This article is for general informational purposes and isn’t a substitute for legal advice. If your business runs influencer or sponsored campaigns, it’s worth having an attorney review your disclosure and privacy practices directly.
Hundreds of millions of people use social media every day, and that includes the businesses marketing to them. Platforms like Instagram, TikTok, and X have reshaped how brands reach customers, but the legal rules around that marketing haven’t stood still. Endorsement disclosure requirements have tightened, enforcement has picked up, and data privacy laws now touch almost every campaign that collects an email address or drops a tracking pixel.
Here’s where the law actually stands in 2026, and what it means for your brand’s social strategy.
FTC disclosure rules for sponsored content and influencers
If your business works with influencers, or if your own team posts about your products, the Federal Trade Commission’s Endorsement Guides apply. The core rule is simple: if a post is paid, gifted, or otherwise tied to a “material connection” between the poster and the brand, that connection has to be obvious to an ordinary viewer, not buried in a wall of hashtags or a bio link.
The FTC revised its Endorsement Guides in 2023, and the update clarified two things that trip up a lot of brands. First, a “material connection” is broader than a cash payment. Free products, discounts, affiliate commissions, and even early access to a product before launch all count. Second, a platform’s built-in disclosure tool, like Instagram’s “Paid Partnership” label, isn’t automatically enough on its own. The responsibility for a clear, conspicuous disclosure sits with the brand and the influencer, not the platform.
Enforcement has caught up with the guidance. Recent years have seen class action lawsuits against major consumer brands over undisclosed influencer partnerships, along with FTC scrutiny of hidden endorsement networks paid through personal accounts rather than transparent sponsorship deals. Civil penalties for violations can run well into the tens of thousands of dollars per instance, and the FTC adjusts that figure periodically. AI-generated reviews and testimonials are now squarely on the FTC’s radar too: content simulating a real customer opinion still needs disclosure if there’s a brand relationship behind it, generated or not.
What this means in practice for your business:
- Put “Ad” or “Sponsored” at the start of a caption or within the first seconds of a video, not after a “see more” cutoff
- Disclose on every sponsored post, story, and livestream segment, not just the first one in a series
- Treat platform tags as a supplement to your own disclosure, not a replacement for it
- Have a written influencer agreement that spells out disclosure requirements, and keep records showing you monitored compliance
Data privacy laws touch your social media strategy more than you’d think
Running ads, building custom audiences, or collecting entries for a giveaway all involve handling personal data, and that pulls your social campaigns into a growing patchwork of privacy law. California’s privacy law (CCPA/CPRA) was the first major U.S. state law of its kind, but a majority of states now have their own version, each with slightly different rules on consent, opt-outs, and what counts as a “sale” of data. If your audience includes anyone in the EU or UK, GDPR requirements apply as well.
For most brands, the practical takeaways are narrower than the legal landscape sounds: have a privacy policy that actually describes what your pixels and tracking tools collect, give people a real way to opt out, and don’t collect more personal information through contests or lead forms than you’re prepared to secure and disclose properly.
Contests, giveaways, and sweepstakes rules
A giveaway is one of the fastest ways to run into legal trouble on social media, mostly because “no purchase necessary” rules and official terms aren’t optional extras. If entrants can pay, follow, tag, or share to boost their odds, most U.S. states require a free alternate method of entry, published official rules, and clear eligibility terms. Platforms layer their own promotion guidelines on top of that, and running a contest that technically violates a platform’s rules (like requiring a share to enter, where the platform prohibits it) can get your account restricted independent of any government enforcement.
Copyright and using other people’s content
Reposting a customer’s photo, using trending music in a Reel, or pulling a stock image off Google all carry copyright risk if you don’t actually have the rights to use them. Getting written permission or a proper license before reposting user-generated content, and sourcing music and images from licensed libraries rather than the open web, avoids the vast majority of takedown notices and cease-and-desist letters brands run into. If your team is regularly repurposing customer photos or influencer content, it’s worth having a standard permission request built into your workflow rather than asking case by case.
Employee social media policies
Employees posting on personal accounts still create legal exposure for the business they work for, particularly around confidential information, harassment, and unauthorized statements that look like they’re speaking for the company. A written social media policy that spells out what employees can and can’t share, and who’s authorized to speak on behalf of the brand, is one of the simplest protections a business can put in place. It’s also worth pairing with basic training, since most employee social media incidents come from a lack of awareness rather than intentional misconduct.
Social Media and the Law FAQ
Do I have to disclose free products, not just paid partnerships?
Yes. The FTC treats free or discounted products as a material connection, the same as cash payment, and it requires disclosure either way.
Is an Instagram “Paid Partnership” tag enough on its own?
Not necessarily. The FTC has stated that platform disclosure tools can help, but the ultimate responsibility for a clear, visible disclosure rests with the brand and the influencer.
What happens if my business doesn’t comply with FTC disclosure rules?
Consequences range from FTC enforcement action and civil penalties to private class action lawsuits, both of which have become more common in the past few years.
Does GDPR apply to a U.S. business running social media ads?
It can, if your ads or data collection reach people located in the EU or UK, regardless of where your business is based.
Build a social strategy that holds up
Legal compliance works best when it’s built into your strategy from the start, not bolted on afterward. If you’re weighing which platforms to prioritize, our roundup of the top social media platforms for brands is a good starting point, and our overview of the social media life cycle covers how trust and transparency (the same values disclosure rules protect) factor into long-term audience relationships.
If influencer partnerships or user-generated content are part of your plan, make sure your creative sourcing lines up with your compliance obligations. Our guide to optimizing Instagram images is a useful reference once you’ve confirmed you actually have the rights to what you’re posting. For B2B teams building out sponsored or partner content specifically, our guide to social media for B2B lead generation and our breakdown of current social media trends both cover how disclosure and transparency now factor into audience trust and, in turn, performance.
Not sure whether your current social campaigns are compliant? Get in touch and we’ll help you review your strategy from both the marketing and the compliance side.
Source: www.cartwrightking.co.uk
About The Author
