A guide for DTC brands, agencies, and performance teams running UGC and paid social in 2026.

If you’re running paid social on Meta, TikTok, or YouTube right now, the legal ground underneath your ad creative is shifting fast. There’s no federal US AI regulations on the books. Instead, brands and agencies face a growing patchwork of state-level rules and federal enforcement actions, each with its own definitions, penalties, and timelines.

New York’s synthetic performer disclosure rule has applied since June 9. California’s AI Transparency Act took effect on August 2, and on September 16 Governor Newsom signed a second synthetic performer law that starts on January 1, 2027. Tennessee already treats unauthorized AI voice cloning as a crime. And the FTC keeps using the powers it already has against deceptive AI claims and fake reviews.

To make this concrete: if you’re a supplements brand running Meta ads with AI-generated testimonials, you’re now exposed on multiple fronts at once. The FTC’s fake reviews ban, New York’s synthetic performer disclosure, and potentially Tennessee’s voice-likeness rules all apply to different aspects of the same campaign. And they each come with different penalties, different timelines, and different enforcement bodies.

Is AI UGC legal in the US? Yes. No US law bans AI-generated UGC ads. But New York (now) and California (from January 1, 2027) require a clear label when an AI-generated person features in an ad, the FTC bans fake AI testimonials, and copying a real person’s voice or likeness without consent can break state publicity laws.

The safest play: comply with the strictest state standard now. Federal preemption is still being debated, but none of the laws in this guide has been struck down.

Quick-reference comparison

See how the EU AI act and global AI advertising laws can affect your campaigns

New York: AI performers in ads (in force since June 9, 2026)

New York’s Synthetic Performer Disclosure Law is the first US regulation that specifically targets AI-generated people in advertising. Governor Hochul signed it on December 11, 2025 at SAG-AFTRA’s New York office, and it took effect 180 days later, on June 9, 2026. It now sits in New York’s General Business Law as section 396-b.

What the law covers

The law defines a “synthetic performer” as any digital asset created or modified by generative AI that is intended to give the impression of a human performer but is not recognizable as any identifiable real person. Think AI avatars, digital spokespeople, and simulated extras in video ads. The definition is broad enough to cover the outputs of most AI UGC ad tools that generate realistic-looking human presenters.

If your ads feature real human creators filmed on camera, this law does not apply to them. It specifically targets AI-generated humans, not AI-assisted editing of real footage.

Audio-only ads, ads for expressive works such as films and games, and AI used only for language translation are exempt.

Who is liable

Liability sits with whoever “produces or creates” the advertisement. That means the brand, the agency, the production company. Platforms and media publishers disseminating the ad are explicitly exempt, so TikTok, Meta, and YouTube will not be held responsible for running your non-compliant ad. You will.

There’s one important qualifier: liability is triggered only by “actual knowledge.” If your brand genuinely didn’t know a synthetic performer was used (say, a production vendor inserted one without telling you), you may not be liable. But relying on that defense is risky. Legal analysts recommend tightening contracts with agencies and AI vendors to require upfront identification of any synthetic performer use, rather than relying on plausible deniability.

That said, the platforms have built their own enforcement layer that runs in parallel. We cover how TikTok, Meta, and YouTube auto-label AI ads in a companion post.

What you need to disclose (and how)

The law requires a “conspicuous” disclosure that a synthetic performer appears in the advertisement. This disclosure must appear in the ad itself, in every medium where it runs. If you run the same ad on Instagram, YouTube, and connected TV, each version needs the disclosure.

Here’s the catch: the law doesn’t specify exact wording, format, or placement. It doesn’t say whether you need on-screen text, a verbal callout, a watermark, or all three. That ambiguity will likely get clarified through enforcement actions and industry practice over the next year. In the meantime, err on the side of making it obvious.

California’s version (below) is more specific. If you run ads in both states, using California’s wording everywhere covers both.

Penalties

First violation: $1,000. Each subsequent violation: $5,000. There is no private cause of action, which means consumers cannot sue you directly. Enforcement comes from state authorities only.

I haven’t found any enforcement actions or Attorney General guidance so far. A pending bill, A11683 (introduced September 2, 2026), would extend the rule to recognizable digital replicas and require the label to stay on screen for as long as the performer appears.

The human UGC angle: Ads featuring real creators filmed on camera are completely unaffected by this law. No disclosure required, no compliance overhead. The rule only kicks in when the “performer” is AI-generated.

California: AI performers in ads (from January 1, 2027)

California became the second state with a synthetic performer ad law when Governor Newsom signed SB 1050 on September 16, 2026. It takes effect on January 1, 2027, and it goes further than New York’s version in three ways.

What it covers

Any ad that “prominently” features a synthetic performer: an AI-generated person who appears in the foreground demonstrating a product, voices the narration, or reacts to it. Unlike New York, audio-only ads are covered, so an AI-voiced radio or podcast spot needs a label too. Ads for films, TV shows and games are exempt when the performer is used as in the work, and so is AI used only for translation.

What you need to disclose

A clear and conspicuous disclosure, substantially similar to “this performance features a synthetic performer” or “no human performer is depicted.”

Who is liable

Anyone who creates the ad and causes it to be published. There’s no “actual knowledge” requirement, which is New York’s main defense. A violation counts as false advertising under California law, which likely allows private lawsuits, and ad media must pull a non-compliant ad once a court rules on it.

Imagine you’re a DTC skincare brand testing an AI-generated presenter in Meta ads across the US. Today, you need a label in New York. From January, you need one in California too, including on the audio-only cut you run on streaming radio. The simplest approach is one label, in California’s wording, on every version of the ad.

The human UGC angle: Real creators filmed on camera aren’t synthetic performers, so SB 1050 doesn’t apply to them.

California: AI provenance data (in force since August 2, 2026)

Where the synthetic performer rules focus on what viewers see, California’s AI Transparency Act (SB 942) works on the file itself. It was signed in September 2024, delayed by AB 853 to August 2, 2026, and then rewritten by SB 1000, which Governor Newsom signed on September 30, 2026. SB 1000 is an urgency law, so its changes applied immediately.

What AI providers must do now

• Embed hidden provenance data. Every AI-generated image, video or audio file needs a “latent disclosure” that also says whether the AI created or altered the content.
• Offer a free disclosure verification tool. Anyone can use it to check that data, and providers can point users to a third-party tool.
• No size threshold. SB 1000 removed the old one-million-monthly-user threshold, so every publicly accessible GenAI system in California is covered.

SB 1000 also removed the requirement to offer users a visible label (a “manifest disclosure”). California’s AI Transparency Act no longer requires a visible AI label. For ads, visible labels now come from the synthetic performer laws and from the platforms themselves.

The metadata stripping liability

If a licensee knowingly removes the disclosure capability from a licensed AI system, the provider must revoke the license within 72 hours of finding out (down from 96). The licensee can also face an injunction and attorney’s fees.

(Keep the two existing paragraphs starting “In practical terms” and “This is especially relevant for agencies”.)

What’s next: platforms from January 2027

From January 1, 2027, large online platforms with more than 2 million monthly users must let people inspect provenance data (by showing it, linking to it or making it downloadable) and must not knowingly strip it (AB 853 and AB 2713). Makers of cameras and phones follow for devices first made from January 1, 2028. Expect the provenance data on your ad files to become more visible, not less.

Penalties: $5,000 per violation, and each day counts as a separate violation. Enforcement comes from the California Attorney General, city attorneys and county counsel.

Colorado: AI in eligibility decisions (from January 1, 2027)

Colorado’s AI Act (SB 26-189) focuses on a specific question: whether AI is being used to make eligibility, access, or pricing determinations that affect consumers. The law covers “automated decision-making technologies” making “consequential decisions” across seven categories: education, employment, housing, financial or lending services, insurance, health care, and essential government services. Advertising, marketing, product recommendations, search, and content moderation are all explicitly excluded, meaning using AI to decide who sees your ad is not a consequential decision under this law.

If you are a DTC brand in health and beauty, apparel, food and beverage, or software, this section likely does not apply to you. You can skip ahead to the federal preemption section.

If you are in fintech, insurance, real estate, or consumer lending and you use AI systems to make or substantially influence actual decisions (auto-denying a loan application, calculating a differentiated insurance premium, screening a rental applicant), you may be classified as a “deployer” of an automated decision-making technology.

Deployers must notify consumers when AI is used in a consequential decision about them, disclose the outcome within 30 days of any adverse decision, correct inaccurate personal data on request, and provide a meaningful human review process. Penalties reach $20,000 per violation. The Attorney General must first issue a 60-day notice-and-cure period before seeking civil penalties, a provision that runs through January 1, 2030.

SB 26-189 is itself a replacement, and the backstory matters. The original Colorado AI Act (SB 24-205) was repealed in May 2026 after xAI filed suit to block it, the DOJ intervened on xAI’s side, and the court approved a stay that both sides agreed to. The legislature rewrote the law rather than wait out the courts. Brands in regulated categories should prepare for the January 1, 2027 deadline rather than treating this turbulent history as a signal the law won’t stick.

That stay still applies to the new law. xAI can ask for a preliminary injunction once the Attorney General’s rules are final, and the Attorney General can’t enforce until 14 days after the court rules on that request, so enforcement could start later than January 1. The Attorney General filed draft rules on August 11, 2026, with a hearing and comment deadline on October 26, 2026.

Tennessee: AI voice cloning (in force since July 2024)

Tennessee’s ELVIS Act is easy to overlook because it is already in effect and has not yet produced headline-grabbing enforcement actions. But for agencies producing UGC ads with AI-generated voiceovers, it may be the most dangerous law on this list.

What the ELVIS Act does

The Ensuring Likeness Voice and Image Security Act (HB 2091 / SB 2096) was signed on March 21, 2024 and took effect on July 1, 2024. It passed unanimously (93-0 in the House, 30-0 in the Senate) and was the first US state law to explicitly protect voice from AI cloning.

Before this law, Tennessee’s 1984 right of publicity statute only covered name, photograph, and likeness. The ELVIS Act adds “voice” as a protected category, defining it as “a sound in a medium that is readily identifiable and attributable to a particular individual, regardless of whether the sound contains the actual voice or a simulation of the voice.”

That last part is key. It does not matter whether the AI actually used the person’s voice recordings. If the output sounds like them, you are in scope.

Criminal liability, not just civil

Most right-of-publicity laws in the US only provide civil remedies. Tennessee went further. Unauthorized AI voice cloning under the ELVIS Act is a Class A misdemeanor, carrying up to 11 months and 29 days of imprisonment plus a $2,500 fine.

The law also creates a novel liability category for technology providers. Anyone who distributes an algorithm, software, tool, or other technology” whose “primary purpose or function” is creating unauthorized voice or likeness facsimiles faces direct liability. This could potentially reach the AI voice cloning platforms themselves, not just the people using them.

The agency risk with UGC

Here is the scenario that should concern brands: a UGC creator submits a video using an AI voice filter that sounds like a recognizable artist, influencer, or public figure. The brand approves it, runs it as a paid ad, and the rights holder’s team notices. Under the ELVIS Act, the brand is liable as a publisher if it “knew or reasonably should have known” the voice use was unauthorized. If the creator is a signed recording artist, the record label can also file suit.

The first civil case is already in court. In November 2025, the John R. Cash Trust sued Coca-Cola over an ad with a singer who sounded like Johnny Cash. The voice was a human tribute singer, not AI, which shows the law reaches any “readily identifiable” imitation. I haven’t found any criminal prosecutions so far. The practical advice: audit all AI voiceovers for likeness risk, require creators to declare any AI voice tools in their briefs, and get explicit consent when voice output could resemble an identifiable person.

The human UGC angle: When a real creator speaks in their own voice, there’s no likeness claim to worry about. The ELVIS Act targets AI simulations of identifiable voices, not real people talking on camera.

Other likeness laws: digital replicas

Tennessee isn’t the only state protecting people’s likeness from AI copies anymore:

• New York (since December 11, 2025). Using a digital replica of a deceased performer without consent is unlawful when you know it’s unauthorized. Damages are $2,000 or actual damages, whichever is greater.
• California SB 1111 (signed September 2026). Adds AI digital replicas to the state’s right-of-publicity law and to criminal false impersonation.
• Hawaii Act 247 (signed July 14, 2026). Bans knowingly using a realistic digital imitation of an identifiable person in advertising without consent, and lets that person sue.

Let’s say a creator delivers an ad where an AI voice sounds like a well-known actor. Even if nobody intended it, you’re now relying on the actor’s team not noticing. Ask creators to declare any AI voice or face tools, and don’t run outputs that resemble a real person without written consent.

The FTC: the federal floor (ongoing enforcement)

While states are writing new laws, the FTC is using the authority it already has. Section 5 of the FTC Act prohibits unfair or deceptive practices, and the Commission has been applying that standard aggressively to AI claims in advertising since 2024.

The AI-washing sweep

The FTC brought at least a dozen “AI-washing” enforcement cases in 2025, targeting companies that overstated what their AI products could actually do. The most notable recent action: the Air AI settlement in March 2026, which resulted in an $18 million judgment (largely suspended due to inability to pay) and a permanent ban on the operators marketing business opportunities.

These cases are not just about AI companies. They set a clear precedent: if you claim your product uses AI in ways it does not, or if you overstate AI capabilities in your marketing, the FTC will treat that as deceptive advertising.

Fake reviews and AI disclosure

In August 2024, the FTC finalized a rule banning fake AI-generated reviews and testimonials “by someone who does not exist.” That rule has been enforceable since October 2024. If your brand is using AI to generate customer testimonials, product reviews, or endorsement content that implies a real person had a real experience, you are in violation.

What the FTC doesn’t require is a separate AI label on every piece of AI content. Its Q&A on the reviews rule says there’s “no blanket prohibition on the use of AI-generated avatars,” and the Endorsement Guides require you to disclose the paid relationship, not the use of AI. An AI disclosure becomes necessary when leaving it out would mislead people, for example an AI “customer” describing results they never had. For AI performers, the state laws above set the labeling rules.

In practice, a TikTok Spark Ad from a creator who used an AI voiceover still needs “#ad”. If the voice could make viewers believe a real person said something they didn’t, add an AI disclosure at the start of the video too.

Penalty scale

The numbers are significant. Undisclosed synthetic endorsements can now cost up to up to $53,088 per violation. Growth Cave settled with the FTC for $48.6 million over misleading AI claims. accessiBe paid $1 million. The FTC does not need new legislation to pursue these cases. Section 5 is broad enough to cover deceptive AI practices across every marketing channel.

The human UGC angle: Real testimonials from real customers don’t trigger the fake reviews ban, and organic creator content doesn’t need the AI-generation disclosure layer. You still need to disclose the paid partnership.

The federal preemption wild card

Running underneath every state rule above is a federal push to make them irrelevant. On December 11, 2025, the White House issued an executive order establishing a “minimally burdensome national policy framework” for AI. It created a DOJ AI Litigation Task Force with a mandate to challenge state AI laws as unconstitutional under the Commerce Clause or First Amendment, directed the FTC to clarify when state laws are preempted, and threatened to restrict federal broadband funding to states with “onerous” AI legislation.

The task force’s only court action so far is joining xAI’s lawsuit against the original Colorado AI Act (SB 24-205) on April 24, 2026. In July 2026, the FTC proposed a policy statement on when state AI laws may be preempted, using Colorado’s law as its main example; it isn’t final yet. In Congress, the White House published a legislative framework in March 2026, and several drafts are circulating, including Senator Blackburn’s TRUMP AMERICA AI Act (which preserves “generally applicable” state rules) and a House draft from June. None has passed, and a preemption moratorium was dropped from the defense bill in December 2025.

Here is what matters for your planning: an executive order cannot unilaterally preempt state law. Only Congress or the courts can, and neither has done so for the laws in this guide. Courts have blocked some state election deepfake laws on free speech grounds, but not the advertising rules covered here. The practical advice from legal experts is consistent: build your compliance program around the strictest applicable state requirements. The rules you follow today could change by 2027 or 2028, but they have not been overruled yet, and betting on that outcome is a compliance risk, not a compliance strategy.

What to do next

The action items across these five jurisdictions converge into a few priorities:

1. Audit your campaigns for AI performers and AI voices, and label them in New York now and in California from January 1, 2027 (audio-only ads included).
2. Keep provenance data intact in your creative pipeline instead of stripping it on export.
3. Add AI disclosure and consent clauses to creator briefs and agency contracts.
4. Disclose paid partnerships on every sponsored post, and add an AI disclosure wherever AI could mislead viewers about who is speaking or what they experienced.

Each of those steps involves real workflow decisions, from how you structure creator contracts to how you handle metadata on export. Here is a full compliance guide that walks through those decisions in detail, including a framework for which types of AI use trigger disclosure and which do not, a decision table comparing human UGC, AI UGC, and hybrid approaches by compliance risk and cost, and a step-by-step audit checklist for your Q4 and Q1 campaigns.

Alternatively, here is how human-creator pipeline works in practice. Billo’s creative operations workflow handles briefing, creator matching, rights, and content delivery in one place, with none of the disclosure, metadata, or voice-likeness risks that come with AI-generated creative.

Summary and next steps

The US AI advertising landscape in 2026 is defined by a state-by-state patchwork plus accelerating federal enforcement. There is no single rule to follow, but there is a clear hierarchy of urgency:

New York’s synthetic performer law has applied since June 9, and California’s stricter version, which covers audio-only ads too, follows on January 1, 2027. California’s AI Transparency Act now requires hidden provenance data in all AI-generated content, and large platforms must let people inspect it from January. Colorado’s SB 26-189 takes effect the same day for AI decisions in regulated industries, with advertising excluded. Tennessee’s voice protection law carries criminal penalties and now has its first civil case in court. And the FTC keeps pursuing AI-related deception under its existing powers, with penalties of up to $53,088 per violation.

The federal government is actively trying to preempt these state laws through litigation and executive action, but none of these laws has been struck down. The expert consensus is to comply with the strictest applicable standard today and build enough flexibility to adjust when the federal picture clarifies.

For brands and agencies running UGC ads at volume, one pattern is becoming hard to ignore: as disclosure requirements, metadata mandates, and liability risks stack up around AI-generated content, working with authentic human creators is increasingly the path of least resistance. Real creators filmed on camera do not trigger synthetic performer disclosure laws, do not require embedded provenance metadata, and do not carry voice-likeness liability. The compliance overhead for human UGC is simply lower, and that gap widens with every new regulation that takes effect.

FAQs