The Black Box 007: They Sold "Yes, Your Devices Are Listening to You." The Listening Was the Fake Part.
Bot Mutiny |
The FTC fined three companies $930,000 over an AI service that promised to overhear your conversations. It never collected a single word of audio.
The Black Box 007: They Sold "Yes, Your Devices Are Listening to You." The Listening Was the Fake Part.
The FTC fined three companies $930,000 over an AI service that promised to overhear your conversations. It never collected a single word of audio.
September 04, 2026
A New Hampshire marketing company wrote a line of sales copy that said: "Yes, your devices are listening to you."
It was selling that sentence as a feature. The product was called Active Listening, and for roughly two years it was pitched to small businesses across the country as a way to find customers by overhearing them. On August 27, 2026, the Federal Trade Commission finalized consent orders against three companies over it. The total is $930,000.
The finding underneath that number is not the one most people would expect. The FTC did not conclude that these companies listened to anyone. It concluded that they did not, and that saying they did was the violation.
What was sold
MindSift LLC, based in New Hampshire, developed and marketed Active Listening. It sold the service directly to small businesses and also white-labeled it to CMG Media Corporation, the Georgia company that does business as Cox Media Group. A third firm, 1010 Digital Works LLC of Mequon, Wisconsin, whose sole owner is Dmitriy Shteynbuk, worked with MindSift on the same product and supplied it to Cox Media Group on the same white-label basis. Cox Media Group resold it to its own advertising clients.
The pitch was that smart devices in a home or a car pick up conversations, and that software could sort those conversations for commercial intent. A person says they need a new roof. The system hears it. The roofer gets a lead that week.
Cox Media Group's promotional material described the service as delivering an understanding of consumer behavior that search data could not, under the heading "Know What They're Talking About." Elsewhere the copy addressed the obvious objection directly and cheerfully: "Creepy? Sure. Great for marketing? Definitely." Another line assured readers that "It may seem like black magic, but it's not." The explanation offered for how it worked was AI.
According to the FTC's complaint, the marketing claimed the technology drew voice data from smartphones, smart televisions, smart speakers and other devices, and it referenced data associated with Amazon, Google and Samsung. MindSift told prospective customers its technology could harvest essentially all pre-purchase discussions in real time. Both MindSift and 1010 Digital Works represented that the service could target consumers inside a defined area, such as a ten-mile radius around a set of zip codes.
The two suppliers also wrote Cox Media Group's sales language for it. MindSift furnished marketing copy and ghostwritten replies for CMG to send to customers who asked questions. Both MindSift and 1010 Digital Works supplied CMG with the same promotional question to put to its clients: "Where do you want us to listen?"
What it actually was
The FTC alleges that Active Listening never collected voice data. Not partially, not in a limited pilot, not from a subset of devices. All three complaints describe the same underlying mechanism, and it has nothing to do with audio.
The companies bought consumer email lists from other data brokers and resold them at a markup.
That is the entire product. The lists were not assembled from conversations because no conversations were captured. The geographic claim failed on its own terms as well: the FTC alleges the lists covered consumers nationwide rather than the specific local areas customers were paying to reach. A business buying a ten-mile radius was receiving names from anywhere.
The consent claim collapsed in a similar way. The companies represented that consumers had opted in to voice collection. The basis for that representation was language buried in the terms of service of unrelated mobile applications and devices. The FTC's position is that this does not constitute opt-in consent for a service of this kind. That finding is worth separating from the rest, because it is the one piece of this case that would survive even if the technology had been real.
The Commission said as much. If Active Listening had worked the way it was advertised, the collection and use of consumers' voice data without adequate consent would itself have violated the FTC Act. The only reason this case is about deception rather than surveillance is that the surveillance was fictional.
The deck, and how it was read
None of this began with the FTC. On August 26, 2024, Joseph Cox at 404 Media published Cox Media Group's pitch deck for Active Listening. The piece did what it said it would: it documented the deck and reported what CMG claimed. The document was authentic.
What happened next was not 404 Media's doing. Dazed ran the story under the headline "Conspiracy confirmed! Our phones are listening to everything we say." PhoneArena told readers the leaked deck "proves that your phone is listening to what you say." A claim that had circulated for a decade as folklore suddenly had a corporate document behind it, and the document was real.
Not everyone read it that way. Writing on August 29, 2024, Karl Bode at Techdirt put the qualifier in his headline and then stated it plainly in the text: it was not clear Cox was "truly capable of doing what it claims," as against overstating its abilities to attract advertising partners. Two years later that sentence is the FTC's finding.
The failure mode here is worth naming, because it is not obvious. Every outlet had an authentic primary document. The deck said what the deck said. The error was treating a company's marketing claim about its own capabilities as evidence that the capability existed, which is a different thing and a much weaker one. A pitch deck is proof of a pitch.
The orders
The complaints were announced on May 21, 2026. After a public comment period that drew two comments, the Commission voted 2-0 to finalize the consent agreements on August 27.
CMG pays $880,000, due within eight days of the order taking effect, an amount its counsel had already stipulated was held in escrow. MindSift and 1010 Digital Works each pay $25,000. The money is designated for redress to CMG customers affected by the practices.
The prohibition is broader than the money. Each respondent is barred from making any misrepresentation, express or implied, about the qualities or features of its advertising or marketing services, about the collection and use of voice data, about whether consumers have consented to the collection, use or disclosure of voice data, and about the geographic targeting capabilities of its services.
The order defines Voice Data as any full or partial audio file of an individual's voice, voice communications or audio communications, along with any transcripts of such a file. That definition is doing real work. It means a future product that captures fragments, or that keeps only the text of what was said, still lands inside the prohibition.
The compliance obligations run long. CMG must acknowledge receipt under oath within ten days, deliver the order to officers, managers and relevant employees within ten days and collect signed acknowledgments within thirty, file a sworn compliance report after one year, report structural or contact changes within fourteen days, keep accounting, personnel, complaint, advertising and compliance records for five years, and respond to Commission information requests within ten days.
The order stands for twenty years.
What the record does not establish
This is a case built on what did not happen, so the boundaries matter more than usual.
The record does not establish that any smart device listened to anyone on behalf of these companies. It establishes the opposite.
It does not establish that other companies are doing this. Nothing in these documents speaks to any firm outside the three named respondents.
It does not name the data brokers the email lists were purchased from, and it does not say how many small businesses bought the service or what they paid in total. The $930,000 is a settlement figure, not a measure of revenue.
It does not establish that any consumer was identified from something they said out loud, because on the FTC's account no conversation was ever captured to identify them from.
And it does not resolve the broader question people actually care about, which is whether phones listen for advertising purposes generally. These orders concern three companies that said they were doing it while selling recycled email lists. That is a narrower finding than the headline instinct suggests, and it is the only finding here.
The part that should bother you
For years the claim that a phone listens and then serves an ad has lived in the space between technical implausibility and personal certainty. Almost everyone has a story about it. The stories are hard to argue with because the coincidence is real even when the mechanism is not.
What the FTC record shows is that a company noticed the belief and built a business on top of it. Active Listening did not need to work. It needed to be believable, and the belief was already installed. MindSift's own copy did not hedge or obscure. It said yes, your devices are listening to you, and then it asked buyers where they wanted the listening pointed. The sales advantage came from the customer's existing conviction, not from any capability.
Then there is where the money goes. The $930,000 is earmarked for redress to Cox Media Group's customers, meaning the businesses that bought advertising they did not get. On this record they are the injured parties, and that follows logically: they paid for a service that was misrepresented to them.
Nobody who believed their phone was listening receives anything. Nothing was taken from them, so there is nothing to return. The only thing this product ever successfully harvested was the assumption that it worked, and the FTC has no remedy for that.
The Black Box is built from primary documents. This issue draws on the FTC's administrative complaints and finalized consent orders against CMG Media Corporation, MindSift LLC and 1010 Digital Works LLC, announced May 21, 2026 and finalized August 27, 2026, all available at ftc.gov. Contemporaneous 2024 coverage cited from 404 Media and Techdirt.