Rules
The laws, regulations, and platform policies that decide what can be claimed, who can be targeted, and how ads must be labeled. This page is a map, not legal advice. Full jurisdiction-by-jurisdiction registers are maintained by Agency Echelon for data privacy, artificial intelligence, and digital assets.
United States: federal
- FTC Act Section 5 and advertising substantiation
- Unfair or deceptive advertising is prohibited; claims need a reasonable basis before they are made. Applies to every ad in every channel.
- FTC Endorsement Guides (2023) and Fake Reviews Rule (2024)
- Disclosure of material connections with endorsers and creators; ban on fake reviews and testimonials.
- COPPA (as amended 2025)
- Parental consent before collecting personal information from children under 13; no behavioral advertising on child-directed content.
- CAN-SPAM Act
- Requirements for commercial email: accurate headers, opt-out, physical address.
- TCPA
- Consent requirements for telemarketing, autodialed calls, and texts; the basis for SMS marketing rules.
- FEC political advertising disclaimers
- Disclaimer requirements for public communications by candidates, parties, and PACs, extended to internet ads in 2022.
- Fair Housing Act, ECOA, and civil rights laws
- Restrictions on targeting housing, credit, and employment ads by protected characteristics; the reason platforms limit targeting for those categories.
United States: state privacy
- California CCPA/CPRA and the state privacy law patchwork
- Opt-out of sale, sharing, and targeted advertising; Global Privacy Control honored; sensitive data limits including precise geolocation. Roughly twenty states have comprehensive laws.
- State children's and age-appropriate design laws
- Restrictions on targeting and data collection for minors in several states; some enjoined, some in force.
European Union and United Kingdom
- GDPR and UK GDPR
- Lawful basis for processing; consent for advertising identifiers in practice; fines to 4 percent of global turnover.
- ePrivacy Directive (and PECR in the UK)
- Consent before storing or reading cookies and similar identifiers.
- Digital Services Act
- Ad labeling with sponsor and targeting parameters; ban on sensitive-data and minor profiling for ads; public ad repositories for very large platforms.
- Digital Markets Act
- Gatekeeper obligations including limits on combining personal data across services without consent, affecting Meta and Google targeting in the EU.
- Regulation on the Transparency and Targeting of Political Advertising
- EU-wide rules for political ads, applicable from October 2025.
- EU AI Act transparency obligations (Article 50)
- Disclosure duties for AI-generated and manipulated content, in application since August 2, 2026, relevant to synthetic ad creative.
- UK Online Safety Act and ASA CAP Code
- Platform duties on illegal advertising; the ASA's self-regulatory code for all UK advertising including influencer disclosure.
Platform policies (private rules with the force of access)
- Google Ads policies
- Prohibited content, restricted categories, personalized advertising limits, political verification.
- Meta Advertising Standards
- Prohibited and restricted content; special ad categories for housing, employment, credit, and social issues.
- Apple App Tracking Transparency and App Store guidelines
- Permission for cross-app tracking; SKAdNetwork requirements.
- Google Play and Privacy Sandbox on Android policies
- Advertising ID handling and data safety disclosure.
Sector-specific
- Alcohol, cannabis, gambling, pharmaceuticals, financial products, crypto
- Each carries its own federal, state, and platform rules on audience, claims, and disclaimers. Crypto and digital-asset advertising rules are tracked at cryptoregulations.net.
- AI in advertising
- Disclosure of synthetic content, deepfake restrictions, and platform labeling rules are tracked jurisdiction by jurisdiction at artificialintelligenceregulations.com.
Regulatory terms are defined in the privacy and regulation section of the glossary.