FTC Rules Protect Against GenAI-led Impersonations: Rule Finalizes to Protect Businesses, and Government from Scams

February 15, 2024, the Federal Trade Commission (FTC) finalized the rules to address AI-enabled impersonation scams to protect consumers, government, and business entities.   

Generative AI (GenAI) adoption spiked in 2022 with the release of OpenAI’s large language model (LLM)-based tool. The tool’s popularity and widespread adoption across businesses replaced many white-collar positions with AI, stirring debates about potential risks outweighing its purported benefits.   

Within a year, almost 80% of U.S. adults expressed concerns over the use of GenAI. Their top concern included impersonation of individuals to unauthorized access to information, according to Ipsos Consumer Tracker on GenAI application. The study also revealed that about 66% of surveyed adults felt they could not report negative AI-generated experiences. Later, a new breed of cybercrimes emerged where AI-led voice cloning tools targeted 70% of the people worldwide.    

Across the U.S. regulatory ecosystem, GenAI regulations are still nascent and will require overarching focus from the federal and state legislatures. However, the rules surrounding the consequences of AI on individuals privacy rights are already in place across all U.S. states (except Utah). So far, President Biden’s Executive Order on AI has some legal relevance, and the 2024 elections are expected to add momentum. Among the regulatory agencies, the FTC has always had an interest in AI space and actively solicited inputs on policymaking regarding ethical and legal concerns regarding AI.   

The commission’s enforcement authority derives from Section 5 of the FTC Act, which prohibits unfair or deceptive acts or practices and unfair methods of competition. The Executive Order encourages the FTC to consider exercising its existing authorities, as appropriate, to ensure competition in the AI marketplace and protect consumers from potential AI harm. In October 2023, the FTC held a virtual roundtable to discuss concerns about GenAI use and its impact on the creative industry.   

In 2024, the FTC finalizes the expansion of new rules with stricter approaches to safeguard individuals from the dangers of AI impersonation. Nearly a week after the Federal Communications Commission (FCC) announced its unanimous decision deeming AI-generated robocalls illegal, the FTC issued a supplemental notice of proposed rulemaking (SNPR) to prohibit AI-led impersonation of individuals.   

The final rule publication precedes two versions of public comments on the initial notice of proposed rulemaking from December 2021. The notice of the rulemaking proposal was issued in September 2022, followed by an informal hearing in May 2023. The new proposal to the rule now extends to businesses and governments targeted to impersonation scams. The commission recommended a trade regulation rule that would include:  

• Liability against businesses providing goods and services (involving use of AI technologies that create texts, images, or videos) with the knowledge or reason to know that they will engage in unlawful impersonation of individuals, government, and businesses.   
• Prohibition against individual impersonation. If adopted, the ban will also extend the new trade regulation rule, preventing the impersonation of government and businesses.   

The FTC is awaiting public feedback on whether to declare it illegal for all businesses, particularly AI platform providers that create images, videos, or texts of individuals and use them for impersonation. FTC Chair Lina M. Khan expressed concerns about the rising incidence of impersonation scams facilitated by cutting-edge tools like GenAI. She added, “Our proposed expansions to the final impersonation rule would do just that, strengthening the FTC’s toolkit to address AI-enabled scams impersonating individuals.”  

What’s in the Final FTC Rules on Business and Government Impersonation 

In addition to the SNPR, the FTC finalized the rule on impersonation of businesses and government, boosting its authority to directly file federal court cases against the impersonators and penalizing them to compensate businesses and government affected by impersonation scams financially. Impersonation scams amount to billions of dollars. By imposing the latest rule, the FTC can effectively combat scams. Under the new rule, impersonation acts carried out by scammers that make them liable to pay monetary relief to their victims include:  

• Unauthorized use of government seals or business logos for offline and online consumer interaction.   
• Imitating government and business emails and web addresses. For example, the use of gov” in email addresses or websites where the company’s name is misspelled.    
• Falsely suggesting government or business affiliation with terms that imply affiliation with a government agency or business.   

The final government and business impersonation rule will be effective 30 days after its publication in the Federal Register. The timeline for public comments on the SNPRM will be open for 60 days after its publication. The FTC’s notice will also include guidelines for issuing comments.   

Agencies like the FTC will enforce its legal stance on using AI and GenAI tools improperly. Businesses must retain consumers’ trust by keeping up with the changing compliance standards recommended by regulators.   

AI and GenAI tools are evolving at the rate where they can mimic human interactions and behaviors, but it is still an opportunity for businesses to leverage the advancement to drive trust that is difficult to program with AI.  

At iTech GRC, we believe trust and leadership go hand in hand for compliance and risk leaders. That’s why we specialize in IBM OpenPages implementation, helping businesses use AI-led enhancements to improve the transparency of their AI data, models, and decisions.   

Get to know our experts today!