answering in writing before third party data touches a client campaign:

• What notice did the consumer see, and does it cover this specific use, such as advertising or pricing, rather than a general “partners” clause?
• Can the vendor produce a sample of the actual consent flow, not a description of it?
• What is the data source chain, and how many brokers sit between the consumer and you?
• Does the data include the kinds of inputs the FTC’s own pricing statement uses as examples of concern, such as a consumer’s physical location at a specific place, medical conditions, or household composition?

8. What else is on the FTC advertising docket this fall?

Two other FTC actions from the last month touch the tools agencies use every day: a new advance notice of proposed rulemaking on platform ad optimization and impersonation scams, and a still pending proposed statement on AI model outputs. On September 24, 2026, the Commission voted 2 to 0 to seek comment on whether to update its Impersonation Rule to address the ad optimization tools that social media, search, and marketplace platforms offer advertisers.

The notice asks how each platform tool optimizes the content and delivery of ads, whether those tools further scams that impersonate legitimate businesses and government agencies, and whether the Commission should require measures such as vetting advertisers, monitoring posted ads, and removing confirmed impersonation ads. The FTC stated that comments will be due 60 days after the notice is published in the Federal Register. As of September 28, 2026, the FTC had posted the notice text on its site, but we had not found it published in the Federal Register, so confirm the actual deadline before commenting. This is the earliest stage of rulemaking and it targets platforms, not agencies. Still, if it produces advertiser vetting requirements, agencies that run accounts for clients will be the ones answering the verification questions.

The second item is the FTC’s proposed policy statement concerning the suppression of accuracy in AI systems, issued July 1, 2026 under Executive Order 14365, which addresses when state laws requiring changes to truthful AI model outputs are preempted. We covered it in our California AI Transparency Act analysis. Its comment period closed July 31, 2026, and as of September 28, 2026 the FTC’s policy statements index still listed it only as a proposed statement. It is a preemption statement, not a license to make unsupported claims.

For agencies with European clients, a third clock is already running. Article 50 transparency duties under the EU AI Act, including disclosure of certain AI generated content, applied from August 2, 2026, as we explained in our piece on what the Digital Omnibus delayed and what it did not. U.S. deception law and EU transparency law ask different questions, and an agency serving both markets needs to answer both.

9. How should an agency vet an AI vendor before reselling it?

An agency should vet an AI vendor by collecting written evidence for every claim it will repeat, testing the core capability itself, and contracting for the vendor’s support if the FTC ever asks.

Adoption has outrun this discipline. According to MediaPost’s report on the 2026 Forrester study produced with the 4A’s, 87 percent of U.S. marketing agencies now use generative AI and 50 percent use agentic AI for marketing execution, while 63 percent cite accuracy and bias concerns and 62 percent cite legal risk as barriers. The 4A’s own public summary puts it at nine in ten agencies using generative AI and half deploying AI agents. The full report, including its sample and question wording, is available only to 4A’s members and we could not review its methodology, so treat the precise percentages as reported figures rather than audited ones.

The reported 62 percent does not say which legal risks respondents had in mind. The enforcement record summarized here says one of the largest is the sales claim. The table below maps each claim family to what a reasonable substantiation file looks like.

Contracts should back the file. A reseller or white label agreement can seek a vendor warranty that its marketing claims are true and substantiated, access to the supporting evidence on request, notice within a set number of days of any regulatory inquiry about the product, cooperation in responding, data use and consent representations, indemnity for claims arising from the vendor’s own materials, information or audit rights, and termination and transition rights. These terms do not eliminate an agency’s own liability for claims it makes, and indemnity can be capped, disputed, or worthless if the vendor cannot pay. They can improve access to evidence, allocate commercial risk, and support a response if the vendor’s representations prove inaccurate.

Finally, write your own copy. Count II in the MindSift complaint is built on allegations about marketing language one company handed another. The single most protective habit a reseller can adopt is to never paste a vendor’s capability claims into a client proposal without checking each one against the file.

10. A 60 day plan for a small agency

A small agency can build a defensible baseline for AI claims in 60 days by inventorying its claims, substantiating or deleting each one, fixing its vendor contracts, and assigning an owner. This is a baseline, not a safe harbor. It will not make a false claim true, but it will show that you had a process, which matters in any FTC conversation and in every enterprise client’s vendor review.

Days 1 to 15: build the claims register. Pull every place your agency describes AI: website service pages, proposals, pitch decks, case studies, white label sales sheets, and email templates. Log each claim, its source, and which of the four claim families it belongs to. Flag every claim that was copied from a vendor, because those are the ones nobody at your agency has tested.

Days 16 to 30: substantiate or delete. For each claim, attach the evidence from the table in section 9 or rewrite the claim to what you can prove. “Uses machine learning to prioritize leads” is defensible if you have the vendor’s architecture note. “Finds buyers the moment they start talking about you” is not. Pay special attention to any claim about consent or data sources.

Days 31 to 45: fix the vendor stack. Send each AI vendor a written request for its substantiation and its consent documentation. Add the warranty, substantiation, notice, and indemnity terms from section 9 at renewal. For any client program that varies price or offers by individual data, document the inputs and draft the three part disclosure the FTC described: that the price is personalized, why, and on what data.

Days 46 to 60: assign ownership and train. Name one person who approves any new AI claim before it goes out. Brief everyone who sells. Map the program to a framework so it survives staff turnover. The NIST AI Risk Management Framework Govern and Map functions fit a claims register naturally, and ISO/IEC 42001 gives a certifiable management system if enterprise clients start asking for one.

If you white label AI tools for other agencies, add one more step: review every piece of partner facing sales material you distribute. That is the kind of material at the center of the FTC’s allegations against the two firms that each paid $25,000 and accepted 20 year orders.

This article is provided for general informational purposes and reflects the state of the law as of September 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.