FTC and EU Ad Rules CIS Buyers Break Without Knowing

Which FTC rules apply to a foreign advertiser?

The short answer is this: if your ad reaches U.S. consumers, treat FTC truth-in-advertising rules as live. The FTC says ads must be truthful, not misleading, and backed by evidence, and its Health Products Compliance Guidance says anyone who participates directly in the marketing or controls it can carry exposure. Offshore incorporation is not a shield. It changes your paperwork, not the claim standard.

That matters because many CIS teams still treat the U.S. like a platform problem. It is not. The core question is what message a reasonable buyer takes from the ad, the landing page, the VSL, and the checkout together. If one asset softens the claim and the next one sharpens it again, regulators read the stack, not the excuse. If the combined impression says a product treats, cures, or reliably delivers a result, the FTC will look at the message, not the zip code.

The FTC's health guidance also treats advertising broadly. It covers social media, native placements, email, and indirect promotion through intermediaries, so do not split your funnel into 'ad copy' and 'not really an ad'. If the same claim appears in the teaser, the pre-sell, and the page, the whole path carries that claim. My practical read is simple: if you are buying U.S. traffic, write the creative as though a U.S. regulator will read it line by line. If you cannot defend the claim with evidence you would show an investigator, do not launch it.

What does the EU require in terms of disclosure and consent?

The EU splits this into two layers. Under Article 26 of the DSA, online platforms that show ads must make each ad identifiable as an ad, name the sponsor, name the payer if different, and expose meaningful targeting information. Separately, the European Commission's Your Europe cookie guidance says tracking cookies for behavioural advertising need prior consent.

That means a clean label on the creative is not enough. If your funnel drops a tracking pixel, retargeting tag, or analytics cookie in the EU before consent, you have a separate problem. Consent needs to be informed, specific to purpose, and as easy to withdraw as it was to give. A banner that says only 'we use cookies' is too thin. If the user accepts checkout cookies but rejects behavioural tracking, do not treat that as a green light for retargeting. Separate the choices.

The DSA is a transparency layer, not a privacy license.

• Show the ad as an ad.
• Name the sponsor and the payer when they are different.
• Do not fire non-essential trackers before consent.
• Offer separate choices for different tracking purposes.
• Make withdrawal as easy as acceptance.

If you operate in the EU, your privacy text should also match the language of the user-facing flow. Do not hide the consent link in a footer while the creative runs in another language. The complaint risk rises when the user cannot tell who collected the data, why, and for how long.

Which health claims are automatically non-compliant?

Strictly speaking, none are automatically illegal from the words alone. Context matters. But disease claims, cure claims, prevention claims, diagnosis claims, and hard result claims are where CIS creatives fail fastest, because the FTC's Health Products Compliance Guidance says objective claims need substantiation, and health claims often need competent and reliable scientific evidence. For many claims, that means human clinical evidence, not screenshots or testimonials.

The FTC says it has settled or adjudicated more than 200 cases involving false or misleading health claims since 1998. That is enough history to make the pattern plain. When the ad implies a medical effect, the agency wants proof that fits the claim, not a folder of general studies and a confident voiceover. A narrower claim can help, but only when the qualifying language is prominent and real. 'May help' is not a magic phrase if the rest of the page still promises a cure.

A disclaimer does not rescue a bad claim. If the page tells a buyer to expect treatment, cure, or a specific body change that the evidence does not support, the net impression still misleads. The FTC looks at what the ad says overall, not at the smallest font on the page. That is the part many affiliates miss. They spend the week polishing the disclaimer and never fix the sentence that broke the file.

How are testimonials and results claims regulated?

The FTC's Endorsement Guides are blunt here: testimonials must reflect the endorser's real experience, material connections must be disclosed, and unrepresentative results need context. If the person did not get the result, they cannot describe it as their result. If an affiliate or creator says the outcome is typical, the advertiser needs support for that impression.

A paid creator can still be an endorser even if the brand gives no script. The connection can be compensation, free product, a rev-share link, or even a long-running relationship that changes how people read the praise. If you hide that tie, the audience is being asked to trust a story with a missing fact. The old 'results not typical' habit does not cure the problem by itself. The safer move is to show what buyers can generally expect, or to cut the result claim entirely.

Selective screenshots create their own problem. A carousel of five-star reviews that hides the one-star complaints can mislead even if every review is real. A hired review, a Telegram repost, or a before-and-after post without a clear relationship disclosure can all fail on the same point: the audience is being asked to trust content that looks independent when it is not. Do not write copy that depends on the reader assuming the review is independent.

What does the DSA change about ad transparency?

The DSA mainly makes the platform show more. Under Article 26, the recipient must be able to identify the message as an ad, see who it is for, see who paid if different, and get meaningful information about the main targeting parameters and, where applicable, how to change them. That does not bless the offer. It just makes the sponsor and targeting harder to hide.

For affiliates, the change is practical. A dark room where only the buyer and the media team knew who paid for what becomes much smaller. If your campaign uses a platform interface in the EU, assume that the user sees more identity and targeting detail than the old habit of 'just run it and forget it' leaves room for. The point is not that transparency makes the ad legal. The point is that it gives the user and the platform more evidence when the claim stack is sloppy.

Transparency is not immunity. An ad can be transparent and still misleading. The platform may show the sponsor clearly and still reject the file, or the user may see the sponsor clearly and still complain to a regulator. If your targeting is narrow, the platform also has to expose meaningful information about the parameters used to reach that person, which pushes you toward simpler claims and fewer fantasies about opacity.

Who is actually liable — the network, the advertiser or the affiliate?

Usually all three can matter. The advertiser is the first target because it owns the offer, but the affiliate and the network do not get a free pass if they help write the claim, hide the disclosure, or keep sending traffic after they know the file is bad. The FTC's health guidance says anyone participating directly in marketing or controlling it can have exposure. That is the rule you should build around.

In practice, control beats labels. A solo affiliate who rewrites the landing page may take more direct exposure than a big network that never touched the copy, while a network that demanded revisions or ignored complaints can get pulled in. Do not assume the stack insulation that sales decks like to promise. The useful question is not who blames who after the ban. It is who had the power to stop the file before launch.

How do you build a compliance check into creative production?

Put compliance at the start of the creative workflow, not after the first spend. By the time the media buyer asks for a rewrite, the offer page has already burned spend and trained the reviewer to look for the same defect again. Build the check into the brief, the edit pass, and the pre-launch approval.

• Write a claim inventory for the page, VSL, ad, and checkout.
• Mark each claim as factual, comparative, testimonial, or implied result.
• Attach evidence for every factual or result claim.
• List banned phrases before the writer starts.
• Require a disclosure pass for endorsements, paid placements, and EU tracking.
• Record who approved the final version and when.

Use an approval gate. No spend until the creative has a claim owner, evidence folder, disclosure line, and target region. Keep version numbers on the ad, the VSL, and the landing page so the reviewer can see what changed. Review the live page on mobile as well as desktop. Many bad ads survive desktop approval and fail on a phone because the disclosure falls below the fold.

Here is the kind of check that saves accounts. If the ad says a supplement 'supports energy' but the landing page says 'end fatigue in 7 days', you do not add a bigger disclaimer and hope for the best. You either prove the stronger claim or rewrite the page so the message stays inside what the evidence and the platform policies can support. After launch, keep one 24-hour checkpoint. Screenshot the live ad, the landing page, and the checkout. If the claim drifts after approval, stop the spend.

A folder of screenshots and marked-up pages beats a vague memory of what the writer intended. Clean claims travel farther than clever ones.

Frequently asked questions

Do FTC rules apply if my company is outside the U.S.?

Yes, if you sell to U.S. consumers. The FTC cares about the message and the evidence behind it, not where the media buyer sits. If the ad stack is written for U.S. traffic, assume U.S. truth-in-advertising rules apply there.

Can a disclaimer fix a weak health claim?

No. A disclaimer only works if it changes the net impression. If the headline or VSL still promises a cure, treatment, or specific result you cannot substantiate, the small print does not erase the problem. Put the claim back inside the proof, or cut it.

What is the fastest EU compliance miss?

The first common failure is the pixel. If your site drops non-essential tracking for behavioural ads before consent, you have a separate EU problem even if the creative itself looks clean. The fix is a real opt-in flow, purpose-specific choices, and an easy withdrawal path.