The victims in the Cox Media Group case were not the people whose conversations were supposedly being listened to. Nobody was listening. There were no conversations.

The victims were the businesses that bought the advertising.

That detail is why this case belongs in a procurement conversation rather than a privacy one. Companies paid for an AI capability, took the vendor’s description at face value, and the capability did not exist.

The sentence worth stealing from the FTC

Across these orders the FTC uses a formulation that is more useful as a purchasing test than as a regulation. A company may not represent the effectiveness of an AI product unless it holds competent and reliable evidence supporting that representation at the time it is made, and retains that evidence.

At the time it is made. And retained.

Run that against any vendor deck you have received this year. Most cannot answer it, and the ones who can will hand you the file in a day.

Workado is not a story about a made-up number

Workado sold an AI content detector and advertised 98.3% accuracy at identifying AI-generated text. Independent testing cited by the FTC measured 53% on general-purpose content. A coin flip with extra steps.

What caused the gap is worth sitting with. The company said the detector was trained on a vast amount of material including blog posts and Wikipedia entries. It was actually trained on abstracts of scholarly articles. And it was never tested on marketing copy or plain language, which is what customers were feeding it.

The 98.3% was probably real. On academic abstracts.

Domain mismatch between where you measured and where you sell is the most common defect in AI products, and a demo will never surface it, because the vendor builds the demo from examples that sit inside the measured domain. The final consent order landed in August 2025 under docket 232-3092.

There is a cheap way to catch this before you sign. Take twenty samples of your own real content, the messy kind with your jargon and your formatting, and hand them to the vendor to run live in front of you. Not their examples. Yours. A vendor whose measurement holds in your domain will happily do it, and one whose number came from somewhere else will suddenly need a scoping call. That test takes an hour and it is the closest thing to the evidence standard you can run yourself.

Same standard, a year later, with money attached

In May 2026 the FTC charged CMG Media Corporation together with MindSift and 1010 Digital Works over a service marketed as Active Listening. The pitch was that a special algorithm listened to and detected relevant conversations picked up by smart devices, so advertisers could target a geographic area.

The service used no voice data. Consumers had never opted in.

The orders were finalized in August 2026 on a 2 to 0 Commission vote. CMG paid $880,000, the two smaller firms $25,000 each, and the money goes to redress for CMG’s customers.

Two years into Operation AI Comply, which the FTC launched in September 2024, the pattern in these cases is consistent. The claim outran the evidence, and the buyer never asked for the evidence.

Four questions, then one clause

When a vendor puts an accuracy figure on a slide, ask in writing which dataset produced it, how closely that dataset resembles yours in language, format, length and jargon, who ran the measurement, and on what date and model version.

If the first answer is vague the other three stop mattering.

We have applied the same discipline to other vendors before, in Anthropic’s copyright settlement and vendor due diligence, and looked at what happens when a large firm publishes without checking in PwC’s hallucinated citations.

Then put two lines in the contract. The vendor represents that it retains the evidence supporting every published performance figure, and will produce it within ten business days on request.

That clause costs nothing to draft and saves you the year the FTC needs.

At IQ Source that folder is the first deliverable whenever a new AI vendor enters an AI Operations engagement. The evidence and the date it was measured. Tedious to write, impossible to reconstruct after the fact.

Audit what evidence your AI vendors actually hold