How-to guide: Issues surrounding online advertising (USA)

Introduction

This guide will assist in-house counsel and private practice lawyers to understand the law and regulation applicable to online advertising and provides context as to the issues that may arise. It includes best practice guidance to navigate the challenges when conducting online advertising campaigns.

This guide covers:

Overview of online advertising
Issues surrounding online advertising
Best practices in online advertising

This guide can be used in conjunction with the following How-to guides: Avoiding false or misleading advertising and Checklists: Online advertising directed to children and Using product endorsements.

Section 1 – Overview of online advertising

1.1 Online advertising

Online advertising uses the Internet to deliver marketing messages to customers, to enhance brand awareness, and to drive sales. Online advertising is a marketing strategy utilizing online channels and platforms through:

placement in social media;
optimization of results in search engines;
advertising on websites; and
other channels, such as email campaigns.

Advertising across these various platforms can be a cost-effective method for targeting customers and generating sales leads. For the avoidance of doubt, in US business, advertising is a form of marketing, but the rules tend to refer only to advertising.

1.2 Social media marketing

Social media marketing is a form of online advertising that forms part of an overall marketing strategy that uses social media platforms like LinkedIn, Facebook, X (formerly Twitter),and Instagram to connect with and target customers to promote a product, service, or brand. The marketing cycle includes the development and planning of a brand strategy, the creation of social media posts to maximize engagement, the oversight and monitoring of feedback (in the form of increased media interaction or sales), and the company response to customer feedback to help brands to optimize the platforms to advertise on.

1.3 Search engines

The Internet has a large variety of search engines, the most popular of which are Google, Bing and Yahoo. These coordinated search engines are carefully designed, engineered and monitored to provide optimum webpage search and feedback. Each search engine gathers and categorizes information about web pages through crawling (ie, using automated software to conduct an internet search), indexing, and ranking, using more than 200 ‘ranking factors' to help with search engine optimization (ie, SEO) which helps keep advertisers ahead of the latest trends to influence and capture consumer attention, including highest ranking keyword searches, user interactions with a website, and automated responses generated by artificial intelligence (AI) chatbots simulating human conversations using technology to carry out customer service tasks.

1.4 The pros and cons of online advertising

1.4.1 Online advertising – advantages

Over the last 20 years, the world has become undeniably digital, and consumers use online resources and technology to research products and services at an increasing level. Businesses now are better able to identify and to reach target customers or engage with existing customers, especially given the cost-effective nature of online advertising. Advertisers can leverage the focus, scope and messaging of their marketing plans to position their product to their target audience, increase brand recognition, and ultimately, generate sales.

Online advertising allows the advertiser to be in full control of the process. The advertiser will be able to know the exact budget and will also be able to monitor its spend and click-through leads to drive desired traffic to a website and to judge the effectiveness of the advertising. The data used to monitor effectiveness will provide global coverage, and will be collected in real-time, on a 24/7 basis. Online advertising also allows a wide range of formats and allows those formats to be tailored to audiences and market segments. An online advertising presence allows an organization to maintain and measure good customer interactions by, for example, making ordering and customer feedback easier.

1.4.2 Online advertising – disadvantages

As channels for online advertising have increased, competition among vendors of online products has also increased since they are up against a global marketplace. Any negative feedback of your brand can be visible to a global audience, and carrying out effective customer service online can be challenging to brand reputation if not handled correctly. Consumers can be overwhelmed by the volume and scale of online messaging. Likewise, the sophistication of online scams and fraudulent activity has increased. This has led to an increase among consumers, consumer advocacy groups and some legislators to increase online privacy protections and to place new rules on online advertising to protect against potential harms. Effective online advertising also requires a certain amount of expertise to properly navigate and manipulate ever-changing online programs. It is extremely easy for a company to waste precious resources on ill-conceived and poorly implemented marketing campaigns. Tasks such as optimizing online advertising can be time consuming, and it is important that staff have the right knowledge and expertise to ensure a return on investment.

1.4.3 Future of online advertising

In early 2023, the US government, joined by several plaintiff states, filed a lawsuit against the Internet giant Google, accusing the company of unfair business practices for engaging in anticompetitive, exclusionary and unlawful behavior to eliminate any threats to its dominance over digital advertising technologies. It was the second suit filed by the government against the company, which it had previously accused of attempting to monopolize search results. The government accused Google of unfairly controlling the advertising marketplace, cutting deeply into the profits of content publishers and advertisers, and forcing publishers to seek other streams of revenue, potentially in the form of paywalls and subscriptions. The result, according to the government, was a reduction in the number and quality of products available to the consumer. See US and Plaintiff States v Google LLC, Case No 1:23-cv-00108 (ED Va. Filed 24 January 2023). The trial began on September 9, 2024 and concluded on September 27. On April 17, 2025, US District Court Judge Leonie M Brinkema delivered her opinion in the case, holding that Google ‘has violated Section 2 of the Sherman Act by willfully acquiring and maintaining monopoly power in the open-web display publisher ad server market and the open-web display ad exchange market, and has unlawfully tied its publisher ad server (DFP) and ad exchange (AdX) in violation of Sections 1 and 2 of the Sherman Act.’ United States v. Google LLC, 778 F. Supp. 3d 797 (E.D. Va. 2025).

Section 2 – Issues surrounding online advertising

2.1 Risks associated with online advertising

2.1.1 Invasion of user privacy

There are legal considerations around collecting and using personal customer data for online advertising purposes. State and federal statutes and regulations protecting the personal data of consumers online have not traditionally been strong, but legislation in the second decade of the twenty-first century has appeared. Several US states have enacted legislation protecting the personal information of residents against unfair or unauthorized data collection and have made rules mandating what action must be taken by companies that collect and store personal information if data is shared inadvertently with unauthorized third parties. Connecticut, Colorado, California, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia, and Utah have all enacted comprehensive consumer privacy laws, meaning they have enacted broad legislation surrounding the collection, use, and disclosure of personal data. However, state laws vary and remain inconsistent. It is important (when advertising across states) that the business is aware of the different state laws that may apply at the state-by-state level. See How-to guides: How to determine and apply relevant US privacy laws to your organization and US Data Protection and Privacy (state-by-state).

At the federal level, privacy laws are specific to particular industries and sectors. However, other laws and regulations often contain privacy standards.

Examples of the key federal privacy laws include:

the US Privacy Act of 1974 (5 US Code, section 552a) which governs all federal agencies, and applies to private entities under contract with federal agencies that maintains records for individuals;
the Health Insurance Portability and Accountability Act (HIPAA) and the privacy rules adopted under the HIPAA, which govern entities, such as hospitals, medical services providers, and third-party collections agencies;
the Gramm-Leach Bliley Act (GLBA), which governs businesses engaged in finance;
the Children’s Online Privacy Protection Act (COPPA) which governs website operations, apps or those operating online services directed to children under the age of 13;
the Electronic Communications Privacy Act (ECPA), which protects the privacy of electronic communications, including emails, phone calls, and data stored electronically;
the Fair Credit Reporting Act (FCRA), which regulates the collection and use of consumer credit information, ensuring accuracy and privacy in credit reporting;
the Family Educational Rights and Privacy Act (FERPA), which protects the privacy of student education records, granting rights to parents and students regarding access and control over educational information; and
the Video Privacy Protection Act (VPPA), which safeguards the privacy of individuals' video rental and purchase records, preventing unauthorized disclosure.

This is not presented as an exhaustive list and companies and organizations are advised to fully conduct research into the federal laws (and rules) that may apply to their particular business practice.

The Federal Trade Commission (FTC) as the US federal government’s principal consumer protection agency has oversight of and is generally responsible for protecting consumers ‘from unfair and deceptive acts and practices in the advertising and marketing of goods and services’ (16 CFR, section 0.1). Please note, however, this protection does not extend to a specific medium of advertising, whether online or by traditional methods. The FTC provides specific guidance for digital advertising in Dot Com Disclosures. Specific regulation of endorsements, claims, and testimonials is available in 16 CFR, Part 255.

2.1.2 Advertising idea theft

Mere ideas generally do not merit protection under US law, either at the state or the local level. There are, of course, exceptions, but these exceptions for the most part are more than ‘mere’ ideas. Trademarks and patents registered with the US Patent and Trademark Office (15 US Code, Chapter 22 and 35 US Code, respectively) and artistic expression fixed in a tangible medium (which may be registered with the US Copyright Office – 17 US Code) are protected by statute. Mere ideas generally only have protection if some form of contractual arrangement, such as a non-disclosure agreement, exists between the parties. For example, if an advertising agency contracts with a web designer to build a website for a new advertising campaign, the ideas behind the campaign (eg, the target market for the ad, the means used to entice users to order products) are not protected by the copyright laws. The only protection the advertiser would have is a contractual agreement with the designer that prohibits disclosure. Please refer to How-to guide: Protecting intellectual property when drafting sales or marketing agreements.

2.1.3 Defamation

There are differences in defamation law treatment between states, so it is best practice to familiarize yourself with the law in your home state and any state in which you are conducting business. However, it is generally recognized that businesses have standing to sue for defamation. Always keep in mind the common law elements of defamation, namely: a false and defamatory statement concerning another; an unprivileged publication to a third party; fault amounting to at least negligence; and some harm caused by the publication. (Restatement (2d) of Torts, section 588.) Defamatory statements, whether directed at a person or a company, are defamatory irrespective of the medium. It is important to note that each state has its own common law rules surrounding defamation claims. In addition to consulting the Restatement (2d) of Torts, it is also wise to consider your specific state law rule on the issue.

For example, a restaurant owner posts fake customer complaints about a competitor on a consumer review website. The restaurant owner places a link to the review site on their restaurant’s own site, with the tag ‘Some Information About the Local Dining Scene’. The fake reviews and the link to them could be defamatory of the competing restaurant.

2.1.4 Fraud

As is the case with defamation, fraud is fraud, irrespective of the medium by which that action occurs. State statutes and common law fraud claims still apply to the Internet and online advertising. It is best practice for companies to familiarize themselves with the law in their home state and in any state in which they conduct or direct their business. Fraudulent activity is rife on the Internet, from purchase fraud to the theft of personal information, and there are federal statutes that augment state law (in order to protect consumers). Foremost among these is the Computer Fraud and Abuse Act (CFAA) (18 US Code, section 1030) that addresses cyber-based crimes that involve accessing computers without authorization. The FTC also protects consumers from various types of fraud by rulemaking and enforcement litigation.

2.2 Federal Trade Commission rules and regulations

The FTC provides several resources on company best practices, including guidance on online advertising that is not expressly regulated by the federal government or on a state level. This is explained in further detail in this section below.

2.2.1 FTC Rules of the Road

The FTC Rules of the Road provide guidance on the safest and best means to accurately and legally market and advertise online. They also provide links to other resources, including various regulations and statutes. The Rules explain the definitions of ‘unfair’ and ‘deceptive’ advertising, and also discuss protection of consumer privacy online. Importantly, the Rules also explain the liability for violations of the advertising laws of third parties, such as advertising agencies, website designers and catalogue marketers.

2.2.2 Effective disclosures in digital marketing

This short FTC publication, .com Disclosures: How to Make Effective Disclosures in Digital Advertising, offers best practice guidance and describes the information and disclosures businesses should consider to avoid using techniques that might lead to false or misleading information across the spectrum of online activities. Clear, conspicuous disclosures benefit advertisers and generate trust among consumers.

2.2.3 Children’s Online Privacy Protection Act (COPPA)

Under the Children’s Online Privacy Protection Act (COPPA), operators of websites, apps or online services that are directed at children under 13 years and operators of websites that have actual knowledge that a site user is under 13 must obtain parents’ consent before collecting or retaining any information on children of that age. Recently, in 2023, a group of organizations applied to be permitted to use facial age estimation technology to circumvent the need to obtain parental consent. In 2024, the FTC denied this application without prejudice, meaning that applicants may file again in the future when the FTC anticipates that additional information will be available to assist it and the public in better understanding age verification technologies and their application.

2.2.3.1 COPPA rule and verifiable parental consent

Under COPPA, website operators of sites that target children (or any site that has knowledge that a user is under 13) must obtain a parent’s verifiable consent to collect, use or disclose any personal information from children, and parents must be provided with the ability to review and to delete their children’s information. This can take the form of providing a consent form to a parent, requiring a parent to use a credit card to make any purchases, have a parent call a toll-free number, or checking a government-issued ID of a parent (16 CFR, section-312.5). The Act also requires operators to post a clear privacy policy and to take reasonable steps to protect the security of children’s personal information (16 CFR, Part 312). For further information regarding compliance with COPPA, see Checklist: Online advertising directed to children.

There are no express rules in COPPA that forbid the use of testimonials from minors, but the general tenor of COPPA is that a company cannot use or store the personal information of a minor without a parent’s consent. This would make using a testimonial from a child under 13 without the consent of a parent difficult, if not impossible.

2.2.3.2 COPPA – Frequently asked questions

The COPPA FAQs provides guidance on the most frequently asked questions of those seeking to comply with COPPA. These are intended to supplement the compliance materials available on the FTC website, under the FTC’s children’s privacy page for businesses.

2.2.3.3 COPPA safe harbor

COPPA regulations (16 CFR, section 312.11) provide for the establishment of safe harbor programs for industry groups and other persons to establish self-regulatory program guidelines. The safe harbor provides that an advertiser who follows standards set by an organization that is approved by the FTC will be deemed to be in compliance with FTC regulations. Foremost among such approved groups is the Children’s Advertising Review Unit (CARU), a non-regulatory group affiliated with the Better Business Bureau (BBB). The BBB helps consumers find businesses they can trust, as the BBB accreditation identifies businesses that are committed to honesty and integrity. Such self-regulating groups must provide substantially the same or better protections than those contained in COPPA. CARU Advertising Guidelines move beyond COPPA and, though not binding, provide professional guidelines for children’s advertising.

2.2.3.4 Six-step compliance plan

A Six-Step Compliance Plan for Your Business is a guidance document prepared by the FTC, which sets out the steps each online business should take if they cater to minors, namely to:

determine if the business collects personal information from those under 13;
post a COPPA-compliant privacy policy;
notify parents before collecting personal information from children under 13;
obtain verifiable consent from a parent;
honor parents’ ongoing rights with respect to information collected from their children; and
implement reasonable procedures to protect children’s personal information.

2.3 State rules and regulations

Enforcement of state rules and regulations regarding advertising depends first on the ability of the state and its courts to exercise jurisdiction over an advertiser. This may be difficult in the context of online advertising. As a rule, for a state court to exercise personal jurisdiction over the resident of another state, two things must happen.

First, certain minimum contacts with the home state must exist, and second, the home state’s long-arm statute (a state statute that allows a court to exercise personal jurisdiction over a party not in that state) must support the jurisdiction.

A defendant may waive personal jurisdiction. Minimum contact can occur if the transaction in question occurred within the forum state (the defendant’s activities are continuous and systematic), or it can occur if the defendant company purposefully avails itself of the state’s marketplace (International Shoe Co v Washington, 326 U.S. 310 (1945) and Ford Motor Co v Montana Eighth Judicial Dist Court, No 19–368, 395 Mont 478, 443 P 3d 407, and No 19–369, 931 N W 2d 744, affirmed). Courts have held that the mere posting of information or advertisements on an internet website does not confer nationwide personal jurisdiction on a court (Remick v Manfredy, 238 F 3d 248, 259 n 3 (3rd Cir 2001)).

2.4 False advertising

Online advertising is subject to the same rules regarding false advertising as are advertisements disseminated via any other medium. A ‘false advertisement’ is defined in the Federal Trade Commission Act as any advertisement that is ‘misleading in a material respect’. In determining whether any advertisement is misleading, courts and the FTC will consider not only representations made or suggested by the advertisement, but also the extent to which the advertisement fails to reveal material facts with respect to consequences which may result from the use of the product under normal condition. See 15 USC, section 55.

See How-to guide: Avoiding false or misleading advertising.

2.5 Claims, endorsement, testimonials

Online claims, endorsements, or testimonials are likewise subject to the same rules as would apply to other advertisements. The FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising sets out these rules. An endorsement must reflect the honest opinions, findings, beliefs or experience of the endorser. If an advertisement represents that the endorser uses the product, the endorser must have been a bona fide user of it at the time the endorsement was given. If the endorsement describes the experience of a consumer about a central or key attribute of the product, the advertisement will likely be interpreted as representing that the endorser’s experience is representative of what consumers will generally achieve with the product.

2.6 The final trade regulation rule on the use of consumer reviews and testimonials

As a part of its efforts to promote consumer protection and fair competition, the FTC has finalized the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials. The rule took effect on October 21, 2024, and violations may lead to civil penalties of up to $51,744 per violation. The new rule prohibits several deceptive practices, including:

Fake reviews and testimonials, such as misrepresenting a reviewer’s experience with a product, or promoting a review by a non-existent person;
Insider reviews, from a person employed by the seller, or the family of such a person;
Incentivized reviews, such as paying for positive or negative reviews;
Review suppression, including threatening negative reviewers, or falsely representing that the reviews on a website are accurate samples of the total reviews received;
Company-controlled review websites that claim to be independent of the seller; and
Fake social media indicators, meaning people or social media accounts that deliberately create a false image of popularity or expertise.

While the rule does not explicitly include AI, the FTC has made it clear that it applies to AI-generated reviews.

The new rule marks a shift from the non-binding Endorsement Guides to a legally enforceable regulation. This shift gives the FTC direct enforcement authority. This change is crucial following the US Supreme Court’s decision in AMG Capital Management, LLC v FTC, 593 US 67 (2021) which limited the FTC’s ability to seek monetary relief under Section 13(b) of the FTC Act. Unlike the Endorsement Guides, this new rule allows the FTC to impose immediate civil penalties, enhancing enforcement capabilities and deterring deceptive practices in consumer reviews and testimonials.

For more information about the rule, see How-to guide: Liability for fake reviews.

See also How-to guide: Avoiding false or misleading advertising.

Section 3 – Best practices in online advertising

3.1 Develop internal policies to safeguard personal information

State and federal law regarding personal information and online advertising is a patchwork. Safeguarding customer privacy is a critical concern for businesses of all sizes and across all industry segments. It is best practice to steer a cautious course and handle this data with care. If the company obtains, stores or shares personal customer information, the company should seek consent beforehand, whether the data subject is a minor or an adult. It is the company's responsibility to ensure that customer data is protected. Any company that focuses on marketing to children under 13 (or any company who knows they have young children as visitors or clients) should exercise extreme caution and be sure to obtain verifiable parental consent prior to collecting, storing or exchanging personal information (see Checklist: Online advertising directed to children).

Failure to comply with customer privacy laws can have significant impact on a business, including reputational damage, fines, financial loss through the loss of customer trust, and potentially legal liabilities. See How-to guide: How to manage your organization’s data privacy and security risks (USA).

3.2 Develop internal policies to avoid misleading online advertising

3.2.1 Transparent customer communications

Digital advertising techniques have created many opportunities for how a business can now engage with their customers. It is important that the company provides site visitors, customers and potential customers with sufficient information for those customers to understand the representations made in online advertisements. This is key to building better and stronger relationships with customers and strikes the balance between effective advertising and building customer trust. As always, plain language is best. Legal language should only be used if absolutely necessary (eg, to display terms and conditions of sale). Avoid puffery. Don’t exaggerate the capacity or performance of a product or service. Remember that in online sales the laws and regulations of a distant jurisdiction may be different than those of your home state. Ensure that any qualifying language, representations or disclaimers are clearly worded and precise and that the company has adequate evidence to support any claims prior to making them publicly.

Negative reviews online are available publicly and can erode trust in the company and damage brand reputation, so the greater the reputation of the company brand has with transparent marketing practices, the better its reputation and customer retention rates.

3.2.2 Strategic online advertising campaigns

A successful, effective online advertising campaign is more than a company deciding to ‘put some ads online’. There should be an understanding of the target markets to be reached (ie, who are the potential customers, where are they based, what is their purchasing power), and how different segments of the market will be approached. The types of digital advertising platforms to be used should be selected with care, both to reach the desired market, but also to avoid advertising on a hostile or unreceptive platform. For example, a product marketed by a person who is prominent for having taken controversial political stands should not be placed on a website dedicated to politics opposed by that person.

3.2.3 Clear and concise product statements

Elaborate and highly detailed statements about a product run the risk of being misunderstood by consumers and may be found to be deceptive or unfair in a particular context. Statements about a product’s attributes must be factual and verifiable. It is also best to avoid association with unrelated products, even if that association may seem benign.

For example, a well-known author of guides to foraging edible plants did advertisements for a breakfast cereal in which he compared the taste of the cereal to wild hickory nuts. The FTC challenged the advertisements on the grounds that they might encourage children to eat dangerous wild plants. The cereal manufacturer agreed to stop running the advertisements (In the Matter of Benton & Bowles, Inc, FTC Docket No. C-2826 (6 July 1976)).

3.3 Follow general guidelines for marketing procedure best practices

Most important, develop a workflow through which all internal stakeholders have a chance to review marketing campaigns and advertising copy in advance.

Company officers also should develop a plan through which competing demands or disagreements over marketing claims and wording (such as between legal and sales) can be rectified. There should be one decision maker who should have final sign-off at the end of the review process in the event of a dispute or who has ultimate authority to take the decision on behalf of the company.

Additional resources

David Vladeck, NYU, Promoting Consumer Privacy: Accountability and Transparency in the Modern World