US Digital Advertising Laws: The 2026 Guide for UK and Irish Businesses

If your business runs paid campaigns on Meta, Google, or TikTok, you are already operating inside the American regulatory system, whether you have one US customer or ten thousand. The platforms are global. The laws are not. US digital advertising laws apply to any advertiser whose campaigns reach American consumers, regardless of where that business is registered, banked, or hosted.

For SMEs in Belfast, Dublin, and London, this is a more immediate question than most marketing teams treat it as. Two things have shifted since 2024. Twenty US states now run their own consumer privacy regimes, and the first state law requiring advertisers to disclose AI-generated people in adverts took effect in June 2026.

This guide explains what current US digital advertising laws ask of non-US advertisers, what changed across 2025 and 2026, and how your campaign structure, website build, and content decisions either reduce your exposure or quietly increase it.

Why US Digital Advertising Laws Reach Businesses in Belfast, Dublin, and London

The Federal Trade Commission’s jurisdiction follows the consumer, not the advertiser. If a UK or Irish business places a Meta advert reaching American users, runs a YouTube influencer campaign with American viewers, or sells through a US-facing Shopify store, the FTC’s rules on truthful advertising, disclosure, and data collection apply. The FTC has pursued non-US companies through international cooperation agreements and by acting against their US-based payment processors and platform accounts, so a Belfast postcode is no shield.

The Nexus Test: Does US Law Apply to Your Business?

Directors often assume that being headquartered outside the United States settles the question. It does not. Advertising directed at American consumers that leads to transactions inside American borders brings you within the reach of US digital advertising laws, and collecting the personal data of a California resident to serve a retargeting advert can bring you within California’s privacy regime whatever your server location.

Work through these questions before your next launch:

• Do you geo-target adverts to US states, cities, or postal codes?
• Do you accept US dollars at checkout?
• Do you collect personal data from US-based IP addresses for marketing?

A yes to any of these means your creative, consent, and data workflows need to align with US digital advertising laws alongside UK and EU requirements, a matter of strategic digital planning as much as legal review.

Running Two Regulatory Systems at Once

Northern Irish businesses face a particular version of this. Campaigns reaching audiences in the Republic of Ireland and the United States operate under EU and American frameworks at once, with different consent models, disclosure standards, and enforcement bodies.

Getting campaign structure and professional website design right at the start costs far less than unpicking a problem after a platform audit or a regulatory complaint. As Ciaran Connolly, founder of ProfileTree, puts it: “Compliance is usually treated as a cost you absorb after something goes wrong. For SMEs advertising into the American market, the better approach is building it into the campaign structure and the website from day one. Consent flows, disclosure copy, and ad creative all carry legal weight, and retrofitting them is always the expensive option.”

The FTC Framework Behind US Digital Advertising Laws

Section 5 of the Federal Trade Commission Act prohibits unfair or deceptive practices, and it sits underneath everything else. The FTC applies a net impression test: what overall impression does the advert create in the mind of a reasonable consumer? If that impression misleads, the advert breaches the Act even when every individual claim inside it is accurate. This is the most misunderstood element of US digital advertising laws among UK marketers, because it means literal truth is not a defence.

Substantiating Claims Before the Advert Goes Live

Any objective claim, from a performance percentage to a comparative superlative, must be supported by evidence you hold before the advert runs. American regulators do not accept verification after the fact, and health and financial claims attract the closest scrutiny.

The difference is usually a matter of phrasing:

Clear and Conspicuous Disclosure

The FTC assesses disclosures on four criteria: placement, proximity, prominence, and absence of distraction. A disclosure sitting in a footer, set in grey text on white, or placed below the call to action fails that test even though the information technically appears on the page. For video creative, it must be visible or audible long enough to be taken in, so brief your video content creation team accordingly. Qualifications belong next to the claim they qualify, at a readable size, visible without scrolling on the device where the advert appears, which is a conversion-focused website design decision as much as a legal one.

Influencer and Affiliate Disclosure for UK Brands

Any material connection between an advertiser and someone promoting the product must be disclosed clearly, and the FTC tightened its endorsement guidelines in 2023. A UK brand running influencer campaigns and wider social media marketing into American audiences must satisfy both the ASA and the FTC at once. The ASA expects clear labelling such as “#ad”. The FTC expects that label positioned where viewers meet it before engaging with the content, not buried below a long caption or tucked into a bio.

Dark Patterns and Subscription Flows After the Click-to-Cancel Ruling

Interface design became a compliance matter in its own right after the FTC’s 2022 report on dark patterns, which covered pre-ticked consent boxes, confusing unsubscribe flows, and sign-up processes that obscure cancellation terms. The FTC treats these as deceptive acts under Section 5, which places your cookie banner and checkout flow inside the scope of US digital advertising laws rather than outside it.

What the Eighth Circuit Ruling Changed

Many 2025 guides still tell UK marketers that the FTC’s click-to-cancel rule governs subscription cancellation. That advice is out of date. On 8 July 2025 the Eighth Circuit vacated the FTC’s amended Negative Option Rule in its entirety on procedural grounds, days before its main provisions were due to take effect. The FTC opened a fresh rulemaking process, publishing an Advance Notice of Proposed Rulemaking on 11 March 2026.

The practical position is narrower than the headlines suggested:

• The vacated rule imposes no obligations at present.
• The Restore Online Shoppers’ Confidence Act still applies to negative option billing.
• Section 5 still reaches deceptive sign-up and cancellation flows.
• California and several other states run their own automatic renewal laws, some stricter than the vacated federal rule.

Making cancellation as simple as sign-up remains the sensible default.

Design Choices That Attract Scrutiny

Pre-ticked boxes, cancellation that needs a phone call when sign-up took two clicks, and banners where “accept all” is a button while “reject all” is a text link all read as manipulation. ProfileTree’s professional web development team builds consent flows that satisfy ICO expectations and FTC guidance together, which usually means fewer interface elements, not more.

The 2026 State Privacy Patchwork

The United States still has no federal privacy statute. The American Privacy Rights Act stalled in Congress, as did its predecessor, so state law fills the gap. Twenty states had full consumer privacy laws in force during 2026, with further laws enacted and awaiting effective dates. This is the part of US digital advertising laws that touches your website most directly.

Does the CCPA Actually Apply to Your Business?

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to for-profit businesses meeting any one of three thresholds. The revenue threshold is adjusted for inflation, and the California Privacy Protection Agency set it at $26,625,000 in annual gross revenue from January 2025. The others are buying, selling, or sharing the personal data of 100,000 or more California consumers or households annually, and deriving half or more of annual revenue from selling or sharing personal data.

Most SMEs clear none of these. The 100,000 threshold is easier to cross than it appears, though, because “sharing” covers passing personal data to advertising technology vendors for cross-context behavioural advertising. A busy content site with heavy US traffic and a full tag stack can reach it without selling anything.

UK GDPR and CCPA Compared

A website built properly for UK GDPR will usually exceed the CCPA baseline, but it will not automatically comply. The opt-out mechanism and privacy notice wording have to be written for California specifically, which belongs in the spec for custom website builds.

Global Privacy Control: The Change Most UK Sites Have Missed

Twelve states now require businesses to honour universal opt-out signals such as Global Privacy Control, which browsers including Firefox and Brave send by default. When a visitor from one of those states arrives with the signal enabled, you are expected to treat it as a formal opt-out from sale, sharing, and targeted advertising, with no further action from the user.

Updated California regulations effective 1 January 2026 go further and require businesses to display that the signal has been processed, for example a short confirmation that the opt-out request has been honoured. Most UK-built sites do not detect the signal at all. That is a technical gap your managed website hosting provider can close in an afternoon, and among the cheapest fixes available under current US digital advertising laws.

Maryland runs the only state digital advertising tax, and it applies to companies with at least $100 million in global revenue, so no SME pays it directly. After the Fourth Circuit struck down the ban on itemising it in August 2025, the cost can surface in your platform invoices instead.

Synthetic Media: The Newest Frontier in US Digital Advertising Laws

If you use AI-generated people in your creative, this is the section that matters most. New York enacted the first American law requiring advertisers to disclose synthetic performers, and it reaches visual and audiovisual advertising served to New York consumers regardless of where the advertiser sits. Of all the recent changes to US digital advertising laws, this is the one most likely to catch UK agencies and online sellers unprepared, because AI-generated lifestyle imagery has become routine in product listings.

New York’s Synthetic Performer Disclosure Law

Governor Kathy Hochul signed the law in December 2025 and it took effect on 9 June 2026, amending New York General Business Law section 396-b. It defines a synthetic performer as a digitally created asset, produced using generative AI or similar software, intended to give the impression of a human performance where the person is not a recognisable real individual. Advertisements featuring one must carry a conspicuous disclosure. Penalties run to $1,000 for a first violation and $5,000 for each subsequent violation.

The law excludes audio-only advertising and AI translation of a real performer’s speech, and carves out promotional material for expressive works such as films and video games. It does not prescribe wording, only that the notice must be conspicuous.

Practical Steps for AI Creative Workflows

Treat this as an inventory problem before it becomes a legal one:

1. Audit every live advert and product listing for AI-generated human imagery.
2. Apply a visible disclosure to any creative featuring a synthetic performer.
3. Agree in writing whether client, agency, or production partner identifies synthetic performers.

ProfileTree’s work on AI-powered marketing with SME clients covers this territory directly, identifying which tools introduce regulatory risk and how to build disclosure into production instead of bolting it on afterwards.

COPPA and Advertising to Under-13s

The Children’s Online Privacy Protection Act applies to any site or service directed at children under 13, and to general-audience sites with actual knowledge they are collecting data from under-13 users. It requires verifiable parental consent before collecting personal data, prohibits behavioural advertising to that age group, and limits what may be retained. For most B2B and general consumer SMEs, COPPA is not a live concern, and the compliance step is an honest audit of where adverts appear and what the site collects through forms and AI chatbot development. Age-gating and excluding under-13 audiences in campaign settings are standard technical decisions.

Platform Policy: Meta, Google, and TikTok as First-Line Enforcers

The major platforms have absorbed US digital advertising laws into their own policies, and platform enforcement usually reaches you faster than any regulator. An account suspension can happen within hours; reinstatement takes days or weeks. For an SME whose digital marketing strategy depends on paid social or paid search, a suspended account during a key trading period is an operational problem before it is a legal one.

The Most Common Account-Level Risks

• Targeting restrictions. Meta and Google limit advertiser data use in sensitive categories including health, finance, and political content, wherever the advertiser is based.
• Advertiser verification. Google requires identity verification for certain advert types and regions, so UK businesses running US-targeted campaigns may need extra steps before adverts serve.
• AI content labelling. TikTok, Meta, and YouTube all operate labelling requirements for AI-generated content, with policy running ahead of formal regulation.

Turning Compliance into a Commercial Advantage

Most SMEs treat US digital advertising laws as a constraint on what they can say. A better framing is that compliance signals trustworthiness, and it compounds with the search engine optimisation and content work you already fund. Three areas repay attention.

Disclosure Copy That Still Converts

FTC-compliant disclosure does not have to read like a legal notice. Sponsored content labels and qualification copy can carry the tone of the surrounding creative while satisfying the ASA and the FTC. Clear disclosure outperforms attempts to obscure a paid relationship, particularly with younger audiences who spot the omission and discount everything around it.

Consent Flows That Reduce Bounce

A slow or manipulative cookie banner increases bounce, depresses conversion, and works against improving search visibility. Consent flows that are quick, honest, and legible improve the on-site experience and satisfy regulators at once, which is the clearest point where web design decisions and legal exposure overlap.

Teams That Understand the Rules Before They Write the Brief

The most expensive failures start in the creative brief, not the legal review. Digital training programmes that give your marketing team a working grasp of US digital advertising laws, particularly the net impression test and disclosure placement, remove a whole category of rework and shorten sign-off.

Building a Compliance-First Marketing Workflow

US digital advertising laws are not static, and the pace of change through 2025 and 2026 makes an annual review inadequate. The workable approach is a short checklist applied at campaign setup, plus a quarterly review of the areas moving fastest, which currently means privacy signals and synthetic media. Team training services keep that review from falling to one person.

Run these checks before any campaign reaching US audiences:

Start with the two items most likely to be failing now: whether your website responds to opt-out preference signals, and whether any live creative features AI-generated people without a disclosure. Both carry current enforcement risk. Once those are settled, your obligations under US digital advertising laws become a matter of process rather than firefighting.

FAQs