Digital marketing law in the US: the seven rules that govern ads, email, texts, reviews, influencers and tracking

In the United States there is no single digital marketing law. Instead, a handful of federal rules and state privacy laws cover each channel: the FTC Act bans deceptive and unfair advertising everywhere, the FTC's Endorsement Guides and its 2024 rule on reviews cover influencers and testimonials, CAN-SPAM covers marketing email, the TCPA covers marketing texts and calls, COPPA covers data from children under 13, and state laws such as California's CCPA cover tracking and targeted advertising. Competitors can also sue over false advertising under the Lanham Act. This page sets out what each one asks of you, quoting the text we read on 22 October 2026. It is a working guide for marketers, not legal advice, and a lawyer should review anything high-stakes.

The map: which rule covers which channel

Rule	What it covers	Where to read it
FTC Act, section 5	Every ad, claim and offer, in any medium	15 U.S.C. 45
Endorsement Guides	Influencers, affiliates, employees and paid testimonials	16 CFR Part 255
Consumer reviews rule	Fake, bought and insider reviews, and fake followers	16 CFR Part 465
CAN-SPAM	Commercial email	15 U.S.C. 7704, 16 CFR Part 316
TCPA rules	Marketing texts and calls	47 CFR 64.1200
COPPA rule	Personal information from children under 13	16 CFR Part 312
CCPA (California)	Selling and sharing personal data, including for targeted ads	Cal. Civil Code 1798.100 onward

1. The FTC Act: the rule behind every other rule

Section 5 of the FTC Act says that "unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful". It does not name channels, so it reaches search ads, social posts, landing pages, emails and video equally. In practice it means three things for a marketer. A claim must be true. Keep the evidence for any objective claim, such as "cuts energy bills" or "rated best in town", before the ad runs, because a claim you cannot support is a claim you cannot show was true. And a disclosure that changes the meaning of an offer, such as a recurring charge or a condition on a discount, must be clear enough that people actually see it, not buried in a footer.

2. Influencers and endorsements

The Endorsement Guides at 16 CFR 255.5 say that when a connection between an endorser and the seller "might materially affect the weight or credibility of the endorsement, and that connection is not reasonably expected by the audience, such connection must be disclosed clearly and conspicuously". The guides list what counts: payment, free or discounted products (even unrelated ones), early access, the chance to win a prize, and business, family or personal relationships. A connection must be disclosed when "a significant minority of the audience" would not expect it.

For a brand, that turns into a working checklist: write the disclosure requirement into every creator contract, check posts after they go live, and treat employees who post about your products as endorsers too.

3. Reviews, testimonials and fake followers

The FTC's rule on consumer reviews and testimonials, 16 CFR Part 465, makes several common tactics unlawful outright:

• Writing, buying or spreading reviews or testimonials that misrepresent whether the reviewer exists, whether they used the product, or what their experience was (465.2).
• Offering anything "in exchange for, or conditioned expressly or by implication on" reviews "expressing a particular sentiment, whether positive or negative" (465.4). You may invite all customers to review; you may not pay for good ones.
• Reviews or testimonials by officers, managers or employees without a clear disclosure of the relationship (465.5).
• Buying or selling "fake indicators of social media influence", such as bot followers or views, to misrepresent influence for a commercial purpose (465.8).

Platforms add their own rules on top. Our guide to reputation management for small businesses covers how to ask for reviews within both.

4. Email: CAN-SPAM

CAN-SPAM does not require opt-in consent for commercial email in the US, but every message must meet its rules. Under 15 U.S.C. 7704, a commercial email needs:

• Honest header information. False or misleading headers are banned.
• A subject line that does not deceive.
• A "clear and conspicuous identification that the message is an advertisement or solicitation", unless the recipient opted in.
• A working opt-out mechanism, and opt-out requests honoured within "10 business days".
• A "valid physical postal address of the sender".

Mailbox providers set a higher bar in practice. Gmail, for example, requires authentication from every sender and one-click unsubscribe from bulk senders, so a CAN-SPAM-compliant email can still miss the inbox.

5. Texts and calls: the TCPA

The FCC's TCPA rules describe a text message as a "short message service (SMS) call", and marketing texts sit inside them. For marketing texts or calls sent with an autodialer or a prerecorded voice to a mobile number, 47 CFR 64.1200 requires "prior express written consent", which it defines as "an agreement, in writing, bearing the signature of the person called" that clearly authorises the marketing messages and names the number. The same section bars telephone solicitations to residential subscribers "before the hour of 8 a.m. or after 9 p.m." at the called person's local time, and sets do-not-call obligations. In practice, a separate, unticked consent box on your form, with the wording saved, is the record you will need. For choosing a platform that handles consent, see our comparison of email and SMS marketing platforms.

6. Children: COPPA

COPPA defines a child as "an individual under the age of 13". A website or app directed to children, or one that knows it is collecting from a child, must "obtain verifiable parental consent before any collection, use, or disclosure of personal information from children" (16 CFR 312.5). If your audience includes young children, that affects sign-up forms, contests, tracking pixels and targeted ads on the site.

7. Tracking and targeted ads: the CCPA and state privacy laws

California's Consumer Privacy Act gives consumers the right "to direct a business that sells or shares personal information about the consumer to third parties not to sell or share" it. "Sharing" includes cross-context behavioral advertising, which the law defines as targeting ads based on a person's "activity across businesses, distinctly branded internet websites, applications, or services". So most retargeting pixels fall inside it.

The law applies to a business that meets any of three tests in Civil Code 1798.140, including annual gross revenue above $25,000,000 (adjusted over time) or buying, selling or sharing the personal information of 100,000 or more consumers or households a year. A covered business needs a "Do Not Sell or Share My Personal Information" link, or an equivalent option, and must respect opt-out preference signals sent by browsers. Several other states have passed their own privacy laws, so check the states where your customers live.

One more risk: competitors

The Lanham Act, at 15 U.S.C. 1125(a), lets a business sue a competitor that, "in commercial advertising or promotion, misrepresents the nature, characteristics, qualities, or geographic origin" of goods or services. Comparison pages and "vs" ads are fine when every claim about the other product is accurate and current. Date your comparisons and keep your sources.

Questions about digital marketing law

Is there one law that covers all digital marketing in the US?

No. The FTC Act covers deception in every channel, and specific rules cover email, texts, children's data, reviews and endorsements. State privacy laws add rules on tracking and targeted ads.

Do I need consent to send marketing emails in the US?

CAN-SPAM does not require opt-in, but it requires honest headers and subject lines, an opt-out honoured within 10 business days, and a postal address. Marketing texts are different: they need prior express written consent.

Can I give customers a discount for leaving a review?

You cannot tie any reward to a positive (or negative) review. The FTC rule targets incentives conditioned on a particular sentiment. Review platforms have their own, often stricter, policies, so check the platform's rules before offering anything.

Do influencers have to say a post is sponsored?

Yes, when the audience would not expect the connection. Payment, free products and other perks all count, and the disclosure must be clear and conspicuous.

Does the CCPA apply to a small business?

Only if it meets one of the thresholds in the law, such as the revenue test or handling the personal information of 100,000 or more consumers or households a year. Many small businesses do not, but other states set their own thresholds.

Claims made about you that you did not write

Every rule above governs what a business says about itself. A growing share of buyers now hear about a business from ChatGPT, Gemini or Perplexity first, in an answer the business did not write and cannot pre-approve. If that answer repeats an old price, a discontinued service or a rival's comparison, the buyer still believes it. AI Knows Us is built for that new layer: it checks what the assistants say about a business and which sources they take it from, so the record can be corrected at the source.