PIR-2026-0003 - FTC penalizes DoNotPay over unsubstantiated "robot lawyer" capability claims

id: PIR-2026-0003
title: FTC orders DoNotPay to pay $193K for marketing an untested "world's first robot lawyer"
date_occurred: 2021 to 2023 (subscription period covered by the order; claims ran longer)
date_detected: unknown (FTC investigation timeline not public)
date_disclosed: 2024-09-25 (complaint announced in the Operation AI Comply sweep); final order announced 2025-02-11 (5-0 Commission vote 2025-01-16)
status: corroborated (FTC complaint and final order, public record)

The agent

agent_description: DoNotPay, a consumer service marketed as "the world's first robot lawyer" - automated generation of legal documents, demand letters, and dispute filings, promising outputs equivalent to a human lawyer's ("sue for assault without a lawyer").
operator_type: startup
autonomy_level: human-approves-each-action (user-initiated document generation and filing)
model_stack: unknown (mix of rule-based automation and generative components; not disclosed in the order)
harness: proprietary consumer web platform
failure_locus: operator-config (the failure was the operator's untested capability claims, not a runtime malfunction)

Authority

authority_scope: external comms (legal documents and disputes filed on subscribers' behalf), data access (subscriber records)
funds_at_risk_usd: unknown (consumer legal exposure from defective documents never quantified)
blast_radius: customers/third parties (subscribers relying on the outputs for real legal matters)

The failure

root_cause: policy-violation - primary: deceptive capability claims charged under the FTC Act. Contributing: plain-error (outputs never tested against a competent attorney's work)
mechanism: DoNotPay marketed its service as a substitute for a human lawyer without conducting testing to determine whether outputs matched attorney-level quality, and without hiring or retaining any attorneys to validate features. The FTC charged the claims as deceptive in its first coordinated AI enforcement sweep (Operation AI Comply, five actions announced 2024-09-25). DoNotPay settled without admitting wrongdoing.
adversary_present: no
exploitation_status: in-wild-malfunction (real product, real subscribers; regulatory outcome, no attacker - reclassified from in-wild-exploited, which implies an adversary)

Impact

severity: loss
direct_loss_usd: 193,000 (ordered monetary relief)
indirect_loss_usd: unknown (harm to consumers who relied on defective legal documents was never quantified - the fine understates the underwriting fact)
downtime: none
data_exposure: none

Detection and recovery

detected_by: third-party (FTC enforcement)
time_to_detect: years (claims ran from at least 2021 to complaint in Sept 2024)
remediation: consent order - $193K monetary relief; prohibition on lawyer-equivalence claims absent substantiation; mandatory notice to 2021-2023 subscribers about limits of the law-related features
structural_fix: capability claims now require substantiating evidence per the order
controls_that_worked: none internal; the bounding control was external regulatory enforcement

Legal

liability_holder: DoNotPay, Inc. (operator); no admission of wrongdoing
precedent_set: first FTC AI-enforcement sweep (Operation AI Comply) - capability overstatement about an automated agent is actionable deception
sealed_material: no

Evidence

telemetry_grade: none (no runtime telemetry at issue; case rests on marketing claims vs absence of testing, per public FTC record)
sources:
- https://www.ftc.gov/news-events/news/press-releases/2025/02/ftc-finalizes-order-donotpay-prohibits-deceptive-ai-lawyer-claims-imposes-monetary-relief-requires
- https://www.ftc.gov/news-events/news/press-releases/2024/09/ftc-announces-crackdown-deceptive-ai-claims-schemes
- https://www.ftc.gov/legal-library/browse/cases-proceedings/donotpay
- https://www.abajournal.com/news/article/robot-lawyer-website-donotpay-settles-ftc-claims-it-couldnt-deliver-on-promises
- independence: regulator primary documents plus independent legal press - strong.
aiid_incident_id: 497 (https://incidentdatabase.ai/cite/497/) - cross-reference; primaries verified independently
confidence: high (all material facts from public FTC orders). Weakest link: no quantification of downstream consumer harm.

Verification notes

Dates, figure, and mechanism verified against FTC press releases and independent coverage; all check out as intake-recorded. Boundary case (low autonomy; regulatory-outcome cluster) - recorded under the v0.1 legal block, which exists for exactly this cluster.

Corrections

2026-08-19: Added aiid_incident_id cross-reference (AIID 497), matched against the AIID weekly database export (2026-08-17). A cross-reference, not a re-verification; no claim changed.