FTC, SEC Scrutiny Raises Stakes for AI Data Disclosures

Updating privacy policies or terms of service after introducing AI features can leave companies exposed to regulatory scrutiny and customer disputes, according to an analysis by Gouchev Law.

The analysis identified a shared expectation across the Federal Trade Commission, Securities and Exchange Commission and European authorities. Companies must accurately explain their AI practices to users. For businesses, that means connecting disclosures to actual data flows, vendor arrangements and model development, while addressing changes before they take effect.

The FTC’s concern centers on companies collecting information under one set of promises and subsequently expanding its use without adequate transparency, the analysis said. A business that pledged not to share customer information without consent, for example, could face exposure if it later sends chat transcripts to an outside AI provider for optimization.

The analysis cited FTC guidance warning that adopting more permissive data practices through a “surreptitious, retroactive amendment” to contractual terms or privacy policies may be unfair or deceptive. Adding language after processing practices have changed does not resolve the underlying mismatch between the original promise and subsequent conduct.

Timing and consent, in other words, matter alongside the substance of disclosures. The analysis cautioned against assuming that a routine terms-update email, a website footer link or continued product use establishes adequate acceptance of a material change. Companies should address how customer inputs will be used before collecting them, particularly when those inputs could train generative AI models.

Broad statements that information helps improve services may not cut it if they fail to explain consequential AI uses, per the analysis. If systems can analyze behavior, generate personalized content, predict outcomes, recommend decisions or refine internal and third-party models, policies and customer agreements should describe specifically the nature and purposes of those activities.

The SEC’s focus adds another dimension. AI disclosures must accurately reflect how systems are developed, trained and deployed, the analysis said. Marketing narratives that overstate capabilities or mischaracterize actual use can create disclosure risk. The FTC likewise scrutinizes misleading product claims, user representations and omissions of material limitations.

European data protection and consumer authorities, meanwhile, are applying transparency, accountability and purpose-limitation principles to AI practices, according to the analysis. AI-specific frameworks add expectations regarding risk classification, governance and controls throughout a system’s lifecycle. Businesses need consistency between operational reality and representations to users, partners and regulators.

Liability can also arise through customer contracts. The analysis cited an unnamed company that introduced chat summarization through a third-party AI model. The vendor retained and reused customer content for model improvement, and confidential material surfaced in other customers’ workspaces.

The company’s agreements did not disclose or restrict that reuse, which conflicted with confidentiality and permitted-use representations. The dispute involved breach-of-contract allegations and ended in a six-figure settlement, according to the analysis. The example illustrated how vendor practices can undermine a company’s own promises.

To reduce exposure, the analysis recommended a coordinated assessment by legal, product and engineering teams. Businesses should inventory deployed AI systems and forthcoming features, identify the information each system accesses, and map external vendors and APIs involved in processing.

That assessment should guide updates to customer agreements, privacy policies and terms of use. Documents should specify what information is collected, processed and stored; how models interact with it; which providers participate; and whether users can opt out, the analysis said.

Vendor agreements also need to address retention, model training and reuse consistently with customer commitments. Policies should be reviewed as products evolve, with legal and compliance teams involved before deployment, per the analysis. The objective is to make disclosures an accurate account of existing operations and planned changes, reducing the gaps that invite enforcement and contractual claims.

For all PYMNTS AI coverage, subscribe to the daily AI newsletter.