The SCAM Act targets fraud delivered through paid online advertisements by making the host platform legally responsible when it takes payment but fails to take adequate steps to prevent scams. Rather than focusing on the underlying scammers, the bill forces platforms to build identity verification, impersonation detection, and ad-review systems—or face enforcement by the Federal Trade Commission, state attorneys general, and private plaintiffs.
For professionals: this bill realigns operational risk to platforms and ad intermediaries, requires significant technical and compliance investments, and opens the door to wide-ranging enforcement and private litigation. It also removes Section 230(c)(1) defenses for this class of paid ads, which could reshape platform-advertiser relationships and ad-moderation practices across the industry.
At a Glance
What It Does
The bill makes it unlawful for an online platform to display a fraudulent or deceptive paid advertisement if the platform accepted payment and did not take ‘‘reasonable steps’’ to prevent the ad from appearing. It defines a set of required procedures (advertiser identity verification, impersonation detection, automated and manual ad-review, and a user reporting tool) and sets reporting, investigation, and removal obligations.
Who It Affects
Public-facing social platforms, apps, and virtual environments that host user-generated content and accept paid advertising; ad networks and intermediaries that sell or place paid ads; legitimate small businesses that advertise; and the Federal Trade Commission and state attorneys general who will enforce the law.
Why It Matters
The bill replaces a predominantly ex post enforcement model against scammers with an ex ante compliance regime on platforms, coupled with FTC rulemaking, presumptive compliance if a platform’s program is FTC‑approved, and a new private right of action—creating both compliance incentives and litigation risk for platform operators.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The statute targets paid advertisements shown on public-facing websites or apps that predominantly host user-generated content. If a platform accepts payment to display an ad, the bill makes the platform responsible for taking ‘‘reasonable steps’’ to prevent the ad from being fraudulent or deceptive.
The text then lists the core compliance obligations platforms must implement: verifying advertiser identity, running active impersonation detection, operating both automated and manual ad-detection systems, and providing a clear tool for users to report suspected scam ads.
When a report is filed or the platform’s detection system flags an ad, the platform must investigate within a short window and communicate outcomes to the reporter. If the platform determines the ad violates the Act, it must remove the ad promptly; the statute also permits platforms to take down ads during an investigation.
The bill creates a ‘‘presumed compliance’’ pathway: platforms can submit a detection program to the FTC, and if the Commission approves and the platform demonstrates enforcement and resources for the program, the platform is presumed to have taken reasonable steps.Enforcement is multi‑layered. The Federal Trade Commission gets authority to promulgate implementing regulations within one year, to treat violations as unfair or deceptive practices under the FTC Act, and to use its full enforcement toolkit.
State attorneys general may sue as parens patriae after providing notice to the FTC, and private parties injured by violations can sue for injunctive relief, actual damages, and potentially treble damages for willful violations, plus costs and attorney’s fees. The bill expressly removes Section 230(c)(1) protections for violations of this statute, while preserving other Section 230(c)(2) protections.The statute also mandates an FTC report within nine months assessing regulatory gaps and information-sharing between platforms, financial institutions, and regulators, and requires annual review of the FTC’s implementing rules.
Finally, the bill defines ‘‘deceptive’’ narrowly for purposes of the Act (material misrepresentations likely to cause financial harm) and limits the covered ‘‘online platform’’ to public-facing services that predominantly provide community forums for user-generated content.
The Five Things You Need to Know
Platforms must verify advertiser identity before placing paid ads, including legal name, physical location, government‑issued ID for individuals, or business documentation and the purchaser’s relation to the entity.
If a platform flags or receives a report about a suspect ad, it must start an investigation within 72 hours and notify the reporter of the outcome within 24 hours of concluding the investigation.
Platforms that submit an ad‑detection program and receive FTC approval, and that can demonstrate active enforcement and adequate resources, obtain a ‘‘presumed compliance’’ defense against liability under the Act.
The FTC must issue implementing regulations within 1 year and review those regulations annually; violations are treated as unfair or deceptive acts under the FTC Act and enforceable by the FTC.
The bill creates a private right of action with actual damages, injunctive relief, costs, and fees, and allows courts to triple damages for willful or knowing violations; state attorneys general may also sue as parens patriae.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Short title
Gives the bill the name ‘‘Safeguarding Consumers from Advertising Misconduct Act’’ or ‘‘SCAM Act.’
Congressional findings
Sets the factual and policy predicate for the legislation—FTC and AARP data on scam losses, the role of social media in initiating scams, and a critique of how courts have interpreted Section 230. These findings frame the statute’s focus on paid ads and justify removing Section 230(c)(1) protection for those ads; they also signal Congressional intent to prioritize consumer financial harms in agency interpretation.
Core prohibition and required platform procedures
Subsection (a) creates the central prohibition: an online platform that accepts payment and fails to take ‘‘reasonable steps’’ to prevent a fraudulent or deceptive paid ad may be liable. Subsection (b)(1) enumerates required procedures platforms must establish before accepting paid ads: identity verification (legal name, physical location, government ID or business documents, and anti‑circumvention measures), an active impersonation program, automated and manual detection systems, and a conspicuous user reporting mechanism. Practically, platforms will need onboarding workflows, identity document capture and verification, machine‑learning and human review pipelines, and escalation processes tied to the statutory timelines.
Investigation and ‘‘presumed compliance’’ pathway
When an ad is reported or flagged, subsection (b)(2) forces a fast‑moving investigatory clock (investigate within 72 hours; notify the reporter within 24 hours of concluding). Platforms may remove ads during investigations. Subsection (b)(3) creates a compliance incentive: if a platform submits its detection program to the FTC, obtains approval, and can show active enforcement and resourcing, the platform receives a statutory presumption it took reasonable steps—shifting the focus of enforcement disputes to whether a program was FTC‑approved and actively applied.
FTC rulemaking and federal enforcement
The FTC must issue implementing regulations under the Administrative Procedure Act within one year and review them annually. Violations are characterized as unfair or deceptive acts under the FTC Act, giving the FTC its full suite of investigatory and remedial powers. Expect the rulemaking to define ‘‘reasonable steps,’’ minimum verification standards, and procedural details for program submissions and demonstrations of enforcement.
State enforcement and private causes of action
States retain parens patriae authority to sue on behalf of residents with notice to the FTC and limited preemption while the FTC litigates. The bill also creates a private right of action for injured persons with actual damages, injunctive relief, and fee-shifting; courts can treble damages for willful or knowing violations. That combination multiplies enforcement channels and introduces potential for concurrent federal, state, and private suits.
Relationship to Section 230 and preemption
The statute explicitly removes Section 230(c)(1) immunity for violations of this Act, while preserving Section 230(c)(2) protections (Good Samaritan blocking). It also states it does not preempt state or local laws, creating overlapping federal and state enforcement regimes that platforms must navigate.
Regulatory report on scams and payments
Requires an FTC report within nine months, in consultation with other agencies, assessing regulatory gaps for scam-related financial transactions, the need for better information‑sharing between platforms, financial institutions, and regulators, and recommendations for further statutory or administrative tools. The report can prompt additional rulemaking or legislative proposals around payments and information flows.
Definitions
Defines core terms: ‘‘Commission’’ (FTC); ‘‘deceptive’’ (aligned with the FTC Act but limited to material misrepresentations likely to cause financial harm); and ‘‘online platform’’ (public‑facing services that predominantly provide a community forum for user‑generated content). The ‘‘predominantly’’ qualifier creates granularity about who is covered and will be central to disputes over scope.
This bill is one of many.
Codify tracks hundreds of bills on Technology across all five countries.
Explore Technology in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Consumers—especially targets of financial scams—gain stronger preventive protections and greater avenues for recovery through FTC actions, state suits, and private lawsuits, improving potential deterrence and restitution.
- Legitimate small and local businesses that are impersonated or unfairly displaced by scam ads will see reduced impersonation and a clearer system for reporting and removing fraudulent listings, lowering fraud-related reputational and financial harms.
- Law enforcement and regulators (FTC and state AGs) gain statutory clarity and new tools to force platform-level remediation and to prioritize systemic interventions over chasing individual scammers.
- Payment processors and financial institutions could benefit indirectly if the FTC’s required report and follow-up actions lead to better information‑sharing protocols that reduce payment‑stage losses.
Who Bears the Cost
- Large online platforms and ad intermediaries must invest in onboarding, identity‑verification systems, machine‑learning detection, expanded human review teams, documentation to satisfy FTC program approval, and legal defenses—raising operational and capital costs.
- Small publishers, independent app developers, and niche platforms may face disproportionate compliance burdens or market exclusion because the verification and detection requirements favor larger firms with compliance budgets.
- Ad networks and programmatic intermediaries will face increased contractual and due‑diligence obligations and potential liability exposure if they accept or place paid ads that later prove deceptive.
- Privacy‑conscious advertisers and users confront new data collection (government IDs, business documents) and identity‑verification flows that create privacy and data‑security obligations—and potential compliance costs if breaches occur.
Key Issues
The Core Tension
The act confronts a classic trade‑off: it aims to protect consumers’ financial safety by making platforms proactively accountable, but doing so forces platforms to collect sensitive identity data, scale expensive detection and human‑review systems, and accept a high litigation burden—raising privacy, free‑speech, and market‑concentration concerns while delivering stronger consumer protections.
Implementation will hinge on definitional lines and the FTC’s rulemaking. The statute’s coverage depends on the statutory definition of ‘‘online platform’’—limited to services that ‘‘predominantly’’ provide community forums—which creates ambiguity about publisher sites, programmatic ad exchanges, and niche vertical platforms.
That ambiguity will drive early litigation and agency guidance requests.
The combination of an FTC enforcement program, state parens patriae suits, and a broad private right of action creates a triad of enforcement that could produce duplicative litigation, parallel discovery, and inconsistent remedies. The ‘‘presumed compliance’’ pathway shifts many disputes to the FTC’s approval process and whether platforms can document active enforcement; but obtaining approval and demonstrating meaningful enforcement may itself be costly, slow, and contestable.
Additionally, identity verification and document collection introduce data‑security and privacy risks—platforms will need to balance fraud prevention with compliance under privacy and data‑breach laws, and small advertisers may be priced out or face friction that drives them to non‑covered channels.
Operationally, the statutory timeframes (investigate within 72 hours; notify reporter within 24 hours after concluding) are tight and will pressure platforms’ triage and escalation systems. False positives are a realistic risk: aggressive removal during investigations can protect consumers but also remove legitimate advertisers and raise free‑expression concerns.
Finally, the explicit carve‑out of Section 230(c)(1) for these paid ads will trigger doctrinal battles over the scope of publisher immunity and could create incentives for platforms to reroute ad monetization models to avoid coverage.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.