Agencies are increasingly being placed in the role of “issue spotter” when it comes to all of the legal hurdles that can get between your work and its intended audience.

This is in addition to your already full plate of legal operations matters like contracts, IP protection, and employment policies.

But while the latter relate to you running a strong business, the former affect your client’s legal risk as much as the agency’s. So, brands have raised their expectations of agencies to notice and plan for legal compliance before their work hits the street, so to speak.

Let’s face it – you didn’t go into the agency business to give legal advice (and you shouldn’t). But a little knowledge of the regulatory environment that affects your work is a time and money saver for everyone concerned.

In that spirit, let’s review a few of the legal developments we’re watching for the industry this year, and how they might affect agencies.

State Regulation of Data Privacy

In the U.S., data privacy regulations are a state-by-state affair.

This means that, unlike environments like the EU where there is a universal set of rules for compliance to protect consumer data, marketers have potentially 50 sets of state laws and regulations for data privacy compliance purposes. And lucky agencies have to build campaigns that are across-the-board compliant. To do that, you’ve got to know the rules.

The safest course of action is to play to the most conservative set of state regulations around data privacy. That has historically been California’s rules, and that remains largely unchanged. However, activity at the state level around data privacy has been dynamic – with Maryland enacting new policy effective October 1, 2025 that rivals California’s state data privacy regulations for compliance burden. There’s also been active rulemaking and enforcement actions in a number of other states and it’s ongoing and increasing (we see you – Rhode Island, Kentucky, Tennessee and Texas, to name a few).

We are on the watch for state enforcement activity in those jurisdictions where the rulemaking has been most active. It’s also worth remembering that California has had at least two significant updates to its data privacy regulations since its first sweeping legislation debuted a few years ago.

What Should Agencies Do About It?

There are a few actions agencies can take when developing strategies and campaigns to plan for data privacy regulatory issues:

• Talk to your clients about their data privacy policies and practices. Are they documented? Can they provide them for you to review? When is the last time they were updated?
• Remember (and remind brands) that it’s not about them (or you). Data privacy compliance has nothing to do with where your client sits geographically (or is incorporated legally), where its intended target market might be located, or where the agency is. It’s all about the consumer’s location – this determines which state’s privacy laws could apply. And so one name on an email list that ties to a consumer located in the State of California can trigger that state’s rules. This plays into the usually-advisable strategy of mapping your data privacy practices to the most conservative state rules. Or to GDPR if relevant.
• Follow the trade press and industry organization news on regulatory changes. One of the primary benefits of these industry-focused channels is that they not only inform about changes to the rules, but they also advocate for policy that is fair to marketers. This is one of the few policy issues on which big business, small business, brands, and agencies usually align, and so there are a lot of marketing trade organizations who monitor and work on agencies’ behalf for policies that are less burdensome for compliance, like the 4As, American Advertising Federation (AAF), and the Association National Advertisers (ANA) .

State-Federal Push/Pull on AI Regulation – Plus Some Unions Weigh In

Speaking of state vs. federal regulations, so far we have seen activity primarily at the state level to regulate AI-generated marketing, most of which focuses on requiring advertisers to disclose when they have used AI to generate published ads, especially when synthetic likenesses or performances are used.

Add to this, though, is tension between the states and the federal government, which so far has asserted its interest in being the primary rulemaker around AI regulation (although not specifically limited to advertising). What’s the impact for advertisers of this dynamic? Well, not much, so far. The states who have put forth regulations around AI-created marketing have yet to see those rules disturbed, and so they are rules that brands and their agencies still need to understand.

To further add to the mix, AI-generated content, and the rights to make derivative uses of that content (think, for example: multiple campaign concepts, one performer’s image or voice duplicated to fit each of them), has been a huge issue of contention in talent union negotiations. A huge component of the SAG-AFTRA strike that affected the ad industry recently was debate over how to handle AI-generated content, and compensating creators and talent appropriately for it. Agencies were definitely slowed down by the debate. We’ve got to assume that it will continue to be a factor in union rulemaking that affects commercial work.

What Does This Mean for Agencies?

There are a couple of primary takeaways for agencies to consider when developing strategy or campaigns that involve AI in the creation:

• Default to disclosure. If generative AI was used to create advertising (especially if synthetic performances are involved), assume disclosure of AI use in the creative is, or will quickly become, the default. If you’re publishing in a state that already requires disclosure, that duty is live, and now. Build this into your plans.
• Be ready to negotiate on creator rights. Expect that creators and talent will continue to sharpen their pencils when negotiating content use rights, and especially name/image/likeness issues associated with AI-generated synthetic likenesses of voice or image. This means being ready to discuss the legal rights, as well as the compensation expectations, with your clients when budgeting projects.
• Understand the interplay between data privacy rules and AI use. Remember when using AI-based tools in agency workflow for projects involving consumer data in any way that brands (and your agency) are the ones on the hook for data privacy violations. “AI did it, not us” is not a compliance defense – be very cautious about how you use the tools and about the consumer date you use the tools to process.

Federal Copyright Litigation and Rulemaking Involving AI Platforms

The most frequently asked questions we receive at the firm about AI are about:

1. copyright and rights ownership of work created using generative AI, and
2. responsibility for infringement of someone else’s IP by the output from generative AI.

U.S. copyright law is clear, so far, about the copyright status of works created out of generative AI – they cannot be copyrighted if they are machine generated. If they are partially machine-created and partially human-created, and the separation between the machine and human-made work is clearly identifiable, there may be copyright protection in the human-created portions. That’s a topic for another article.

And so what legal developments, exactly are we on the watch for related to AI and IP?

There has been a significant amount of litigation against the major AI platforms by major content rights holders (think:  Disney, The Associated Press, the New York Times) regarding  liability for copyright infringement resulting from AI platform output that infringes on the rights of copyright owners. These cases arose because massive amounts of copyrighted material were input into the AI platforms, without the permission of the copyright holders, creating the possibility of copyright infringements and also bypassing the content owners’ compensation rights. And a number of them have resolved with voluntary settlements involving content licensing deals.

We’re watching the pending cases to see whether any high federal court will decide that an AI platform is legally responsible for resulting copyright infringement when its output results in duplicate or derivative work without permission of the content owner. Until that happens, the only parties potentially “holding the bag,” legally speaking, for infringement are the parties who publish this content – like advertisers. And their agencies who put the output in advertising or marketing campaigns.

What Should Agencies Do About It?

Your agency’s goal on this issue is to manage risk and fairly divide responsibility for accidental IP infringement between client and agency. Consider these steps:

• IP Clearance Remains Critical. The efficiencies that AI might afford your agency in creating its work are not an excuse to shortcut standard IP due diligence before that work gets released into the market. Remember that steps like trademark searching, copyright clearance, proper IP license review, and every other vetting procedure you use to clear work are still necessary. Budget for them. Talk with your clients about the necessity of them.
• Use Contract Language to Divide Responsibility. Speaking of responsibility, not only should you have clear conversations with your clients about who assumes responsibility for clearing IP (it should be the client giving the final approval), but your MSA terms and conditions should be clear about the client’s responsibilities to review, clear and approve work. The contract should also be clear on which party will assume responsibility (aka liability) if an infringement occurs.
• Review Your Insurance Coverages. Review your agency’s general liability insurance “advertising injury” coverage, as well as your errors and omissions coverage (you have that – right?) to make sure your policy limits make sense in light of your client and work concentration.

State Ad Taxation

If you’re in Washington State, the taxation of advertising services has already become your agency’s reality. As states’ budgets become more and more constrained, expect that other states will continue to look for additional revenue sources – and advertising taxation (whether in the form of sales/use tax, or the elimination of deductibility of ad expenses) is always an attractive target.

This isn’t actually a legal issue. But it is something that can create an adverse legal consequence for an agency that fails to properly collect or remit these taxes. And it’s also an issue that is wise to address in your contracts with clients. And so – no surprise – our top tip here for agency action is just that – including sales tax collection language in your MSA or other client agreements is always a wise idea.

And we rely on industry trade organization news to keep tabs on additional legislative activity in any states that are considering taxation of ad spend in any way. Your agency should monitor this news as well.

What legal developments is your agency watching closely this year? We’d love to hear from you about them.