H.R.7548, the Safeguarding Consumers from Advertising Misconduct (SCAM) Act, makes it unlawful for an online platform to display a paid commercial advertisement that is fraudulent or deceptive if the platform accepted payment and failed to take "reasonable steps" to prevent the ad from appearing. The bill sets concrete compliance mechanics: identity verification of advertisers, automated and manual detection systems, an active impersonation program, a user reporting tool, and specific investigation and removal timelines.
The Act ties compliance to Federal Trade Commission oversight: platforms can secure a presumption of compliance by submitting a detection program for FTC approval, while the FTC must issue implementing regulations within one year and may enforce violations as unfair or deceptive acts. The bill also strips Section 230(c)(1) immunity for these violations, preserves Section 230(c)(2), authorizes state parens patriae suits, and creates a private right of action with treble damages for willful breaches—shifting liability and operational incentives for ad-supported platforms and intermediaries.
At a Glance
What It Does
The bill prohibits paid fraudulent or deceptive ads on covered online platforms unless the platform took specified reasonable steps to prevent them. Required measures include advertiser identity verification, impersonation detection, automated and manual ad-scanning systems, a reporting tool, and strict investigation and takedown timelines.
Who It Affects
Public-facing platforms that predominantly host user-generated content (social media, social networks, virtual reality environments) that accept payment to display ads, ad-tech vendors and verification providers, advertisers and business entities buying ads, and financial institutions tied to scam payments.
Why It Matters
The Act creates a statutory duty for platforms to police paid ads and links noncompliance to FTC enforcement, state litigation, and private lawsuits—effectively narrowing Section 230(c)(1) protections for paid-ad misconduct and altering risk allocation in the online advertising ecosystem.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The SCAM Act targets paid advertising on publicly accessible platforms that function as community forums for user-generated content. It makes it unlawful to display a fraudulent or deceptive commercial advertisement when the platform accepted payment and did not take the required preventive measures.
The requirement is conditional: a platform that can demonstrate it took ‘‘reasonable steps’’ as described in the bill may avoid liability; the bill sets out what those steps look like and how compliance is established.
On the operational side, the bill requires platforms that accept payment to implement advertiser identity verification (including government ID or business documentation), programs to detect and mitigate impersonation, automated and manual ad-detection systems, and a clear reporting tool for users and governments. It also mandates procedural timelines: when a platform or a reporter flags an ad, the platform must investigate within 72 hours and notify the reporter within 24 hours of concluding the investigation; if a violation is found the platform must remove the ad within 24 hours of that determination.Enforcement is multi-layered.
The Federal Trade Commission must write implementing regulations within one year and may treat violations as unfair or deceptive acts under existing FTC law; the FTC reviews and can approve platforms’ detection programs, creating a path to a rebuttable presumption of reasonable steps. States’ attorneys general may bring parens patriae suits (with notice and potential FTC intervention), and the Act creates a private right of action allowing injured persons to seek injunctive relief, actual damages (with discretionary trebling for willful violations), restitution, and attorney’s fees.
The bill explicitly removes Section 230(c)(1) protection for these violations while preserving 230(c)(2) safe harbor for good-faith content removal.The bill also directs the FTC to prepare a report within nine months, in consultation with other agencies, assessing regulatory gaps related to scam-driven financial transactions, whether better information-sharing is needed between platforms and financial institutions, and possible additional statutory authorities. Finally, the Act defines key terms—limiting ‘‘online platform’’ to public-facing UGC-centered services and defining ‘‘deceptive’’ in alignment with FTC jurisprudence but limited to practices likely to cause financial harm—shaping the perimeter of who and what falls under the law.
The Five Things You Need to Know
The bill requires platforms that accept payment to investigate reported or detected suspect ads within 72 hours and to notify the reporter of the investigation’s outcome within 24 hours of concluding it.
Platforms are presumed to have taken "reasonable steps" only if they submit a fraudulent-ad detection program to the FTC, obtain FTC approval, and demonstrate active enforcement and resourcing of that program.
Section 230(c)(1) immunity does not apply to violations of this Act, but Section 230(c)(2) protections for good-faith removal remain expressly preserved.
The bill creates a private right of action permitting actual damages, injunctive relief, and, for willful or knowing violations, discretionary treble damages; plaintiffs can sue up to 5 years from discovery.
The FTC must issue implementing regulations within 1 year of enactment and must review those regulations annually; the FTC enforces violations under its existing unfair-or-deceptive authority.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Core prohibition on paid fraudulent or deceptive ads
This subsection makes it unlawful for an online platform to display a paid advertisement the platform knows or should have prevented if it accepted payment and failed to take the statutory "reasonable steps." The provision ties liability to paid placement: unpaid or organic user content is outside the text’s express prohibition unless the platform took payment. Practically, this channels enforcement toward the paid-ad pipeline and the platform functions that process advertiser onboarding and ad serving.
Minimum procedural compliance requirements
The bill lists mandatory procedures platforms must implement to qualify as taking reasonable steps: identity verification of advertisers (legal name, physical location, government ID or business documentation, contact info, and anti-circumvention measures), an active impersonation detection program, automated and manual ad-detection systems, and a conspicuous user reporting mechanism. These are prescriptive baseline controls that will push platforms to standardize onboarding and continuous monitoring practices and to integrate vendor solutions for identity proofing and fraud detection.
Investigation, takedown and reporting timelines
When an ad is reported or flagged by a platform’s detection system, the platform must investigate within 72 hours and notify the reporter within 24 hours after concluding the investigation. If the platform determines the ad violates the Act, the ad must be removed within 24 hours of that determination; the bill also allows platforms to remove ads earlier during an investigation. These timelines create predictable operational SLAs but may be challenging for complex cross-border or payment-integrated fraud investigations.
FTC rulemaking and enforcement framework
The FTC must promulgate implementing regulations under the Administrative Procedure Act within one year and review them annually. Violations are treated as unfair or deceptive acts under the FTC Act, giving the Commission its existing investigatory, injunctive, and remedial toolkit; penalties and privileges available under the FTC Act apply. Crucially, the FTC also approves platform detection programs for the presumption of compliance, creating a de facto certification role that will shape enforcement practices.
State parens patriae authority and coordination with FTC
State attorneys general may sue on behalf of residents for violations, seeking injunctions, restitution, damages, and other relief. The Act requires state notice to the FTC before suit (with narrow exceptions) and allows FTC intervention; if the FTC already has a pending civil action against a defendant, states are barred from bringing parallel suits. This provision creates parallel enforcement channels but builds in coordination so the FTC can centralize major actions while states pursue local harms.
Private right of action with fee-shifting and treble for willfulness
Individuals injured by violations can sue in federal court for injunctive relief, actual damages, restitution, and other equitable remedies; courts must award litigation costs and reasonable attorneys’ fees to prevailing plaintiffs. If a court finds willful or knowing misconduct, it may treble damages. The private right of action is subject to a 5-year statute of limitations measured from discovery, which significantly increases litigation risk for platforms and could drive litigation-driven compliance.
Interaction with Section 230, reporting requirement, and definitions
The Act strips Section 230(c)(1) immunity for covered violations but preserves 230(c)(2) protections for good-faith moderation. It directs the FTC to produce a report within nine months assessing regulatory gaps related to scam-driven financial transactions and potential information-sharing mechanisms with financial institutions. Definitions narrow the law’s scope: "online platform" is limited to public-facing UGC-centered services, and "deceptive" is tied to established FTC meaning but limited to practices likely to cause financial harm, which will shape both applicability and enforcement focus.
This bill is one of many.
Codify tracks hundreds of bills on Technology across all five countries.
Explore Technology in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Older adults and frequent social-media users—The bill targets channels where scammers disproportionately contact adults aged 18–29 and older consumers, aiming to reduce exposure to paid scam ads and financial loss by forcing platforms to filter paid content more thoroughly.
- Small and legitimate businesses impersonated by scammers—By requiring impersonation detection and advertiser verification, the bill helps reduce fraudulent pages and ads that steal reputation and redirect customers.
- Consumers who fall victim to scam-driven payments—The private right of action, state enforcement, and FTC remedies create additional recovery paths and deterrence, potentially increasing restitution outcomes for victims.
Who Bears the Cost
- Large online platforms and ad-tech vendors—They must operationalize identity-proofing, detection systems, impersonation programs, reporting tools, and fast investigation workflows, incurring engineering, vendor, and compliance costs and potential liability exposure if FTC approval isn’t obtained.
- Smaller platforms and niche UGC services—Platforms with limited resources face a disproportionate compliance burden; identity-verification and manual review capacities may be costly and could force smaller services to restrict paid advertising or exit ad-supported models.
- Advertisers and onboarding intermediaries—Advertisers must provide government IDs or business documentation and withstand more rigorous verification, increasing friction for legitimate advertisers and raising operational burdens for ad agencies and programmatic exchanges.
Key Issues
The Core Tension
The Act confronts a classic trade-off: tighten platform accountability to reduce financially harmful scam ads versus the risks of overbroad moderation, privacy intrusion through identity verification, and heavy compliance costs—especially for smaller platforms—while shifting dispute resolution into a multi-forum enforcement environment that could create inconsistent outcomes.
The bill creates enforcement and operational clarity in some respects but leaves significant implementation questions. The definition of "online platform" is tethered to "predominantly" providing community forums for user-generated content; that threshold will matter in borderline cases (news sites with comments, commerce platforms, publishers using paid ads) and could lead to litigation over coverage.
The statute prescribes verification and detection program elements, yet does not spell out technical standards, leaving the FTC’s rulemaking and program-approval process to determine practical compliance expectations—an approach that centralizes standard-setting but may produce regulatory uncertainty during the approval window.
Tensions also arise between identity-verification requirements and privacy or speech concerns. Requiring government IDs and business documentation to buy ads will reduce anonymity for bad actors but may chill small or sensitive-issue advertisers and raise data-protection risks; the bill does not include specific data-minimization, retention, or cross-border transfer safeguards.
Operational timelines (72-hour investigations; 24-hour notifications and takedowns) create tight SLAs that may reduce scam exposure but also increase false-positive removals and operational strain when fraud traces to multiple jurisdictions or involves complex payment chains. Finally, the combination of FTC enforcement, state AG suits, and private litigation increases deterrence but raises the risk of duplicative litigation and inconsistent remedies unless the FTC’s coordinating role proves decisive.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.