The Roundup: Capital One’s Johnson to Lead the CFPB, FTC $250M Subscription, New York’s AI Disclosure Law, CFPB Immigration Status in Lending

Welcome to the PerformLine Regulatory Compliance Roundup, home of the latest news, articles, and reports from our industry, curated for you. Let’s get into it.

In this edition: Trump nominates a CFPB director; the FTC freezes Genesis Tech’s sprawling subscription operation; New York’s first-in-the-nation synthetic performer disclosure law takes effect; the CFPB reverses prior guidance and tells lenders to weigh immigration status in ability-to-repay analysis; plus a look at the FTC’s revived click-to-cancel rulemaking.

Do you want to be the first to know when the Regulatory Roundup is released? Subscribe to never miss an email and follow us on LinkedIn for even more updates on marketing compliance.

Trump Taps Capital One’s Brian Johnson to Lead the CFPB

President Trump nominated Brian Johnson to serve as the CFPB’s permanent director. Johnson is a Capital One executive who has overseen U.S. card compliance at the bank since November 2024, and he previously served in multiple roles at the CFPB during the first Trump administration, rising to deputy director. Before Capital One, he was a managing director at Patomak Global Partners and a partner at the law firm Alston & Bird. The nomination heads to the Senate Banking Committee for confirmation. Bloomberg Law

Why It Matters: For compliance teams, the operational reality remains consistent: a smaller, less active CFPB shifts day-to-day accountability toward state regulators and private litigation. Prioritize building robust risk assessments that account for a dynamic multi-state enforcement landscape, while recognizing that federal oversight will remain measured and focused.

FTC Freezes Genesis Tech’s $250 Million Subscription Empire

On June 17, at the FTC’s request, a federal court in the Northern District of California temporarily halted the Genesis Tech enterprise—comprising 15 corporations and eight individuals—over what the agency describes as a sprawling network of deceptive subscription schemes. The Ukraine-based app publisher, operating through subsidiaries incorporated in Cyprus, allegedly marketed a portfolio of unrelated-looking apps designed to obscure their common ownership: the fitness and nutrition apps MadMuscles, Harna, and Unimeal; the PDF editors PDF Guru and PDF Master; the horoscope and psychic-chat app Nebula; and the self-help brand Wisey, which marketed courses claiming to diagnose and treat ADHD symptoms. From early 2023 to mid-2025, just five of these products generated nearly $250 million in global revenue.

The FTC alleges three core tactics. First, failure to disclose material terms: the apps were marketed as free or available for a low one-time cost, then enrolled consumers in auto-renewing subscriptions. Second, unauthorized billing, including charging for extra products without consent and double-charging customers. Third, difficult cancellation: omitting online cancellation options, forcing consumers through lengthy exit-interview questionnaires, and continuing to charge cards even after confirming cancellation. The enterprise allegedly registered new shell companies and merchant accounts on a rolling basis to evade fraud-monitoring programs. The conduct violates Section 5 of the FTC Act and the Restore Online Shoppers’ Confidence Act (ROSCA).

Notably, the FTC is pursuing this case under existing ROSCA and FTC Act authority while it works to revive a click-to-cancel framework through a new rulemaking launched in March 2026, after the prior Negative Option Rule was struck down in court. Federal Trade Commission

Why It Matters: This is an extreme fraud example, but the FTC was explicit that the same principles apply to every legitimate company using automatic renewals: clearly and conspicuously disclose all material terms, obtain affirmative consent, and make cancellation simple. For marketing and compliance teams, the takeaway is concrete—audit your enrollment flows, free-trial-to-paid conversions, disclosure language, and cancellation mechanisms now. The agency is actively enforcing the subscription space even without a click-to-cancel rule on the books, and parallel state auto-renewal laws (now in more than two dozen states) add private class-action exposure on top of federal risk.

New York’s First-in-the-Nation AI “Synthetic Performer” Disclosure Law Takes Effect

New York’s synthetic performer disclosure law took effect, making New York the first state to require advertisers to disclose when an advertisement includes an AI-generated synthetic performer. Signed by Governor Hochul in December 2025, the law amends General Business Law § 396-b and requires any business that produces or creates a commercial advertisement to conspicuously disclose when it contains a synthetic performer—defined as a digitally created human likeness, generated by AI or a software algorithm, that is intended to appear as a human performer but is not recognizable as any identifiable natural person.

The law applies to any company whose ads reach consumers in New York, regardless of where the advertiser is headquartered, and covers television, digital advertising, and social media content. The disclosure obligation is triggered only where the advertiser has actual knowledge that a synthetic performer is included. Civil penalties are $1,000 for a first violation and $5,000 for each subsequent violation, with enforcement resting with the New York attorney general. Key exemptions include audio-only advertisements, AI used solely for language translation of a human performer, expressive works such as films, television, and video games where the synthetic performer’s use is consistent with the underlying work, and the publishers or platforms that merely disseminate a noncompliant ad.

The statute does not define “conspicuous,” leaving the form, placement, and size of required disclosures to be shaped by enforcement and market practice. California, Illinois, and Texas are advancing similar legislation. Office of Governor Hochul

Why It Matters: For any brand or third-party partners using AI-generated human imagery in marketing, increasingly common in high-volume e-commerce and social creative, this is an immediate compliance obligation, not a future one. Teams should inventory live ad creative for synthetic performers, clarify in agency and vendor contracts who is responsible for identifying AI-generated talent and applying disclosures, and build a disclosure checkpoint into the creative review and approval process. Because the trigger is “actual knowledge,” what you document about your AI-generated content matters. And with multiple states moving on similar laws, a New York-compliant process is a sensible national baseline.

CFPB Reverses Course, Tells Lenders to Consider Immigration Status in Ability-to-Repay Assessments

On June 5, the CFPB issued a statement reminding creditors that, when assessing a consumer’s ability to repay mortgages and certain open-end credit products under the Truth in Lending Act and Regulation Z, they may be obligated to consider the consumer’s immigration status—particularly where removal from the United States could disrupt the consumer’s income. Acting Director Russ Vought previewed the statement in a June 4 post on X, and it was scheduled for Federal Register publication on June 8.

The move follows the January withdrawal, by the CFPB and the Department of Justice, of a 2023 joint statement that had cautioned lenders against considering immigration status when extending credit. That withdrawn guidance had warned that status-based policies could violate the Equal Credit Opportunity Act and Regulation B prohibitions on discrimination based on national origin and other protected classes. Vought has argued that ECOA regulations have, for decades, permitted lenders to consider a borrower’s residency status and related information. PYMNTS

Why It Matters: This is a significant reversal in federal guidance that puts lenders in a genuinely difficult position. The CFPB now frames consideration of immigration status as potentially required for a sound ability-to-repay analysis, while state fair lending statutes, and the ECOA national-origin protections themselves, continue to treat status-based decisions as a discrimination risk. New York’s DFS and other state regulators are actively enforcing disparate impact and fair lending standards independent of the CFPB. Lenders should approach immigration-status considerations carefully, document the ability-to-repay rationale, and account for the state-level exposure that the federal guidance does not address.

On the Radar: The FTC’s Click-to-Cancel Rulemaking Could Return

The FTC relaunched a negative-option rulemaking in March 2026 after the prior Click-to-Cancel rule was vacated in court in 2025. The Genesis Tech case shows the agency will keep enforcing subscription practices under ROSCA and Section 5 in the meantime, but a revived federal click-to-cancel framework—or something close to it—may return. Combined with click-to-cancel rules already moving at the state and municipal level, including the New York City rule, recurring-billing businesses should expect the disclosure-and-easy-cancellation standard to keep tightening.

Why It Matters: Don’t wait for the federal rule to land. Build clear disclosure and simple, one-step cancellation into your subscription flows now so you’re compliant across whichever framework moves first.

That’s it for this edition of the Regulatory Roundup. Have questions, tips, or feedback? Reach out to us at performline.com or connect with us on LinkedIn.