FTC Section 5: AI Privacy in the US
Updated for 2026.
The Federal Trade Commission (FTC) enforces US privacy law through Section 5 of the FTC Act. That section bans "unfair or deceptive practices." No single federal privacy law like GDPR exists in the US. Yet the agency set a new record in 2024.
2024: A Record Enforcement Year
The commission issued 19 AI-related actions in 2024. That beats the prior three years combined. Add 25 active US state privacy laws on top. Together, they create a complex burden for any company in the US.
Key 2024 cases:
Amazon Alexa ($25M, 2023/ongoing): Amazon paid $25M for COPPA violations. It had kept voice files of children past stated time limits. The agency said Amazon used those files to train AI without proper consent. Amazon was ordered to delete the retained files.
Meta ban on teen ad use: Federal regulators barred Meta from using records of users under 18 for ads. This built on an existing consent order.
AI data broker actions: The agency took action against several brokers. Those brokers sold AI-built personal profiles without proper notice or consent. The cases set a key rule: AI profiling of personal records is "sensitive" processing. That label triggers extra notice duties.
Health records cases: The commission has power over health records not covered by HIPAA. Consumer apps, wearables, and some telehealth firms fall here. Several 2024 cases hit firms that shared those records without proper consent.
25 State Laws: The US Patchwork
No single federal law covers all US residents. Instead, 25 state laws together cover most of the country.
California CPRA (from 2023): The broadest US state law. It covers 40 million state residents. It applies to firms with over $25M in revenue or that hold records on 100,000+ state consumers. It set up the California Privacy Protection Agency (CPPA) as a full-time regulator.
Virginia, Colorado, Connecticut: Three more laws with similar rights. They cover over 20 million residents combined.
Texas and Florida: Two large states now also have active privacy laws.
Washington My Health MY Data Act: The strongest US health records law outside California. It extends rights beyond HIPAA to consumer health apps.
For firms in all 50 states, the 25 laws share a core set of duties. Consumer rights, privacy notices, vendor contracts, and record limits are all required. The exact rules vary by state.
See the legal compliance guide for how these duties stack.
What the 2024 Actions Mean for Tech Teams
The 2024 cases give clear technical guidance.
Training records: Firms must track which personal records trained each AI model. They must show consent covered that training use. They must also confirm what time limits applied.
Purpose limits: AI profiles cannot be used beyond what was told to users at sign-up. Using behavior analysis for hiring when only ads were disclosed is a Section 5 violation.
Vendor duties: The agency treats SaaS vendors as the deploying firm's risk. If a tool processes user records, that must be in the privacy notice. Vendor conduct must match stated purposes.
Zero-knowledge systems: Most AI vendor cases target undisclosed use of records. A zero-knowledge system holds only encrypted files. The vendor has no key to open them. It cannot use records in ways that were not disclosed. That technical fact lines up with what the agency targets.
Learn how anonym.legal uses zero-knowledge systems at /security-compliance.
Proposed Commercial Surveillance Rule
The commission's proposed rule on commercial tracking is pending as of 2025. If passed, it would create explicit federal rules.
- Record limits for AI use.
- Opt-out rights for automated profiling.
- Bars on using collected records for new purposes.
- Security rules for stored personal records.
This rule would add GDPR-like duties for any firm serving US consumers. It would raise the floor for US privacy law across the board.
Read about record limits at /docs/faq.
Sources
- FTC: Federal Trade Commission. ftc.gov.
- FTC: AI Enforcement Actions 2024. ftc.gov/news-events/news/press-releases/.
- CPPA: California Privacy Protection Agency. cppa.ca.gov.
- FTC: Proposed Commercial Surveillance Rules. ftc.gov/legal-library/browse/rules/commercial-surveillance-rulemaking.