AI marketing for US small business: the FTC still reads your ads

Short answer: For a US small business, AI marketing means handing the repetitive jobs to a tool: replying to leads, drafting posts, repurposing content and building reports. It does not mean skipping the rules that already existed. There is no federal AI law, but the FTC still enforces truth in advertising against AI-written claims and reviews, several states require you to disclose a bot, and the FCC treats an AI voice call like any other robocall under the TCPA. Health practices carry HIPAA on top of that. Start with one job, budget from around US$20 a month, and treat everything AI writes as your own claim, because legally it is.

Picture the owner of a landscaping company outside Boise, Idaho, opening a chatbot for the first time on a Sunday night because a competitor across town has forty Google reviews and this business has six. The owner asks for five-star reviews, and the tool obliges, upbeat and specific, in seconds. Three go up under invented customer names before a business partner asks where these customers came from.

The tool did exactly what it was built to do. It has no idea that the FTC’s rule against fake reviews and testimonials has been in effect since late 2024, or that writing your own reviews is off limits whether a person or a machine typed them. This guide is general information, not legal advice, and a specific claim or a regulated category is worth a call to a lawyer who knows your state.

The jobs AI takes over first, and the ones it cannot

A US small business’s week already has more jobs than hours. AI earns its place on five of them:

• Lead replies. A first response to a missed call or web form, in minutes instead of by evening.
• Drafting. A first version of a web page, a Google Business Profile post, or an email, from your own notes.
• Repurposing. One finished job or case study turned into several posts.
• Ad variations. Headlines and descriptions tested against each other, once a human approves the claims (see AI ad creative).
• Reporting. Leads, sources and outcomes pulled into a one-page weekly summary instead of a spreadsheet nobody opens.

It is worse at three jobs that matter more: judgment (which customer is worth a discount, and which is not worth the headache), local trust (a neighbor believes a business that shows up at the school fundraiser, not a paragraph that mentions the neighborhood), and your margins, which it can list but not set.

All of this assumes customers can already find you. If visibility is the actual gap, see SEO, AEO and GEO in the US and ranking in Google’s AI Overviews first. For the adoption numbers behind this shift, see AI marketing statistics for the US. If the term itself is still fuzzy, start with what AI marketing is, and the three kinds it comes in.

There is no federal AI law, so which rules actually apply?

Congress has not passed a law that regulates AI marketing as its own category. Some sellers of AI tools read that gap as an invitation. It is not.

Section 5 of the FTC Act bans unfair or deceptive practices, and the FTC reads AI-made marketing exactly as it reads anything else. In 2024 the agency ran a sweep it called Operation AI Comply, targeting businesses that used AI tools to make deceptive claims, and businesses whose AI tools made deceptive claims for their customers. The tool did not write the ad; you did.

A handful of states have passed broader AI laws aimed at a different target: consequential decisions such as hiring, lending and housing, where an algorithm decides something significant about a person’s life. Colorado is the best-known example, and its effective date has already been pushed back, which tells you the ground is still moving. Typical small business marketing is not the kind of decision these laws are built for, but the list of states is growing, so check current status before assuming you are outside it.

An AI-written claim is still your claim

Whatever wrote the sentence, you are the one who published it, and the FTC’s substantiation rule does not care which one it was. “Best in town,” “#1 rated,” “saves customers 40%”: each needs evidence you hold before the ad runs, whether a copywriter typed it or a chatbot generated it on request. Confidence is not evidence.

The sharpest edge is reviews. The FTC’s rule against fake reviews and testimonials has been in effect since late 2024, and it covers AI-generated reviews the same as any other kind. Do not ask a tool to write reviews, post AI-drafted testimonials under invented names, or quote a result you cannot verify. This is the mistake the opening scene above walks into, and it is one of the easiest to avoid: real reviews take longer, but they are the only kind worth having.

One more habit: if you are not actually running AI behind a feature, do not call it “AI-powered.” That is its own claim. For the full rules on ad claims, testimonials and endorsements, see our digital advertising guide for the US.

When your chatbot or voice agent has to admit it is a bot

Two rules cover this, one for text and one for voice, and both start from the same idea: a customer can know they are talking to software.

California’s BOT Act, in force since 2019, makes it unlawful to use an undisclosed bot to mislead a person in California about its artificial identity to sell them something or influence a vote. It turns on where the customer is, not where your business is based, so if you sell to Californians online, assume it can apply to you. Utah’s 2024 AI disclosure law requires businesses to disclose AI interaction when a customer asks, and more proactively for certain regulated professions such as health care. Rather than track every state’s wording, build one habit: say it is automated, clearly, the first time it replies.

Voice is stricter than most owners expect. In February 2024 the FCC ruled that AI-generated voices count as “artificial” voices under the TCPA, so an AI voice agent calling a lead needs the same prior express written consent as a prerecorded human voice. That standard is covered in full in our marketing automation guide and AI lead generation guide. Do not point a voice agent at a list you have not confirmed consent for.

Customer data, HIPAA and the prompt box

What you type into an AI tool is where the real legal risk sits for a US business.

Roughly twenty states have passed comprehensive consumer privacy laws, led by California’s CCPA and CPRA, and the list keeps growing. A free consumer AI plan may use what you type to train its models, and customer names, emails and complaints can qualify as personal data those laws cover. Check a tool’s data retention and training settings, and use a business plan that excludes your inputs from training.

Health care carries a sharper layer on top. A dental, medical, physical therapy or mental health practice handling patient information is covered by HIPAA, which does not pause because the tool is a chatbot instead of a person. Patient names, appointments or diagnoses must not go into a tool unless the vendor has signed a Business Associate Agreement, and most consumer plans do not offer one. Marketing uses of patient information carry their own HIPAA rules on top. Get advice before any patient data touches an AI tool.

Can your business copyright AI-written marketing copy?

The US Copyright Office has taken a clear position: protection requires a human author. Material generated purely by AI, with no meaningful human contribution, is not protected, and a good prompt alone is generally not enough to count as authorship. A federal appeals court upheld that requirement in the 2025 decision in Thaler v. Perlmutter.

The practical meaning: a tagline straight out of a chatbot, unedited, is something a competitor can legally copy, because there is nothing there the law protects. What holds up is your human contribution, the edits you make, the parts you select and rearrange. Keep a record of drafts and what you changed.

For anything you consider a real asset, register it and disclose the AI-assisted parts honestly, since current guidance calls for that. This area is still developing, so check current guidance before treating AI output as something you own outright.

Spanish, regional English and keeping one brand voice

Most AI tools default to American English, which spares a US business the spelling fight UK and Canadian owners have with their tools. Tone is a separate problem: left alone, a chatbot writes in an upbeat, exclamation-heavy register that reads as generic rather than local.

The bigger gap opens in Spanish, by far the second most common language spoken in US homes. In large parts of the country a Spanish version of your marketing reaches customers your English version never will. The problem is that machine-translated Spanish tends to read as generic or noticeably Spain-flavored, when the Mexican, Puerto Rican, Cuban and Central American communities that make up most US Spanish speakers each have their own words, rhythm and references.

The fix: have a native speaker from the community you actually serve review anything before it goes out, keep a short style sheet, and never auto-publish a Spanish version straight from a translation tool.

Matching the first AI job to your kind of business

Business type	First job to hand over	The US rule that shapes it
Home services and trades	After-hours lead reply and booking	State contractor license number rules in ads
Health care practices	Review responses, written without patient details	HIPAA and the Business Associate Agreement question
Restaurants and retail	Menu updates and event posts	Allergen and pricing accuracy in every post
Professional services (law, accounting, real estate)	Intake chat and inquiry triage	State bar and licensing board advertising rules

Pick the job by where the business actually loses money today, not by what a tool vendor is selling this month. A trade business bleeds jobs to slow after-hours replies, so that goes first, with the license number rule from our digital advertising guide applied to the ad and the reply alike. A health practice should start somewhere that never touches patient data. A restaurant or retail shop should watch pricing and allergen claims on every post. A law firm, accounting practice or real estate office should let AI handle the first intake message and hand real advice to a person immediately, since most state bars and licensing boards still expect a professional behind any claim about outcomes.

What to check before you buy an AI marketing tool

Before you subscribe, run it past this list. Most answers take one email to the vendor.

• Does it train on your data, and can you opt out? Business plans usually let you turn this off. Free plans often do not.
• What is the data retention period?
• Will it sign a Business Associate Agreement if you are in health care? No BAA means the tool is off the list for patient information.
• Does it have a current SOC 2 report?
• Does it integrate with your CRM or phone system?
• Who owns the output, under the actual terms?
• Is pricing per seat or per usage? Usage-based pricing can look cheap in a demo and expensive by month three.
• Does your state charge sales tax on software subscriptions? It varies, so check yours before budgeting.

Our best AI marketing tools guide covers the shortlist in more depth.

Pricing out the first year, tier by tier

Tier	What is in it	Monthly	First-year total
DIY tools only	A consumer AI plan (about US$20) plus one automation tool (about US$90), within the US$40 to US$150 range our automation and lead generation guides cite	US$110	US$110 x 12 = US$1,320
Tools plus a paid setup	The same US$110 in tools, plus a one-time build at the low end of the cited US$2,500 to US$6,000 range	US$110	US$2,500 + US$1,320 = US$3,820
Ongoing managed help	An entry-level managed program at the smaller-market rate our cost guide puts at roughly US$2,500	US$2,500	US$2,500 x 12 = US$30,000

Media spend is not included. Move up a tier only once the one below has paid for itself.

A worked example: an HVAC company in Columbus, Ohio (hypothetical)

This is a hypothetical, built to show the arithmetic, not a real client and not measured results.

Picture an HVAC company in Columbus, Ohio, running two trucks through a hot July. The owner tracks 40 after-hours calls a month that go to voicemail. Historically about 5 of those callers, 12.5 percent, call back the next morning and book; the rest have already called a competitor by breakfast.

The business turns on an AI text-back tool: every missed call gets a text within a minute, confirming the service area and offering the next available slot. Over the following month, 15 of the 40 missed calls convert into a booked appointment, 37.5 percent, an extra 10 jobs a month. The average job is worth US$450 at a 40 percent margin, so each extra job is worth US$180 in profit: 10 x US$180 = US$1,800 extra monthly profit.

The tool costs US$90 a month, and the one-time setup cost US$2,500. Net of the tool cost, extra profit is US$1,710 a month. US$2,500 divided by US$1,710 is a payback of about 1.5 months, roughly six weeks.

Something did go wrong. In its first week, the bot quoted a flat US$89 diagnostic fee pulled from an old web page, when the real after-hours rate was US$150, and the customer was annoyed when the technician corrected it on site. The fix: the bot books and confirms, and no longer quotes prices. That change is why a rollout like this gets tested in stages, not switched on everywhere at once.

Your first sixty days, in four two-week sprints

Sprint 1, days 1 to 14: settings and policy. Pick your tools, turn off training on your data, write the one-line disclosure you will use everywhere a bot replies, and decide who reviews output before it goes out.

Sprint 2, days 15 to 28: one job live. Turn on the single highest-value job, usually the after-hours lead reply, and watch it daily.

Sprint 3, days 29 to 42: a second job. Add drafting or repurposing once the first job is stable and someone is reading its output. If Spanish matters to your customers, a native speaker joins here, not as an afterthought.

Sprint 4, days 43 to 60: review and decide. Compare the numbers below against your baseline, keep what moved a number, and name an owner for whatever stays. This is the same staged approach we use when building AI automation for clients.

Numbers that prove it is paying, and numbers that lie

Track three numbers and be suspicious of two others. Speed to first reply, minutes not hours, is the number AI moves fastest. Booked jobs, not leads or conversations, is the number that pays the bills. Cost per booked job, tool and ad spend divided by jobs booked, is the honest version of cost per lead.

Two numbers lie by looking good: posts published measures effort, not results, and chatbot conversations measures that the bot said something back, not that it closed anything.

Watch your sample size. A business with a few dozen inquiries a month can see swings of two or three jobs from ordinary noise. Give a change four to six weeks before judging it. For where these tools are heading, see the future of marketing automation.

Five ways US owners get burned

1. Posting AI-written reviews. The FTC’s rule against fake reviews and testimonials, in effect since late 2024, does not care that a machine wrote them.
2. Running an undisclosed bot or AI voice call. California’s BOT Act and the FCC’s 2024 TCPA ruling both turn on disclosure and consent.
3. Pasting patient or customer data into a consumer AI plan. A practice without a signed BAA is building a problem it will not see until a complaint arrives.
4. Publishing a claim you cannot back up. “Best,” “#1,” a specific percentage saved, all need evidence before the ad runs.
5. Assuming a translated page is fine because the grammar checks out. Correct Spanish that reads as generic tells a customer this business does not know their community.

For the cases behind this list, see the AI marketing mistakes the FTC has already brought cases over.

Reasons to hold off on AI marketing this year

Not yet, if any of this is true. Nobody currently answers your leads promptly, since AI speeds up a broken process instead of fixing it. You cannot track where a job came from, so automating on top of untracked numbers means you will never know what worked. You run a heavily regulated practice and have not had a compliance conversation with someone who knows your licensing board or state rules. Or you get a handful of inquiries a month, where a personal reply from the owner beats any automation.

Waiting costs little. Starting with a clear answer to who owns this beats starting fast.

Frequently asked questions

Is there a federal law that regulates AI in marketing in the US? No dedicated one. Section 5 of the FTC Act bans unfair or deceptive practices, and the FTC applied it to AI-made marketing through its 2024 Operation AI Comply sweep. A few states, Colorado among them, have passed broader AI laws targeting consequential decisions like hiring and lending, not typical small business marketing. Check current status, since the ground keeps moving.

Do I have to tell customers they are chatting with a bot? In California, yes in practice: the BOT Act, in force since 2019, makes it unlawful to use an undisclosed bot to mislead someone there about its artificial identity to make a sale. Utah’s 2024 law adds disclosure duties, especially for regulated professions. Disclose that a reply is automated everywhere, the first time it responds. It costs nothing.

Can I use an AI voice agent to call my leads? Only with the same consent a robocall needs. In February 2024 the FCC ruled AI-generated voices count as artificial voices under the Telephone Consumer Protection Act, so an AI voice agent calling a lead needs prior express written consent for telemarketing, the same standard as a prerecorded human voice. A list without documented consent is a TCPA problem either way.

Can a dental or medical practice use ChatGPT for its marketing? Carefully, and not with patient information. HIPAA covers dental, medical, physical therapy and mental health practices, and it does not pause because the tool is a chatbot. Patient names, appointments or diagnoses should not go into a tool unless the vendor has signed a Business Associate Agreement, which most consumer AI plans do not offer. Get advice first.

Can I copyright marketing copy that AI wrote? Not if it is purely AI-generated. The US Copyright Office requires human authorship, and a 2025 appeals court decision, Thaler v. Perlmutter, upheld that. A prompt alone is generally not enough to count as authorship. What can be protected is your human contribution, the edits, selection and arrangement you add. Keep your drafts and check current guidance before registering anything important.

Can I use AI to write customer reviews or testimonials? No. The FTC’s rule against fake reviews and testimonials, in effect since late 2024, covers AI-generated reviews the same as any other kind. Writing your own reviews, however they were drafted, is off limits, and so is posting a testimonial from a customer who does not exist. Ask real customers for real reviews, even if it takes longer.

How much does AI marketing cost a US small business each month? A single tool commonly runs US$40 to US$150 a month, and a basic consumer AI plan is around US$20, check current pricing. A done-for-you automation typically costs US$2,500 to US$6,000 once. Ongoing managed help through an agency starts around US$2,500 a month in smaller markets. Start with one tool before adding anything else.

Is AI good enough to write my Spanish-language marketing? Not on its own. Machine-translated Spanish often reads as generic or noticeably Spain-flavored, when the Mexican, Puerto Rican, Cuban and Central American communities that make up most US Spanish speakers each have their own vocabulary and tone. Have a native speaker from the community you serve review anything before it publishes, and never auto-publish a translated version straight from the tool.

---

Want to know which AI job would pay off first in your business, and which US rule applies to it? Get a free AI marketing audit. No jargon, no pressure.