The Roundup: A 40-State $700M Auto Settlement, the FTC Targets Payment Processors, and California Regulates AI Ad Performers

Welcome to the PerformLine Regulatory Compliance Roundup, home of the latest news, articles, and reports from our industry, curated for you. Let’s get into it.

In this edition: a 40-state attorney general coalition secures roughly $700 million from subprime auto lender Credit Acceptance Corporation as states keep filling the federal enforcement gap; the FTC goes after the payment processors that enable deceptive merchants; California enacts a disclosure law for AI-generated advertising performers as AI ad scrutiny grows; the CFPB’s nominee for permanent director clears the Senate Banking Committee while the open banking rule waits in the wings; plus a New York City click-to-cancel deadline lands October 1.

Do you want to be the first to know when the Regulatory Roundup is released? Subscribe to never miss an email and follow us on LinkedIn for even more updates on marketing compliance.

A 40-State Coalition Wins Roughly $700 Million From a Subprime Auto Lender

The story we’ve been telling for two editions, state attorneys general stepping into the space the CFPB has vacated, reached its clearest expression yet this month. On September 17, New York Attorney General Letitia James and a bipartisan coalition of 39 other states plus the District of Columbia secured a settlement worth roughly $700 million from Credit Acceptance Corporation (CAC), a major subprime auto lender. The states alleged that CAC deceptively pushed more than 55,000 consumers into unaffordable loans (with average APRs above 38%, and some topping 100%) loaded with hidden costs and unnecessary add-ons, then misrepresented compliance when it packaged those loans into securities.

The settlement delivers more than $630 million in debt relief, $60 million in cash restitution for consumers who lost vehicles to repossession, and $15.5 million in penalties, along with business reforms including out-of-showroom confirmation and cancellation of add-on products. The detail that matters most for the bigger picture: the CFPB was originally a co-plaintiff (the suit was filed jointly in January 2023), but it is no longer part of the case. The states carried it across the finish line without the federal regulator.

Meanwhile, other AGs kept up the pace. On September 14, Massachusetts Attorney General Andrea Joy Campbell announced a settlement permanently barring a debt buyer and its companies from buying or collecting debt in the state, over allegations of aggressive, unlawful tactics including seizing consumers’ vehicles, wiping out roughly $52 million in claimed debt affecting more than 6,000 consumers. New York Attorney General

Why It Matters: This is the through-line of 2026 in a single case: when a federal regulator steps back, state AGs, often in large bipartisan coalitions, are ready and able to pick up major enforcement, including the fair-lending, deceptive-marketing, and add-on-product theories the CFPB might once have led on. For lenders and their marketing partners, the practical takeaways are consistent with what we’ve flagged all summer: unaffordable-product and hidden-cost theories are alive and well at the state level, add-on products draw scrutiny when consent is murky, and a 40-state coalition can reach you no matter where you operate. Build your marketing and disclosure practices to the strictest applicable state standard, and assume multi-state, not single-regulator, exposure.

The FTC Targets the Payment Processors Behind Deceptive Billing

The FTC spent September going after a part of the marketing-and-billing chain that often escapes attention: the payment processors that enable deceptive merchants. On September 8, the agency announced a $12 million settlement with payment processor Humboldt Merchant Services (5967 Ventures LLC), alleging it knowingly opened and maintained accounts for more than 1,000 shell or pass-through merchants fronting for unauthorized-billing scams, ignoring red flags like abnormally high chargebacks. The order permanently bans Humboldt from processing for high-fraud-risk merchants. Days earlier, on September 3, the FTC reached a $4.85 million settlement with global processor Nuvei over allegations it processed payments for merchants it knew or should have known were running deceptive overseas tech-support schemes. Federal Trade Commission

Why It Matters: The theme here is enabler liability, a version of the “you’re responsible for who you enable” principle we saw in the doxo action and the FTC’s marketplace posture. If your business sits anywhere in the payments or partner chain (processing, sponsoring, or facilitating for other companies’ offers), the FTC is signaling that knowing (or willfully ignoring) that your partners are deceiving consumers can put you on the hook. For banks and fintechs with BaaS, lending-partner, or merchant-processing relationships, this reinforces the need for real, documented due diligence and ongoing monitoring of the partners and merchants operating under your infrastructure, chargeback spikes and other red flags included.

➤ Monitor your partners’ and merchants’ marketing across every channel with PerformLine’s Omni-Channel Monitoring

California Regulates AI-Generated Ad Performers as AI Ad Scrutiny Grows

Artificial intelligence in advertising drew regulatory attention on two fronts this month. On September 16, California Governor Newsom signed SB 1050, which requires a clear and conspicuous disclosure on any video or audio advertisement that uses AI-generated (“synthetic”) performers to sell a product or service, with the disclosure placed near the synthetic performer. The law takes effect January 1, 2027, and makes California the second state after New York to require this kind of disclosure. Although it was framed around performer and worker protection (Newsom signed it at SAG-AFTRA headquarters), it applies directly to any marketer, financial services included, using AI-generated spokespeople or actors in ads.

At the federal level, the FTC finalized consent orders on August 27 totaling roughly $930,000 with a media company and two marketing firms that had advertised an AI-powered “Active Listening” service, claiming it could target ads based on consumers’ real-time conversations captured from smart devices, with consumer consent. The FTC alleged the service actually relied on resold email lists gathered without consent, making the AI capability claims deceptive. Office of Governor Newsom

Why It Matters: AI is moving from a marketing tool to a regulated element of the ad itself. Two lessons stand out. First, if you use AI-generated voices or personas in ad creative (increasingly common in financial services marketing), California now requires you to disclose it, and other states are building similar AI-transparency regimes. Second, claims about what your AI can do are still just advertising claims: the “Active Listening” orders show the FTC will treat exaggerated or unsubstantiated AI capability claims as deceptive like any other. Inventory where AI shows up in your creative and your product claims, and make sure both the disclosures and the substantiation are in place.

➤ Monitor your advertising claims and disclosures across every channel with PerformLine’s Brand Monitoring

The CFPB’s Next Director Clears Committee as the Open Banking Rule Waits

The CFPB’s leadership question inched forward. On September 17, the Senate Banking Committee voted 13-11, along party lines, to advance Brian Johnson, Trump’s nominee for permanent director and a former Capital One executive, to the full Senate. He has not been confirmed; his nomination now awaits a floor vote that had not been scheduled as of this writing, and in the meantime Mark Paoletta has been serving as acting director since August. The Bureau’s reduction-in-force litigation remains frozen under the summer stay, which is tied to Senate action on Johnson’s nomination.

On the rulemaking side, the revised Section 1033 open banking proposal we flagged last edition is still under White House (OIRA) review and had not been published for public comment by the end of the month, so its specifics, including whether banks will be allowed to charge for data access, remain officially undisclosed. Consumer Finance Monitor

Why It Matters: The Bureau’s direction still hinges on a confirmation that hasn’t happened yet, so plan for continued federal uncertainty, which, as the lead story shows, is exactly the vacuum the states are filling. Watch two things: the timing of Johnson’s floor vote, which will set the Bureau’s leadership and posture for the next stretch; and the open banking proposal, which could publish soon and open a comment window that matters to nearly every financial institution and fintech. When that rule drops, be ready to weigh in, especially on data-access fees and authorized-third-party standards.

On the Radar: New York City’s Click-to-Cancel Rule Takes Effect October 1

New York City’s Department of Consumer and Worker Protection rule, the first municipal click-to-cancel mandate in the country, takes effect October 1. It requires that any auto-renewal or continuous-service subscription offered to NYC consumers be cancellable through the same method used to sign up, with penalties starting at $525 per violation and escalating for repeat violations, plus potential consumer refunds. Separately, keep an eye on the FTC’s proposed “personalized pricing” enforcement policy statement from last edition: the public comment window, extended by a week, closed September 25, after which the agency could move toward finalizing its position.

Why It Matters: Subscription and auto-renewal compliance keeps fragmenting to the state (and now city) level, and the standards vary. If you run any recurring-billing offer with NYC subscribers, October 1 is a hard deadline: your cancellation path has to be as easy as your sign-up path. Map your enrollment and cancellation flows against every jurisdiction where you have subscribers, design to the strictest standard, and treat “as easy to cancel as to sign up” as the baseline everywhere.

➤ Monitor your enrollment and cancellation disclosures across channels with PerformLine’s Digital Monitoring

That’s it for this edition of the Regulatory Compliance Roundup. Have questions, tips, or feedback? Reach out to us at performline.com or connect with us on LinkedIn.