The Federal Trade Commission has made its case against Cox Media Group's fake "Active Listening" AI advertising product final, locking three companies into 20 years of compliance oversight. CMG Media Corporation, MindSift LLC, and 1010 Digital Works LLC must pay a combined $930,000 within eight days - money already held in escrow - and face a compliance regime that runs for two decades, with each breach carrying civil penalties.
The final decision and orders were issued on August 26, 2026, and announced the following day. The vote was 2-0, with Chairman Andrew N. Ferguson and Commissioner Mark R. Meador sitting on a Commission with three vacant seats. Two comments were filed during the public comment period, according to the FTC, though the agency didn't describe their content.
All three orders open with the same prohibition. The respondents must not misrepresent, expressly or by implication: the qualities or features of their advertising or marketing services; the collection and use of voice data; consumer consent to that collection; and geographic targeting capabilities. The definition of voice data sweeps in transcripts as well as audio files - closing the gap between recorded audio and processed text derived from it.
None of the three companies admitted wrongdoing. Each order records that the respondent "neither admits nor denies the allegations in the complaint" but admits the facts necessary to establish jurisdiction.
What the companies actually sold
The FTC first made the proposed consent agreements public in May 2026. Cox Media Group and its partners marketed Active Listening as an AI system that detected purchase intent from conversations captured by smartphones, smart televisions, and smart speakers, then targeted advertising within a local radius. No such capability existed.
What customers actually received were consumer email lists bought from third-party data brokers and resold at a markup. The geographic coverage bore little relation to the territories customers had purchased. The companies told customers consumers had opted in to the voice collection - they had not.
CMG Media Corporation, a Delaware company based in Atlanta, operates a portfolio of broadcast and local marketing businesses. MindSift is a New Hampshire LLC, and 1010 Digital Works is a single-member Wisconsin company. Its sole member is Dmitriy Shteynbuk.
The order against CMG is drafted wider than the other two. It binds conduct in connection with services offered by the respondent "or by any business the respondent controls," pulling controlled subsidiaries inside the prohibition. The MindSift and 1010 orders don't contain that clause.
The payment mechanics
CMG Media Corporation must pay $880,000 to the Commission. MindSift LLC and 1010 Digital Works LLC must each pay $25,000. In all three cases, the sums are already held in escrow by the respondent's counsel, and transfer must be made by electronic funds transfer within eight days.
The effective date is the date of publication on ftc.gov as a final order - not the date of issuance. A default running ten days past the due date makes the entire amount immediately due and payable. Each day of nonpayment is treated as a separate offence carrying civil penalties.
The bankruptcy provisions are the sharpest instrument. Under all for three orders, the facts in the complaint will be taken as true in any subsequent collection litigation, including nondischargeability complaints in bankruptcy cases. The orders carry collateral estoppel effect under Section 523(a)(2)(A) of the Bankruptcy Code, which covers debts obtained by false pretences or actual fraud. A respondent that enters bankruptcy cannot shed the obligation or relitigate the findings.
Two decades of compliance work
Each order terminates 20 years from its issuance date, or 20 years from the most recent date the US or the Commission files a federal court complaint alleging a violation - whichever is later. A dismissed complaint, or a court ruling that the respondent didn't violate the order, resets the clock.
Within that window, the obligations are continuous. Each respondent must submit a sworn acknowledgment of receipt within 10 days. For 20 years, any majority-owned business must receive a copy of the order, with signed and dated acknowledgments collected within 30 days. A sworn compliance report falls due one year after issuance, identifying points of contact and the compliance architecture in detail.
Sworn acknowledgment of any compliance-relevant structural change - creation, merger, sale, dissolution - is due within 14 days. Bankruptcy filings must likewise be notified within 14 days.
The recordkeeping obligations reach beyond routine bookkeeping. For five years from the last dissemination any covered claim, respondents must retain all materials relied upon in making it, and all tests, studies, and analyses that contradict or qualify that claim. Separately, for five years from creation, they must retain all records that demonstrate non-compliance - requiring a company to preserve evidence of its own breach.
Monitoring is equally invasive. Within 10 days of a written request, respondents must submit additional compliance reports and produce records for inspection and copying. Commission representatives may communicate directly with respondents, interview any affiliated person who agrees to an interview (counsel may be present), and pose as consumers of suppliers without identification or prior notice.
There are two drafting artifacts in the orders themselves. All three orders label two consecutive provisions under Compliance Reports and Notices with the letter D - one covering the sworn declaration format, one covering the submission address. Both provisions operate. A second inconsistency sits in the FTC's own press release, which describes the payment and prohibition terms as sitting "under the proposed orders" settling the allegations - though the orders were finalized in August, not May.
Enforcement context
The Commission that voted these orders final has been active through 2026 while operating with two sitting members. On August 19, 2026, the same two commissioners decided 2-0 to authorize a proposed policy statement declaring that undisclosed personalized pricing likely constitutes an unfair or deceptive act. The previous May, they closed the four-year Kochava location data case with a stipulated order restricting Precise location sharing. In April, they sued WPP, Publicis, and Dentsu over alleged brand protection.
The Active Listening matters trace back to Operation AI Comply, the enforcement sweep launched September 25, 2024 against companies exploiting AI claims. The FTC's 2026-2030 strategic plan, published April 6, 2026, spots 4. And the administrative route against deceptive AI is not unchallenged - in March 2026, the Fifth Circuit vacated the pays/deducted against Intuit, raising questions about the FTC's in-house adjudication of deceptive claims. Consent orders differ from litigated ones, since the respondents agreed to the terms.
Marketers should pay attention to what the FTC said in these orders. Clicking through app terms of service does not amount to opt-in for voice collection, the Commission said. Only disclosed, specific consent counts. That logic was already there in the InMarket Media action banning unapproved disclosure of precise location data without informed consent, and in the November 2024 guidance that data clean rooms are not privacy-preserving by default.
There is a demand-side irony the orders can't reach: Small businesses bought Active clients on the strength of its detail - recognizable platforms, specific percentages. Exaggerated AI claims create backlash, and backlash increases the cost of the substantiation that legitimate capability claims require. Redress will return some money, but it won't rebuild the two years of budget customers spent on a targeting method that didn't exist.
For marketers, the takeaway is concrete and sobering. A vendor must retain the evidence that would undercut its own claims - internal tests, analyses, studies showing the real geographic reach and audience provenance - for five years. The Commission can demand it within 10 days. Radius targeting, intent signals, opt-in provenance, AI-driven inference: these are standard vocabulary across the industry. The active listening complaints suggest they're also a liability, if the sales deck doesn't match the data pipeline.
Legislation moving through Congress - the SECURE Data Act would establish a national privacy framework - would formalize parts of this enforcement posture. The Active Listening orders demonstrate what the FTC can already reach under Section 5 without it.
Why this matters for marketers
For a compliance-focused marketer, this sets a clear precedent: The FTC treats voice data consent as a matter of what the consumer was told and agreed to - not the technical jargon in an terms-of-service page or data clean room documentation. Any vendor claiming voice-based targeting capabilities now faces an audit trail - with the Commission having the power to demand evidence, and hold a company's own records against it.
For marketers sourcing and reselling data, or evaluating AI listening products to offer clients, the bottom line is to verify what a vendor actually delivers before putting the pitch on paper. The orders also require vendors to retain evidence that contradicts their own claims. If you're a marketing manager, understanding these compliance obligations is now a core skillset. The full AI Learning Path for Marketing Managers covers these exact compliance issues - the gap between marketing claims and real AI capability.
Your membership also unlocks:
