Affiliate marketing in the United States is regulated primarily by the Federal Trade Commission, with the FCC, FDA, CFPB, IRS, state attorneys general, state privacy and licensing agencies, and foreign regulators such as those enforcing the EU’s General Data Protection Regulation each covering specific channels, products, or audiences. Which of them applies to you depends on what you promote, how you promote it, and who sees it.
The FTC Is the Lead Regulator
The FTC’s authority comes from Section 5 of the FTC Act, which makes unfair or deceptive acts or practices in commerce unlawful.1Office of the Law Revision Counsel. 15 U.S. Code 45 – Unfair Methods of Competition Unlawful That language reaches nearly everything an affiliate does: product reviews, social posts, email blasts, comparison sites, paid search. If the content misleads consumers, the FTC can act. The agency has publicly identified affiliate marketing as a focus area and warned that “some marketers may use misleading information to get people to click on their ads.”2Federal Trade Commission. FTC Helps Consumers Understand Affiliate Marketing in Online Advertising
Civil penalties for violating an FTC rule or order can reach $53,088 per violation, and each instance counts separately. Enforcement is real, not theoretical: in August 2025 the FTC secured a $20.9 million combined judgment against the operators of an e-commerce business opportunity scheme and permanently banned them from the industry.3Federal Trade Commission. FTC Case Against E-Commerce Business Opportunity Scheme and Its Operators Results in Permanent Ban From Industry
Disclosures and the Fake Review Rule
Two FTC rules do most of the day-to-day work on affiliate content. The Endorsement Guides, at 16 CFR Part 255 and revised in 2023, require that any material connection between an endorser and an advertiser be disclosed clearly and conspicuously when it could affect how consumers weigh the recommendation.4Federal Trade Commission. FTCs Endorsement Guides: What People Are Asking Commissions count. So do free products, early access, and family ties. Burying a disclosure at the bottom of a page or hiding it behind a hyperlink does not qualify; a visual endorsement needs a visual disclosure, and a video endorsement should say it out loud.5eCFR. 16 CFR Part 255 – Guides Concerning Use of Endorsements and Testimonials in Advertising
The 2024 rule at 16 CFR Part 465 bans fake and manipulated reviews.6Federal Trade Commission. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials You can pay someone to write a review, but you cannot pay them to write a favorable one. The rule also bans suppressing negative reviews through legal threats and cherry-picking which reviews to show while claiming a site displays all of them. AI-generated reviews, bot-generated followers, and undisclosed insider reviews all fall within its reach.
The FCC Regulates Marketing Texts and Calls
Marketing text messages and automated calls fall under the Telephone Consumer Protection Act, enforced by the FCC. Under 47 U.S.C. § 227, sending a marketing text to a cell phone using an autodialer or prerecorded message without prior express consent is unlawful, and for promotional messages that consent must be in writing.7Office of the Law Revision Counsel. 47 USC 227 – Restrictions on Use of Telephone Equipment
A rule change effective January 2025 directly targets how lead-generation affiliates operate. The FCC’s one-to-one consent rule requires that written consent be obtained separately for each seller. A comparison-shopping site now needs a separate consent for each company the consumer agrees to hear from rather than bundling them into a single opt-in, and follow-up messages must be logically related to the site where consent was given.8Federal Communications Commission. One-to-One Consent Rule for TCPA Prior Express Written Consent The old model of selling one lead to dozens of companies off a single form no longer works.
Phone-based marketing carries a second layer through the FTC’s Telemarketing Sales Rule, which sets disclosure requirements, prohibits misrepresentations, and restricts certain payment methods.9Federal Trade Commission. Complying With the Telemarketing Sales Rule Two agencies, two statutes, both applicable.
Email Falls Under CAN-SPAM
The FTC enforces the CAN-SPAM Act of 2003 for commercial email.10Federal Trade Commission. CAN-SPAM Act: A Compliance Guide for Business Every marketing email must use accurate header information, avoid deceptive subject lines, include a valid physical postal address, and offer a clear opt-out mechanism. Opt-outs must be honored within ten business days.
Both the company whose product is promoted and the company that actually sends the email can be held liable. Outsourcing your email campaigns does not transfer the compliance risk. Each non-compliant email is a separate violation carrying a penalty of up to $53,088, so one careless send to a large list can produce a catastrophic number.
Product and Audience-Specific Regulators
Certain categories bring additional agencies into the picture. The Consumer Financial Protection Bureau has jurisdiction over affiliates promoting financial products such as credit cards, personal loans, and mortgage services, and can act alongside or independently of the FTC when claims about those products mislead consumers.
The Food and Drug Administration regulates health claims for dietary supplements, food products, and medical devices. Affiliates promoting these products are held to the same standards as the manufacturers. Health claims must meet the FDA’s Significant Scientific Agreement standard and be authorized through a formal petition process before appearing in marketing materials.11Food and Drug Administration. Authorized Health Claims That Meet the Significant Scientific Agreement Standard Repeating a manufacturer’s unauthorized health claim on a review site creates the same exposure the manufacturer would face.
If your site is directed at children under 13 or you know you are collecting personal information from children under 13, the Children’s Online Privacy Protection Act applies.12Federal Trade Commission. Complying with COPPA: Frequently Asked Questions COPPA requires verifiable parental consent before you collect, use, or share a child’s data, a clear privacy policy, and data minimization. The FTC finalized updates to the COPPA Rule in January 2025 that added a separate parental consent requirement for sharing children’s data with third parties for targeted advertising, tightened retention limits, and expanded the definition of personal information to include biometric identifiers.13Federal Trade Commission. FTC Finalizes Changes to Childrens Privacy Rule Limiting Companies Ability to Monetize Kids Data
State Attorneys General and State Privacy Laws
Every state has consumer protection statutes and an attorney general empowered to enforce them. These laws generally track the FTC Act’s prohibition on deceptive practices, though some states impose stricter requirements. State and federal enforcement can proceed in parallel against the same conduct.
Several states have also enacted comprehensive data privacy laws that reach affiliate operations. California’s combination of the CCPA and CPRA is the most consequential: residents can find out what personal information is collected, opt out of the sale or sharing of that data, and request deletion. It applies to any affiliate targeting California residents regardless of where the affiliate is based. Administrative fines reach $2,663 per violation and $7,988 for intentional violations or those involving consumers the business knows are under 16.14California Privacy Protection Agency. California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties
Some product categories also trigger state licensing. Insurance is the clearest case. Because insurance is regulated at the state level, anyone soliciting insurance products generally needs a producer license in each state where they do business.15National Insurance Producer Registry. Understanding the Insurance Licensing Process An affiliate earning commissions on insurance referrals may qualify as a solicitor under state law, and the licensing rules vary by state.
The EU Reaches Affiliates Anywhere
If you target audiences in the European Union, the GDPR applies regardless of where you sit. It reaches any entity that offers goods or services to people in the EU or monitors their behavior there.16General Data Protection Regulation (GDPR). General Data Protection Regulation – Art 3 GDPR – Territorial Scope For most affiliate marketing purposes, processing personal data requires explicit, informed consent. Pre-checked boxes and “by continuing to browse you consent” banners do not qualify.
Affiliate tracking cookies and pixels are typically classified as non-essential advertising cookies, which cannot be set until the visitor has given valid consent. If the visitor declines, the tracking link may not fire and the referral will not be credited. That is a real trade-off with no compliant workaround. GDPR fines can reach €20 million or 4% of annual global turnover, whichever is higher.17General Data Protection Regulation (GDPR). Fines and Penalties
The IRS Regulates the Income Side
The IRS treats affiliate commissions as self-employment income. Any business that pays you $600 or more in commissions during a tax year must issue a Form 1099-NEC, and you owe income tax on the money whether or not you receive the form.18Internal Revenue Service. Instructions for Forms 1099-MISC and 1099-NEC If your net affiliate earnings exceed $400 in a year, you also owe self-employment tax at 15.3%, covering Social Security (12.4%) and Medicare (2.9%).19Internal Revenue Service. Self-Employment Tax (Social Security and Medicare Taxes) Affiliate income is reported on Schedule C and self-employment tax on Schedule SE.
When Brands Are on the Hook for Affiliate Conduct
A common assumption is that brands escape liability when an affiliate breaks the rules. The FTC generally sees it the other way. CAN-SPAM expressly holds both the promoted company and the sending company responsible. Enforcement history has extended similar logic beyond email: courts have held affiliate networks liable for their publishers’ deceptive content even when the network did not create the materials, particularly when the network approved the content or actively participated in the promotion.
The practical consequence is that reputable affiliate programs build compliance requirements into their terms and reserve the right to terminate affiliates who violate FTC guidelines. Contractual language alone will not insulate a brand, though. If you run a program, the FTC expects reasonable steps to police what your affiliates are claiming and disclosing. If you are the affiliate, the brand can terminate you and claw back commissions for compliance failures, and regulators can pursue you directly for the same conduct.