How a regulated American business markets itself inside its own rules, and the five clauses to put in an agency contract
The federal floor every category sits on, the sector layers above it, and the review step that makes aggressive marketing safe rather than slow.
Published by AI Knows Us · Updated 22 October 2026
A regulated American business can market aggressively, and the thing that makes it safe is a review step rather than a quieter campaign. The structure is two layers. Underneath everything sits the federal floor: Section 5 of the FTC Act, which reaches unfair or deceptive acts and practices, the FTC Endorsement Guides on testimonials and reviews, the Commission's 2024 rule on consumer reviews and testimonials, CAN-SPAM for commercial email and the Telephone Consumer Protection Act for calls and texts. On top of that sits your sector's own layer, which is where the real constraint usually lives. Get the review step and five contract clauses right and the rest of the programme can run at full speed.
The federal floor, in the form a marketer needs it
| Rule | What it governs | The practical test |
|---|---|---|
| FTC Act, Section 5 | Deceptive or unfair acts and practices | The whole impression a reasonable buyer takes, not the literal words |
| FTC Endorsement Guides | Testimonials, reviews, influencer content | Is the material connection between endorser and brand disclosed clearly |
| 2024 rule on consumer reviews and testimonials | Fake reviews, undisclosed insider reviews, incentivised reviews | Could you show where every review came from and what was given for it |
| CAN-SPAM | Commercial email to American recipients | Honest headers, a working unsubscribe honoured promptly, a physical address |
| Telephone Consumer Protection Act | Calls and texts | Do you hold the consent, in a form you could produce later |
| State privacy laws | Collection and use of personal data | Obligations follow the data, so they apply to your vendors too |
The sector layer, which is where the specifics are
- Legal. State bar advertising rules restrict comparative and outcome claims and differ between states. A multi state firm is managing several rule sets at once.
- Financial advice and securities. The SEC marketing rule and FINRA requirements govern testimonials, endorsements and how performance may be presented. These are strict and specific.
- Healthcare. Patient privacy obligations constrain what can be used in marketing at all, which makes a patient story a consent process rather than a content brief.
- Insurance. Licensed state by state, with advertising requirements attached to the licence.
- Consumer finance, education and health products. Each has additional federal attention, and claim substantiation is the recurring theme.
The common structure across all five is that the rules restrict promises, comparisons and undisclosed endorsements. They do not restrict publishing a price, a specification, or a counted figure about your own practice with its denominator and date. That matters more than it sounds, because those three are exactly the assets that get quoted.
The five clauses to put in an agency contract
- A named reviewer and a review gate. Every claim, testimonial, price and outbound sequence passes a named person before it ships. Name the person and the turnaround in the contract rather than in an email.
- Substantiation held before publication. The agency warrants that any performance or outcome claim it drafts is supported by evidence you hold, identified before the asset goes live.
- Review and testimonial provenance. The agency will not source, incentivise or solicit reviews in any way that would require a disclosure it has not made, and will record where every review came from.
- Consent records for outbound. For email and for any calls or texts, the agency documents the consent basis per list and hands those records over on request and on exit.
- Indemnity and insurance, with the certificate attached. Ask for the certificate rather than the assurance, and specify that the policy covers advertising liability.
What the engines are citing in regulated American categories
On 22 October 2026 we put a 198 question American buyer bank in 33 batches to the ChatGPT and Gemini product surfaces through a data provider. The United States was named inside the text of every question, because the provider accepts gl, hl and location parameters and ignores all three. Batch 33 names us in the question and is a ceiling measurement, so it is excluded from every figure.
In 64 blind American readings the engines produced 2,866 citation URLs across 1,143 distinct hosts. Two of the most cited hosts in the entire American set were the regulator: ftc.gov appeared in 9 readings and consumer.ftc.gov in 6, which puts the Commission's own properties alongside Google's documentation at the top of the list. For a regulated business that is a direct instruction. A page that states the FTC position accurately, cites the Commission's own document, and dates the reading agrees with a source the engine already trusts, and agreement with a trusted source is how a page gets quoted.
The engines named no American services firm in those 64 readings, regulated or otherwise, and named nobody at all in 38 of them. All 48 supplier namings went to software products, led by Semrush at 14 and HubSpot at 12. So in regulated categories the shortlist slot is unclaimed rather than occupied, and the assets that claim it are available inside the rules.
One host in the raw data, ccn.web.tr at 8 readings, is the data provider's own fetch infrastructure rather than a publisher, and it is excluded from every source analysis.
What to do in the next thirty days
- Write the review gate down. Who reviews, what they review, how long they have, and what happens to a rejected asset.
- Audit every testimonial and review currently published for provenance and disclosure. This is the item most likely to be wrong today.
- Pull the consent basis for every outbound list and record it. If it cannot be produced, the list is a liability rather than an asset.
- Publish one thing the rules permit and competitors have not. A fee position, an engagement specification, or a counted figure about your own practice area.
- Put the five clauses into the next agency contract and into the renewal of the current one.
If your category is one where the lead quality loop is the real operational constraint rather than the claim rules, that loop is described in the lead quality loop regulated categories force you to build. If disclosure on generated creative is the specific problem, the brief and review gate for that are in the brief, the review gate and the disclosure rules.
Questions regulated American businesses ask about marketing inside the rules
Can I use client testimonials at all?
In most categories yes, with the material connection disclosed and the provenance recorded. In securities and investment advice the specific rules on testimonials and endorsements govern, and those are stricter, so clear each one.
Does the FTC apply if I am already regulated by my own body?
The federal floor sits underneath the sector layer rather than being replaced by it, so both apply. Build the review step to satisfy the stricter of the two in each case.
Who should the named reviewer be?
Somebody with authority to stop an asset and with the sector knowledge to recognise the problem. A compliance officer or outside counsel on a retainer both work. An account manager does not.
Is it safer to publish less?
Publishing less reduces exposure and it also removes you from the shortlist. The rules restrict promises and comparisons, and they leave prices, specifications and counted facts entirely available, which is where the opportunity is.
Why does being accurate about the rules help visibility?
Because in our 64 American readings the regulator's own properties were among the most cited hosts, ftc.gov in 9 readings and consumer.ftc.gov in 6. A page that agrees with a trusted source is easier for an engine to quote.
Reading the queue a compliance review does not cover
A regulated American business usually has a careful process for what it says and no instrument for what an assistant says about it. On our reading of 22 October 2026 the engines named no services firm in 64 readings and named nobody in 38 of them, while citing the FTC's own properties 15 times between two hosts. AI Knows Us reads ChatGPT, Gemini, Perplexity, Claude and Google AI Overviews for the buying questions in a category, reports each engine separately with its denominator, and keeps the raw answer text, which also means a claim an engine makes about your business can be read and corrected rather than discovered second hand. In the United States that is the Growth plan at 299 dollars a month, the cheapest tier reading all five engines, read on aiknowsus.com/pricing on 22 October 2026.