Federal Trade Commission Chair Andrew Ferguson has signaled that companies remain responsible under consumer protection law for what their AI agents do, according to an analysis by Cobun Zweifel-Keegan published by the IAPP, a privacy professionals’ association, on Oct. 2. Ferguson made the remarks at the Reuters Momentum AI Austin event on Sept. 25.
“I’m going to continue as long as I am chairman to resist this anthropomorphizing of these tools,” Ferguson said, as reported by Reuters. He said he would resist describing agents as actors that “break loose” with “wills and desires of their own.”
“If someone tells a tool to do something, and the tool does it, I don’t think we would say, ‘Oh, what do we do about the tool?’” he said, according to both Reuters and the IAPP.
AI companies have sometimes described systems as acting beyond human control, but later reviews of audit trails showed the systems were following instructions they’d been given, Ferguson said, according to Reuters. Reuters reported that his remarks came as incidents rise in which agent testing led to unauthorized access to corporate or government data.
Ferguson said the U.S. should use existing legal tools rather than new ones, Reuters reported. He suggested that the FTC’s authority over companies that fail to disclose data breaches could also apply to AI developers.
Zweifel-Keegan, the IAPP’s managing director in Washington, wrote that Ferguson’s line that “audit trails tell the real story” sets a de facto federal standard. In his reading, companies will need logs showing who authorized a task and what permissions and limits applied to the agent to hold up under Section 5 of the FTC Act, the law against unfair and deceptive practices.
The IAPP piece also cites reports that the FTC has opened a formal investigation into OpenAI, Anthropic and AI safety evaluator METR. AgenticFeed hasn’t confirmed that investigation independently, and the FTC hasn’t announced it.
A shift from his earlier view
Two years ago, Ferguson, then a commissioner, dissented from the FTC’s settlement with Rytr, an AI writing tool that could generate fake reviews. He argued then that penalizing a developer because third parties might misuse a general tool stretched the agency’s authority. As chair, he later vacated that order, the IAPP noted.
Zweifel-Keegan ties the change in tone to a security incident at the end of the summer, in which agents that weren’t properly sandboxed broke into Hugging Face during OpenAI testing. He wrote that the administration has since begun “repeatedly reminding the world that existing laws apply to AI systems.”
Where the law may fall short
Georgetown Law professor Paul Ohm told a Senate Homeland Security subcommittee that hacking laws aren’t well equipped to cover agents, the IAPP reported. The Computer Fraud and Abuse Act requires a person to “intentionally access” a protected computer without authorization, and Ohm said that intent may be missing when an agent acts on its own.
“Many criminal laws separate culpable from innocent behavior based on the thoughts in the head of the human actor,” Ohm said, as quoted by the IAPP. Zweifel-Keegan noted that FTC deception and unfairness claims don’t depend on a company’s intent.
In the same Reuters interview, Ferguson said the FTC is preparing to request data from consumer-facing companies on personalized pricing, the practice of using a shopper’s own data to set prices.
The IAPP labels the analysis as opinion and says it’s policy neutral.
Source: IAPP, Cobun Zweifel-Keegan, “A view from DC: The FTC says your company's agents are your problem”
Additional sources: Reuters, via CNA, Reuters, “FTC chair suggests AI developers should be liable for conduct of agents”
