Last week, the Federal Trade Commission (FTC) issued a Supplemental Notice of Proposed Rulemaking, seeking public comment on its proposal to amend the Rule on Impersonation of Government and Businesses (Impersonation Rule or Rule), that is being finalized by the FTC last friday, to add a prohibition on the impersonation of individuals. The amendment would also extend liability for violations of the Impersonation Rule to parties who provide goods and services with knowledge or reason to know that those goods or services will be used in illegal impersonations. The FTC stated the impetus for the amendment is the surging number of complaints it has received around impersonation fraud, including “deepfakes” generated using artificial intelligence (AI).

In the press release announcing the Supplemental Rulemaking, FTC Chair Lina M. Khan stated, “[f]raudsters are using AI tools to impersonate individuals with eerie precision and at a much wider scale. With voice cloning and other AI-driven scams on the rise, protecting Americans from impersonator fraud is more critical than ever.”

The Impersonation Rule aims to combat scammers who impersonate businesses or government agencies by enabling the FTC to directly file federal court cases to force scammers to return the money made from the scams. The Rule is in direct response to the U.S. Supreme Court’s ruling in AMG Capital Management LLC v. FTC, discussed here, which held that the FTC does not have authority under the Federal Trade Commission Act § 13(b) to seek equitable monetary relief, such as restitution or disgorgement.

Under the Impersonation Rule, the FTC would be authorized to directly seek monetary relief in federal courts from scammers that:

• Use government seals or business logos when communicating by mail or online.
• Spoof government and business emails and web addresses, including using lookalike email addresses or websites that utilize misspellings of a company’s name.
• Falsely imply government or business affiliation. For example, stating “I’m calling from the Clerk’s Office” to imply affiliation with a court.

The Supplemental Rulemaking proposes to: (1) rename the Impersonation Rule the “Rule on Impersonation of Government, Businesses, and Individuals”; (2) include a definition of “individual” in the Impersonation Rule; (3) amend the Impersonation Rule to include a prohibition of impersonation of individuals (who are not currently addressed by the Impersonation Rule); and (4) extend liability to parties who provide goods and services with knowledge or reason to know that those goods or services will be used in impersonations of the kind that are unlawful under the amended Impersonation Rule.

The Impersonation Rule will become effective 30 days after publication in the Federal Register. Public comments on the Supplemental Notice of Proposed Rulemaking will be accepted for 60 days after its publication in the Federal Register.

Although the FTC asserts that, “the Rule as amended would not impose new burdens on honest individuals or businesses,” companies should carefully assess to what extent any AI-generated content could be implicated by the Rule, including when providing third-party services under the FTC’s proposed “knowledge” standard.