Trade Regulation Rule on Impersonation of Government and Businesses

AGENCY:

Federal Trade Commission.

ACTION:

Final rule.

SUMMARY:

This final rule prohibits the impersonation of government, businesses, and their officials or agents in interstate commerce. This document contains the text of the final rule and the rule's Statement of Basis and Purpose (“SBP”), including a Regulatory Analysis.

DATES:

This rule is effective April 1, 2024.

FOR FURTHER INFORMATION CONTACT:

Christopher E. Brown (202–326–2825), Attorney, Division of Marketing Practices, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580.

SUPPLEMENTARY INFORMATION:

I. Background

A. Advance Notice of Proposed Rulemaking

On December 23, 2021, the Federal Trade Commission (“Commission” or “FTC”) published an advance notice of proposed rulemaking (“ANPR”) to address certain deceptive or unfair acts or practices of impersonation.¹ As part of the ANPR, the Commission requested comment on any issues or concerns relevant or appropriate to this rulemaking to combat impersonation of governments, businesses, or their agents, and whether and how to proceed with a notice of proposed rulemaking (“NPRM”).² The Commission took comments for 60 days, and received 164 comments from representatives from a broad spectrum of businesses, trade associations, government or law-enforcement organizations, and individual consumers, which are publicly available on this rulemaking's docket at https://www.regulations.gov/docket/FTC-2021-0077/comments. Commenters generally expressed support for the Commission's proceeding with the rulemaking. They also voiced deep concerns about the prevalence and harmfulness of both government and business impersonation. No commenter expressed the view that the Commission should not commence the rulemaking. Commenters also offered suggestions for the Commission's consideration in drafting the proposed rule and other recommendations in furtherance of the proposed rulemaking.

B. Notice of Proposed Rulemaking

Based on an extensive review of the comments received in response to the ANPR, the Commission's own history of enforcement, and other considerations that occurred after the ANPR's publication,³ the Commission published the NPRM on October 17, 2022.⁴ In the NPRM, the Commission stated it has reason to believe impersonation of government, businesses, and their officials or agents is prevalent.⁵ The Commission identified no disputed issues of material fact based on the comment record; explained its considerations in developing the proposed rule; solicited additional public comment thereon, including posing specific questions designed to assist the public in submitting comment; and provided interested parties the opportunity to request to present their position orally at an informal hearing.⁶ Finally, the NPRM set out the Commission's proposed rule.

In response to the NPRM, the Commission received 78 comments from entities and individuals interested in the proposed rule, discussed in Section III.⁷ Although some raised concerns and recommended specific modifications or additions to the Commission's proposal, the majority generally supported the rule proposed in the NPRM. Two commenters timely submitted requests for interested parties to make an oral statement at an informal hearing.⁸

C. Notice of Informal Public Hearing

On March 30, 2023, the Commission published an Initial Notice of Informal Hearing (“Notice of Hearing”).⁹ The Notice designated the Commission's Chief Administrative Law Judge, D. Michael Chappell, to serve as the presiding officer of the informal hearing and stated that any member of the public wishing to speak at the informal hearing or make a documentary submission to be placed on the public rulemaking record (or both) should submit a comment on or before April 14, 2023.¹⁰

On May 4, 2023, Chief Judge Chappell presided over the informal hearing using video conferencing, which enabled the public to watch live from the Commission's website, https://www.ftc.gov. Because there were no disputed issues of material fact to resolve, the informal hearing included no cross examination or rebuttal submissions, and the presiding officer made no recommended decision. The informal hearing included oral statements from 14 interested parties.¹¹ The majority of commenters who presented oral statements at the informal hearing or filed documentary submissions generally expressed strong support for the Commission's proposed rule.¹² Several commenters, however, also expressed concern that the proposed rule language does not explain the circumstances under which the Commission would apply proposed § 461.4, which would prohibit providing the means and instrumentalities to commit violations of government and business impersonation. Some suggested alternative language imposing a scienter requirement to narrow the scope of this provision, discussed in Section III.D.

In crafting the final rule, the Commission has carefully considered the comments received in response to the NPRM and on the rulemaking record, which includes the oral statements and documentary submissions in response to the Notice of Hearing. The final rule contains some changes from the proposed rule. These modifications, discussed in detail in Section III, are based upon input from commenters and careful consideration of relevant law. Section III also discusses commenters' recommendations that the Commission declined to adopt, along with the Commission's reasons for rejecting them. Accordingly, the Commission adopts the proposed rule with limited modifications as discussed below. The rule will take effect April 1, 2024.

II. The Legal Standard for Promulgating the Rule

The Commission is promulgating 16 CFR part 461 pursuant to section 18 of the FTC Act, 15 U.S.C. 57a, the Administrative Procedure Act (“APA”), and Part 1, subpart B of the Commission's Rules of Practice.¹³ This authority permits the Commission to promulgate, modify, and repeal trade regulation rules that define with specificity acts or practices that are unfair or deceptive in or affecting commerce within the meaning of section 5(a)(1) of the FTC Act, 15 U.S.C. 45(a)(1).

The Commission's Rules of Practice further provide that if the Commission determines to promulgate a rule, it will adopt a SBP, which must address three factors: (1) The prevalence of the acts or practices addressed by the rule; (2) the manner and context in which the acts or practices are unfair or deceptive; and (3) the economic effect of the rule, taking into account the effect on small businesses and consumers.¹⁴ In this section of the preamble, the Commission summarizes its findings regarding each of these factors.

A. Prevalence of Acts or Practices Addressed by the Rule

In its ANPR, the Commission cited public data from the Consumer Sentinel Network database and described its enforcement record, demonstrating government and business impersonation scams are not only highly prevalent but increasingly harmful.¹⁵ In the NPRM, the Commission also took notice of additional indications of prevalence that came after the ANPR's publication.¹⁶ Specifically, the NPRM cited data from a broad spectrum of commenters (businesses, trade associations, and government or law-enforcement organizations) regarding the prevalence of government and business impersonation scams, which echoed the Commission's findings that these schemes are among the most common deceptive or unfair practices affecting U.S. consumers and businesses and continue to be a significant source of consumer injury.¹⁷

B. Manner and Context in Which the Acts or Practices Are Deceptive or Unfair

A representation, omission, or practice is deceptive if it is material and likely to mislead a consumer acting reasonably under the circumstances.¹⁸ The most frequent allegations in the Commission's enforcement actions involving government and business impersonation pertain to defendants tricking consumers to pay money or disclose personal information by making, expressly or by implication, statements that misrepresent the defendants' identity.¹⁹ Nearly as frequent are allegations of misrepresentations concerning defendants' affiliation with, endorsement or approval by, or other association with a government or business. The Commission has further found false threats of severe consequences and promises of benefits are additional deceptive tactics deployed by government and business impersonators. In the Commission's experience, such claims regarding identity, affiliation, or endorsement are material to consumers making their decision to trust impersonators. The numerous government and business impersonation complaints consumers submit to the Commission each year, as well as comments submitted in connection with this rulemaking proceeding, consistently reference these same concerns. Accordingly, the specific practices described in the preamble to the proposed rule reflect the type of conduct most commonly associated with deceptive and unfair practices pertaining to government and business impersonation.²⁰

C. The Economic Effect of the Rule

As part of the rulemaking proceeding, the Commission solicited comment and data (both qualitative and quantitative) on the economic impact of the proposed rule and its costs and benefits.²¹ In issuing the final rule, the Commission has carefully considered the comments received and the costs and benefits of each provision, as discussed in more detail below in Section VI. The record demonstrates the most significant anticipated benefit of the final rule is the Commission's ability to obtain monetary relief. This is particularly critical because that ability was curtailed by the U.S. Supreme Court's decision in AMG Cap. Mgmt., LLC v. FTC, which holds that equitable monetary relief, including consumer redress, is not available under section 13(b) of the FTC Act.²² Further, obtaining monetary relief based on violations of the final rule under section 19(b) of the FTC Act will be significantly faster than obtaining such relief under section 19(a)(2) without a rule violation.²³ By enabling the Commission to obtain monetary relief more efficiently, the final rule would also reduce the expenditure of Commission resources.²⁴ As an additional benefit, the rule enables the Commission to obtain civil penalties against violators.²⁵ The final rule also provides a benefit to businesses through increased deterrence of business impersonators, which reduces businesses' expenditure of resources associated with monitoring for and addressing impersonation.²⁶ Moreover, as the record and the Commission's law enforcement experience demonstrate, the final rule is unlikely to impose costs on any honest business, and may increase deterrence of impersonation scams, which would benefit consumers through a reduction in their total financial losses from these schemes.²⁷

III. Response to Comments

The Commission received 78 comments in response to the NPRM from a diverse group of individuals, industry groups and trade associations, consumer organizations, and government agencies.²⁸ The Commission received 28 comments in response to the Notice of Hearing, including oral presentations from 14 commenters.²⁹ Commenters generally supported the proposed rule, recognizing the Commission's authority to protect consumers from the increasing number of government and business impersonation frauds targeting consumers.

In the NPRM, the Commission invited comment on any issues or concerns the public believes are relevant or appropriate to the Commission's consideration of the proposed rule.³⁰ The NPRM also posed eight specific questions for the public.³¹ Some of these questions relate to the Paperwork Reduction Act (“PRA”) and Regulatory Flexibility Act (“RFA”), and are addressed in Sections V and VI, respectively.³² The other questions, along with common issues or concerns relevant to the Commission's consideration of the proposed rule outside of the specific questions, are addressed in this section of the preamble.

A. Finalizing the Proposed Rule as a Final Rule

In Question 1 of the NPRM, the Commission asked whether it should finalize the proposed rule as a final rule, and how, if at all, it should change the proposed rule in promulgating the final rule.³³ The majority of commenters did not express a clear view regarding whether the Commission should adopt the proposed rule as final. Many of these commenters, however, did share their experience regarding the prevalence and harmfulness of various kinds of government and business impersonation frauds.³⁴ Some of these commenters complained more generally about various non-impersonation scams.³⁵ The majority of commenters that addressed Question 1 of the NPRM were substantially supportive of the proposed rule, but stopped short of urging the Commission to finalize the text of the proposed rule without modification. These commenters typically recommended either broadening or narrowing the scope or text of the rule in response to other specific questions asked in the NPRM or relevant to the Commission's consideration of the proposed rule.³⁶

Six commenters explicitly addressed the Commission's question regarding finalizing the proposed rule as a final rule, and without recommending additional modifications to the text of the proposed rule, urged the Commission to do so.³⁷ Some of these commenters stated the proposed rule is in the public interest because it would allow for civil penalties against government and business impersonators, provide redress for victims of impersonation scams, and deter future bad acts.³⁸

Several government agencies and trade associations explained how the proposed rule would benefit them, their members, or the people they serve. The United States Patent and Trademark Office (“USPTO”) described its experience of agency impersonation, and stated that reliance on the FTC's enforcement capabilities through such a rule would allow the USPTO to conserve and allocate its resources to different enforcement efforts that impact the USPTO and its stakeholders.³⁹ Similarly, the Marine Retailers Association of the Americas (“MRAA”), a trade association representing marine retailers, argued the benefits associated with finalizing the proposed rule would reduce the financial burden on businesses and improve trust among consumers.⁴⁰ The United States Copyright Office (“USCO”) expressed support for finalizing the proposed rule, arguing that doing so would allow the Commission to move more quickly to put a stop to impersonation scams.⁴¹ The USPTO and the USCO explained they do not have law enforcement authority to remedy the harms resulting from bad actors impersonating the agencies, and USCO argued the proposed rule would foster public trust in the copyright system.⁴² The Cellular Telecommunications and internet Association (“CTIA”), a trade association for wireless service providers, argued in favor of finalizing the proposed rule because its scope is “targeted and judicious,” and appropriately focused on the bad actors that harm consumers.⁴³

Somos, Inc., which manages registry databases for the telecommunications industry, stated it “strongly supports the Commission's proposed rules,” but suggested the Commission explicitly clarify that spoofing a telephone number of a business or government entity to aid in that impersonation violates the rule.⁴⁴ The Commission is not persuaded that explicitly stating telephone spoofing, or any specific type of government or business impersonation, constitutes a violation of the rule is necessary.⁴⁵ Moreover, the Telemarketing Sales Rule (“TSR”) already bars telemarketers from “failing to transmit. . .the telephone number and. . .the name of the telemarketer to any caller identification service in use by a recipient of a telemarketing call.” ⁴⁶ By definition, a spoofed telephone number is not the number of the telemarketer, and the Commission can rely on this prohibition to bring an enforcement action for violation of the TSR against a telemarketer that uses a spoofed number.

The Commission also received several comments that identified the lack of access to accurate information concerning domain name registrants (commonly known as “WHOIS” data) as a significant impediment to combatting the use of domain names to impersonate government and businesses.⁴⁷ These commenters expressed support for expanding the text or scope of the final rule to address this issue.⁴⁸ In particular, a few commenters urged the Commission to issue a final rule that requires domain name registrars to collect, verify, maintain, and disclose accurate WHOIS data to the FTC and third-party victims on request for such information based on credible evidence of impersonation fraud.⁴⁹ The Coalition for Online Accountability (“COA”), a group advocating for online transparency and accountability, argued “[t]here is no justification for the redaction of data of legal person registrants or the overwhelming denial of reasonable access to personal WHOIS data for legitimate third-party interests. . ..” ⁵⁰ Both the Messaging Malware Mobile Anti-Abuse Working Group (“M3AAWG”) and the Anti-Phishing Working Group (“APWG”) also suggested the Commission encourage Domain Name System (“DNS”) registries and registrars to engage in DNS mitigation and frequently impersonated entities to participate as “trusted notifiers” to address fraudulently registered domain names.⁵¹

The Commission declines to adopt commenters' suggestion that the final rule expressly reference in accompanying examples the use of domain names in impersonation schemes. Rather, the Commission here repeats what it previously stated in the NPRM and earlier in this SBP, that the following list of examples of conduct covered by the prohibition on the impersonation of government and businesses was intended to be illustrative, not exhaustive: (1) calling, messaging, or otherwise contacting an individual or entity while posing as a government or an officer or agent or affiliate or endorsee thereof, including by identifying a government or officer by name or by implication; (2) sending physical mail through any carrier using addresses, government seals or lookalikes, or other identifying insignia of a government or officer thereof; (3) creating a website or other electronic service impersonating the name, government seal, or identifying insignia of a government or officer thereof or using “.gov” or any lookalike, such as “govusa.com”; (4) creating or spoofing an email address using “.gov” or any lookalike; (5) placing advertisements that pose as a government or officer thereof against search queries for government services; (6) using a government seal on a building, letterhead, website, email, vehicle, or other physical or digital place; (7) calling, messaging, or otherwise contacting an individual or entity while posing as a business or an officer or agent or affiliate or endorsee thereof, including by naming a business by name or by implication, such as “card member services” or “the car dealership”; (8) sending physical mail through any carrier using addresses, seals, logos, or other identifying insignia of a business or officer thereof; (9) creating a website or other electronic service impersonating the name, logo, insignia, or mark of a business or a close facsimile or keystroke error, such as “ntyimes.com,” “rnicrosoft.com,” “microsoft.biz,” or “ carnegiehall.tixsales.com ”; (10) creating or spoofing an email address that impersonates a business; (11) placing advertisements that pose as a business or officer thereof against search queries for business services; and (12) using, without authorization, a business's mark on a building, letterhead, website, email, vehicle, or other physical or digital place.⁵² Accordingly, the Commission finds the final rule is drafted with sufficient clarity and flexibility to address the unauthorized use of internet identifiers, including but not limited to domain names.

Only one commenter suggested in response to Question 1 of the NPRM that the proposed rule should not be finalized.⁵³ The Americans for Prosperity Foundation (“AFPF”), a 501(c)(3) nonpartisan education organization, argued the Commission should “abandon its Section 18 rulemaking ambitions, instead refocusing its efforts on case-by-case enforcement actions in federal court in cases involving concrete harm to consumers.” ⁵⁴

The Commission disagrees with the AFPF's suggestion that the section 18 rulemaking process is too difficult or unwieldy to address many of the unfair or deceptive acts or practices prevalent in commerce. In 1975, Congress passed the Magnuson-Moss Warranty—Federal Trade Commission Improvement Act laying out specific procedures for the promulgation of “Trade Regulation Rules” to protect consumers in a dynamic and changing economic landscape.⁵⁵ The Commission's regulations at 16 CFR part 1, subpart B, respect the underlying statutory requirements of section 18, which provide ample transparency and opportunity for public participation in the promulgation of Trade Regulation Rules. The Commission intends therefore to fulfill its mission to protect against unfair or deceptive acts or practices in or affecting commerce and to provide consumers and businesses with due process, clarity, and transparency while crafting the rules to do so. Accordingly, the Commission rightfully responds to Congress's grant of authority by initiating this rulemaking.

The AFPF also expressed various criticisms specific to the language of the proposed rule and recommended several suggested revisions discussed in greater detail in Sections III.C and III.D below.

Following review of all comments and careful consideration of the relevant law, the final rule issued by the Commission contains some minor changes from the proposed rule, as discussed in Section III.

B. Relevant Evidence Regarding Provisions of the Proposed Rule, Prevalence, Impact and Alternative Proposals

In the ANPR, the Commission asked specific questions about the prevalence of impersonation fraud, and requested the data source commenters relied upon for formulating their answer(s).⁵⁶ The ANPR also asked specific questions regarding how to craft a proposed rule to maximize the benefits to consumers and minimize the costs to businesses, and what alternatives to regulations the Commission should consider in addressing impersonation frauds.⁵⁷ In Question 2 of the NPRM, the Commission posed these same or nearly identical specific questions regarding each different provision of the proposed rule.⁵⁸ Six commenters specifically addressed these questions.⁵⁹ Each of these commenters described various types of government and business impersonation scams common to their own experience or industry in support of their view that such frauds are highly prevalent.⁶⁰ For example, the Toy Association noted various business impersonation scams experienced by its members, including counterfeit or non-compliant toys, falsified documents regarding endorsement and affiliation related to counterfeit toys, false solicitation and phishing schemes collecting customer information, and domain impersonation.⁶¹ Similarly, the USPTO and USCO described several examples of government impersonation scams involving the trademark and copyright registration processes, respectively, and included illustrative examples as attachments with their public comment.⁶²

Other commenters particularly concerned with online business impersonation cited data from studies or reports regarding trends in these kinds of impersonation frauds, and recent examples of phishing attacks against consumers through the impersonation of recognized online companies in support of their arguments regarding prevalence.⁶³ A small number of commenters addressed the impact (including any benefits and costs) on consumers, governments, and businesses, discussed in more detail in Section VI.

Only one commenter suggested an alternative proposal for the Commission's consideration.⁶⁴ Specifically, the M3AAWG recommended as an alternative to the means and instrumentalities provision in proposed § 461.4 that the Commission “identify best practices or safe harbors to incentivize prompt mitigation efforts and sound verification techniques” to address the use of domain names in business impersonation schemes.⁶⁵ M3AAWG argued this alternative to regulation would avoid the risk of inadvertently imposing “secondary or intermediary liability against legitimate businesses, technologies or services” exploited by impersonators.⁶⁶

Upon review of the comments received in response to Question 2 of the NPRM, the Commission concludes such comments support its own findings that government and business impersonation schemes are both prevalent and harmful. The Commission declines at this time to adopt M3AAWG's alternative proposal for § 461.4. As discussed in Section III.D, the Commission is continuing to review comments and records relevant to the means and instrumentalities provision in proposed § 461.4 to determine whether additional action or protections are warranted and is requesting additional public comment through a SNPRM, published elsewhere in this issue of the Federal Register .

C. Clarity of Prohibitions Against Impersonation of Government & Businesses

In Question 5 of the NPRM, the Commission solicited comment regarding whether the proposed rule's one-sentence prohibitions against impersonation of government in § 461.2 and against impersonation of businesses in § 461.3 are clear and unambiguous, and how, if at all, they should be improved.⁶⁷ The Commission received several comments that addressed this question directly ⁶⁸ or indirectly.⁶⁹ Two commenters considered the one-sentence prohibitions to be clear and unambiguous and/or deferred to the Commission's construction, but suggested certain additions or modifications.⁷⁰ For example, the USCO suggested the Commission consider whether the definition of “officer,” which covers representatives of both governments and businesses, should be bifurcated into two separate and more specific terms to define representatives of governments and businesses, respectively.⁷¹ No other commenter suggested a revision to the definitions in proposed § 461.1. The USPTO suggested the Commission broaden the exemplary “list of matter” used to impersonate a government to specifically reference “logos.” ⁷² In support of this recommendation, the USPTO noted “the use of logos” was explicitly identified in the NPRM's examples of unlawful conduct that would be covered by the prohibition against business impersonation in proposed § 461.3, but not in the NPRM's examples of unlawful conduct that would be covered by the prohibition of government impersonation in proposed § 461.2. The USPTO further asserted government agencies also “use logos in addition to official seals and insignia,” and provided an illustrative example of impersonators misusing the USPTO's logo.⁷³

Three commenters indicated the language of proposed §§ 461.2 and 461.3 was vague or provided inadequate guidance, and warranted modification.⁷⁴ Some commenters raised constitutional concerns based on the purported overbreadth of the one-sentence prohibitions.⁷⁵ These commenters' constitutional arguments addressed two primary considerations: (1) whether the proposed rule provides due process notice; ⁷⁶ and (2) whether it encroaches upon free speech protected under the First Amendment.⁷⁷ The AFPF stated the proposed rule is an “open-ended regulation,” arguing it “fails to provide constitutionally adequate notice of required or prohibited conduct” and otherwise falls short of section 18's specificity requirements.⁷⁸ Other commenters wary of inadvertent intrusions on protected speech asserted any final prohibition should exempt innocent behavior such as parody ⁷⁹ and non-commercial or otherwise legitimate speech.⁸⁰

In his documentary submission in response to the Notice of Informal Hearing, William MacLeod echoed concerns he previously expressed in response to the NPRM that the language in proposed §§ 461.2 and 461.3 “depart[s] from the standards of deception that the Commission applies under Section 5.” ⁸¹ MacLeod noted that: “[i]ts terms do not include `deception' or `fraud' or critical elements of the FTC's deception policy statement.” ⁸² He raised additional concerns about “impersonations and affiliations [that] can be false, but also unbelievable.” ⁸³ MacLeod argued that the prohibitions, as written, are too broad and would proscribe non-deceptive acts or practices, such as “fictional depictions” in television advertisements.⁸⁴

Raising First Amendment concerns, the AFPF similarly asserted that the proposed rule's “falsely pose as” language, “read literally,” would impose civil penalties on “utterly innocuous conduct” and “would appear to make it unlawful for anyone to dress up as an FTC Commissioner, politicians, or . . . a Microsoft executive and attend a Halloween party.” ⁸⁵ It also expressed concern that the proposed prohibitions did not require “materiality,” “consumer harm,” or “connection to interstate commerce.” ⁸⁶ Several commenters suggested alternative language to cure what they perceived to be the overbreadth of the prohibition provisions. For example, M3AAWG recommended that the final rule adopt a definition of “impersonation” that mirrors the definition of “criminal impersonation” in 18 U.S.C. Chapter 43.⁸⁷ M3AAWG asserted that such a definition would narrow the scope of the rule to cover only those bad actors with “clear intent and specific knowledge” of prohibited acts.

MacLeod proposed narrowing the focus of the final rule by adopting language that specifies particular prohibited practices or the mens rea of its intended targets.⁸⁸ The AFPF agreed with MacLeod and suggested that the Commission revise the proposed rule to “explicitly incorporate Section 5's statutory prohibition . . . [and] requirements set forth in the Commission's Deception Statement.” ⁸⁹

After analyzing and considering the comments, the Commission is persuaded that the language of the final rule should adhere more closely to the language of section 5 of the FTC Act to avoid any potential confusion about the scope of the rule. The Commission believes that these revisions sufficiently address some commenters' concerns that the language of the proposed rule put it in conflict with Due Process requirements and the First Amendment.

The Commission emphasizes that it does not intend for the final rule to regulate non-commercial speech. To adhere more closely to the language of section 5 of the FTC Act and case law, the Commission has revised the final regulatory text to incorporate relevant language from section 5. Specifically, the Commission has replaced “unlawful” with “unfair or deceptive act or practice,” and added “materially” and “in or affecting commerce” in §§ 461.2 and 461.3. These changes make it abundantly clear that the scope of the final regulatory text is coterminous with the scope of the FTC's authority under the FTC Act, and they clearly specify the misconduct prohibited by the final rule. Accordingly, false impersonations or misrepresentations that are not material to a commercial transaction, such as impersonation in purely artistic or recreational costumery or impersonation in connection with political or other non-commercial speech, are not covered by the final rule.

The Commission concludes that it is unnecessary to divide the definition of “officer” into two separate terms as suggested by the USCO. Section 461.1 defines “officer” to “include[ ] executives, officials, employees, and agents,” which the Commission believes appropriately describes and covers both government and business representatives.

As previously stated, the NPRM's list of examples of prohibited conduct covered by the rule is intended to be illustrative, not exhaustive, and therefore, the Commission declines to adopt the USPTO's suggestion that it enlarge that exemplary “list of matter.” Rather, the Commission maintains that not including specific prohibitions in the regulatory text provides it with sufficient flexibility to address the many types of “matter” (including objects, items, logos, insignia, etc.) used to impersonate governments and businesses alike, which are too numerous to list.

The Commission declines to adopt a definition of “impersonation” that reflects a criminal regulatory scheme as proposed by M3AAWG. The FTC Act does not include a mens rea requirement, and there is no evidence in the record that the imposition of such a requirement is warranted. Furthermore, while intent is not required under the rule or the FTC Act, in any action seeking civil penalties for violation of the rule, the Commission will need to establish “actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule.” ⁹⁰

The Commission rejects the recommendation by both MacLeod and AFPF to incorporate the FTC Deception Policy Statement into the final rule. Nevertheless, as discussed earlier in this Section III.C, informed by MacLeod's and AFPF's comments, the Commission has revised the regulatory text of §§ 461.2 and 461.3 to mirror the language of section 5 of the FTC Act more closely. In particular, the reference to “unfair or deceptive act or practice,” and the inclusion of materiality and interstate commerce requirements should address commenters' concerns that this rule might be read to cover impersonation in connection with artistic costumery, parody, or other non-commercial speech.⁹¹ The Commission further notes that, by the terms of these sections, a court must find that the alleged defendant made an express or implied misrepresentation regarding material information for §§ 461.2 and 461.3 to be violated. For an express or implied misrepresentation regarding material information to be made in violation of the FTC Act and this rule, there must be a representation that misleads consumers acting reasonably under the circumstances regarding material information. Thus, while the Commission rejects the recommendation by both MacLeod and AFPF to incorporate the FTC Deception Policy Statement into the final rule, by incorporating the changes above, the Commission has ensured that the final rule is consistent with the Deception Policy Statement, is consistent with other relevant Commission rules, and provides further specificity regarding the prohibited acts and practices under section 5 of the FTC Act.

D. Prohibition Against Providing Means and Instrumentalities

In Question 6 of the NPRM, the Commission asked whether the final rule should contain the prohibition in proposed § 461.4 against providing the means and instrumentalities for violations against government or business impersonation. The Commission received more than 20 comments that expressly addressed this question.⁹² Many of the sentiments reflected in these comments were also echoed by several commenters that presented oral statements in response to the Notice of Informal Hearing.⁹³ A few commenters arguing for the importance of holding intermediaries accountable for enabling or promoting impersonation schemes encouraged the Commission to finalize the text of the proposed provision without modification.⁹⁴ These commenters specifically argued that finalizing the proposed § 461.4 could help to combat impersonation schemes perpetrated by foreign-based scammers—beyond U.S. court jurisdiction—that obtain services from U.S.-based instrumentalities, such as payment processors and internet service providers.⁹⁵

Addressing means and instrumentality liability, both the AFPF and MacLeod reiterated their concerns referenced in Section III.C, regarding section 18's specificity requirements, due process notice, free speech, and conformity to the FTC's Deception Policy Statement.⁹⁶ Most commenters who addressed Question 6 expressed support for means and instrumentalities liability, but with some concern or suggested modifications. Some supportive commenters cautioned that the proposed means and instrumentalities provision could be read too broadly.⁹⁷ Others expressed the concern that without a specific scienter or knowledge requirement, the proposed rule provision runs the risk of imposing strict liability against innocent and unwitting third-party providers of services or products.⁹⁸ Accordingly, several commenters urged the Commission to clarify the scope of means and instrumentalities liability or explicitly include a specific knowledge requirement in the final rule provision.⁹⁹

For example, the Consumer Technology Association (“CTA”), a trade association representing the U.S. consumer technology industry, stated that the Commission's explanation and examples of the “means and instrumentalities” provision in the NPRM seem to limit its applicability, but such limitation “is not squarely reflected in the text of the proposed rule.” ¹⁰⁰ The CTA therefore urged the FTC to clarify that “means and instrumentalities” liability applies only “to entities that have knowledge or consciously avoid knowing that they are making representations being used to commit impersonation fraud.” USTelecom, a trade association representing the broadband technology industry, argued that a discrepancy exists between the case law, the NPRM's discussion of means and instrumentality liability, and the proposed rule provision. It urged the Commission to “adjust the proposed language in § 461.4 to codify the requirement that the person has knowledge or reason to expect it is providing the means and instrumentalities . . .” (emphasis in original).¹⁰¹ Similarly, the American Bar Association Section of Intellectual Property Law suggested that the Commission “explicitly include [in § 461.4] the language referenced in the [NPRM] from Shell Oil Co., 128 F.T.C. 749 (1999)—acting with `knowledge or reason to expect that consumers may possibly be deceived as a result.' ” ¹⁰²

Other commenters argued that inclusion of a scienter requirement is a necessary but not sufficient modification of the proposed language to impose means and instrumentalities liability. For example, the internet & Television Association (“NCTA”), a trade association for the United States cable television industry, argued that such “liability requires both providing deceptive means and instrumentalities, e.g., providing false or misleading claims or counterfeit items, and actual knowledge that the deceptive representations or goods will be used to commit impersonation violations” (emphasis in original).¹⁰³ Likewise, M3AAWG advocated that, in addition to a “knowledge or reason-to-know test,” primary liability under a revised § 461.4 should also require that the provision of such means and instrumentalities be done willfully or in bad faith, and with clear intent and specific knowledge.¹⁰⁴

A few commenters urged the Commission to adopt a final rule that explicitly recognizes specific or defined “means and instrumentality” violations perpetrated in connection with impersonation frauds, such as the use of legal process documents ¹⁰⁵ or manipulated media technologies ( i.e., deepfakes) ¹⁰⁶ or failure to disclose WHOIS data.¹⁰⁷

Based upon the comments received on the proposed provision regarding means and instrumentalities, the Commission has decided that this specific provision warrants further analysis and consideration; thus, the Commission has decided not to finalize proposed § 461.4. The Commission is not aware of any other rule, whether issued pursuant to section 18 or APA rulemaking authority, that identifies a means and instrumentalities violation. The Commission notes that it has used means and instrumentalities allegations as a type of deception to establish primary liability in the absence of privity between the defendant and the deceived persons, albeit rarely, in connection with matters that involve impersonation.¹⁰⁸ Pending further analysis and consideration, the Commission declines to adopt proposed § 461.4 at this time. The Commission is still considering the provision regarding means and instrumentalities, as well as issues related to the impersonation of individuals or entities other than governments and business in interstate commerce and is requesting public comment through a Supplemental Notice of Proposed Rulemaking (“SNPRM”), published elsewhere in this issue of the Federal Register .

E. Inclusion of Prohibition Against Impersonating Nonprofits

In response to the ANPR, the Commission received a number of comments that urged the Commission to include “nonprofit” entities in the proposed rule's definition of businesses that can be impersonated.¹⁰⁹ The Commission agreed with these comments, and consequently, defined a “business” that may be impersonated to include nonprofits in § 461.1 of the proposed rule, notwithstanding the fact that the Commission is authorized to sue a corporation only when the corporation is “organized to carry on business for its own profit or that of its members.” ¹¹⁰ As the Commission explained in the NPRM, the reason for doing so is because for profit businesses may impersonate nonprofit business.¹¹¹ In Question 7 of the NPRM, the Commission solicited comment regarding whether any final rule should keep the prohibition against impersonating nonprofit organizations.¹¹² The Commission received more than a dozen comments that specifically addressed this question, and each of them expressed support for a final rule keeping the prohibition against impersonating nonprofits.¹¹³ None of the comments responding to the NPRM or Notice of Hearing opposed doing so. The vast majority of commenters who addressed this question were themselves nonprofit organizations operating as trade associations, and referenced their own experience with impersonation frauds in support of a final rule keeping the prohibition against impersonating nonprofits.¹¹⁴ Several commenters expressed the view that nonprofits are often the subject of impersonation scams in the same way as for profit businesses and government agencies.¹¹⁵ Other commenters asserted that impersonation of nonprofits could be uniquely harmful because bad actors “prey[ ] on the goodwill of individuals attempting to make donations, and misappropriate[ ] those donations to corrupt private actions.” ¹¹⁶ Some commenters noted that nonprofits are particularly susceptible to being impersonated in scams involving affiliation or endorsement claims because nonprofits often offer awards or seals of approval.¹¹⁷

Finally, two commenters cited trademark law in support of keeping nonprofits in the definition of business and a final rule that includes the prohibition against impersonating nonprofits. Specifically, both INTA and the Toy Association stated that trademark law has “long recognized that the misuse of names of non-profit organizations can lead to harmful consumer confusion.” ¹¹⁸ In INTA's and the Toy Association's view, the same applies with respect to impersonation schemes; thus, the final rule should also make no distinction between for profit and nonprofit businesses.

Based upon the record, including public comments in response to Question 7 of the NPRM, the Commission has determined that the final rule will retain the definition of “business” in § 461.1 that includes nonprofits and the prohibition against impersonating nonprofit organizations in § 461.3.

F. Inclusion of Individuals or Entities Other Than Government and Business Impersonators

In the NPRM, the Commission asked whether the proposed rule should be expanded to address the impersonation of individuals or entities other than governments and business in interstate commerce.¹¹⁹ The NPRM identified romance and grandparent impersonation scams as illustrative, but non-exhaustive, examples of other types of impersonation fraud, and solicited further comment regarding their prevalence and impact, and alternative proposals to regulation. Six commenters specifically addressed these questions, and each of them stated that the Commission should expand the reach of the proposed rule to extend beyond government and business impersonators.¹²⁰ Some commenters asserted that fraudsters often impersonate individuals in similar ways they impersonate government and businesses.¹²¹ In support of expanding the rule, several commenters argued that romance and grandparent impersonation scams were harmful and prevalent, citing to data from the FTC and other sources showing a steady increase in the number of consumer reports and median individual losses for such scams.¹²² A comment submitted by a group of students at Rutgers Law School asserted that older consumers are susceptible to “interpersonal confidence fraud and romance scams” and provided relevant data demonstrating that older consumers may be more likely to fall victim to these kinds of impersonation than to government impersonation.¹²³ Several commenters also stated that while the number of reports of these two types of impersonation scams are not as high as government and business impersonation, they are likely underreported, and that median individual losses are often higher.¹²⁴ The AARP stated that, “[o]f all fraud activity, romance scams and scams impersonating a family member in trouble are the most insidious, given the emotional devastation that combines with often significant financial losses.” ¹²⁵ A joint comment submitted by several consumer and privacy advocacy organizations argued that such evidence “should be sufficient justification” for the Commission to “add a subsection to proposed Section 461 to cover `Impersonation of Individuals.' ” ¹²⁶

A few commenters discussed the prevalence and harmfulness of other kinds of impersonation scams as support for expanding the rule beyond government and businesses to include individuals. For example, the NCTA stated that its member companies had observed an increase in sophisticated residential IP address scams that impersonate online subscribers for illegal purposes such as piracy and fraud.¹²⁷ NCTA encouraged the Commission to consider a new rule to prohibit impersonation of individuals through “unauthorized use of an individual's online credentials, accounts, IP addresses, and digital networks.” ¹²⁸ The Recording Industry Association of America (“RIAA”) described impersonation scams involving offers of NFTs and mobile apps suggesting affiliation with sound recording artists and phishing scams where third parties claimed to be a music artist's manager or producer.¹²⁹ RIAA recommended that the Commission expand the rule to include the following: “[I]t [is] unlawful to falsely pose as or to misrepresent, directly or by implication, affiliation with, including endorsement or sponsorship by, an individual, for financial gain.” ¹³⁰

The Rutgers Law Students noted the prevalence of social media, and profiles of celebrities and influencers in current modes of online communication, arguing that it would be a “grave oversight” to omit persons with such notable identities from a rule prohibiting impersonation.¹³¹ The students also argued that individuals are more likely than government agencies or businesses to suffer direct harm to their identities from impersonation scams and less likely to be able to repair the reputational injuries.¹³² Accordingly, they proposed that the Commission add another section to the rule with language prohibiting the impersonation of “any person” that parallels the language in §§ 461.2 and 461.3 prohibiting the impersonation of government and businesses, respectively.¹³³ The students further stated that this additional provision “closes a loophole” that proposed §§ 461.2 and 461.3 leave open regarding the impersonation of former government and business officials.¹³⁴ Finally, the students concluded that adding such a narrowly drafted provision would not burden honest businesses or individuals, and would benefit consumers because the median individual losses for other kinds of impersonation frauds are often greater than for government and business impersonation.¹³⁵ Both the students and the NCTA agreed that expanding the proposed rule to prohibit impersonation of individuals would not impact recreational or comedic impersonations of individuals in television or film.¹³⁶

Upon consideration of the comments received in response to Question 8 of the NPRM and all relevant records and data, the Commission is seeking additional public comment about potentially expanding part 461 to cover impersonation of individuals or entities other than governments and businesses in interstate commerce in a SNPRM published elsewhere in this issue of the Federal Register .¹³⁷

G. Requiring Domain Name Registrars To Collect, Verify, Maintain, and Disclose Accurate WHOIS Data

The Commission received several comments that identified the lack of access to accurate information concerning domain name registrants (commonly known as “WHOIS” data) as a significant impediment to combatting the use of domain names to impersonate government and businesses.¹³⁸ These commenters expressed support for expanding the text or scope of the final rule to protect consumers from this increasingly prevalent impersonation scheme.¹³⁹ In particular, a few commenters urged the Commission to issue a final rule that requires domain name registrars to collect, verify, maintain, and disclose accurate WHOIS data to the FTC and third-party victims on request for such information based on credible evidence of impersonation fraud.¹⁴⁰ As previously noted, the COA argued that the redaction or denial of reasonable access to WHOIS data is unjustified.¹⁴¹ Both M3AAWG and APWG also suggested that the Commission encourage DNS registries or registrars to engage in DNS mitigation and frequently impersonated entities to participate as “trusted notifiers” to address fraudulently registered domain names.¹⁴²

Because the deceptive use of internet domain names is already covered under the rule, the Commission declines to adopt commenters' suggestion that the final rule expressly reference in the text or accompanying examples the use of domain names in impersonation schemes. As previously noted in Section III.A, the NPRM's preamble contained a list of examples of conduct covered by the prohibition on the impersonation of government and businesses that was intended to be illustrative, not exhaustive.¹⁴³ Such a comprehensive list would be both impossible and would not provide the trade regulation rule with the flexibility to accommodate changes in the marketplace and scammers' behavior. The Commission finds therefore that the final rule is drafted with sufficient clarity and flexibility to address the unauthorized use of internet identifiers, including but not limited to, domain names. Furthermore, the Commission declines to issue a final rule that imposes affirmative requirements upon domain name registrars which is beyond the purview of this rulemaking and doing so arguably would place an impracticable burden upon consumers to know about and verify the trustworthiness of such WHOIS data.

H. Comments Regarding Limitation of Remedies

A small number of commenters urged the Commission to clarify that any final rule regarding impersonation would not limit any rights and remedies already available to businesses and consumers that have been the subject of impersonation.¹⁴⁴ For example, notwithstanding its support of the Commission's rulemaking to address impersonation, the American Bar Association Section of Intellectual Property Law asserted that many government impersonation scams should be referred to the Department of Justice for criminal prosecution, and therefore, cautioned that any regulatory approach “not dilute the impetus for a criminal law solution.” ¹⁴⁵ Other commenters suggested that the Commission clarify that any final rule is not intended to limit any existing private right of action or civil remedies.¹⁴⁶ Specifically, the Toy Association and INTA both advocated that any final rule on impersonation not be interpreted as limiting the rights and remedies available to trademark owners under the Lanham Act and the Anti-Cybersquatting Consumer Protection Act. INTA further proposed that the Commission issue a clarification that any final rule is intended only to complement—not expand or contract—the legal protections available to private parties under the entire body of federal or state trademark and unfair competition law.¹⁴⁷

By issuing the final rule regarding government and business impersonation, the Commission does not preempt or intend to preempt action in the same area, which is not inconsistent with this final rule, by any federal, state, municipal, or other local government. This final rule does not annul or diminish any rights or remedies provided to consumers or businesses by any federal, state law, municipal ordinance, or other local regulation, insofar as those rights or remedies are equal to or greater than those provided by this final rule.

IV. Final Rule

For the reasons described above, the Commission has determined to adopt the provisions of proposed § 461.1 as initially proposed, and the provisions of §§ 461.2 and 461.3 with clarifying modifications. The Commission declines to finalize proposed § 461.4 at this time.

Specifically, the Commission concludes that the proposed definition of “officer” is sufficient to cover both government and business representatives, and therefore, need not be divided into two separate terms. Further, the final rule includes a definition of “materially”—which has been used in other section 18 rules—to avoid potential confusion or potential perceived conflict with non-commercial speech. For these same reasons, the final rule replaces “unlawful” with “unfair or deceptive act or practice” and adds “materially” and “in or affecting commerce” in §§ 461.2 and 461.3. Such revised language further clarifies that the rule conforms to the well-established standards for deception and unfairness under the FTC Act. Finally, the Commission declines to finalize the proposed § 461.4 provision regarding means and instrumentalities at this time because further analysis and consideration is warranted based on the record, including comments. The Commission is requesting additional public comment on this provision, and on issues related to the impersonation of individuals or entities other than governments and business in interstate commerce, through a SNPRM, published elsewhere in this issue of the Federal Register .

V. Paperwork Reduction Act

The Paperwork Reduction Act (“PRA”), 44 U.S.C. 3501 et seq., requires federal agencies to seek and obtain Office of Management and Budget (“OMB”) approval before undertaking a collection of information directed to ten or more persons. In Question 3 of the NPRM, the Commission asked commenters whether the proposed rule contained a collection of information.¹⁴⁸ No comments responding to the NPRM or Notice of Hearing addressed this question. While the Commission has revised the rule based on the comments it received, it has not added any new requirements that would collect information from the public. Accordingly, the Commission has determined that there are no new requirements for information collection associated with this final rule.

VI. Regulatory Analysis and Regulatory Flexibility Act Requirements

Under section 22 of the FTC Act, the Commission, when it promulgates a final rule, must issue a “final regulatory analysis.” ¹⁴⁹ The required contents of this final regulatory analysis are: (1) “a concise statement of the need for, and the objectives of, the final rule”; (2) “a description of any alternatives to the final rule which were considered by the Commission”; (3) “an analysis of the projected benefits and any adverse economic effects and any other effects of the final rule”; (4) “an explanation of the reasons for the determination of the Commission that the final rule will attain its objectives in a manner consistent with applicable law and the reasons the particular alternative was chosen”; and (5) “a summary of any significant issues raised by the comments submitted during the public comment period in response to the preliminary regulatory analysis, and a summary of the assessment by the Commission of such issues.” ¹⁵⁰ Additionally, the Regulatory Flexibility Act (“RFA”), 5 U.S.C. 601–612, requires an agency to provide a Final Regulatory Flexibility Analysis (“FRFA”) with the final rule, if any, unless the agency certifies that the rule will not have a significant economic impact on a substantial number of small entities.¹⁵¹

The NPRM included an Initial Regulatory Flexibility Analysis (“IRFA”) even though the Commission did not expect that the proposed rule would have a significant economic impact on a substantial number of small entities.¹⁵² The Commission invited public comment on the proposed rule's effect on small entities to ensure that no significant impact would be overlooked.¹⁵³

The FTC does not expect that the final rule will have a significant economic impact on a substantial number of small entities, and this SBP serves as notice to the Small Business Administration of the agency's certification of no significant impact. The final rule imposes no disclosure or recordkeeping requirements. As such, both the burdens imposed on small entities and the economic impact of the final rule are likely to be minimal, if any. Furthermore, as noted in the IRFA, the rule does not change the law regarding the legality of government and business impersonation, which are already prohibited by section 5 of the FTC Act.¹⁵⁴ Although the Commission certifies the final rule would not, if promulgated, have a significant impact on a substantial number of small entities, the Commission has determined, nonetheless, it is appropriate to conduct the following FRFA,¹⁵⁵ which incorporates the Commission's initial findings, as set forth in the NPRM,¹⁵⁶ addresses the required contents of the final regulatory analysis, and describes the steps the Commission has taken in the final rule to minimize its impact on small entities.

A. Concise Statement of the Need for, and Objectives of, the Final Rule

Based upon the record, including public comments, the Commission is implementing the rule to expand the remedies available to it to combat government and business impersonation deception. Throughout this rulemaking proceeding, the Commission has described how the U.S. Supreme Court decision in AMG Cap. Mgmt., LLC v. FTC, 141 S. Ct. 1341, 1352 (2021) overturned how section 13(b) of the FTC Act had historically been understood for 40 years to provide equitable monetary relief, and made it significantly more difficult for the Commission to obtain money for injured consumers.¹⁵⁷ The objective of this final rule is to make available a shorter, faster and more efficient path for recovery of money for injured consumers directly through federal court action in Commission enforcement actions involving impersonation of government or business.¹⁵⁸ Further, the rule would deter illegal impersonation and allow for the imposition of civil penalties, where appropriate.¹⁵⁹

B. Discussion of Significant Alternatives the Commission Considered That Would Accomplish the Stated Objectives of the Final Rule and That Would Minimize Any Significant Economic Impact of the Final Rule on Small Entities

Through the NPRM, the Commission requested public comment on what impact (including costs) will be incurred by existing and future businesses to comply with the proposed rule, and whether the Commission should consider alternative proposals to the proposed rule.¹⁶⁰ This information was requested by the Commission to minimize the final rule's burden on all businesses, including small entities. As explained throughout this SBP, the Commission has considered the comments and alternatives proposed by commenters and finds the final rule will not create a significant economic impact on small entities.¹⁶¹ Indeed, the type of deception that will be unlawful under the final rule is already unlawful under the FTC Act, but the final rule would allow the Commission to obtain monetary relief more efficiently than it could solely under section 19(a)(2) of the FTC Act ( i.e., without a rule violation). Accordingly, the Commission does not propose any specific small entity exemption or other significant alternatives.

C. Summary of Significant Issues Raised by the Public Comments in Response to the Preliminary Regulatory Analysis and IRFA

None of the comments received during the public comment period raised any significant issues in response to the preliminary regulatory analysis required pursuant to section 22 of the FTC Act.¹⁶² In the IRFA, however, the Commission sought comment regarding the impact of the proposed rule and any alternatives the Commission should consider, with a specific focus on the effect of the rule on small entities. In the NPRM, the Commission reiterated this request for comment in Question 4, asking whether the proposed rule, if promulgated, would have a significant impact on a substantial number of small entities. Two commenters that specifically addressed the impact of the proposed rule on small entities stated it would have a beneficial economic impact by reducing the time and financial burden small entities expend on fighting impersonation frauds.¹⁶³ One commenter urged the Commission not to implement a final rule that would require third-party providers of government filing services to include extensive disclosures in their marketing materials, arguing such disclosure requirements could lead to small businesses declining the offered services and falling out of compliance with government filing obligations.¹⁶⁴ This commenter, however, did not identify any proposed disclosure requirements that were the subject of his concern, nor does the Commission impose any such disclosure requirements in connection with the final rule. None of the comments responding to the NPRM or Notice of Hearing disputed the analysis in the IRFA. Finally, the Small Business Administration did not submit comments.

After reviewing the public comments on the proposed rule, as discussed throughout this SBP, the Commission concludes the final rule will not unduly burden small entities. The Commission's explanation in the IRFA regarding the proposed rule is true of the final rule—it only constitutes a significant economic impact for small entities violating existing law, which are not entitled to procedural protections when agencies consider rulemaking.¹⁶⁵

D. Analysis of Projected Benefits and Adverse Effects of the Final Rule

In the NPRM, the Commission invited public comment and data on any benefits and costs of proceeding with the rulemaking to inform a final regulatory analysis.¹⁶⁶ In issuing the final rule, the Commission has carefully considered the comments received and the costs and benefits of each provision. As discussed throughout this SBP, the Commission believes, and the record demonstrates, the final rule would provide several benefits to consumers, businesses, and competition, and help preserve agency resources, without imposing any significant adverse effects.

The Commission's explanation in the IRFA regarding the proposed rule is true of the final rule—it is difficult to quantify with precision what all its benefits may be, but it is helpful to begin with the scope of the problem the final rule would address, and then describe the benefits qualitatively. As discussed in the NPRM, reported consumer losses due to government impersonation topped $445 million in 2021; ¹⁶⁷ and as anticipated, remained large, and even increased substantially, with total consumer losses of $513 million reported in 2022 and more than $483 million for the first ten months of 2023.¹⁶⁸ Similarly, the annual consumer loss reported due to business impersonation has increased from $453 million in 2021 to $670 million in 2022.¹⁶⁹ Accordingly, the most significant anticipated benefit of the final rule is that it will allow the Commission to provide monetary relief to victims of rule violations and seek civil penalties against violators.¹⁷⁰ Furthermore, the final rule should reduce economic harm resulting from impersonation because its potential deterrent effects make it less likely impersonators get to keep their ill-gotten gains and more likely they must pay civil penalties.

The final rule also would provide the benefit of a shorter path to obtaining consumer redress because the Commission could directly pursue in federal court section 19 remedies in government and business impersonation enforcement actions that do not implicate an existing rule. The availability of more immediate consumer redress in federal court under section 19 would allow the Commission to reduce the expense of litigating and minimize the litigation fora and scope. The Commission could then apply the savings of these enforcement resources to investigating and, where the facts warrant, bringing enforcement actions in additional impersonation matters.

The final rule also would benefit businesses whose brands are harmed by impersonators.¹⁷¹ As several commenters have mentioned, a final rule that would allow the Commission to bring enforcement actions more efficiently against impersonators would save businesses the time and other resources dedicated to monitoring and combatting these kinds of deception.

The record is devoid of any evidence suggesting the final rule would cause harm or adversely impact economic conditions.

E. Description and an Estimate of the Number of Small Entities to Which the Final Rule Will Apply, or Explanation Why No Estimate Is Available

Small entities engaging in the impersonation of government and business potentially may be found across a variety of industries and economic sectors, but industry and sector data do not identify entities by such conduct. Accordingly, it is not possible to estimate the number of small entities to which the final rule will apply. However, because the Commission finds the final rule will not impose any recordkeeping or other compliance costs on covered entities, the Commission concludes the final rule will not have a significant impact on a substantial number of small entities, notwithstanding the lack of data on how many small entities will be covered by the final rule.

F. Description of the Projected Reporting, Recordkeeping, and Other Compliance Requirements of the Final Rule, Including an Estimate of the Classes of Small Entities That Will Be Subject to the Requirements of the Final Rule and the Type of Professional Skills That Will Be Necessary To Implement the Final Rule

The final rule does not have any reporting or recordkeeping requirements.¹⁷² As explained previously, the final rule would apply to no small entities other than small entities violating existing law, and therefore, no classes of small entities will be subject to the requirements of the final rule. Finally, no professional skills are necessary for compliance with the final rule other than honesty and integrity.

G. An Explanation of the Reasons for the Determination of the Commission That the Final Rule Will Attain Its Objectives in a Manner Consistent With Applicable Law and the Reasons the Particular Alternative Was Chosen

The Commission's primary objective in commencing this rulemaking was to expand the remedies available to it in combatting two prevalent categories of impersonation scams most frequently reported by consumers—government impersonators and business impersonators. As explained throughout this SBP, based upon the record, including public comments, the Commission finds the final rule will attain this objective in a manner consistent with applicable law.

The final rule is straightforward and defines with specificity acts or practices that are unfair or deceptive in or affecting commerce within the meaning of section 5(a)(1) of the FTC Act, 15 U.S.C. 45(a)(1). It also avoids novelty by borrowing from existing rules and statutory definitions.¹⁷³ At the same time, the final rule is drafted with sufficient flexibility to address the various types of conduct covered by the prohibition on the impersonation of government and businesses. Furthermore, this rulemaking has provided ample transparency and opportunity for public participation in accordance with the underlying statutory requirements of section 18 of the FTC Act, 15 U.S.C. 57a, the Administrative Procedure Act, and Part 1, subpart B of the Commission's Rules of Practice.¹⁷⁴

VII. Congressional Review Act

Pursuant to the Congressional Review Act (5 U.S.C. 801 et seq.), the Office of Information and Regulatory Affairs has designated this rule as not a “major rule,” as defined by 5 U.S.C. 804(2).

Endnotes

¹ Fed. Trade Comm'n, Advance Notice of Proposed Rulemaking: Trade Regulation Rule on Impersonation of Government and Businesses, 86 FR 72901 (Dec. 23, 2021), https://www.federalregister.gov/documents/2021/12/23/2021-27731/trade-regulation-rule-on-impersonation-of-government-and-businesses.

² See id. at 72904.

³ Those included, among others, numerous reports of government impersonation scams reported to federal agencies as reflected in the following public announcements. On March 7, 2022, the Federal Bureau of Investigation issued a Public Service Announcement “warning the public of ongoing widespread fraud schemes in which scammers impersonate law enforcement or government officials in attempts to extort money or steal personally identifiable information.” Similarly, on May 20, 2022, multiple federal law enforcement agencies issued a scam alert spearheaded by the Social Security Administration's Office of the Inspector General warning the public of government impersonation scams involving the reproduction of federal law enforcement credentials and badges. On June 3, 2022, the Commission issued a press release noting that in some impersonation scams, fraudsters have instructed consumers to convert cash into cryptocurrency under false threats of government investigations or fraud. See Fed. Trade Comm'n, Notice of Proposed Rulemaking: Trade Regulation Rule on Impersonation of Government and Businesses, 87 FR 62741, 62742 (Oct. 17, 2022), https://www.federalregister.gov/documents/2022/10/17/2022-21289/trade-regulation-rule-onimpersonation-of-government-and-businesses.

⁴ See id. at 62741–51.

⁵ See id. at 62741–42.

⁶ Id. at 62750.

⁷ See Fed. Trade Comm'n, Trade Regulation Rule on Impersonation of Government and Businesses, https://www.regulations.gov/docket/FTC-2022-0064/ comments.

⁸ Cindy L. Brown and Raye Mitchell, Cmt. on NPRM at 9 (Dec. 19, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0077 (“Brown Cmt.”); William MacLeod, Cmt. on NPRM at 2 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0078 (“MacLeod Cmt.”).

⁹ Fed. Trade Comm'n, Initial Notice of Informal Hearing: Trade Regulation Rule on Impersonation of Government and Businesses, 88 FR 19024 (Mar. 30, 2023), https://www.federalregister.gov/documents/2023/03/30/2023-06537/trade-regulation-rule-on-impersonation-of-government-and-businesses. This Initial Notice of Informal Hearing also served as the Final Notice of Informal Hearing. The Commission determined William MacLeod's comment in response to the NPRM represented an “adequate request” for such an informal hearing. The comment from Cindy Brown explicitly requesting to make a presentation at an informal hearing also represented an “adequate request” triggering the Commission's obligation to hold an informal hearing but was inadvertently omitted from inclusion in the Initial Notice of Informal Hearing.

¹⁰ Because this informal hearing was the first held in several decades, the Commission allowed interested parties to request the opportunity to make an oral comment in response to the Notice of Informal Hearing as well as the NPRM. However, the Commission noted that in the future it may limit oral statements to those who requested to make an oral statement in response to the NPRM, as provided for in the Rules of Practice. Id. at 19025 n.24.

¹¹ Although Cindy Brown did not submit a request to make an oral statement in response to the Notice of Hearing, she was permitted to make an oral statement at the hearing based upon her prior comment in response to the NPRM in which she explicitly stated her interest “in making a presentation at an informal hearing.”

¹² The Notice of Informal Public Hearing comments addressing specific provisions of the rule or questions in the NPRM soliciting public comment are discussed in Section III within the substantive discussions on the relevant provisions.

¹³ 5 U.S.C. 551 et seq.; 16 CFR 1.7–1.20.

¹⁴ Rules of Practice, 16 CFR 1.14(a)(1)(i)–(iii). In addition, in accordance with 16 CFR 1.14(a)(2), the regulatory analysis is provided in Section VI of this SBP.

¹⁵ ANPR, 86 FR at 72901; see also Fed. Trade Comm'n, Explore Government Imposter Scams, TABLEAU PUBLIC, https://public.tableau.com/app/profile/federal.trade.commission/viz/GovernmentImposter/Infographic.

¹⁶ NPRM, 87 FR at 62742.

¹⁷ Id. at 62742–46.

¹⁸ In re Cliffdale Assocs., Inc., 103 F.T.C. 110, 174 (1984); see also In re POM Wonderful LLC, No. 9344, 2013 WL 268926, at *18 (Jan. 16, 2013).

¹⁹ ANPR, 86 FR at 72901.

²⁰ NPRM, 87 FR at 62746–47.

²¹ ANPR, 86 FR at 72903–04; see also NPRM, 87 FR at 62748–49.

²² See AMG Cap. Mgmt., LLC v. FTC, 141 S. Ct. 1341, 1352 (2021).

²³ See15 U.S.C. 57b(a) and (b); see also NPRM, 87 FR at 62746 (discussing AMG Cap. Mgmt.).

²⁴ The Commission can recover money for consumers directly through a federal court action or obtain civil penalties directly from a federal court when the Rule has been violated. Without the Rule, the path to monetary relief is longer, and requires the Commission to first issue a final cease-and-desist order—which might not become final until after the resolution of any resulting appeal. Then, to recover money for consumers, the Commission must prove that the violator engaged in fraudulent or dishonest conduct in a second action in federal court. See15 U.S.C. 57b(a) and (b).

²⁵ See section 5(m)(1)(A) of the FTC Act, 15 U.S.C. 45(m)(1)(A) (providing that violators of a trade regulation rule “with actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule” are liable for civil penalties for each violation). In addition, any entity or person who violates such a rule (irrespective of the state of knowledge) is liable for injury caused to consumers by the rule violation. The Commission may pursue such recovery in a suit for consumer redress under section 19 of the FTC Act, 15 U.S.C. 57b.

²⁶ NPRM, 87 FR at 62749.

²⁷ Id.

²⁸ https://www.regulations.gov/document/FTC-2021-0077-0001/comment.

²⁹ https://www.regulations.gov/docket/FTC-2023-0030/comments.

³⁰ NPRM, 87 FR at 62750.

³¹ Id.

³² Id., Question 3 (Does the proposed rule contain a collection of information?) and Question 4 (Would the proposed rule, if promulgated, have a significant economic impact on a substantial number of small entities? If so, how could it be modified to avoid a significant economic impact on a substantial number of small entities?)

³³ NPRM, 87 FR at 62750.

³⁴ See, e.g., Anonymous, Cmt. on NPRM (Nov. 3, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0011 (describing impersonation of accounts payable in medical device industry); Bernadette Padilla, Cmt. on NPRM (Nov. 8, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0014 (describing police impersonation scam involving stolen PII); Anonymous Meeting Planner, Cmt. on NPRM (Dec. 6, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0030 (describing attendee list and hotel reservation impersonation scams); California IT in Education, Cmt. on NPRM (Nov. 9, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0034 (describing attendee list impersonation scam); Illinois Landscape Contractors Association, Cmt. on NPRM (Dec. 12, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0038 (describing attendee list and hotel reservation impersonation scams).

³⁵ See e.g., Salina Maddox, Cmt. on NPRM (Oct. 22, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0003 (spam calls); Tatiana Alvarez, Cmt. on NPRM (Nov. 22, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0008 (Romanian mob scam); Tinee Carraker, Cmt. on NPRM (Nov. 4, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0012 (foreclosure scam); Susan Rounsley, Cmt. on NPRM (Nov. 6, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0013 (violations of Do Not Call requirements).

³⁶ See, e.g., Suhkvir Singh/Rutgers Law School Students, Cmt. on NPRM (Nov. 22, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0019 (“Rutgers Law Students/Singh Cmt.”); AIM, the European Brands Association, Cmt. on NPRM (Dec. 13, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0041 (“AIM Cmt.”); The Messaging Malware Mobile Anti-Abuse Working Group, Cmt. on NPRM (Dec. 15, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0051 (“M3AAWG Cmt.”); The International Trademark Association, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0054 (“INTA Cmt.”); Electronic Privacy Information Center, National Consumer Law Center, National Consumers League, Consumer Action, Consumer Federation of America, National Association of Consumer Advocates, and U.S. PIRG, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0070 (“EPIC Cmt.”); Recording Industry Association of America, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0064 (“RIAA Cmt.”).

³⁷ United States Patent and Trademark Office, Cmt. on NPRM at 2–3 (Dec. 2, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0026 (“USPTO Cmt.”); INTA Cmt. on NPRM; United States Copyright Office, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0067 (“USCO Cmt.”); The Toy Association, Inc., Cmt. on NPRM at 2 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0069 (“Toy Cmt.”); Cellular Telecommunications and Internet Association, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0066 (“CTIA Cmt.”); Marine Retailers Association of the Americas, National Marine Manufacturers Association, National RV Dealers Association, Cmt. on NPRM (Dec. 19, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0076 (“MRAA Cmt.”).

³⁸ See, e.g., USPTO Cmt. on NPRM at 2–3; USCO Cmt. on NPRM at 2; Toy Cmt. on NPRM at 2; CTIA Cmt. on NPRM at 3; MRAA Cmt. on NPRM at 4. See also supra, note 25.

³⁹ USPTO Cmt. on NPRM at 2–3.

⁴⁰ MRAA Cmt. on NPRM at 4.

⁴¹ USCO Cmt. on NPRM at 2–3.

⁴² Id.; USPTO Cmt. on NPRM at 2.

⁴³ CTIA Cmt. on NPRM at 5, 7.

⁴⁴ Somos, Inc., Cmt. on NPRM at 2–3 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0068 (“Somos Cmt.”).

⁴⁵ In explaining the scope of the proposed rule, the NPRM provided an illustrative, but non-exhaustive, list of unlawful conduct that would be covered by the prohibitions against impersonating government and businesses. NPRM, 87 FR at 62746–47. That list merely provides examples as it would be impracticable to list all possible violative conduct.

⁴⁶ 16 CFR 310.4(a)(8).

⁴⁷ USTelecom Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 3–4; RIAA Cmt. on NPRM at 3; Anti-Phishing Working Group, Cmt. on NPRM at 1–2 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0073 (“APWG Cmt.”), https://www.regulations.gov/comment/FTC-2022-0064-0073 (“APWG Cmt.”); Coalition for Online Accountability, Cmt. on NPRM at 1–3 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0074 (“COA Cmt.”); INTA Cmt. on NPRM at 8–10; Coalition for a Secure & Transparent Internet, Cmt. on NPRM at 1 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0065 (“CSTI Cmt.”).

⁴⁸ Id.

⁴⁹ M3AAWG Cmt. on NPRM at 3–4; RIAA Cmt. on NPRM at 3–4; AIM Cmt. on NPRM at 1; COA Cmt. on NPRM at 1–3; INTA Cmt. on NPRM at 8–10.

⁵⁰ COA Cmt. on NPRM at 2.

⁵¹ M3AAWG Cmt. on NPRM at 3–4; APWG Cmt. on NPRM at 1–2; see also APWG, Cmt. on Informal Hearing at 1–2 (Apr. 14, 2023), https://www.regulations.gov/comment/FTC-2023-0030-0027 (“APWG IH Cmt.”).

⁵² See NPRM, 87 FR at 62746–47. The example of voice cloning—a relatively new technology—emphasizes the need for an illustrative, but non-exhaustive, list of unlawful conduct. Audio deepfakes, including voice cloning, are generated, edited, or synthesized by artificial intelligence, or “AI,” to create fake audio that seems real. See Khanjani, et. al., How Deep are the Fakes? Focusing on Audio Deepfake: A Survey, available at https://arxiv.org/ftp/arxiv/papers/2111/2111.14203.pdf.

⁵³ Americans for Prosperity Foundation, Cmt. on NPRM at 1–2 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0062 (“AFPF Cmt.”).

⁵⁴ Id. at 1.

⁵⁵ Public Law 93–637, 88 Stat. 2183 (1975).

⁵⁶ ANPR, 86 FR at 72904.

⁵⁷ Id.

⁵⁸ NPRM, 87 FR at 62750, Question 2.

⁵⁹ USPTO Cmt. on NPRM at 3–9; M3AAWG Cmt. on NPRM at 6–9; INTA Cmt. on NPRM at 3–5; Toy Cmt. on NPRM at 3–5; USCO Cmt. on NPRM at 3–7; MRAA Cmt. on NPRM at 2–4.

⁶⁰ USPTO Cmt. on NPRM at 3–9; M3AAWG Cmt. on NPRM at 6–9; INTA Cmt. on NPRM at 3–5; Toy Cmt. on NPRM at 3–5; USCO Cmt. on NPRM at 3–7; MRAA Cmt. on NPRM at 2–4.

⁶¹ Toy Cmt. on NPRM at 3–5.

⁶² USPTO Cmt. on NPRM at 3–9; USCO Cmt. on NPRM at 3–4;

⁶³ INTA Cmt. on NPRM at 3; M3AAWG Cmt. on NPRM at 7.

⁶⁴ M3AAWG Cmt. on NPRM at 9.

⁶⁵ Id.

⁶⁶ Id.

⁶⁷ NPRM, 87 FR at 62750, Question 5.

⁶⁸ USCO Cmt. on NPRM at 8; USPTO Cmt. on NPRM at 10; INTA Cmt. on NPRM at 6–7; M3AAWG Cmt. on NPRM at 9; MacLeod Cmt. on NPRM at 1–2; AFPF Cmt. on NPRM at 3–6.

⁶⁹ NetChoice Cmt. on NPRM at 2; Toy Cmt. on NPRM at 2; ZoomInfo Technologies LLC, Cmt. on NPRM at 1–2 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0079 (“Zoom NPRM Cmt.”).

⁷⁰ USCO Cmt. on NPRM at 8; USPTO Cmt. on NPRM at 10.

⁷¹ USCO Cmt. on NPRM at 8.

⁷² USPTO Cmt. on NPRM at 10.

⁷³ Id. at 9–10.

⁷⁴ MacLeod Cmt. on NPRM at 2; AFPF Cmt. on NPRM at 3; M3AAWG Cmt. on NPRM at 9.

⁷⁵ M3AAWG Cmt. on NPRM at 2; NetChoice Cmt. on NPRM at 2; Toy Cmt. on NPRM at 2; AFPF Cmt. on NPRM at 2, 4; Zoom Cmt. on NPRM at 1; INTA Cmt. on NPRM at 5–6; William MacLeod, Cmt. on Informal Hearing at 5–7 (Apr. 14, 2023), https://www.regulations.gov/comment/FTC-2023-0030-0019 (“MacLeod IH Cmt.”).

⁷⁶ AFPF Cmt. on NPRM at 2, 4; see also MacLeod IH Cmt. at 2.

⁷⁷ AFPF Cmt. on NPRM at 3, 4. M3AAWG Cmt. on NPRM at 2; NetChoice Cmt. on NPRM at 2; INTA Cmt. on NPRM at 5–6; Toy Cmt. on NPRM at 2; Zoom Cmt. on NPRM at 1; MacLeod IH Cmt. at 5–7.

⁷⁸ AFPF Cmt. on NPRM at 2, 6.

⁷⁹ NetChoice Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 3.

⁸⁰ AFPF Cmt. on NPRM at 4; INTA Cmt. on NPRM at 5–6; Toy Cmt. on NPRM at 2; Zoom Cmt. on NPRM at 1; MacLeod IH Cmt. at 5.

⁸¹ MacLeod IH Cmt. at 1; see also MacLeod Cmt. on NPRM at 1.

⁸² MacLeod IH Cmt. at 2.

⁸³ Id. at 3.

⁸⁴ Id. at 3.

⁸⁵ AFPF Cmt. on NPRM at 3–4.

⁸⁶ Id. at 3, 5–6.

⁸⁷ M3AAWG Cmt. on NPRM at 9.

⁸⁸ Id. at 1, 5.

⁸⁹ AFPF Cmt. on NPRM at 5.

⁹⁰ See15 U.S.C. 45(m)(1)(A).

⁹¹ See Cent. Hudson Gas & Elec. Corp. v. Pub. Serv. Comm'n of N.Y., 447 U.S. 557, 563–64 (1980) (“[T]here can be no constitutional objection to the suppression of commercial messages that do not accurately inform the public about lawful activity. The government may ban forms of communication more likely to deceive the public than to inform it, or commercial speech related to illegal activity.”) (citations omitted); see also Zauderer v. Office of Disciplinary Counsel, 471 U.S. 626, 638 (1985) (holding it is “well settled” that “[t]he States and the Federal Government are free to prevent the dissemination of commercial speech that is false, deceptive, or misleading”).

⁹² USPTO Cmt. on NPRM; Anonymous, Cmt. on NPRM (Dec. 9, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0033 (“0033 Cmt.”); AIM Cmt. on NPRM; Erik M. Pelton & Associates, PLLC, Cmt. on NPRM (Dec. 14, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0045; NetChoice Cmt. on NPRM; M3AAWG Cmt. on NPRM; Consumer Technology Association, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0073 (“CTA Cmt.”); NCTA—The internet and Television Association, Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0071 (“NCTA Cmt.”); ASAE Cmt. on NPRM; INTA Cmt. on NPRM; Somos Cmt. on NPRM; CTIA Cmt. on NPRM; USCO Cmt. on NPRM; USTelecom Cmt. on NPRM; American Society of Association Executives, Center for Exhibition Industry Research Destinations International, Exhibition Services & Contractors Association, Exhibitions & Conferences Alliance, Experiential Designers + Producers Association, International Association of Exhibitions & Events, International Association of Venue Managers, PCMA, Society of Independent Show Organizers, UFI, Cmt. on NPRM (Dec 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0060 (“ECA Cmt.”); RIAA Cmt. on NPRM; American Bar Association Section of Intellectual Property Law, Cmt. on NPRM at 3 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0061 (“ABA–IPL Cmt.”); AFPF Cmt. on NPRM; Zoom Cmt. on NPRM; American Bankers Association, ACA International, American Association of Healthcare Administrative Management, Credit Union National Association, Mortgage Bankers Association National Association of Federally-Insured Credit Unions (the Associations), Cmt. on NPRM (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0080 (“Assocns. Cmt.”); COA Cmt. on NPRM; MacLeod Cmt. on NPRM; Brown Cmt. on NPRM.

⁹³ A copy of the transcript of the May 4, 2023 Informal Hearing is available at https://www.ftc.gov/system/files/ftc_gov/pdf/impersonationruleinformalhearingtranscript.pdf. References to the transcript from the May 4, 2023 Informal Hearing are cited herein as: Name of commenter, May 2023 Tr at page no. ( e.g., Doe, May 2023 Tr at #); see CTA, May 2023 Tr at 16; MacLeod, May 2023 Tr at 27; USTelecom, May 2023 Tr at 30; Chilson, May 2023 Tr at 34; VON, May 2023 Tr at 36; American Bankers Association (ABA), May 2023 Tr at 39–40; INCOMPAS, May 2023 Tr at 42, 44; NCTA, May 2023 Tr at 51–52.

⁹⁴ USPTO Cmt. on NPRM at 10; USCO Cmt. on NPRM at 8; RIAA Cmt. on NPRM at 3; ABA, May 2023 Tr at 39–40.

⁹⁵ USPTO Cmt. on NPRM at 10; USCO Cmt. on NPRM at 8; RIAA Cmt. on NPRM at 3; ABA, May 2023 Tr at 39–40.

⁹⁶ AFPF Cmt. on NPRM at 3–5; MacLeod IH Cmt. at 6–7; McLeod, May 2023 Tr at 27.

⁹⁷ 0033 Cmt. on NPRM; ABA–IPL Cmt. on NPRM at 2; Zoom Cmt. on NPRM at 1.

⁹⁸ ABA–IPL Cmt. on NPRM at 1–2; NetChoice Cmt. on NPRM at 2; USTelecom Cmt. on NPRM at 2; see also CTA, May 2023 Tr at 16; VON, May 2023 Tr at 36; ABA, May 2023 Tr at 39–40; INCOMPAS, May 2023 Tr at 42.

⁹⁹ NetChoice Cmt. on NPRM at 2; CTA Cmt. on NPRM; American Society of Association Executives, Cmt. on NPRM at 1 (Dec. 16, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0057 (“ASAE Cmt.”); INTA Cmt. on NPRM; Somos Cmt. on NPRM; CTIA Cmt. on NPRM at 7; USTelecom Cmt. on NPRM at 2; ECA Cmt. on NPRM at 3; ABA–IPL Cmt. on NPRM at 3; Zoom Cmt. on NPRM at 2; Cmt. on NPRM at 3; see also CTA, May 2023 Tr at 16; MacLeod, May 2023 Tr at 27; USTelecom, May 2023 Tr at 30; Chilson, May 2023 Tr at 34; VON, May 2023 Tr at 36; INCOMPAS, May 2023 Tr at 42, 44; NCTA, May 2023 Tr at 51–52.

¹⁰⁰ CTA Cmt. on NPRM at 7.

¹⁰¹ USTelecom Cmt. on NPRM at 2.

¹⁰² ABA–IPL Cmt. on NPRM at 3.

¹⁰³ NCTA Cmt. on NPRM at 2.

¹⁰⁴ M3AAWG Cmt. on NPRM at 10.

¹⁰⁵ Brown Cmt. on NPRM at 8.

¹⁰⁶ M3AAWG Cmt. on NPRM at 3.

¹⁰⁷ COA Cmt. on NPRM at 3; M3AAWG Cmt. on NPRM at 4–5. “WHOIS data” is a commonly used internet record listing that identifies who owns a domain and how to get in contact with them.

¹⁰⁸ See, e.g., Compl. at 3–5 & Ex. H, FTC v. Moore, No. 5:18–cv–01960 (C.D. Cal. filed Sept. 13, 2018) (alleging that a seller of variety of fake but genuine-looking financial documents provided to others the means and instrumentalities with which to make misrepresentations regarding a person's identity).

¹⁰⁹ NPRM, 87 FR at 62746.

¹¹⁰ Id. at 62751; see also15 U.S.C. 44.

¹¹¹ NPRM, 87 FR at 62747.

¹¹² Id. at 62750.

¹¹³ Minnesota Nursery & Landscape Association, Cmt. on NPRM at 2 (Dec. 2, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0027; Louise Nemmers, Cmt. on NPRM (Dec. 5, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0028; California Landscape Contractors Association, Cmt. on NPRM (Dec. 6, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0029; Outdoor Power Equipment Institute, Cmt. on NPRM at 2 (Dec. 7, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0032; AIM Cmt. on NPRM at 2; AARP, Cmt. on NPRM (Dec. 14, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0043 (“AARP Cmt.”); Minnesota Municipal Utilities Association, Cmt. on NPRM (Dec. 14, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0048; M3AAWG Cmt. on NPRM at 10; CTA Cmt. on NPRM; ASAE Cmt. on NPRM; INTA Cmt. on NPRM; Toy Cmt. on NPRM at 6; RIAA Cmt. on NPRM at 2; National Association of Broadcasters, Cmt. on NPRM (Dec. 19, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0075; MRAA Cmt. on NPRM at 4.

¹¹⁴ See, e.g., Toy Cmt. on NPRM at 6; MRAA Cmt. on NPRM at 4; AARP Cmt. at 2; CTA Cmt. on NPRM at 1; ASAE Cmt. on NPRM; RIAA Cmt. on NPRM at 1; INTA Cmt. on NPRM at 2.

¹¹⁵ AIM Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 10; CTA Cmt. on NPRM at 1.

¹¹⁶ Toy Cmt. on NPRM at 6; INTA Cmt. on NPRM at 6.

¹¹⁷ Toy Cmt. on NPRM at 6; RIAA Cmt. on NPRM at 3.

¹¹⁸ INTA Cmt. on NPRM at 6; Toy Cmt. on NPRM at 6.

¹¹⁹ NPRM, 87 FR at 62750.

¹²⁰ Rutgers Law Students/Singh Cmt. on NPRM; AIM Cmt. on NPRM; AARP Cmt. on NPRM; NCTA Cmt. on NPRM; EPIC Cmt. on NPRM; RIAA Cmt. on NPRM.

¹²¹ AIM Cmt. on NPRM at 2; Rutgers Law Students/Singh Cmt. on NPRM at 1.

¹²² Rutgers Law Students/Singh Cmt. on NPRM at 1–2; AARP Cmt. on NPRM at 2; EPIC Cmt. on NPRM at 5.

¹²³ Rutgers Law Students/Singh Cmt. on NPRM at 1–2.

¹²⁴ Rutgers Law Students/Singh Cmt. on NPRM at 2–4; AARP Cmt. on NPRM at 1–2; EPIC Cmt. on NPRM at 4–5.

¹²⁵ AARP Cmt. on NPRM at 2.

¹²⁶ EPIC Cmt. on NPRM at 5.

¹²⁷ NCTA Cmt. on NPRM at 3, 8.

¹²⁸ Id.

¹²⁹ RIAA Cmt. on NPRM at 3.

¹³⁰ Id. at 2.

¹³¹ Rutgers Law Students/Singh Cmt. on NPRM at 2.

¹³² Id.

¹³³ Id. at 3.

¹³⁴ Id.

¹³⁵ Id. at 3–4.

¹³⁶ Id.; NCTA Cmt. on NPRM at 8, n. 16.

¹³⁷ The Commission also is exploring other tools to address the fake endorsement concerns raised by the RIAA and Rutgers Law School Students. Specifically, in the Commission's proposed Rule on the Use of Consumer Reviews and Testimonials, § 465.2 would prohibit businesses from purchasing a consumer review, or from disseminating or causing the dissemination of a consumer testimonial or celebrity testimonial when the business knew or should have known it was false or fake. See Fed. Trade Comm'n, Notice of Proposed Rulemaking: Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 88 FR 49364, 49391 (Jul. 31, 2023), https://www.federalregister.gov/documents/2023/07/31/2023-15581/trade-regulation-rule-on-the-use-of-consumer-reviews-and-testimonials#sectno-reference-465.2.

¹³⁸ USTelecom Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 3–4; RIAA Cmt. on NPRM at 3; APWG Cmt. on NPRM; COA Cmt. on NPRM at 1–3; INTA Cmt. on NPRM at 8–10; CSTI Cmt. on NPRM at 1.

¹³⁹ Id.

¹⁴⁰ M3AAWG Cmt. on NPRM at 3–4; RIAA Cmt. on NPRM at 3–4; AIM Cmt. on NPRM at 1; COA Cmt. on NPRM at 1–3; INTA Cmt. on NPRM at 8–10.

¹⁴¹ COA Cmt. on NPRM at 2.

¹⁴² M3AAWG Cmt. on NPRM at 3–4; APWG Cmt. on NPRM at 1–2; see also APWG, Cmt. on Informal Hearing at 1–2 (Apr. 14, 2023), https://www.regulations.gov/comment/FTC-2023-0030-0027 (“APWG IH Cmt.”).

¹⁴³ See also supra, note 52.

¹⁴⁴ Toy Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 2; ABA–IPL Cmt. on NPRM at 3; INTA Cmt. on NPRM at 2.

¹⁴⁵ ABA–IPL Cmt. on NPRM at 3.

¹⁴⁶ Toy Cmt. on NPRM at 2; M3AAWG Cmt. on NPRM at 2; INTA Cmt. on NPRM at 2.

¹⁴⁷ INTA Cmt. on NPRM at 6–7.

¹⁴⁸ NPRM, 87 FR at 62750.

¹⁴⁹ See15 U.S.C. 57b–3(b)(2).

¹⁵⁰ 15 U.S.C. 57b–3(b)(2)(A).

¹⁵¹ See5 U.S.C. 603–605; see also section 22(b) of the FTC Act, 15 U.S.C. 57b–3(b).

¹⁵² NPRM, 87 FR at 62749–50; see also5 U.S.C. 603.

¹⁵³ NPRM, 87 FR at 62750.

¹⁵⁴ NPRM, 87 FR at 62749.

¹⁵⁵ See15 U.S.C. 57b–3(b)(3)(A)(ii) (“In order to avoid duplication or waste, the Commission is authorized to . . . whenever appropriate, incorporate any data or analysis contained in a regulatory analysis issued under this subsection in the statement of basis and purpose.”).

¹⁵⁶ NPRM, 87 FR at 62749–50.

¹⁵⁷ See ANPR, 86 FR at 72901 & n.24 (discussing AMG Cap. Mgmt.); NPRM, 87 FR at 62746 (same).

¹⁵⁸ See ANPR, 86 FR at 72901 & n.24; NPRM, 87 FR at 62746; see also15 U.S.C. 57b(a) and (b).

¹⁵⁹ See15 U.S.C. 45(m)(1)(A).

¹⁶⁰ NPRM, 87 FR at 62750.

¹⁶¹ Only one commenter suggested an alternative to regulation, which the Commission declines to adopt for the reasons previously stated in Section III.B.

¹⁶² See supra note 161.

¹⁶³ Toy Cmt. on NPRM at 5–6; MRAA Cmt. on NPRM at 4.

¹⁶⁴ Robert Kamerschen, Cmt. on NPRM at 2 (Nov. 30, 2022), https://www.regulations.gov/comment/FTC-2022-0064-0023.

¹⁶⁵ See NPRM, 87 FR at 62750.

¹⁶⁶ NPRM, 87 FR at 62748.

¹⁶⁷ Id.

¹⁶⁸ See Fed. Trade Comm'n, Explore Government Imposter Scams, TABLEAU PUBLIC, https://public.tableau.com/app/profile/federal.trade.commission/viz/FraudReports/SubcategoriesOverTime (last visited December 21, 2023).

¹⁶⁹ Id.

¹⁷⁰ See 15 U.S.C. Secs. 45(m)(1)(A) and 57b.

¹⁷¹ See Toy Cmt. on NPRM at 5–6; MRAA Cmt. on NPRM at 4; see also NPRM, 87 FR at 62749.

¹⁷² NPRM, 87 FR at 62750.

¹⁷³ See, e.g., TSR, 16 CFR 310.3(a)(2)(vii); R-Value Rule, 16 CFR 460.21; Regulation O (Mortgage Assistance Relief Services), 12 CFR 1015.3(b)(3).

¹⁷⁴ 5 U.S.C. 551 et seq.; 16 CFR 1.7 through 1.20.

List of Subjects in 16 CFR Part 461

• Consumer protection
• Impersonation
• Trade Practices

For the reasons set forth above, the Federal Trade Commission amends 16 CFR Chapter I by adding part 461 to read as follows:

PART 461—RULE ON IMPERSONATION OF GOVERNMENT AND BUSINESSES

Note:

The following statement will not appear in the Code of Federal Regulations.

Statement of Chair Lina M. Khan Joined by Commissioner Rebecca Kelly Slaughter and Commissioner Alvaro M. Bedoya

Today the Federal Trade Commission finalizes its rule prohibiting government and business impersonation schemes and issues a supplemental notice of proposed rulemaking to extend this prohibition to impersonation of individuals. This final rule marks the first time since 1980 that the Commission has finalized a brand-new trade regulation rule prohibiting an unfair or deceptive practice.

Impersonation schemes cheat Americans out of billions of dollars every year. Fraudsters pretending to represent government agencies—like the Social Security Administration or the IRS—tell targets that if they do not hand over money or their sensitive personal information, then they could lose a government benefit, face a tax liability, or even be arrested. Scammers also commonly claim false affiliations with household brand names to bilk consumers for bogus services. This category of fraud skyrocketed during the coronavirus pandemic—with imposters scamming Americans out of reported $2 billion between October 2020 and September 2021, an 85 percent increase year-over-year. Losses remain high: FTC data show that in 2023 consumers reported losing $2.7 billion to reported imposter scams. Impersonation fraud has remained one of the largest sources of total reported consumer financial losses for several years.

Public comments submitted to the Commission provide a snapshot of how impersonation frauds can devastate:

• One commenter reported on how a friend was scammed by someone claiming that they were with Publisher's Clearing House and that she had won a sweepstakes. Her friend was scammed out of a total of $367,000: “She used all of her savings . . . to help her grandchildren go to college and wiped out her IRA and now is left to pay the penalties for depleting it. This woman is now, at age 70, in a position of living only on her social security and has to try to find work. . . .”

• Another commenter received a call from someone claiming to be with the U.S. Treasury Department, who asserted that her social security number had been compromised. This person lost all her money: “That money is from my mother's life insurance policy who passed in 2019. My father needs that money to survive. I am devastated.”

• A third commenter spoke of her mother being scammed by someone pretending to be with a government agency: “Before we, her family, realized the extent to which the imposters preyed upon her, she had divulged identity and banking information.”

The rise of generative AI technologies risks making these problems worse by turbocharging scammers' ability to defraud the public in new, more personalized ways. For example, the proliferation of AI chatbots gives scammers the ability to generate spear-phishing emails using individuals' social media posts and to instruct bots to use words and phrases targeted at specific groups and communities. AI-enabled voice cloning fraud is also on the rise, where scammers use voice-cloning tools to impersonate the voice of a loved one seeking money in distress or a celebrity peddling fake goods. Scammers can use these technologies to disseminate fraud more cheaply, more precisely, and on a much wider scale than ever before.

In its supplemental NPRM, the Commission proposes to expand the rule's prohibitions to also cover impersonation of individuals. If adopted, this additional protection will equip enforcers to seek civil penalties and redress when fraudsters impersonate individual people, not just government or business entities. Given the proliferation of AI-enabled fraud, this additional protection seems especially critical. Notably, the supplemental proposal also recommends extending liability to any actor that provides the “means and instrumentalities” to commit an impersonation scam. Under this approach, liability would apply, for example, to a developer who knew or should have known that their AI software tool designed to generate deepfakes of IRS officials would be used by scammers to deceive people about whether they paid their taxes. Ensuring that the upstream actors best positioned to halt unlawful use of their tools are not shielded from liability will help align responsibility with capability and control.

By unlocking civil penalties and redress, the final rule, along with the proposed supplemental provisions, will promote both more efficient enforcement and greater deterrence. In 2020, the Supreme Court held that the Commission cannot rely on Section 13(b) of the FTC Act to get money back to defrauded consumers, so rulemakings—while not a substitute for a legislative fix—can help ensure that lawbreakers do not profit from their lawbreaking and that wronged consumers can be made whole.

This rule marks the agency's first brand-new Section 18 rulemaking since 1980. Although the authority to issue rules is clearly laid out in the FTC Act, bureaucratic red tape presented an obstacle to the agency's exercise of this important statutory authority. Thanks to efforts initiated under Commissioner Slaughter's leadership to align the procedural requirements for Section 18 rulemaking with the FTC Act's statutory text, Section 18 rulemakings can now proceed more efficiently. This effort took two years from proposal to final rule, finally putting lie to the old idea that this must be an impossibly long process.

Many thanks to the FTC team for their swift work and dedication. This rule banning government and business impersonation will allow us to more vigorously and effectively protect Americans from fraudsters. And we are eager for public input on the supplemental NPRM that would extend this rule to cover impersonation of individuals. With the rapid rise of voice cloning fraud and other AI-based scams, additional protection for consumers seems especially critical. As these technologies enable more sophisticated and innovative forms of fraud, we will continue to ensure the Commission is activating all the tools Congress has given us and faithfully executing on our statutory mandate.