Cox Media Group told small businesses its Active Listening service overheard conversations near smartphones and smart speakers. The FTC's final complaint says it collected no voice data at all, and that CMG resold email lists bought from data brokers at a markup. CMG and its two suppliers pay $930,000.
In 2023 Cox Media Group put a line on cmglocalsolutions.com, the website of its local-marketing business, that a federal complaint now quotes: "Creepy? Sure. Great for marketing? Definitely."
The product was called Active Listening. Cox Media Group, or CMG, owns local television and radio stations and sells advertising to small and medium-sized businesses in those markets. It told those businesses that the service overheard conversations near smartphones, smart TVs and smart speakers, used AI to pick out people talking about a need, and handed the advertiser a list of them. "Don't Just Know What They're Searching For-Know What They're Talking About," the website said.
In late August 2024, 404 Media published a CMG pitch deck for the service, and it was widely reported as confirmation of something many people already believed: the phone is listening. A month later CMG put out a statement that said the opposite. "CMG businesses have never listened to any conversations," it said.
On August 26, 2026, the Federal Trade Commission issued a final complaint and order against CMG, alongside orders against MindSift LLC and 1010 Digital Works LLC, the two firms that supplied the service to CMG on a white-label basis for resale under CMG's name. The complaint sides with the statement, not the sales pitch. "Respondent's Active Listening service did not collect or use voice data in any manner," it says. What the small businesses bought, it says, was "nothing more than consumer email list buying," resold "at a significant markup over the cost of the data."
So one of the best-known "your phone is listening" stories of recent years ends, in the regulator's account, with nothing listening at all. The people the FTC says were deceived are not the owners of the phones. They are the businesses that paid for the lists.
The complaint quotes CMG's own website from 2023. Some of it explained the idea: "At a basic level, your smartphone is technically always listening." Some of it made the promise: "We can identify buyers based on casual conversations in real time. It may seem like black magic, but it's not-it's AI." And some of it set the terms: "Voice Data AI gives you a weekly roster of qualified customers who have spoken about their need for your service or product," with "territories available in 10 or 20-mile radiuses."
The sales presentations, used from 2023 into mid-2024, said the same thing more flatly: "Active listening begins and is analyzed via AI to detect pertinent conversations via smartphones, smart tvs, smart speakers and other devices."
The pitch to a prospective customer included a question: "Where do you want us to listen?" According to MindSift's complaint, MindSift supplied that line to CMG.
Some customers were skeptical. The complaint says CMG "doubled down" and coached its staff with answers. One was a statistic: "Voice related behaviors make up 40%-50% of behavior volumes we consume." Another was a list of names. Staff gave "Alexa, Google, [O]pentable, [and] Samsung" as examples among "570 different data sources" that supplied voice data, and reminded doubters that "almost every app, device including TVs people buy ask for microphone access."
When customers asked whether any of this was legal, the answer was consent: "You may not realize it, but when you download apps, set up new devices you 'accept' the terms, and those terms include allowing them to access your microphone."
MindSift's own pitch, in its separate complaint, was blunter still: "Yes, your devices are listening to you."
The complaint's answer takes one paragraph. Smart devices "did not transmit voice data" to the service, and CMG "did not use 'AI to detect pertinent conversations.'" The service "did not collect or use voice data in any manner." What CMG sold instead was email list buying, which the complaint describes as "an industry practice where data brokers sell lists of email addresses of individuals presumed to have particular interests or demographic characteristics." CMG bought such lists and resold them "at a significant markup over the cost of the data."
The local part was not local either. Where CMG promised reach within a set radius (the complaint's example is "within a ten-mile radius of Orlando, Florida"), the service "generated lists of consumers from across the country, with only a fraction of consumers located near the small business advertising customer."
The formal charge has three parts, and the complaint says each representation was false. CMG said the service collected and used voice data from smart devices. It said that data came from users who had consented. And it said the lists held only people in the customer's chosen area. The second part is the odd one to read: the complaint charges that consumers never consented to a collection of voice data that, by its own account, never happened.
There is a detail in MindSift's complaint that reads differently once you know the ending. MindSift ghost-wrote an answer for CMG's skeptical customers, and its second sentence mentions email addresses: "Our algorithm will use a personal identifier, most commonly an email address to match behaviors generated via Voice from IoT devices, Search, DSP's [sic], Data Providers, Publishers." The FTC's account is that the email address was the whole of it.
CMG's statement, published on its website on September 26, 2024, answered the stories of that summer: "As we stated before, CMG businesses have never listened to any conversations nor had access to anything beyond third-party aggregated, anonymized, and fully encrypted data sets that can be used for ad placement." It said the information in recent stories was "based on outdated materials for a product that CMG Local Solutions no longer sells (although the product never listened to customers, it has long been discontinued to avoid misperception)."
So CMG gave two accounts of one product. To the businesses paying for it, the service heard conversations and turned them into leads. To the public, after the pitch deck came out, it never listened to anything. Both cannot be true. The FTC's complaint adopts the second and charges CMG over the first.
The statement did not drop the idea entirely. A few sentences later it says: "Advertising data based on voice and other data is collected by these platforms and devices under the terms and conditions provided by those apps and accepted by their users." That is the same theory CMG's sales staff used on doubtful customers: voice data exists, other companies collect it, and people agreed to it in terms of service they accepted. The sentence is not an admission of anything, and the FTC's complaint does not cite it. It shows the voice-data story surviving inside the denial.
The 2024 coverage was about consumers being overheard. The 2026 orders are about small businesses being misled about what they were buying.
CMG must pay $880,000. MindSift and 1010 Digital Works pay $25,000 each. That is $930,000 in all, of which CMG's share is 94.6 percent. CMG's order requires it to hand over "sufficient customer information to enable the Commission to efficiently administer consumer redress to all purchasers of the advertising and marketing services subject to the misrepresentations identified in the Complaint." The purchasers were the businesses. The FTC's announcement of the final orders says the money will be used for redress to CMG's customers.
The order itself is more careful. The money "may be deposited into a fund administered by the Commission or its designee to be used for relief, including consumer redress." If a Commission representative decides direct redress is impracticable, or money is left over, it can go to other relief connected to the practices, and anything unused goes to the U.S. Treasury.
What none of the documents say is how many businesses bought Active Listening, what they paid, or how large the "significant markup" was. So there is no way to turn $930,000 into a refund per business, and this essay does not try.
During the comment period on the MindSift and 1010 Digital Works orders, the Center for AI and Digital Policy asked the Commission for more. As the FTC's reply lists its recommendations, the group wanted the orders to "prohibit monitoring and surveillance products and services," to broaden their definition of voice data, to require consent and data deletion and bar data transfers, to "require algorithmic disgorgement," and to require governance programs. Algorithmic disgorgement means deleting the models or algorithms a company built from data it should not have had.
The Commission said no, in a letter dated August 26, 2026. "As alleged in the complaints, digital eavesdropping and interception of private communications of individuals did not in fact happen; neither MindSift nor 1010 Digital collected or exploited consumers' biometric information." The group's requests, the letter notes, drew on earlier orders, and it names two: United States v. Kurbo Inc. and In the Matter of Support King, LLC, whose order the FTC's own file name calls the SpyFone order. In those matters, it says, the companies "were alleged to have collected personal information in a surreptitious or illegal manner." "Here," it adds, "that is not the case." And later: "The facts as alleged in the MindSift and 1010 Digital matters did not involve actual surveillance products or services."
The group had argued that orders this narrow implied something troubling. The Commission quoted the argument back and rejected it: it did not agree that the orders "suggest[] that a commercial service for the unauthorized collection of consumers' private communications data would be permissible if advertised accurately." It called the relief "appropriately tailored to address the deceptive representations alleged," and made the orders final "without any modifications." The FTC's announcement says the Commission received two comments on the proposed orders and voted 2-0 to approve them.
The two sides were describing different cases. The privacy group was answering the 2024 story, a surveillance product. The Commission was answering its own complaints, a list reseller that claimed to be one. On the complaints' account there were no recordings to erase and no conversation-detecting AI to take apart.
CMG's order has a single definition. "Voice Data" means "any full or partial audio file of an individual's voice, voice communications, or audio communications, as well as any transcripts of such audio file."
For the next 20 years CMG must not misrepresent "the collection and use of Voice Data" or "consumers' consent to the collection, use, or disclosure of Voice Data," along with the qualities of its advertising services and their geographic targeting. For the same 20 years it must create records, keeping each for five, including "accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues, and resulting net profit or loss."
On the FTC's account, CMG never had any Voice Data. The order's central term still describes it in detail, because in a deception case the order is written against the claims, and the claims were about voice.
It shows what CMG told its small-business customers, in the words the FTC's complaint quotes from CMG's website, presentations and coaching scripts. It shows what the Commission alleges was actually sold, what CMG and the two smaller firms must pay, and who the order says the redress is for. And it shows the Commission turning down a request to treat the case as one about surveillance.
It does not show that CMG did anything wrong as a matter of proven fact. CMG's consent agreement says it "neither admits nor denies any of the allegations in the Complaint, except as specifically stated in the Decision and Order," and admits only the facts needed for jurisdiction. It also waived the requirement that the decision contain findings of fact. The order's only findings identify CMG and state that the Commission has jurisdiction and that the proceeding is in the public interest. Everything above about what the service did is the FTC's allegation, which CMG settled rather than contested.
It does not show how many businesses bought the service, what they paid, how large the markup was, or when, and how much, redress will reach them.
It does not show that no phone anywhere listens for advertising purposes. It is about one product. What Amazon, Google and Meta said in 2024 about their own devices and CMG was not read for this essay, and is not characterised here.
Every quotation from CMG's website, presentations and scripts comes from the FTC's final complaint in In the Matter of CMG Media Corporation, Docket C-4838, issued August 26, 2026, which reproduces them. The complaint's own spelling is kept, including the hyphens in "For-Know" and "not-it's". The MindSift quotations come from its final complaint, Docket C-4839. The order's terms come from CMG's final Decision and Order, and the admissions language from CMG's Agreement Containing Consent Order. The exchange with the Center for AI and Digital Policy comes from the Commission's letter of August 26, 2026. CMG's words to the public come from its statement on cmg.com.
The description of CMG's business comes from the FTC's analysis to aid public comment on the proposed order.
404 Media's article is behind a paywall past its opening, and it is used here only for the fact that it published the pitch deck in August 2024.
The only arithmetic is the total and the share: $880,000 plus $25,000 plus $25,000 is $930,000, and $880,000 is 94.6 percent of it.
CMG's customers had only the sales pitch to go on, and the FTC settled what the service did by reading records. An AI agent's claims about its own work need the same kind of record. Chain of Consciousness keeps a tamper-evident log of what an agent read and did, so what it says it did can be checked against what it did.
pip install chain-of-consciousness npm install chain-of-consciousness
Or start without installing anything: Hosted Chain of Consciousness.