FTC COMPLIANCE RESOURCE PACK
Four production-ready templates every FTC-regulated business needs. GLBA Privacy Notice, Safeguards Rule annual board report, claim substantiation log, marketing disclosure checklist. Aligned with 16 CFR Parts 313, 314, 255, 316, 310 and FTC Act Section 5.
FTC Enforcement Has Quietly Become the Most Aggressive in the United States
2024-2026 has produced a record run of FTC enforcement actions across the Safeguards Rule, the Endorsement Guides, ROSCA auto-renewal, AI-generated reviews, and dark patterns. Every business under Section 5 jurisdiction now needs documented compliance evidence — not just compliance intent.
The Federal Trade Commission writes the rules and enforces the rules across two complementary axes that touch nearly every business operating in the United States. On the privacy and data security axis, the Safeguards Rule (16 CFR Part 314) — expanded in late 2021 and amended in late 2023 — now imposes documented program requirements on a "financial institution" definition broad enough to capture mortgage brokers, motor vehicle dealers, finders, check cashers, payday lenders, real estate appraisers, tax preparers, and any non-bank lender. The 30-day breach-notification amendment under 16 CFR 314.5 (effective May 2024) added a federal disclosure clock for breaches involving 500 or more consumers.
On the marketing and advertising axis, FTC Act Section 5 — the unfair-or-deceptive-acts-or-practices statute that has anchored federal advertising regulation since 1914 — now sits alongside a thicket of more specific FTC instruments: the Endorsement Guides (16 CFR Part 255), materially expanded in 2023 to add disclosure requirements for material connections in social media; the Native Advertising Enforcement Policy Statement; the CAN-SPAM Act (16 CFR Part 316); the Telemarketing Sales Rule (16 CFR Part 310); the Made in USA Labeling Rule (16 CFR Part 323); and the Restore Online Shoppers' Confidence Act (ROSCA, 15 USC 8401-8405) governing online subscription disclosures and cancellation flows.
2024-2026 enforcement has produced a record run of consent decrees and civil penalty orders. Median settlement values are up materially. The agency is now actively pursuing AI-generated reviews, dark-pattern subscription flows, undisclosed influencer relationships, and inadequate Safeguards Rule programs. Regulated businesses that cannot produce documented privacy notices, board-level program reports, claim substantiation logs, and marketing disclosure checklists are flying without instruments.
This Resource Pack is the documentation chassis that satisfies the four most-frequently-requested FTC artifacts: privacy notice, annual program report, claim substantiation log, marketing disclosure checklist. Author once. Review annually. Sleep at night.
Four Templates, One ZIP Download
Editable HTML files. Open in any browser, paste into Word or Google Docs, brand with your business letterhead, sign, file.
GLBA Privacy Notice Template
Full GLBA Privacy Notice template structured to satisfy 16 CFR Part 313 disclosure requirements. Sections: information collected, information shared with affiliates, information shared with non-affiliated third parties (with the categories required by the Rule), consumer rights, opt-out election mechanism, joint-marketing arrangements, contact information, and effective date. Uses the FTC model form structure for maximum safe-harbor protection. Ready to brand and post on your website's privacy page or include in your customer-onboarding packet.
Safeguards Rule Annual Board Report Template
Annual report template the Qualified Individual files with the board (or senior officer) under 16 CFR 314.4(i). Sections aligned to the Rule's required topics: overall status of the information security program, risk assessment summary and material changes, risk management and control decisions, service-provider arrangements and oversight, results of testing and monitoring, security events of the past year and management's response, recommendations for material changes, board attestation and acknowledgement signature block. The single highest-leverage compliance artifact for any FTC-covered financial institution.
Claim Substantiation Log
Tracker for every objective marketing claim across every channel. Columns: claim text, claim type (performance, comparative, health, environmental, savings, ROI, security, AI capability), substantiation source (peer-reviewed study, internal data, expert analysis, vendor representation, customer survey), substantiation reviewer, substantiation date, channel of publication (website, social, email, paid, OOH, podcast, video), publication date, expiration / re-substantiation cadence. Maintain it. When the FTC, a competitor, or a state AG files a challenge, this log is your first line of defense under FTC Act Section 5 and the Endorsement Guides.
Marketing Disclosure Checklist
Pre-publication compliance gate covering FTC Endorsement Guides 16 CFR Part 255 (including the 2023 amendments), Native Advertising Enforcement Policy, social-media-specific guidance for Instagram / TikTok / YouTube / Twitter / LinkedIn, the 2024 expanded scope on AI-generated endorsements and AI-generated reviews, CAN-SPAM email disclosures (16 CFR Part 316), Telemarketing Sales Rule disclosures (16 CFR Part 310), Made in USA Labeling Rule (16 CFR Part 323), and ROSCA online subscription disclosures (15 USC 8401-8405). Run the checklist before any campaign goes live.
Five Common FTC-Compliance Use Cases
Initial Customer Onboarding
Send the GLBA Privacy Notice with the first contract or terms of service. Required under 16 CFR 313 before the customer relationship begins. Single highest-frequency FTC privacy artifact.
Annual Board Cycle
Walk the Safeguards Rule annual board report through the next regular board meeting. Capture sign-off in the minutes. Required documented evidence under 16 CFR 314.4(i).
Pre-Campaign Marketing Gate
Run every campaign — paid, organic, influencer, email, OOH, AI-generated — through the marketing disclosure checklist before publication. Catches Endorsement Guides and Native Advertising violations before they ship.
Claim Approval Workflow
Make the claim substantiation log a required gate in your marketing or product-launch workflow. Every objective claim entered with substantiation source before going live. The single most common FTC enforcement defense.
FTC Inquiry or CID Response
If a Civil Investigative Demand or compliance inquiry arrives, the four templates produce four of the five most-requested FTC artifacts in their finished form. Reduce response time from weeks to days.
Five Steps from Download to Filed Documentation
Download and unzip
Enter your work email below. We send the ZIP within 60 seconds. Unzip locally; the four HTML files open in any browser for preview.
Publish the GLBA Privacy Notice
Brand the template, post on your website's privacy page, include in onboarding packets, send to existing customers if your sharing practices have changed in the last 12 months.
File the Safeguards annual report
If your business is a covered financial institution under the Rule, walk the annual report through the next board meeting. Capture sign-off in the minutes. Save with the QI Designation Memo and the WISP.
Wire the substantiation log into marketing
Add the claim substantiation log as a required column in your marketing pipeline (Asana, Notion, Monday, Trello, Airtable). Every objective claim requires a substantiation entry before publication.
Run the disclosure checklist pre-launch
Make the marketing disclosure checklist a required pre-publication gate. Owner: marketing leadership or general counsel. Time per campaign: 15-30 minutes. Caught violation cost: thousands to millions.
Free Download — Email Below
Enter your work email. We send the ZIP within 60 seconds and add you to our monthly cybersecurity newsletter (one-click unsubscribe). No credit card. No upsell ambush.
Pair the Pack with the Course
The pack is the documentation chassis. The course turns your QI, general counsel, and marketing leadership into FTC-fluent operators.
FTC Compliance Mastery Course
FTC regulatory deep-dive: GLBA Privacy and Safeguards Rules, FTC Act Section 5 substantiation doctrine, Endorsement Guides walkthrough, CAN-SPAM and TSR refresh, ROSCA and auto-renewal compliance, breach-notification rehearsal, current 2024-2026 enforcement trends. $499 per seat per year.
View course →FTC Compliance Training Service Page
PTG's full FTC-compliance training and consulting offering: WISP authoring, fractional Qualified Individual coverage, Safeguards Rule annual reporting, advertising substantiation review, breach-notification readiness, FTC inquiry response.
Service overview →Other Industry-Specific Resource Packs
Build out the documentation chassis across every regulatory environment your business operates in.
Security Awareness Training Resource Pack
Incident Report, MFA Enrollment Checklist, Vendor Risk Questionnaire, Quick Reference Card. For every employee at every business. Pair with the SAT course.
Download SAT pack →CPA Firm Cybersecurity Resource Pack
WISP template, Qualified Individual designation memo, vendor SOC 2 review tracker, breach 30-day matrix. For accounting firms and tax practices subject to IRS Pub 4557 and FTC Safeguards.
Download CPA pack →Frequently Asked Questions
Twelve questions we hear most often about the FTC Resource Pack, the templates, and how the pack fits into a complete program.
What is in the free FTC Compliance Resource Pack?
Who is this pack for?
Is the resource pack really free?
What is the GLBA Privacy Notice and when do I need to send it?
What is the Safeguards Rule annual board report?
What is the claim substantiation log for?
Does the marketing disclosure checklist cover influencer and social media?
Which compliance frameworks does this pack support?
How does this pair with the FTC Compliance Mastery course?
Are the templates legal advice?
Do I need a Qualified Individual to use the Safeguards annual report template?
What other free resource packs do you offer?
Built for FTC-Regulated Businesses, by Practitioners
Get the Pack. File the Documentation. Pass the Audit.
Free FTC Compliance Resource Pack now. Optional paid course when you are ready to layer on FTC regulatory deep-dive training.
Petronella Technology Group, Inc. — 7000 Six Forks Road, Raleigh, NC 27615 — 919-348-4912 — support@petronellatech.com. The free FTC Compliance Resource Pack is provided "as-is" for single-business internal use. Templates are not legal advice. Consult counsel for jurisdiction-specific compliance interpretations. The FTC Compliance Mastery course is sold separately at $499 per seat per year.