If You Market With AI, Clear These Three Hurdles First

A few days ago, in a group chat of friends who run cross-border e-commerce stores, I watched someone excitedly show off their results: using AI, they'd generated over a hundred customer reviews in a single day, at almost zero cost.

He probably thought he'd discovered a growth secret.

Then someone replied: "Bro, delete that. Now. That's a fine waiting to happen."

Oh boy. In that moment it hit me: there are probably plenty of marketers out there still living two years in the past.

Back then, marketing with AI was a bit like driving through an intersection with no cameras: run the red light, and odds are nobody cares. AI-written articles, cloned voices for ads, fake reviews churned out by the batch — almost none of it carried any consequences.

But the free ride is over.

Starting in late 2024, the European Union, the U.S. Federal Trade Commission (FTC), and privacy regulators around the world began baring their teeth, one after another.

Today, the biggest risk in marketing isn't "not knowing how to use AI" — it's using AI the wrong way. Best case, you lose your account. Worst case, you get fined.

So which hurdles exactly? I've laid them out for you — three big ones: the EU AI Act, the FTC's truth-in-advertising rules, and GDPR's training-data trap.

Let's take them one at a time.

Hurdle One: The EU AI Act — Machines Can "Read" That You're AI

You might be sitting in Shanghai. You might be sitting in Toronto. But I'm sorry to say: the rules for the AI tools in your hands were most likely written by the EU.

The EU AI Act is the EU's law for the AI industry. The companies behind tools like ChatGPT and Midjourney count as providers of "general-purpose AI models" under the Act. On August 2, 2025, the obligations targeting these companies officially took effect.

The provision that matters most to marketers is called transparency.

What does transparency mean? It means AI-generated content must carry a machine-readable marker. Images and text get an invisible watermark quietly embedded in them — think metadata standards like C2PA. One machine scan, and it's clear: this was made by AI.

Someone's already thinking: just strip out the watermark — problem solved?

Don't. Just don't.

Stripping the watermark directly violates your tool provider's terms of service, and they can ban your account on the spot. Trade one hidden marker for your entire tool account? No matter how you run the numbers, that's a losing deal.

Here's a detail many people have missed: to stay compliant, some U.S. AI tools have started locking features by region. Voice cloning, deepfakes — features like these have been pulled entirely in Europe.

Which means when you run global campaigns, you can't just ask "does this feature work well?" You also have to ask: is this feature legal in every country I'm targeting?

Hurdle Two: The FTC's Precedent — AI-Generated Reviews Are Fraud

If you run e-commerce or affiliate marketing, read this next part word by word.

Think of the FTC as America's "advertising police," dedicated to hunting down false advertising. In late 2024, it set its sights on an AI writing tool called Rytr.

Rytr had a feature called "review generation": a few clicks, and it would fabricate a batch of perfectly plausible user reviews.

In the FTC's view, that amounted to supplying the tools of the trade for fraud. The case settled in early 2025, and one settlement condition stood out: Rytr was barred from ever again offering any feature that generates consumer reviews.

Some people say: so one company got busted — what does that have to do with me?

Well, here's exactly where it concerns you. This case set a precedent:

Generating user reviews with AI is fraud.

Marketers' old line of defense used to be: "I just used AI to polish it up — the customer's real experience was there."

The FTC's position now is blunt: if those specific details were invented by AI — say, "this coffee has a nutty aroma" — and the AI never actually tasted the coffee, that's consumer deception.

A genuine feeling changes nothing. Invented details make it fake.

One layer deeper. The FTC also updated its Endorsement Guides to specifically cover AI avatars. If you use tools like HeyGen or Synthesia to sell with a virtual presenter, your disclosure must satisfy two conditions — both, no exceptions:

One: the video itself must carry on-screen text that says, plainly, "AI-generated."

Two: the avatar itself has to say it, out loud: "I'm a virtual person."

The old trick of tucking an #AI hashtag into the video description? No longer enough.

Hurdle Three: GDPR — What Goes In Doesn't Come Back Out

The third hurdle is privacy. It's the least visible one — and carries the heaviest fines.

GDPR, Europe's toughest privacy law, can fine you up to 4% of global annual revenue.

In mid-2025, Meta planned to update its privacy policy to feed European users' public data into training its own AI. European regulators pushed back on the spot, forcing Meta to hit pause and offer a much clearer "opt out of training" option.

If that's what happens to a giant, imagine what happens to the rest of us.

But behind all this lurks a much thornier contradiction. GDPR gives users a right called the "right to be forgotten": when a user asks for their data to be deleted, you have to delete it.

But think about it for a second: can a large model actually "forget"?

No.

Once your data has been trained into a model's parameters, there's essentially one way to pull it back out: tear the whole model down and retrain it — at a cost that's simply not realistic.

So the only real fix is to choke the problem off at the entrance.

Never feed personal information — customer emails, customer addresses — into free-tier AI tools.

Why? Because the free tier's terms say so: your data may be used for training. And when accountability day comes, it's you — not the tool company — who violated GDPR.

That's right: "free" just means your data pays the bill.

So what do you do? Use the enterprise or team plans. These put it in black and white in the contract: your data is not used for training.

A few dollars saved on subscriptions, versus a fine calculated as a percentage of revenue. That math isn't hard.

Canada: No Law — and That Makes It More Dangerous

There's one more interesting case, from Canada.

In January 2025, Canada's long-in-the-works Artificial Intelligence and Data Act (AIDA) died when Parliament was prorogued — dead before it ever became law. So to this day, Canada has no federal AI law; the government has issued only a "voluntary code of conduct."

So are Canadian companies safe then?

Quite the opposite.

No law doesn't mean no risk — it means no benchmark. You have no way of knowing which of today's gray-area moves will become grounds for punishment tomorrow.

What's more, the digital economy is global. The EU AI Act, like GDPR, has "extraterritorial reach": if your AI processes the data of EU citizens, or you sell to European customers, it applies to you — no matter where your office sits.

Canada may not be able to touch you. The EU and the FTC can.

Don't bet on "nobody's watching here." If you're going to bet on something, bet on being clean.

Before You Publish, Run These Five Questions

I've distilled all these rules into a pre-publish checklist:

1. Among your reviews and customer testimonials, is even one of them AI-generated? If yes, delete it.
2. Using an AI avatar in your videos? Did it clearly identify itself as AI — on screen and in the voiceover?
3. Are your AI tools on enterprise or team plans? Could customer data end up in training?
4. Are the default metadata watermarks still on your AI-generated images? Resist the itch to strip them.
5. Did your email blast list come with explicit consent from every recipient? Or are you leaning on "legitimate interest" (a GDPR legal basis for processing data without explicit consent) — the excuse regulators love to pounce on?

One more thing: feel free to have AI draft your privacy policy — but never publish it as-is. AI will cite legal provisions that don't even exist, with a completely straight face. Documents like this must go through a human lawyer before they go out.

Finally, Where I Stand

For many people, the word "compliance" triggers an instant headache — they see cost, they see shackles.

I see it the other way around.

Back in 2023, knowing how to use AI made you a growth hacker. Today, AI skills are everywhere; using AI responsibly is the scarce trust signal.

Consumers are sharper than ever. A lazy AI mail-merge, a fabricated review — they can smell it through the screen.

And when you keep the watermark, disclose the avatar, guard the customer data, you're really saying one thing to every customer: I respect you, I respect your data, and I'm not playing games with you.

You never have to say it out loud — the way you operate says it for you.

Compliance up front is a moat. Compliance after the fact is a confession.

Oh, and that friend from the group chat who was showing off his reviews? He later went back and deleted those hundred-plus reviews, one by one.

Delete early, pay less.

And may you never need to.