Ethics and disclosure
Write the disclosure line for an AI-assisted asset, name the FTC or EU rule it satisfies, and refuse the synthetic testimonial no line can fix.
On this page
Generation made two things cheap that advertising law has always watched closely: a person vouching for a product, and a realistic picture of something that did not happen. The US rules on endorsements and reviews say which of these may run and what must be said beside them, and the EU adds a duty to label realistic generated media. A disclosure line is a sentence long, and writing it is a decision with a named rule behind it, not a matter of taste.
The mistake: testimonials from survey comments
The founder of the invoicing app has 600 positive comments from the last customer survey. The proposal: generate 20 polished quotes from their themes, attach first names and stock photographs, and run them on the pricing page and in the annual-plan ads. The sentiment is real, the founder argues; only the wording is new.
That is exactly what the reviews rule forbids. 16 CFR Part 465, the Rule on the Use of Consumer Reviews and Testimonials (opens in a new tab), makes it an unfair or deceptive practice for a business to write or create a consumer review or testimonial that materially misrepresents that the reviewer exists, that they used the product, or what their experience was (§465.2(a)). A generated quote under a stock name fails the first test. A paraphrase put in a real customer's mouth fails the third. Part 465 is a rule rather than guidance, which lets the FTC seek civil penalties against knowing violators, and "the model wrote it" describes the violation rather than excusing it.
Synthetic testimonials are out, and no disclosure line rescues one: a footnote saying "AI-generated quote" does not make the reviewer exist. The fix uses what the founder already has. The 600 comments are customers' own words; ask 20 of those customers for permission to quote them verbatim, by name, and pick quotes that describe a typical result.
The endorsement guides in five provisions
The older and broader text is 16 CFR Part 255, Guides Concerning Use of Endorsements and Testimonials in Advertising (opens in a new tab). An endorsement there is any advertising message consumers are likely to believe reflects the opinions or experience of someone other than the advertiser. Five provisions decide most generated campaigns:
- Honest opinion of a real user (§255.1). An endorsement must reflect the endorser's honest opinions or experience, and an ad that says the endorser uses the product needs an endorser who was a bona fide user of it when they gave it. A generated quote has no endorser to be honest.
- Actual consumers, or say they are not (§255.2(c)). An ad that presents people as actual consumers should use actual consumers or clearly and conspicuously disclose that they are not. A generated presenter reading a customer's words is not that customer.
- Typical results (§255.2(b)). A customer's experience with a key attribute is read as what customers generally achieve. "It cut my invoicing time in half", from the one customer who halved it, needs the typical figure beside it.
- Material connections (§255.5). A creator paid in money, free product or commission, or an employee, discloses the connection when a significant minority of the audience would not expect it.
- Clear and conspicuous (§255.0(f)). Difficult to miss and easily understood, in the same medium as the claim, visual for visual and audible for audible, and on social media "unavoidable". A disclosure behind "more", or fourteenth in a row of hashtags, is not one.
When generated content needs a line
The rules attach to what an asset shows and claims, not to the tool that made it. So three checks run on every generated asset, and each yes adds a duty.
An asset that passes all three with no yes, such as generated ad copy a person has edited, with no customer in it, needs no label under these rules. It still needs every claim proved, which is check 1 of the review standard. For long published pages, Google Search's guidance on generative AI content on your website (opens in a new tab) suggests explaining how automation was used where readers would want to know, which is a courtesy rather than a duty.
Four disclosure lines from the invoicing app's annual-plan campaign:
| Asset | The line | What it satisfies |
|---|---|---|
| Video ad: a generated presenter reads a real customer's review | "AI-generated presenter, not a customer. Words from a review by a customer since 2024, used with permission." On screen for the whole spot. | §255.2(c); §465.2; Art. 50(4) in the EU |
| A paid creator's post with a generated image | "Paid partnership with the app" as the first line, the platform's paid-partnership label, and "AI-generated image" on the image | §255.5; §255.0(f); Art. 50(4) in the EU if the image is realistic |
| A chat assistant on the pricing page | "You're chatting with an AI assistant. Ask for a person at any time." Before the first reply. | Art. 50(1) in the EU |
| Generated ad copy, edited, with no person in it | none | claims proved and on file |
The EU AI Act's transparency duties, in one paragraph
Article 50: Transparency obligations for providers and deployers of certain AI systems (opens in a new tab), in the EU's AI Act, has four duties a marketing team meets. A system that interacts directly with people must be built so they are told it is an AI, unless that is obvious (50(1)). Providers of systems that generate audio, images, video or text must mark the output in a machine-readable way, with an exception for tools that only assist standard editing (50(2)); that duty is the tool vendor's, and the reason to ask a vendor whether its output carries the mark. A deployer publishing a deep fake, generated image, audio or video that resembles real people, places or events and would falsely appear authentic, must disclose that it was generated or manipulated, with a lighter duty for evidently artistic, satirical or fictional work (50(4)). And generated text published to inform the public on matters of public interest must be disclosed, unless a person reviewed it and someone holds editorial responsibility (50(4)). The information must be clear and given at the latest at first exposure (50(5)). For most campaigns only the chat assistant and the realistic generated person trigger a duty.
Consent and data in personalisation
Personalisation at segment-of-one is a data question before it is a copy question, and two rules settle most of it.
First, use data for what the person expects it to be used for. Usage inside the product, such as invoices sent this month or a feature never tried, is what a user expects an invoicing app to notice. The names and amounts on their invoices are their clients' data and their business. "Chase Acme Ltd for the $4,200 they owe you" is accurate, helpful and alarming, and the reader noticing is one of the failure modes of personalisation. Before customer data goes into a third-party model, read the contract terms on retention and training, the questions trust, safety and regulation as product surface asks of a vendor.
Second, an objection has to reach the profile, not only the email. In the EU, Regulation (EU) 2016/679, the General Data Protection Regulation (opens in a new tab), gives a person the right to object at any time to processing of their data for direct marketing, which includes profiling to the extent it is related to that marketing (Article 21(2)). Once they object, their data is no longer processed for direct marketing (Article 21(3)); unlike an objection to other processing under Article 21(1), the company cannot answer it with compelling grounds of its own. The right has to be stated explicitly, clearly and separately from other information, no later than the first communication with the person (Article 21(4)). When an unsubscribe is how the person objects, stopping the email while the scoring model keeps profiling them for the next campaign does not meet Article 21(3).
In practice
To the founder: "Quotes come from customers, verbatim, with permission. Generated people never stand in for customers, and every realistic generated person or voice is labelled." To an agency or a creator: the disclosure line, where it sits and how long it shows, written into the contract with the right to take a post down. To the team: disclosure is check 3 of the review standard, so a missing line is a severe defect and a paid ad without one does not ship.
The mistake that costs money is the synthetic testimonial. The 20 quotes save perhaps a week of asking customers. Each is a violation of a rule that carries civil penalties, and every ad and page it ran on has to be pulled and replaced, which costs more than the week.
Check yourself
1. A customer recorded a video testimonial last year. The founder wants a generated version of her, with new wording, praising a feature she has never used. Run it?
No. She was not a bona fide user of that feature (§255.1(c)), and the ad misrepresents her experience (§465.2(a)(3)); a label saying the video is generated fixes neither. Either ask her to try the feature and record a new testimonial, or run her original words, unchanged, about what she did use.
2. A creator paid $2,000 a post put "#ad" as the twelfth of fifteen hashtags. Fix it or pull it?
Fix it before it runs. On social media the disclosure should be unavoidable (§255.0(f)), and the twelfth hashtag is not. "Paid partnership with the app" goes in the first line, with the platform's paid-partnership label, which §255.5 requires because the audience would not expect the payment. Put the placement in the contract so the next post arrives right.
3. The product team adds a support chat assistant and marketing wants to call it "Sam from support". Allow the name?
Only as "Sam, our AI assistant", with the line "You're chatting with an AI assistant" before the first reply. A human name alone implies a person, and Article 50(1) requires that people interacting with an AI system in the EU are told so unless it is obvious; a name chosen to sound human makes it less obvious, not more.