FTC Privacy Enforcement in 2025: What Marketers Are Getting Wrong

FTC privacy enforcement in October 2025 has moved well past the warning stage. The Commission has shifted from signalling intent to issuing fines, consent orders, and operational restrictions that directly affect how marketing teams collect data, run campaigns, and report results. If your legal team is the only group paying attention, you are already behind.

The practical consequence for marketers is not abstract. Enforcement actions are landing on companies that believed their data practices were defensible, and the gap between what legal approved and what regulators found acceptable has turned out to be wider than most anticipated.

What the FTC Is Actually Targeting in 2025

The FTC’s enforcement posture in 2025 has become more operationally specific than most marketers expected. Earlier cycles of regulatory activity tended to focus on egregious breaches: data sold without consent, children’s data mishandled, security failures that exposed millions of records. Those cases still exist. But the more consequential shift is that enforcement is now reaching into standard marketing infrastructure.

Pixel tracking, third-party data enrichment, retargeting audience construction, and the use of inferred data for personalisation are all areas where the FTC has demonstrated active interest. The Commission’s position is that consumers often have no meaningful understanding of how their data moves through the advertising ecosystem after they visit a website, and that this lack of transparency constitutes a deceptive practice under Section 5 of the FTC Act.

That framing matters because it does not require a data breach to trigger liability. A company can have strong security, a published privacy policy, and a functioning consent banner, and still face enforcement if the FTC determines that the actual data flow was materially different from what a reasonable consumer would expect.

I have spent time on both sides of this kind of gap. Running agency operations across dozens of clients, I watched how data practices were documented versus how they actually worked in campaign execution. The documentation was usually written by legal. The execution was run by the performance team. The two rarely overlapped cleanly. That is not unique to any one agency or client. It is structural, and it is exactly the kind of structural gap regulators are now examining.

Why Compliance Teams Cannot Solve This Without Marketing

One of the more persistent misconceptions I encounter is the idea that privacy compliance is a legal problem that marketing teams can hand off. It is not. The FTC’s recent enforcement actions make clear that the liability lives in the operational decisions: which pixels fire on which pages, how audience segments are constructed, what data is passed to which platforms, and whether the consent collected at the point of data capture actually covers the downstream uses.

Those are marketing operations decisions. Legal can set the boundaries, but they cannot map your tag architecture, audit your CRM integrations, or tell you whether the audience you are retargeting on Meta was built from data collected under a consent framework that covers that use case.

This is why marketing operations has become the function that actually carries the compliance risk. Not in a formal legal sense, but in a practical one: if enforcement lands on your organisation, the investigation will trace back through the systems and decisions that your operations team owns.

The companies I have seen handle this well are the ones where someone in marketing leadership took ownership of the data flow map. Not a diagram produced for an audit and filed away, but a living document that the campaign team actually uses when they are setting up a new channel or onboarding a new platform. That kind of operational discipline is not glamorous, but it is the difference between a company that can demonstrate accountability and one that cannot.

The Data Broker Problem Is Bigger Than Most Marketing Teams Realise

A significant portion of 2025 FTC enforcement activity has centred on data brokers and the companies that use them. The mechanism is straightforward: a brand purchases audience data from a third-party provider to enrich their targeting, the data was collected under terms that do not cover that use, and the brand is now part of an enforcement action even though they never collected the data themselves.

Most marketing teams do not conduct meaningful due diligence on the data they purchase. They evaluate reach, match rates, and cost per thousand. They do not typically ask for documentation of how the underlying data was collected, what consent language was used, or whether the data subjects were informed their information would be used for advertising purposes by third parties. That is the gap the FTC is walking through.

The practical implication is that using a third-party data provider is no longer a low-risk shortcut to audience scale. It is a decision that carries liability, and the due diligence required before signing that contract has increased substantially. Marketers who went through the GDPR compliance process will recognise the pattern: what felt like excessive caution at the time turned out to be the minimum standard. The same dynamic is playing out now with FTC enforcement.

Consent Management Is Being Tested, Not Just Ticked

The consent management platform market grew rapidly in the years after GDPR. Brands bought platforms, deployed banners, and believed the compliance box was checked. What is becoming clear in 2025 is that deploying a consent banner and having a defensible consent framework are not the same thing.

The FTC has focused specifically on whether consent is genuinely informed and freely given, or whether it is obtained through interface design that pressures users toward acceptance. Dark patterns in consent flows, pre-ticked boxes, and consent language buried in lengthy terms are all areas where enforcement has landed. The question is not whether you have a consent mechanism. It is whether a reasonable person using it would understand what they were agreeing to.

That is a higher bar than most consent implementations currently meet. I have reviewed consent flows for clients where the “accept all” button was three times the size of the “manage preferences” option and rendered in a contrasting colour that drew the eye. That is a dark pattern by any reasonable definition, and it is the kind of implementation detail that regulators are now documenting in enforcement proceedings.

SMS consent is a specific area of heightened scrutiny. SMS privacy policy requirements have tightened considerably, and the FTC has been explicit that consent collected for one communication channel does not automatically extend to another. If your SMS list was built from email opt-ins without a specific SMS consent step, that is an exposure worth addressing before it is addressed for you.

What This Means for Media Planning and Budget Allocation

The enforcement environment is starting to reshape media planning decisions in ways that are not always explicit in the conversation. Channels that rely heavily on third-party data for targeting are carrying higher compliance risk than channels where the data relationship is direct. That risk is a legitimate budget input, even if it rarely appears on a media plan.

When I was managing significant ad spend across multiple clients, the efficiency conversation was almost entirely about cost per acquisition and return on ad spend. Compliance risk was a legal consideration, handled separately. That separation is becoming harder to sustain. A channel that delivers a strong CPA but exposes the organisation to an FTC investigation is not delivering the return the numbers suggest.

The practical shift I am seeing among more sophisticated marketing operations teams is a move toward channels and tactics where the data relationship is cleaner: owned email lists with documented consent, contextual targeting that does not rely on behavioural profiles, and paid search where the targeting signal is intent expressed in real time rather than inferred from historical behaviour. None of these are new ideas. What is new is the regulatory pressure making them commercially preferable rather than just philosophically appealing.

For teams running influencer programmes, the data dimension is worth examining carefully. Influencer marketing planning increasingly involves first-party data from creator audiences, and the terms under which that data is shared between platforms, creators, and brands are often poorly documented. That is an area where due diligence has not kept pace with spend levels.

The Operational Gap That Creates Most of the Risk

Most of the enforcement exposure I see in marketing organisations does not come from deliberate bad practice. It comes from operational fragmentation. The marketing team makes decisions about data use. The technology team implements them. Legal reviews the policy documentation. Nobody has a complete view of what is actually happening across the full data lifecycle.

Early in my agency career, I built a website from scratch because the budget for a proper build was not available. I learned the technical side out of necessity. That experience gave me something most senior marketers do not have: a working understanding of how the technology actually functions, not just what it is supposed to do. That gap between intended behaviour and actual behaviour in marketing technology is where most compliance risk lives.

A tag management system configured correctly in a staging environment behaves differently in production. A consent signal passed from your CMP to your ad platforms may not be received and honoured in the way your documentation assumes. These are not hypothetical risks. They are the kinds of discrepancies that surface in FTC investigations when regulators ask for evidence that the stated data practices match the actual data flows.

The detail in how analytics and session recording tools handle personal data is a useful reference point for understanding how granular these questions can get. Regulators are not looking at your privacy policy in isolation. They are looking at whether the tools you run on your properties behave in the way your policy describes.

Building the operational discipline to close this gap requires cross-functional ownership. Marketing operations needs to sit with legal, with the technology team, and with whoever manages your data infrastructure, and produce a shared view of what data is collected, where it goes, what it is used for, and what consent covers each step. That is not a one-time exercise. It is an ongoing operational function, and it needs to be treated as one.

If you are building or restructuring that function, the broader thinking on marketing operations as a discipline is worth working through systematically. The compliance dimension is one part of a larger operational maturity question.

How Agile Marketing Structures Are Responding

One of the more interesting structural responses I have observed is the integration of privacy review into campaign sprint cycles rather than treating it as a pre-launch gate. Agile marketing organisations that have embedded compliance checkpoints into their standard workflow are finding that the cost and friction of compliance drops significantly compared to organisations that treat it as a separate review process.

The analogy I use is quality assurance in software development. When QA is a separate phase at the end of a development cycle, it creates bottlenecks and expensive rework. When it is embedded throughout the process, defects are caught earlier and the overall output is more reliable. Privacy compliance in marketing works the same way. Catching a data practice issue during campaign planning is significantly less costly than catching it during an FTC investigation.

The marketing operations function is the natural home for this kind of embedded review. It sits at the intersection of campaign execution and technical infrastructure, which is exactly where the compliance decisions are made. Marketing operations as a strategic function has been undervalued for years relative to the creative and media planning disciplines. The current enforcement environment is making the case for investment in that function more commercially compelling than it has ever been.

The Measurement Problem Nobody Has Solved Yet

There is an honest conversation that the industry has not had clearly enough about what privacy-compliant measurement actually looks like in practice. The tools and methodologies that replaced cookie-based attribution are better than they were two years ago, but they are not equivalent replacements. Anyone telling you otherwise is selling something.

I spent years managing large paid search and display budgets, and the measurement frameworks we used felt precise. They were not. They were approximations that we treated as precision because the numbers came from platforms with authoritative-looking dashboards. The shift to privacy-preserving measurement has made the approximation more visible, which is uncomfortable but more honest.

The practical response is to build measurement frameworks that are explicit about their limitations rather than presenting modelled data as if it were observed data. Marketing mix modelling, incrementality testing, and controlled experiments are all more defensible approaches than last-click attribution built on third-party tracking. They are also more labour-intensive and less immediately intuitive to stakeholders who are used to seeing a clean attribution dashboard.

That stakeholder management challenge is real. Part of the work of building a privacy-compliant measurement framework is resetting expectations about what marketing measurement can and cannot tell you with confidence. That is not a comfortable conversation, but it is a necessary one, and having it proactively is better than having it forced on you by an enforcement action that calls your measurement methodology into question.

About the Author

Keith Lacy is a marketing strategist and former agency CEO with 20+ years of experience across agency leadership, performance marketing, and commercial strategy. He writes The Marketing Juice to cut through the noise and share what works.

Frequently Asked Questions