Last updated: 2026-10-03
On August 27, 2026, the Federal Trade Commission announced final orders against CMG Media Corporation, doing business as Cox Media Group, and two marketing firms, MindSift LLC and 1010 Digital Works LLC, over a service sold to small businesses as "Active Listening". The three firms pay a total of $930,000. The orders, Docket Nos. C-4838 (CMG), C-4839 (MindSift) and C-4840 (1010 Digital Works), are dated August 26, 2026. The FTC announced the proposed settlements on May 21, 2026. In each consent agreement, the respondent states that it "neither admits nor denies any of the allegations in the Complaint".
What do the FTC complaints allege about Active Listening?
CMG owns local television and radio stations. According to the CMG complaint, it offered Active Listening from 2023 through a white-label deal with MindSift. The complaint quotes CMG's website, cmglocalsolutions.com: "We can identify buyers based on casual conversations in real time. It may seem like black magic, but it's not-it's AI." and "Creepy? Sure. Great for marketing? Definitely." (¶ 5).
CMG employees, the complaint alleges, cited "Alexa, Google, [O]pentable, [and] Samsung" as among "570 different data sources" of voice data, and told prospects that "almost every app, device including TVs people buy ask for microphone access" (¶ 7). For consent, CMG pointed to app terms: "You may not realize it, but when you download apps, set up new devices you 'accept' the terms, and those terms include allowing them to access your microphone" (¶ 8).
The FTC's allegation, from ¶ 9:
Contrary to Respondent's statements, smart devices with voice collection capabilities did not transmit voice data to Respondent's Active Listening service, and Respondent did not use "AI to detect pertinent conversations." In fact, Respondent's Active Listening service did not collect or use voice data in any manner. Rather, Respondent's advertising and marketing services were nothing more than consumer email list buying, an industry practice where data brokers sell lists of email addresses of individuals presumed to have particular interests or demographic characteristics.
The lists were sold for local targeting such as "a ten-mile radius of Orlando, Florida", but per the complaint they came "from across the country, with only a fraction of consumers located near the small business advertising customer" (¶ 11). The MindSift and 1010 Digital Works complaints add a second count: supplying CMG with sales language, including the pitch question "Where do you want us to listen?", which the FTC calls providing the "means and instrumentalities" for deception.
What do the final orders require?
| Respondent | FTC file no. | Docket no. | Payment | Counts |
|---|---|---|---|---|
| CMG Media Corporation (Cox Media Group), Atlanta | 242-3029 | C-4838 | $880,000 | Misrepresentation |
| MindSift LLC, Nashua, New Hampshire | 242-3030 | C-4839 | $25,000 | Misrepresentation; means and instrumentalities |
| 1010 Digital Works LLC, Mequon, Wisconsin | 242-3033 | C-4840 | $25,000 | Misrepresentation; means and instrumentalities |
Source: the FTC case page, complaints and final orders.
Provision I of the CMG order bars any misrepresentation about "the qualities or features of its advertising or marketing services", "the collection and use of Voice Data", "consumers' consent to the collection, use, or disclosure of Voice Data" and "the geographic targeting capabilities" of those services. The order defines Voice Data as "any full or partial audio file of an individual's voice, voice communications, or audio communications, as well as any transcripts of such audio file". The payments fund redress for CMG's customers, per the August 27 release. The order terminates 20 years after issuance, or 20 years after the latest federal court complaint alleging an order violation, whichever comes later. The May release puts the civil penalty for each order violation at "up to $53,088".
The Commission voted 2-0 after "receiving two comments". The FTC's reply to the Center for AI and Digital Policy in the MindSift and 1010 Digital Works matters, dated August 26, 2026, declines recommendations for surveillance bans, algorithmic disgorgement and data deletion: "As alleged in the complaints, digital eavesdropping and interception of private communications of individuals did not in fact happen."
Is my phone listening for ads?
The FTC alleges Active Listening collected no voice data. The record contains no test of any app or device. On consent, the May release states: "Clicking through mandatory terms of service does not constitute 'opt-in consent' for such an invasive service or for use of consumers' voice data from inside their homes."
An app that uses the microphone declares it: on iOS, NSMicrophoneUsageDescription; on Android, RECORD_AUDIO, which "Allows an application to record audio."
What a CanITrustThat scan shows for microphone access
When I scan an Android app, the static pass reports a RECORD_AUDIO declaration in the manifest, with the file and line. It flags the declaration again when the same manifest requests a location permission and an ad SDK is present, or when the Play listing is child-directed. A declaration is presence in the binary: the app can ask for the microphone. A traffic capture records what the app sent on a test device, to which host, before or after the consent prompt. What the receiving host uses the data for is outside the capture. What a scan checks and the limits of a scan are on the methodology page.
Related: the Hims & Hers FTC lawsuit alleges deception over health data sent to ad platforms; the EFF location study shows ad SDK traffic in a capture. I run these checks for lawyers and researchers working with lawyers, on one app or a list in bulk. Sign up for a CanITrustThat account to run your own research, let us run an investigation for you, or browse the scanned apps.