A fake ad does not need to reproduce a campaign perfectly. It only needs enough of the brand name, product footage or customer-support language to move someone to the wrong account or domain.
When that happens, the useful question is not simply whether the ad is fake. The brand must be able to show which legal entity is genuine, which accounts are authorised, who owns the creative, and where an official click should end. That makes brand authenticity a production deliverable, not only a legal escalation.
What changed in 2026—and what did not
On September 24, 2026, the US Federal Trade Commission said it was considering an update to its Government and Business Impersonation Rule, or other action, focused on online platforms. The related Advance Notice of Proposed Rulemaking was published on October 1, with comments due by November 30, 2026.
This is not a final rule imposing a new platform-liability regime. The FTC is collecting evidence about whether ad-optimisation services—including ad copy creation, image and video generation, targeting and delivery—further impersonation scams, and what action might be appropriate.
The record cites more than one million imposter reports and nearly $3.5 billion in reported consumer losses during 2025. Those figures describe the FTC's US record, not a global advertising benchmark. Their strategic value is narrower: impersonation is now being examined alongside the same automation that legitimate advertisers use to produce and distribute campaigns.
Verification is infrastructure, not a cure
Google's advertiser-verification policy says the programme is gradually expanding to all advertisers. Verification can cover identity or business operations, while disclosures and the Ads Transparency Center may show information such as an organisation's name and location, creatives, and dates and locations where ads ran. Significant changes to a payments profile or business information can lead to reverification.
TikTok's business-verification guidance was updated in September 2026. It connects verification across Ads Manager, Business Center and client companies; in some markets, a spend threshold can trigger a verification deadline. Legal names, websites, certificate details and account data need to match, while exact thresholds vary by country or region.
These systems help platforms identify an advertiser. They do not automatically prove that:
- an agency, reseller or creator remains authorised to publish for the brand;
- a copied or AI-modified cut remains within the original licence;
- a support number, redirect or landing domain belongs to the real business; or
- the brand can assemble evidence quickly enough for a platform report or investigation.
The gap between platform verification and operational proof is where brands lose time.
The ONCE four-layer Brand Authenticity Pack
The pack should not put incorporation records, contracts and source files into one public folder. It should separate public facts, platform-only documents and access-controlled internal records.
1. The entity card
Record the legal entity, approved brand names, registration jurisdiction, official domains, public support channels and a security contact. Where a distributor or local billing entity is involved, distinguish brand owner, advertiser, payer and operator.
Consistency matters more than volume. A legal document, payments profile, privacy notice, app-store listing and website footer that use conflicting names create friction when platforms try to connect them to one organisation.
2. The publishing-authority map
Map Business Centers, ad accounts, pages, channels, agencies and creator accounts. Each node should have an owner, administrators, approved markets, purpose, start date, expiry date and revocation route.
This map answers a question a logo cannot: is the account publishing the logo still authorised to represent the brand? An agency change, distributor termination, employee departure or regional-account transfer should trigger a permissions review.
3. The creative-authorisation envelope
For each master asset, record its ID, source-file location, approved product and trademark use, talent and voice permissions, music and stock licences, approved claims, and permitted edits. State whether translation, dubbing, cropping, synthetic extension or AI regeneration is allowed.
For AI-assisted work, brands can connect this envelope to a content-provenance delivery record. The distinction matters: provenance explains what happened to a file; an authenticity pack explains who may publish it as the brand. The C2PA 2.4 human and organisational identity recommendation provides a way to express organisational identity in Content Credentials, but it does not replace advertiser verification or commercial permission.
4. The destination proof chain
Record official domains, approved subdomains, final landing pages, redirect rules, support numbers, payment or app-download destinations, and responsibility for short links and tracking parameters. For higher-risk campaigns, retain page captures and a trace from ad preview to final destination.
Many impersonation campaigns do not copy every visual detail. They borrow enough brand recognition to send the user somewhere else. Reviewing only the creative misses the decisive part of the journey.
Maintain the pack through events, not annual housekeeping
Three events should trigger an update:
- Entity events: a name change, merger, billing-entity change or distributor change updates the entity card and may require platform reverification.
- Channel events: a new market, account, agency or creator relationship enters the authority map before publishing access and assets are released.
- Creative or destination events: a claim, performer, music licence, AI use, domain or support channel change refreshes the creative envelope and destination chain.
Not every campaign needs the same depth. A short, organic post published from one owned account can use a light version. A paid campaign spanning markets, agencies and ad accounts—or involving customer support, financial information, celebrity likenesses or synthetic media—needs the full pack.
A practical cost comparison is:
Authenticity operating cost per approved deployment = (initial documentation + verification and reverification + rights mapping + destination checks + monitoring and response + archive maintenance) ÷ approved market–account–destination combinations.
The denominator is not the number of exported videos. It is the number of deployment combinations with an identified entity, account, creative and destination.
Assign one answer to each owner
Marketing owns the approved brand names, markets and destinations. The media agency owns the live account and administrator map. Legal or brand protection defines rights and reporting positions. Production owns master IDs, source-file references, permission attachments and the version history.
A production partner cannot guarantee that a platform will accept a report or that impersonation will never occur. It can make the original asset, approval trail and permitted variations legible at handoff. The brand still needs one authenticity owner who can assemble the package when verification, an agency transition or an impersonation incident occurs.
The next cross-border campaign production brief should therefore answer four questions before the first cut: which entity is advertising, which accounts may speak for it, how the creative may change, and where a legitimate click must end. Those answers are less glamorous than the hero frame, but they determine whether the brand can prove itself when the hero frame is copied.
Sources and scope
This analysis uses the FTC announcement and October 1, 2026 ANPRM, current Google Ads advertiser-verification policy, TikTok for Business verification guidance updated in September 2026, and the C2PA 2.4 organisational identity recommendation. Platform requirements and the FTC proceeding may change. This is a production and governance framework, not legal advice.
