Every drafts and review matters
Extract structured data from hundreds of documents at the same time.
5 min read
2 days ago
No federal AI law exists yet, but five state and federal rules now carry penalties up to $53,000 per violation. Here's what to fix before your next campaign goes live.
If you run paid social or paid search for a DTC or SaaS brand, every AI tool in your creative stack now carries legal exposure your vendor contracts were never written for.
Picture a skincare brand running Meta ads with an AI-generated spokesperson reading an AI-cloned voiceover. Or a B2B SaaS company whose landing page promises an "AI-powered" engine it can't fully back up. A single campaign like either one can be exposed on several fronts at once: different rules, different regulators, different penalties.
The rule for staying clean is simple: disclose it, trace it, and make sure you can defend every claim. This guide breaks down the five rules that matter most for DTC and SaaS brands in 2026, and shows you how to keep using AI for speed without handing a regulator an easy case. The answer in 2026 isn't "stop using AI." It's "govern it."
Key Takeaways:
Five rules sounds like a lot to track. It gets easier once you see that they police three separate things. Sort each rule into one of these buckets and the list stops feeling overwhelming.
Review what's inside your creative. New York, California, and Tennessee govern the asset itself: the AI-generated face, the synthetic voice, and the provenance data baked into the file. This is where most DTC and SaaS ad creative is exposed.
Check whether AI is making decisions about people. This is Colorado, and it's narrower than it sounds. It has nothing to do with ad targeting. It only applies when an AI system makes a "consequential decision" about someone, like approving a loan, setting an insurance price, or screening a job applicant, in a regulated sector such as finance, housing, or employment. If you're a DTC e-commerce brand, this one isn't yours. If you're a SaaS or fintech company whose product decides who qualifies for what, read it closely.
Make sure your claims are honest. The FTC sits underneath all of it. It doesn't need a new law to act: deceptive AI claims and fake AI reviews are already illegal under powers it has today.
Sort each rule into one of those three buckets and the rest of this guide slots into place.
The three things these rules check: what's inside the creative (NY, CA, TN), whether AI is making decisions about people (CO), and whether your claims are truthful (FTC).
If you're reading this after June 9, 2026, New York's Synthetic Performer Disclosure Law is already live, Tennessee's ELVIS Act has been in force since July 2024, and the FTC is actively enforcing. California's SB 942 metadata rules take effect August 2, 2026, and Colorado's stayed AI Act may return January 1, 2027. The compliance steps below haven't changed, only the deadline framing has.
Some of the dates in this guide have started to pass, so here's where things stand if you've landed here later in 2026:
Everything below still applies. The only thing that's changed is that the New York rule moved from "prepare for" to "comply with now." Treat the checklist near the end as a live audit, not a countdown.
THE 2x TAKE
If you're past a deadline and haven't audited, don't panic-pause your campaigns. Run the checklist once, fix what's actually exposed, and keep shipping. The brands that get caught out aren't the ones who started a few weeks late, they're the ones who never built the disclosure-and-metadata habit at all.
New York's Synthetic Performer Disclosure Law (bills S.8420-A / A.8887-B) is the first US rule that specifically targets AI-generated people in advertising. According to the Office of Governor Kathy Hochul, it was signed on December 11, 2025, and takes effect 180 days later, on June 9, 2026.
The law amends New York's General Business Law to require a conspicuous disclosure whenever an ad includes a "synthetic performer," broadly defined as a digitally created asset, generated by AI or an algorithm, designed to look like a real human performer who isn't any identifiable real person. Think AI avatars, digital spokespeople, and synthetic presenters. The definition is wide enough to capture the output of most AI "actor" and AI-UGC tools.
If your creative features a real person on camera, you're out of scope. The law draws the line at the asset type, not the editing process. UGC shot on a phone doesn't trigger it.
Liability sits with whoever "produces or creates" the ad: the brand, the agency, the production company. Platforms that merely run the ad are exempt, so Meta, TikTok, and YouTube won't absorb the risk for you. Liability is triggered by "actual knowledge," which makes vendor contracts important: get synthetic-performer declarations in writing before delivery, not after the creative has already run.
The disclosure must be "conspicuous" and appear in the ad itself, in every medium it runs in. The statute doesn't dictate exact wording or placement, so until enforcement clarifies the standard, err on the side of making it obvious.
Penalties are $1,000 for a first violation and $5,000 for each one after, enforced by the state. There's no private right to sue. And note the geographic reach: if the ad runs in New York, your headquarters location is irrelevant.
THE 2x TAKE
A hybrid workflow makes this a non-issue. When AI generates a presenter, you label it; when a real creator is on camera, you don't. The discipline is simply knowing which is which on every asset. That's exactly why a human reviews each creative before it ships, rather than pushing AI output straight to live.
Where New York governs what consumers see, California's AI Transparency Act (SB 942) goes into the technical layer. It was signed in 2024 and was originally set for January 1, 2026; AB 853 pushed the operative date to August 2, 2026, to align with the EU AI Act's provenance timeline, according to analysis by Perkins Coie.
SB 942 puts obligations on "covered providers": generative-AI platforms with more than one million monthly users, such as the large image and video tools. That's the AI vendors, not you directly. They must provide:
The manifest-versus-latent distinction matters for advertisers. The visible watermark is the consumer-facing layer. The latent metadata is engineered to survive your entire production chain: format conversions, compression, cropping. Meta and TikTok read it on ingest, whether or not the visible badge made it through your edit.
Here's the trap. If a covered provider learns that a licensee knowingly stripped or disabled the disclosure capability, it must revoke that license, and the licensee can face injunctive relief and attorney's fees. In practice, the liability point isn't your creative decision to use AI. It's your production pipeline quietly stripping provenance data on export and publishing the result as though it has no AI origin. Fines run up to $5,000 per violation, per day, which compounds quickly across a creative library. There's no private right of action; enforcement comes from the Attorney General and local prosecutors.
THE 2x TAKE
This is a pipeline problem, not a creative problem. The fix is to preserve provenance metadata on export and avoid the batch-editing steps that silently strip it. That's the kind of mistake that happens when nobody owns the hand-off between AI generation and publishing. Treat metadata as something you protect by default, the same way you protect tracking parameters.
Colorado's AI Act (SB 24-205) takes a completely different angle. It doesn't regulate what's in your creative; it regulates AI systems that make "consequential decisions" in eight regulated areas, including financial and lending services, insurance, housing, employment, healthcare, education, legal services, and essential government services.
Deployers of these "high-risk" systems would owe duties like annual impact assessments and consumer notice, with civil penalties up to $20,000 per violation. If you're a DTC brand in beauty, apparel, food and beverage, or general e-commerce, this one is almost certainly not your fight. It's aimed at SaaS and fintech companies whose AI influences eligibility, pricing, or approval decisions.
This is where framing this as a June 30 deadline is already out of date. The law was set to take effect June 30, 2026, but it's been overtaken by litigation. xAI sued to block it on April 9, 2026; the US Department of Justice intervened on April 24; and on April 27, a federal magistrate judge stayed enforcement, per reporting by Norton Rose Fulbright. In parallel, Colorado lawmakers introduced a replacement bill (SB 26-189) that narrows the framework and pushes the effective date to January 1, 2027.
The practical effect: enforcement won't begin on June 30, 2026. But the underlying statute hasn't been repealed, and a narrower version is likely coming. If you operate AI-driven decisioning in a regulated vertical, keep preparing. Just don't panic about a June deadline that no longer holds.
THE 2x TAKE
For most of the e-commerce brands we work with, Colorado is a "monitor, don't act" item. For SaaS clients in lending, insurance, or hiring, it's worth documenting how your models make decisions now; that documentation is useful for the EU and other states regardless of how Colorado's politics shake out.
Tennessee's ELVIS Act has been live since July 2024 and doesn't have a countdown clock. No headline enforcement yet, which is exactly why it keeps getting skipped in compliance conversations. For any campaign that uses AI voice in a commercial context, it's the rule that carries criminal exposure rather than civil fines.
The Ensuring Likeness Voice and Image Security Act was signed on March 21, 2024 and took effect July 1, 2024. It made Tennessee the first state to add "voice" as a protected right, defined broadly to cover both a person's actual voice and a simulation of it, according to analysis by Holland & Knight.
That last part is the catch: the question isn't what training data the AI used. The question is whether a listener could pick out whose voice it sounds like. If they can, you're in scope.
Every other state handles voice and likeness violations through civil litigation. Tennessee made it a crime: an unauthorized AI voice clone can be prosecuted as a Class A misdemeanor, carrying up to 11 months and 29 days in jail plus a $2,500 fine, on top of civil damages. The Act also reaches the tool makers: anyone distributing technology whose primary purpose is producing unauthorized voice or likeness facsimiles can face direct liability.
The scenario to worry about: a creator submits a video using an AI voice filter that resembles a recognizable artist or public figure, you approve it, and you run it as a paid ad. If you "knew or reasonably should have known" the voice use was unauthorized, the brand is on the hook. No enforcement actions have landed yet, but analysts expect that to change as AI voice tools spread.
THE 2x TAKE
Two cheap safeguards close most of this risk: require creators and editors to declare any AI voice tools in the brief, and audit voiceovers for likeness before launch. When a real creator speaks in their own voice, there's no likeness claim to manage at all. That's one reason we keep human voices in the mix even when AI handles the rest of the edit.
While states write new laws, the FTC doesn't need a new law for this. It's running Section 5, the standing prohibition on unfair or deceptive acts, and has been applying it to AI advertising cases since 2024 without waiting for new legislation.
The FTC's Rule on the Use of Consumer Reviews and Testimonials took effect October 21, 2024. It bans fake or AI-generated reviews and testimonials "by someone who does not exist." If you're using AI to fabricate customer testimonials or reviews that imply a real person had a real experience, you're in violation. Civil penalties for knowing violations were set at up to $51,744 per violation when the rule was announced, a figure the FTC adjusts for inflation each year, and which has since climbed above $53,000, according to the FTC's own published penalty schedule.
This is the section SaaS founders should read twice. The FTC has pursued a wave of "AI-washing" cases against companies that overstated what their AI actually does. The precedent is clear: if you claim your product "uses AI" in ways it doesn't, or you exaggerate its capabilities in your marketing, that's deceptive advertising, no new statute required.
For a SaaS brand, the words "AI-powered," "fully automated," or "learns from your data" are claims you may have to substantiate, not just taglines.
The FTC also expects two separate disclosures when content is both paid and AI-generated. One label doesn't cover both. In video, both should be visible up front, in the first few seconds as on-screen text, not buried in a caption. A creator post that used AI for voice or visual effects and is also a paid partnership needs an "#ad"-style disclosure and an AI disclosure.
THE 2x TAKE
Honesty is the entire compliance strategy here, and it happens to be good marketing. Use real customer testimonials. Make AI claims you can defend with a straight face. And when a piece of content is both sponsored and AI-touched, label both, clearly, at the start. None of that slows down a well-run creative pipeline.
Running underneath all of this is a federal effort to make the state rules moot. On January 23, 2025, the White House issued an executive order aimed at a single, "minimally burdensome" national AI framework. It created a DOJ AI Litigation Task Force to challenge state AI laws, threatened to condition federal broadband funding on state compliance, and carved out a few areas (like child-safety protections) from its preemption push. That task force made its first move by joining the Colorado lawsuit.
Here's what actually matters for planning: an executive order directs federal agencies and can fund legal challenges to state laws. It cannot by itself override them. That takes a federal statute or a court ruling, and neither has happened. No court has struck down a state AI advertising law. Legal analysts expect years, not months, of uncertainty. The consensus advice is consistent: build for the strictest standard you're exposed to today, and keep enough flexibility to adjust later. Betting your compliance program on preemption that hasn't happened is a risk, not a strategy.
Notice what almost every rule above has in common: none of them ban AI. They penalize undisclosed AI, untraceable AI, unconsented AI, and dishonest AI. That matters, because the takeaway of "just use real humans and avoid the whole problem" isn't realistic for a brand that wants to test fifty creative variations a month in 2026.
The brands that win this era aren't the ones who avoid AI. They're the ones who govern it. In practice that means using AI for what it's genuinely good at (speed and volume) while keeping a human in the loop for the things a model can't be trusted to decide on its own.
AI handles the speed and volume. Humans handle the judgment calls. That split is the entire compliance strategy.
The durable model: AI for speed and volume, humans for the judgment calls.
AI for speed: concepting angles, drafting variations, generating first-pass visuals, resizing and localizing at volume, summarizing performance data.
Humans for judgment: deciding when a disclosure is required, screening for voice and likeness risk, preserving provenance metadata on export, and making sure every AI claim can be substantiated.
That's not a compromise. It's just how a serious creative operation should run when the rules have teeth. The compliance overhead is small when the workflow is built for it, and ruinous when AI output is pushed straight to live with no one checking.
Five moves before June 9. The metadata and double-disclosure steps apply again in August when California's law goes live.
A pre-launch compliance pass costs minutes per campaign; an FTC inquiry or a per-day California fine costs far more.
No single regulation covers AI advertising in the US right now. Five jurisdictions apply, each with a different deadline, a different enforcement body, and a different trigger. Here's the order of urgency:
Comply with the strictest standard you're actually exposed to, keep a human in the loop, and document your decisions. Do that, and AI stays what it should be, a force multiplier for your creative, instead of a liability hiding in your ad account.
2x runs paid social, paid search, and performance creative for DTC e-commerce and SaaS brands, with an AI-assisted, human-led process built for exactly this kind of scrutiny. If you'd like us to pressure-test your current creative against the rules above, book a free strategy call.
Yes, and the $1,000 to $5,000 per-violation penalty applies regardless of where you're headquartered. New York's law covers any ad containing a synthetic performer that runs in New York. If your campaigns reach New York audiences, you're in scope. Geographic reach is determined by where the ad runs, not where the brand is registered.
Not by default. None of these rules ban AI use. The FTC's Rule on Consumer Reviews and Testimonials carries penalties exceeding $53,000 per knowing violation, but that rule targets undisclosed AI endorsements, not AI use itself. Disclosure, provenance metadata, voice consent, and honest claims are the requirements. Used with a human in the loop, AI-assisted creative can be fully compliant.
New York is the layer the viewer sees: a conspicuous label in the ad. California is the layer underneath, baked into the file itself. Platforms and detection tools read the California layer on ingest whether or not the visible badge survived your editing workflow. California's fines run up to $5,000 per violation, per day, a figure that compounds quickly across a large creative library.
In Tennessee, yes, but only for voice. Cloning an identifiable person's voice without consent is a Class A misdemeanor under the ELVIS Act, carrying up to 11 months and 29 days in jail plus a $2,500 fine, in force since July 1, 2024. The other four rules on this list carry civil penalties only.
No. State laws are enforceable now. The January 2025 executive order signals intent to preempt them, but as of June 2026, no court has struck down a state AI advertising law, and an executive order can't override state law without Congress or the courts. If you wait and the laws survive, you're liable for every violation in the meantime.
No. This is general information for marketers, written to help you ask better questions. For how any of these rules apply to your specific campaigns, talk to a qualified attorney.
© 2026 2x Agency. General information only, not legal advice.
The integration of AI into the legal industry is still in its early stages, but the potential is immense. As AI technology continues to evolve. We can expect even more advanced applications, such as:
Accessible to individuals and small businesses.
Bridging gap by providing affordable solutions.
Extract structured data from hundreds of documents at the same time.
Extract structured data from hundreds of documents at the same time.
