HIPAA, FINRA, FTC, GDPR, CAN-SPAM, TCPA, and State Privacy Laws: The Regulated Marketer’s Compliance Cheat Sheet

Disclaimer: This is a working guide to help marketing teams ask the right questions and avoid the obvious landmines. We’re marketers, not lawyers, so please talk with yours before making compliance decisions.

---

Marketing in regulated industries means answering to multiple regulators at once, and the penalties have climbed sharply. The FTC, HIPAA, FINRA, CAN-SPAM, TCPA, GDPR, and a 19-state privacy patchwork all carry their own rules for consent, disclosure, and recordkeeping. Recent updates matter: TCPA now lets consumers revoke consent through any reasonable method, and AI-generated voices carry full liability. Before launching, marketing teams should know who they’’re reaching, what data they have rights to use, and whether their claims hold up.

---

Say you just wrapped your best quarter ever. The campaign you spent months building pulled in more qualified leads than anything your team has run before.  

Then a letter arrives from a regulator. Suddenly, your best quarter has become your most expensive one. 

It happens more than you’d think. In 2025, the FTC secured a $2.5 billion settlement against Amazon over subscription practices, and GDPR fines topped €1.2 billion that same year. During the first half of 2025, TCPA class actions surged 95% year-over-year. The common thread? Marketing activity that crossed a regulatory line. 

If you’re a marketer at a regulated company (healthcare, financial services, or any organization that touches consumer data), compliance is your job, too. 

Here’s what you need to know, regulator by regulator. 

FTC: The One That Applies to Everyone 

What it is: The Federal Trade Commission enforces truth-in-advertising, data privacy, and consumer protection standards. If you market to consumers in the U.S., you answer to the FTC, regardless of your industry. 

Key rules for marketers:  

• Claims must be truthful and substantiated.  

• Endorsements and influencer relationships require clear disclosure.  

• Subscription and auto-renewal models must provide transparent terms and easy cancellation.  

• The FTC is actively targeting dark patterns (design tricks that push consumers toward unintended choices).  

• The Consumer Review Rule, now being enforced, prohibits fake reviews and review suppression, along with incentivized reviews tied to positive sentiment. 

Common mistakes:  

• Undisclosed paid influencer partnerships and buried unsubscribe flows.  

• Misleading urgency tactics.  

• Using testimonials without proper substantiation or selectively displaying only positive reviews on your site. 

Quick reference: Penalties can reach $53,088 per violation, per day. The FTC is currently focused on subscription practices, hidden fees, misleading reviews, and children’‘s data privacy. Assume every consumer-facing claim will be scrutinized. 

HIPAA: Healthcare Marketing’s Minefield 

What it is: The Health Insurance Portability and Accountability Act governs how protected health information (PHI, which is any health information that could identify a patient) is used and disclosed. It applies to covered entities (hospitals, insurers, providers) and their business associates, which often includes marketing agencies. 

Key rules for marketers:  

• Using PHI for marketing generally requires written patient authorization. This covers email campaigns and retargeting, and even testimonials that reference a patient’s condition or treatment.  

• If your external marketing agency touches any patient data, they need a signed Business Associate Agreement (BAA).  

• Tracking pixels on health-related pages is a major risk area. OCR (the Office for Civil Rights, HIPAA’s enforcement arm) has aggressively pursued violations tied to tools like Meta Pixel and Google Analytics on patient-facing sites. 

Common mistakes:  

• Deploying tracking pixels on patient portals or appointment pages without a BAA in place. 

• Using patient data in email campaigns without explicit authorization. 

• Responding to online reviews with patient-specific information.  

• Assuming cookie consent banners satisfy HIPAA requirements (they don’t; HIPAA requires either a BAA or a valid authorization under 164.508). 

Quick reference: Civil penalties range from $141 to over $2 million per violation category per year. Criminal penalties can reach $250,000 and 10 years in prison. OCR closed 22 enforcement actions in 2024, collecting nearly $12.8 million. Pixel-tracking violations alone have generated over $100 million in penalties and settlements since 2023. 

FINRA: When Your Audience Involves Investors 

What it is: The Financial Industry Regulatory Authority oversees broker-dealers and their communications with the public. If your company sells securities or investment products, FINRA Rule 2210 governs virtually everything your marketing team publishes.

Key rules for marketers:  

• All retail communications (which is FINRA’s term for anything that reaches more than 25 retail investors within 30 days) must be fair and balanced, without misleading claims.  

• Static content like ads and social posts requires pre-approval by a registered principal before it goes live. That extends to brochures, email campaigns, and webinar scripts, too.  

• Social media posts that discuss your firm’s products or investment strategies, even from personal accounts, count as business communications, and your firm must archive them.  

• Influencer partnerships carry the same compliance obligations as traditional advertising, including proper disclosure and full recordkeeping. 

Common mistakes:  

• Posting to social media without principal approval or failing to archive all business-related communications (including comments and DMs).  

• Working with influencers who resist oversight or skip required disclosures.  

• Making performance claims without balanced risk context, like using promissory language such as “guaranteed returns” or “risk-free.” 

Quick reference: FINRA’s 2026 Regulatory Oversight Report highlights communications with the public as an ongoing priority. May 2025 saw a wave of “finfluencer” enforcement actions, including a $1.6M fine against Webull for failing to supervise more than 400 paid social media influencers, and a $350K fine against Public.com (Open to the Public Investing) for similar oversight failures.

CAN-SPAM and TCPA: The Channel-Specific Rules 

What they are: CAN-SPAM governs commercial email. The TCPA (Telephone Consumer Protection Act) governs phone calls, text messages, and faxes. Together, they set the rules for your two most direct outbound channels. 

Key rules for marketers: 

CAN-SPAM 

• Every commercial email must include accurate sender information and a clear subject line, along with a physical postal address and a visible opt-out mechanism. 

• You must honor opt-out requests within 10 business days. Federal law doesn’t require explicit opt-in consent, but you must give recipients a way out. 

TCPA 

• Marketing calls and texts made with autodialed or prerecorded technology require prior express written consent.  

• As of April 2025, consumers can revoke consent through any reasonable method (text, email, phone), and businesses must process opt-outs within 10 business days.  

• The FCC has also classified AI-generated voices as “artificial or prerecorded” under TCPA, so AI-powered outreach carries full liability. 

Common mistakes:  

• Using purchased email or phone lists without proper consent documentation or burying the unsubscribe link where nobody can find it.  

• Sending marketing texts without express written consent.  

• Failing to suppress numbers on the National Do Not Call Registry and ignoring state-level telemarketing laws that may be stricter than federal rules (Texas and Florida both have their own versions with steeper penalties). 

Quick reference: CAN-SPAM penalties can reach $46,517 per non-compliant email. TCPA penalties start at $500 per violation and can be tripled to $1,500 for willful violations, with no cap on total damages. Case in point: one TCPA class action resulted in a $925 million judgment. 

GDPR: The Global Wildcard 

What it is: The EU’s General Data Protection Regulation governs the processing of personal data for anyone in the European Economic Area. If your website, emails, or ads reach EU residents, GDPR likely applies to you, even if your company is based in the U.S. 

Key rules for marketers:  

• You need a lawful basis to process personal data. For marketing, that usually means consent (which must be freely given, specific, and unambiguous) or legitimate interest (which requires a documented assessment).  

• Cookie consent must be real: no pre-checked boxes and no “accept all” buttons designed to be easier to click than “reject.” 

• Data subjects can access, correct, and delete their data, and you must respond to those requests promptly.  

• International data transfers out of the EEA require adequate safeguards. 

Common mistakes:  

• Assuming GDPR doesn’t apply because your company has no EU office or relying on pre-checked consent boxes and service-gating (“agree or you can’t use this”). 

• Failing to stop tracking when users click “reject.”  

• Treating consent for one purpose as a blanket consent for everything. 

• Ignoring data transfer requirements when using U.S.-based marketing tools. 

Quick reference: Fines can reach €20 million or 4% of global annual turnover, whichever is higher. Cumulative GDPR fines now exceed €7.1 billion, with €1.2 billion issued in 2025 alone. In September 2025, France’‘s CNIL fined Google €325 million for displaying ads without consent. 

State Privacy Laws: The Patchwork Problem 

What they are: Without a federal privacy law, individual U.S. states have passed their own comprehensive consumer data privacy statutes. As of early 2026, 19 states have comprehensive privacy laws in effect, with Indiana, Kentucky, and Rhode Island joining in January 2026. 

Key rules for marketers:  

• Most state laws give consumers the right to access and delete their personal data, and to opt out of having it sold.  

• Note that the “sale” of personal data is defined broadly in many states; it often covers sharing data with third-party ad platforms for retargeting, not just exchanging data for money.  

• Several states now require businesses to recognize universal opt-out mechanisms (like the Global Privacy Control browser signal).  

• California’s CCPA/CPRA remains the strictest, with new automated decision-making and cybersecurity audit requirements that took effect in 2026. 

Common mistakes:  

• Treating CCPA compliance as “good enough” for all states, when each law has unique thresholds, definitions, and requirements.  

• Ignoring non-California state laws or failing to map where your customers are and which laws apply.  

• Not recognizing universal opt-out signals and overlooking data broker registration requirements. 

Quick reference: California’s CPPA recorded its largest settlement at $2.75 million in early 2026. State AGs are coordinating enforcement and ramping it up. Your analytics, retargeting, and third-party data practices all fall within scope. 

Putting It All Together: A Pre-Launch Checklist 

Before any campaign goes live, your team should be able to answer these five questions: 

1. Who are we reaching?  

If your audience includes patients, investors, EU residents, or consumers in states with privacy laws, you have specific obligations beyond general advertising rules. 

2. What data are we using, and do we have the right to use it?  

Consent, authorization, and opt-in requirements vary by regulator and channel. “We bought the list” has never passed as a compliance strategy. 

3. Are our claims truthful, substantiated, and balanced?  

The FTC and FINRA both require that marketing materials tell the whole story, including risks and limitations alongside the benefits. 

4. Are our opt-out and unsubscribe mechanisms working?  

Test them. Regularly and across every channel. Under the TCPA’s new rules, consumers can opt out through any reasonable method, and you have 10 business days to honor it. 

5. Does legal need to see this?  

If the answer is “maybe,” the answer is yes. Building a quick-review workflow with your legal or compliance team is faster than building a litigation defense.  

Compliance Is a Marketing Advantage 

Seven regulators, 19 state privacy laws, and penalties that can run into the billions. That’s the reality for any marketing team working in any business that touches consumer data. The good news is that none of it requires you to slow down or play it safe. It just requires knowing which rules apply to which campaigns and building a workflow that catches problems before they ship. 

If you want a partner who knows this terrain, PriceWeber can help. We work with regulated brands every day to create marketing that performs and holds up under scrutiny. 

Or, call us at 502-499-4209 to talk with one of our experts today. 

KEY TAKEAWAYS

• The FTC applies to every consumer-facing marketer in the U.S., with truthful claims, clear influencer disclosures, and honest reviews as the baseline.
• HIPAA risk in marketing usually shows up in tracking pixels and unauthorized PHI use, and cookie consent banners don’t satisfy HIPAA on their own.
• FINRA treats almost everything your team publishes as a retail communication, including social posts, webinar scripts, and influencer partnerships.
• CAN-SPAM and TCPA penalties stack quickly across email, calls, and texts, and AI-generated voices now carry full TCPA liability.
• GDPR reaches U.S. companies whose websites or campaigns touch EU residents, with no pre-checked boxes and no ignoring “reject” clicks.
• State privacy laws are now a 19-state patchwork with no federal preemption, so California compliance alone won’t cover the rest.