Summary. Consumer marketing is regulated by five overlapping regimes that share one requirement — a record of what the consumer saw and agreed to — and that punish the same failure in different currencies: statutory damages per message, civil penalties per violation, class actions with a per-subscriber remedy, and an order dictating product design for twenty years. This toolkit organizes them by channel and by function: substantiation and the claims library, consent and suppression for calls and texts, email requirements, subscription symmetry, endorsement disclosure and the fake reviews rule, pricing display, promotions, and the governance and records that make the program defensible.

What this toolkit is for, and who should use it

A marketing organization runs campaigns across email, text, social, paid media, and its own website, using vendors, agencies, creators, and lead sources, and each channel carries its own rules. The failures are almost never conceptual. They are a consent record nobody versioned, a suppression list one platform never saw, a disclosure behind a link, and a cancellation flow the growth team made harder and wrote a memo about.

This toolkit is for a general counsel, a marketing operations leader, and outside counsel auditing a program.

Roadmap at a glance

  1. The substantive standard — deception, unfairness, and substantiation.
  2. The claims library.
  3. Calls and texts — consent, suppression, revocation, and timing.
  4. Email.
  5. Subscriptions and negative options.
  6. Endorsements and influencers.
  7. Reviews and testimonials.
  8. Interface design — dark patterns and pricing display.
  9. Promotions, contests, and sweepstakes.
  10. Privacy consent and its interaction with marketing.
  11. Vendors, agencies, and lead sources.
  12. Governance, records, and response.

Stage 1 — The substantive standard

  • Deception under FTC Act § 5: a representation, omission, or practice likely to mislead a consumer acting reasonably, that is material.
  • Unfairness: an act causing or likely to cause substantial injury not reasonably avoidable and not outweighed by countervailing benefits.
  • Substantiation: every objective claim requires a reasonable basis before it is made. For health, safety, and efficacy claims, that means competent and reliable scientific evidence.
  • Implied claims count. The net impression governs, and disclaimers rarely cure a misleading main message.
  • State law parallels. Every state has an unfair and deceptive practices statute, most with private rights of action, attorney's fees, and in several states statutory or multiple damages.
  • Industry-specific overlays for financial services, healthcare, alcohol, gambling, and children's products.

Resources

Stage 2 — The claims library

  • Build a library of approved claims, each with the substantiation attached and a named owner.
  • Record what evidence supports what wording, because a small change in phrasing can require different support.
  • Require that campaigns draw from the library rather than inventing language.
  • Review annually and whenever the underlying evidence changes.
  • Include comparative claims with the tested basis, establishment claims ("clinically proven") with the study, and environmental claims consistent with the applicable guidance.
  • Maintain the disclosure inventory — the qualifying language each claim requires, and where it must appear.

Stage 3 — Calls and texts

  • Prior express written consent for telemarketing: a separate unchecked box, the complete disclosure adjacent to it (sender, message type, frequency, automated technology, rates, not a condition of purchase, and opt-out instructions), and a signature satisfying ESIGN.
  • The consent record: the disclosure text by version, a rendering of the page, timestamp, IP address, the number as entered, and the method — retained at least five years.
  • One authoritative suppression list consulted by every sending system, including franchisee and affiliate platforms.
  • Scrub the National Do Not Call Registry within 31 days of any telemarketing send, retain the records, maintain a written do-not-call policy, train personnel, and honor internal requests for five years.
  • Revocation by any reasonable means, with STOP-type replies per se reasonable, honored within ten business days, and applied across all programs from the sender.
  • Curfew 8 a.m. to 9 p.m. in the recipient's local time, determined by carrier lookup rather than area code.
  • Query the Reassigned Numbers Database for the safe harbor.
  • Register for 10DLC and comply with carrier and CTIA requirements.
  • State mini-TCPAs are frequently broader; build to the strictest.

Resources

Stage 4 — Email

  • CAN-SPAM requires accurate header information and a non-deceptive subject line; identification of the message as an advertisement where applicable; a valid physical postal address; a clear and conspicuous opt-out mechanism functional for at least thirty days; and honoring opt-outs within ten business days.
  • No prior consent is required for commercial email under federal law — the regime is opt-out rather than opt-in, which is the opposite of the text regime and the source of most confusion.
  • Transactional or relationship messages are exempt from most requirements but must still have accurate headers.
  • The sender is responsible for messages sent on its behalf, and both the sender and the initiator can be liable.
  • No harvesting, dictionary attacks, or automated account creation, which carry aggravated penalties.
  • State law and foreign law are stricter. Several states impose additional requirements, and consent-based regimes abroad — Canada's anti-spam legislation and the EU's e-privacy rules — require opt-in for most commercial email.
  • Suppression must be shared across every sending platform and every affiliate.

Resources

Stage 5 — Subscriptions and negative options

  • ROSCA requires clear and conspicuous disclosure of all material terms before obtaining billing information, express informed consent, and simple mechanisms to stop recurring charges.
  • Disclosure on the same screen as the billing request, in visual proximity to the consent control: automatic renewal, amount, frequency, first charge, cancellation deadline, how to cancel, and any commitment or termination fee.
  • A separate affirmative act consenting to the negative option, nothing preselected, and a retainable acknowledgment after enrollment.
  • Symmetry in cancellation: same medium, comparable clicks and time, no mandatory call or chat, retention offers only with permission, and immediate effect with confirmation.
  • Reminders before trial conversion and before long-term renewals.
  • State statutes, California's in particular, impose their own disclosure, acknowledgment, reminder, and online-cancellation requirements, with an unconditional gift remedy that drives class litigation.
  • Versioned screenshots of both flows are the evidence.

Resources

Stage 6 — Endorsements and influencers

  • Material connections must be disclosed — payment of any amount, free or discounted product, employment, family or personal relationships, contest entry conditioned on posting, affiliate commissions, and any other benefit.
  • Clear and conspicuous means difficult to miss and easily understandable: both visually and audibly in audiovisual content, at the beginning of a caption, on screen for the duration, in the same language, and not solely through a platform's built-in tool.
  • Endorsements must reflect honest opinions, and the endorser must have used the product where that is implied.
  • Typicality: an endorsement implying representative results requires substantiation that they are, and "results not typical" no longer cures it.
  • Advertisers, endorsers, and intermediaries can each be liable, and the advertiser must train and monitor.
  • The agreement must state the disclosure requirement, prohibit unapproved claims, obtain a metrics representation, address usage rights and exclusivity, and include a morals clause that does not require a conviction.

Resources

Stage 7 — Reviews and testimonials

The FTC's rule on consumer reviews is a legislative rule carrying civil penalties per violation, which distinguishes it from guidance.

  • No fake or false reviews, and no buying, selling, or disseminating them where the party knew or should have known.
  • Insider reviews — by officers, managers, employees, or their immediate relatives — require clear disclosure of the connection.
  • No company-controlled review sites presented as independent.
  • No review suppression through unfounded legal threats, intimidation, or false accusations, and no representing that displayed reviews are all reviews when negatives were suppressed.
  • No purchased followers, views, or engagement indicators the buyer knew or should have known were fake.
  • Operationally: eliminate review gating, apply the moderation policy neutrally, disclose or prohibit insider reviews, never purchase engagement, and document the policy.

Stage 8 — Interface design

  • Sneaking — hidden costs, hidden subscriptions, items added without action.
  • Urgency and scarcity claims that are not true — resetting countdowns, perpetual "limited time" offers, unfounded low-stock messages.
  • Misdirection — confirmshaming, visual interference favoring one choice, trick wording, preselected upgrades.
  • Obstruction — the roach motel, price comparison prevention, intermediate currency obscuring real cost.
  • Forced action — enrollment or registration required for something unrelated.
  • Nagging — repeated prompts after a refusal.
  • Pricing display: show the total price inclusive of mandatory fees wherever a price first appears, consistent with the FTC's fees rule for covered sectors and with state statutes that reach essentially all consumer transactions.
  • Audit by walking the flow on a phone, with a stopwatch, using someone outside the product organization.

Stage 9 — Promotions and sweepstakes

  • A promotion with consideration, prize, and chance is an illegal lottery. Remove one element: a genuine free alternate method of entry given equal dignity, or a real skill contest with judging criteria.
  • Official rules posted and linked from every promotional post, stating eligibility, age restrictions, entry period and method, odds, prize description and approximate retail value, sponsor identity, winner selection and notification, and publicity and liability releases.
  • Registration and bonding in the states that require it above a prize threshold.
  • Winner documentation — affidavit of eligibility, liability release, and tax reporting for prizes above the reporting threshold.
  • Influencer-run promotions require the material connection disclosure and the rules link in the post, and the brand remains responsible for both.
  • Platform rules on promotions must also be followed.

Stage 10 — Privacy consent

  • Consent obtained through dark patterns is not consent under state privacy statutes, and symmetry is required: if "Accept All" is one click, "Reject All" must be one click.
  • Opt-out rights for sale and sharing, targeted advertising, and profiling, honored through a preference mechanism and through universal opt-out signals where the state requires it.
  • Sensitive data requires opt-in consent in several states.
  • Minors: opt-in consent for targeted advertising and sale for the 13-to-16 band in several statutes, and design-code obligations where a service is likely to be accessed by minors.
  • Ad tech: pixel and tag governance, contracts with the correct role designations, and attention to the wiretapping and session-replay theories now being litigated under state privacy and communications statutes.

Resources

Stage 11 — Vendors, agencies, and lead sources

  • Diligence before engagement, with compliance obligations flowing downstream contractually and audit rights actually exercised.
  • For purchased leads, require per lead the disclosure text, the URL, a rendering of the page, and full metadata — and audit a sample independently.
  • Confirm the disclosure gave consent to your company specifically.
  • Indemnities backed by insurance, from a counterparty that could fund a claim.
  • Verify the forms and notices a vendor sends on your behalf; you are liable for them.
  • Terminate on complaint patterns, and document the decision.
  • Recognize that vicarious liability attaches through actual authority, apparent authority, and ratification, and that contract language alone does not defeat it.

Stage 12 — Governance, records, and response

  • One named owner with authority over every sending system and every channel.
  • Pre-approval of every campaign against a checklist covering list source, consent basis, disclosure version, timing, claims used, and substantiation.
  • Records: consent records, disclosure and flow versions with effective dates, suppression and scrub logs, campaign approvals, substantiation, training acknowledgments, monitoring logs, and vendor audits — retained at least five years.
  • Metrics reported to executives alongside conversion: cancellation completion rate, opt-out honoring latency, complaint volume, and chargebacks citing authorization or cancellation.
  • Insurance: confirm whether the CGL policy excludes statutory-violation claims (most do), and obtain a specific endorsement or a media liability policy.
  • On a demand or a filing: issue a litigation hold covering platforms, CRM, consent databases, and vendor communications; pull the individual claimant's record first; assess the class; check arbitration; notice every carrier; and fix the practice, because continuing after notice is what produces willfulness findings.

A channel-by-channel quick reference

Channel Consent standard Suppression Timing limits Key record
Marketing text Prior express written consent, separate and specific One list across all systems; National and state registries 8 a.m.–9 p.m. recipient local time Versioned disclosure and consent metadata
Marketing call Same, plus internal do-not-call policy and training Same, scrubbed within 31 days Same Scrub logs and policy
Servicing text or call Consent implied by providing the number for that purpose Revocation still honored Curfew as applicable Account record showing the number's source
Commercial email None required federally; opt-in abroad Shared suppression, honored within 10 business days None federally Opt-out log with timestamps
Direct mail None Internal preference list None Preference records
On-site and in-app Privacy consent where data is processed Preference center and universal opt-out signals None Consent string and version
Influencer content Not consent; disclosure and substantiation Not applicable Not applicable Agreement, training acknowledgment, monitoring log

The pattern across every row is the same: the company must be able to produce, years later, evidence of what the consumer saw, what they agreed to, and when — and evidence that a request to stop was honored across every system. A program that can do that survives nearly any inquiry in this area; one that cannot will settle regardless of how careful the underlying practices were.

One organizational recommendation. Marketing compliance fails at the seams — a franchisee's platform, an agency's list, a loyalty tool bought by a different department, a legacy system nobody decommissioned. Once a year, ask a single question of every business unit: what systems can send a message to a customer? The answer is always longer than the compliance inventory, and closing that gap is worth more than any additional policy.

Master resource index

Articles

Guides

Checklists

Related toolkits

External and primary sources

This toolkit is educational and not legal advice. Federal rules in this area have changed recently and several are subject to litigation, and state statutes impose additional and sometimes stricter requirements. Consult qualified advertising counsel before launching a campaign or modifying a consumer-facing flow.