id: PIR-2026-0003title: FTC orders DoNotPay to pay $193K for marketing an untested "world's first robot lawyer"date_occurred: 2021 to 2023 (subscription period covered by the order; claims ran longer)date_detected: unknown (FTC investigation timeline not public)date_disclosed: 2024-09-25 (complaint announced in the Operation AI Comply sweep); final order announced 2025-02-11 (5-0 Commission vote 2025-01-16)status: corroborated (FTC complaint and final order, public record)agent_description: DoNotPay, a consumer service marketed as "the world's first robot lawyer" - automated generation of legal documents, demand letters, and dispute filings, promising outputs equivalent to a human lawyer's ("sue for assault without a lawyer").operator_type: startupautonomy_level: human-approves-each-action (user-initiated document generation and filing)model_stack: unknown (mix of rule-based automation and generative components; not disclosed in the order)harness: proprietary consumer web platformfailure_locus: operator-config (the failure was the operator's untested capability claims, not a runtime malfunction)authority_scope: external comms (legal documents and disputes filed on subscribers' behalf), data access (subscriber records)funds_at_risk_usd: unknown (consumer legal exposure from defective documents never quantified)blast_radius: customers/third parties (subscribers relying on the outputs for real legal matters)root_cause: policy-violation - primary: deceptive capability claims charged under the FTC Act. Contributing: plain-error (outputs never tested against a competent attorney's work)mechanism: DoNotPay marketed its service as a substitute for a human lawyer without conducting testing to determine whether outputs matched attorney-level quality, and without hiring or retaining any attorneys to validate features. The FTC charged the claims as deceptive in its first coordinated AI enforcement sweep (Operation AI Comply, five actions announced 2024-09-25). DoNotPay settled without admitting wrongdoing.adversary_present: noexploitation_status: in-wild-malfunction (real product, real subscribers; regulatory outcome, no attacker - reclassified from in-wild-exploited, which implies an adversary)severity: lossdirect_loss_usd: 193,000 (ordered monetary relief)indirect_loss_usd: unknown (harm to consumers who relied on defective legal documents was never quantified - the fine understates the underwriting fact)downtime: nonedata_exposure: nonedetected_by: third-party (FTC enforcement)time_to_detect: years (claims ran from at least 2021 to complaint in Sept 2024)remediation: consent order - $193K monetary relief; prohibition on lawyer-equivalence claims absent substantiation; mandatory notice to 2021-2023 subscribers about limits of the law-related featuresstructural_fix: capability claims now require substantiating evidence per the ordercontrols_that_worked: none internal; the bounding control was external regulatory enforcementliability_holder: DoNotPay, Inc. (operator); no admission of wrongdoingprecedent_set: first FTC AI-enforcement sweep (Operation AI Comply) - capability overstatement about an automated agent is actionable deceptionsealed_material: notelemetry_grade: none (no runtime telemetry at issue; case rests on marketing claims vs absence of testing, per public FTC record)sources:confidence: high (all material facts from public FTC orders). Weakest link: no quantification of downstream consumer harm.Dates, figure, and mechanism verified against FTC press releases and independent coverage; all check out as intake-recorded. Boundary case (low autonomy; regulatory-outcome cluster) - recorded under the v0.1 legal block, which exists for exactly this cluster.