Who should answer for a scam ad: the scammer, the company that sold the ad space, or the company whose software tracks the results? The Federal Trade Commission (FTC) wants to hold online platforms liable, but its definition of “platform” leaves the answer murky. It could reach beyond Google and Meta to Walmart, Uber, and even Apple when it supplies software for other companies’ ads.
The FTC has asked for public comment on whether search engines, social media services, and other platforms should face liability when scammers use their ad tools to impersonate businesses and government agencies. Thus far, the agency has issued an advance notice of proposed rulemaking (ANPRM), an early step toward drafting a rule.
Most of the FTC’s evidence concerns Google and Meta. It cites Reuters reporting, based on internal Meta documents, that Meta earned an estimated $16 billion from scam ads in 2024. That’s a substantial reason to investigate, but it doesn’t tell the agency where to draw the lines.
And those lines matter. A company can sell ad space or select an ad’s audience without helping create its false claims. The FTC’s broad definition of “platform” blurs those distinctions, while its theory of liability for ad targeting runs into both Section 230—the federal law that generally shields online services from liability for third-party content—and the First Amendment. A workable rule needs to distinguish helping to deliver an ad from helping to create the fraud.
Will the Real Platform Please Stand Up?
Who counts as a platform? Under the ANPRM, any public-facing website or app where third parties offer goods or services through paid ads or other listings. The examples include Google and Facebook, but also Amazon, LinkedIn, and the Apple App Store.
That definition reaches companies whose advertising operations sit within much larger businesses. Walmart reported $4.4 billion in global advertising business in fiscal 2025—equivalent to about 0.65% of its total revenue. Uber’s advertising business was running at more than $2 billion a year by the end of 2025, compared with $52 billion in total annual revenue, according to its annual report. Apple sells ads in the App Store, Apple News, and Stocks, and, since August, in Apple Maps.
These companies don’t all sell ads the same way. In a self-serve system, an advertiser opens an account, uploads an ad, and bids for placement without dealing with platform staff. Walmart, Uber, and Apple sometimes work more directly with advertisers before running their ads. Apple won’t run a Maps ad until the business has verified its organization and claimed its location. Uber credits much of its ad growth to Sponsored Listings, which restaurants and stores already selling on Uber Eats buy to promote themselves.
Other arrangements blur the platform’s identity. A news publisher can sell ads in its Apple News channel or let Apple sell the unsold slots, with the publisher keeping 70% of the revenue. In the latter arrangement, the publisher supplies the article, and Apple sells the ad. The ANPRM’s definition could treat either the publisher or Apple as the platform responsible for the ad, but the notice doesn’t clarify which would bear liability.
Apple also writes software for other ad sellers. Ad networks—companies that place ads from multiple advertisers across multiple apps—can register for Apple’s AdAttributionKit, serve an ad in a developer’s app, and receive a report when it leads to an app installation or sale. The ad network handles the advertiser’s account and supplies the ad. Apple’s software tracks whether the ad led to an app installation or sale.
An earlier version of the proposal, published in 2024, would have imposed liability on anyone supplying goods or services “with knowledge or reason to know” that others would use them for impersonation. The FTC dropped that provision, but its new ANPRM doesn’t clarify whether the rule it’s now considering would reach companies that supply software like AdAttributionKit.
Apple’s App Store lists more than 2.1 million apps. But hosting those apps and supplying software to measure ad results doesn’t make Apple responsible for verifying every advertiser. That duty belongs to the company that handles the advertiser’s account and can check its identity—in this case, the ad network.
Out of Section 230 and Into the First Amendment
Section 230 of the Communications Decency Act generally bars courts from treating an online service as the publisher of content someone else created. Courts have read it to shield platforms from most lawsuits over users’ posts and advertisers’ ads. The ANPRM argues that ad targeting may fall outside that shield, relying on two cases.
In Moody v. NetChoice (2024), the Supreme Court reviewed Texas and Florida laws restricting how large social media platforms moderate posts. The Court explained that a platform engages in its own expression when it selects and arranges others’ posts into a feed. The First Amendment protects those editorial choices.
In Anderson v. TikTok (2024), the 3rd U.S. Circuit Court of Appeals applied that reasoning to Section 230. TikTok’s feed had recommended a “blackout challenge” video to a 10-year-old who died attempting it. Relying on Moody, the court treated that recommendation as TikTok’s own speech, which Section 230 doesn’t cover.
The 3rd Circuit likely got that wrong. Section 230(f) expressly includes “access software providers” whose tools “filter, screen, allow, or disallow content” or “pick, choose, analyze, or digest content.” A recommendation algorithm—a system that selects content for users—arguably does just that. Still, courts could extend Anderson’s reasoning to ad targeting.
Before Moody, courts generally held that using algorithms to connect users with content didn’t, by itself, make a platform liable for that content, including false advertisements. In Force v. Facebook (2019), victims of Hamas attacks argued that Facebook’s algorithms connected terrorists with supporters. The 2nd U.S. Circuit Court of Appeals held that matching users with third-party content falls within the publishing activity Section 230 protects. The 9th U.S. Circuit Court of Appeals continued to follow that approach in Doe 1 v. Meta Platforms (2026).
But Anderson’s reasoning comes with a constitutional catch. If ad targeting is the platform’s own speech, a rule regulating it must satisfy the First Amendment—the very protection Moody recognized. Losing Section 230 protection doesn’t make liability automatic. Newspapers receive no Section 230 protection for their print editions, for example, but generally don’t face liability for deceptive or defamatory ads unless they knew or should have known the ads were false.
Advertising also receives First Amendment protection, although less than other speech. In Central Hudson (1980), the Supreme Court struck down a New York rule that barred electric utilities from advertising to encourage electricity use. The decision established the test courts still use to determine when the government may restrict commercial speech, including advertising.
False or misleading ads receive no protection. But restrictions on truthful ads for lawful products must serve a substantial government interest, directly advance that interest, and restrict no more speech than necessary. A rule governing targeting tools would reach every ad those tools deliver, including truthful ones. It would therefore have to clear that constitutional hurdle.
There’s a more direct route to liability when a platform helps create the deception. Section 230 doesn’t shield a platform that materially contributes to the unlawful part of an ad—for example, by helping write a false claim. In that case, the platform has helped create the deceptive content, rather than merely publishing someone else’s ad.
In Bouck v. Meta, plaintiffs alleged that Meta’s tools generated images and text for fraudulent investment ads. A federal court in California declined to dismiss the case on Section 230 grounds because those allegations raised a factual question about Meta’s contribution. The court later dismissed the complaint for lack of jurisdiction.
By contrast, the same court dismissed Suddeth v. Meta on Section 230 grounds. The plaintiffs hadn’t alleged that the fraudulent ads used Meta’s tools for anything beyond distribution through recommendation software. A rule following that distinction would hold platforms liable for deceptive content their tools helped write, but placing an ad would not, by itself, be enough.
The FTC’s Keyword Reversal
The ANPRM also asks whether matching ads to searches for business or government names is itself unfair or deceptive. That question puts the FTC in an awkward spot. In 2018, it held that online retailer 1-800 Contacts and its rivals had unlawfully agreed not to bid on one another’s brand names as search keywords. The FTC found that those agreements suppressed truthful ads alerting consumers to cheaper alternatives.
The 2nd Circuit vacated that decision in 2021. It held that the FTC should have applied the rule of reason—a case-by-case test that weighs an agreement’s competitive harms against its benefits—and hadn’t proved a violation under that test. Thomas A. Lambert had also criticized the FTC’s case in a 2019 post for Truth on the Market. Even so, the agency’s earlier position recognized that ads triggered by a competitor’s name can help consumers.
Consider someone searching for her bank’s name. A clearly labeled ad from a rival bank offers another option without saying anything false. An ad falsely claiming to come from her bank impersonates it, regardless of which search term triggered it.
Barring ads triggered by a business’s name would block both the rival bank’s truthful ad and the impersonator’s fake one from those search results. But the impersonator could still pay to show the fake ad alongside searches for “online banking login” or place it on social media. The rule would block a useful comparison while leaving the scammer other routes to the same victim. The deception lies in the ad’s false claim to come from her bank—a claim the FTC’s 2024 Impersonation Rule already prohibits.
A Safe Harbor for Rough Waters
Several companies the rule would cover are also among scammers’ favorite disguises. Check Point Research, a cybersecurity firm, ranked Apple second among brands impersonated in phishing attempts—messages or websites that pose as trusted sources to trick users—in the first quarter of 2026. Microsoft ranked first, followed by Apple, Google, and Amazon. The ranking covers phishing generally, not just ads. But all four companies sell ads, and scammers impersonate all four to target their customers.
The ANPRM points to a potentially useful model, but misstates how it works. It says Section 512 of the Digital Millennium Copyright Act “requires” online services to establish a process for copyright owners to request removal of infringing material. What Section 512 actually offers instead is a safe harbor—protection from certain copyright liability—for services that follow its takedown procedures and meet other conditions. Services can forgo that protection and defend themselves under ordinary copyright law. Losing the safe harbor doesn’t itself establish infringement.
A similar approach to impersonation ads would let Walmart, Uber, and Apple tailor their procedures to how they sell advertising, instead of following requirements built around self-serve systems. The safe harbor could require prompt investigation and appropriate action when an impersonated business or government agency reports an ad.
That condition would add something existing law lacks. The Integrity, Notification, and Fairness in Online Retail Marketplaces for Consumers Act, known as the INFORM Consumers Act, requires online marketplaces to verify high-volume third-party sellers and let consumers report suspicious sellers. It doesn’t, however, expressly require marketplaces to investigate those reports. Conditioning protection on a response would give platforms a reason to follow through.
The FTC should target deception. First, it needs to know who did the deceiving.
