Is the FTC investigating Anthropic?

Yes. Anthropic's S-1, filed October 26, 2026, says the FTC issued it a civil investigative demand in October 2026 about its consumer protection, data protection and privacy practices and the safety and security of its products. On October 26 an FTC spokesperson told Axios the agency had sent demands for Anthropic executives to testify.

Does the FTC investigation affect Claude customers?

Not directly. No customer has been named and no finding has been made. Anthropic says the probe could require changes to how it designs, tests or deploys its models, so the practical risk is product or policy changes, not a sudden shutdown.

Can Anthropic's zero data retention terms change?

The S-1 says Anthropic's safety framework has required, and may continue to require, monitoring and retention incompatible with zero data retention for certain model classes. Ask in writing whether your terms cover each model you plan to use.

How much of Anthropic's revenue came from usage policy violators?

About 5% to 7% of revenue for the nine months ended September 30, 2026, by Anthropic's estimate. It says it stepped up detection and enforcement in August and September 2026 and restricts or terminates access when it finds violations.

Anthropic S-1 and FTC Probe: 5 Risks for Claude Customers

This is for teams that run Claude in production, through Anthropic's API, its apps or a cloud marketplace. Anthropic filed its S-1 registration statement on October 26, 2026, and the same day the FTC sent demands for Anthropic executives to testify in its consumer-harm probe. Our verdict: the investigation is not a reason to switch, but the filing describes five risks that already reach customers, and each has a cheap check.

Event date: October 26, 2026, S-1 filing with the SEC and the FTC's testimony demands. First reported the same day by Axios, which cited an FTC spokesperson, and The Hill. We read the risk factors, results discussion and legal proceedings in the S-1 itself.

What the S-1 says about the FTC

The filing confirms what the FTC had told reporters. "In October 2026, the FTC issued a civil investigative demand to us seeking information about our consumer protection, data protection, and privacy practices, as well as the safety and security of our products." Anthropic warns that the probe could "require changes to how we design, test, or deploy our models, platform, and applications."

Anthropic S-1 risk factor: in October 2026 the FTC issued a civil investigative demand seeking information about consumer protection, data protection, privacy, safety and security

Screenshot: Anthropic PBC Form S-1, filed October 26, 2026, risk factors. Captured October 27, 2026.

Axios reported that the FTC's demands "span 50 pages for each company" and ask for documents on security incidents, safeguards, marketing and privacy policies. The FTC subpoenaed OpenAI and Anthropic on October 15. The new step is testimony: the agency confirmed demands for Anthropic executives, and said individuals at other AI companies got them too, without naming them. The Hill reported the FTC "did not confirm the same demands were sent" to OpenAI.

For background on the probe and why it started, see our Project Panama post, and the false police tip incident The Hill tied to it.

Five risks the filing puts on customers

Usage-policy enforcement got stricter. Anthropic estimates that customers it later found violating its usage policy or commercial terms made up "approximately 5% to 7% of our revenue for the nine months ended September 30, 2026." It "enhanced our detection and enforcement efforts, in particular in August and September 2026," and the outcome for those customers is "restricting or terminating their access." If an automated review misreads your use case, you find out when access stops.
Zero data retention has limits. Under ZDR, Anthropic keeps "only classifier scores, not prompts or outputs." But "our safety framework has required and may continue to require monitoring and retention incompatible with ZDR for certain model classes," and that has already pushed some customers to other providers.
The government can switch models off. In June 2026, the Commerce Department "imposed worldwide export restrictions on our Fable 5 and Mythos 5 models, which we disabled for all customers until those restrictions were lifted." Anthropic adds: "Similar restrictions could be imposed again in the future."
Government work carries a separate risk. On September 25, 2026, the D.C. Circuit ruled 2-1 that the Department of War's Section 4713 supply-chain risk designation of Anthropic was proper. Anthropic has asked the full court to rehear it, and says the cases may hurt sales to "customers that sell products and services to the U.S. government."
Limits and models change. Anthropic has "changed, and may in the future change, usage limits, rate limits, or model and product capabilities." It also names a March 2026 outage and the risk that customers on older models face forced migration.

Anthropic S-1 risk factor on zero data retention: ZDR may prevent producing records, and the safety framework has required retention incompatible with ZDR for certain model classes

Screenshot: Anthropic PBC Form S-1, risk factors, zero data retention. Captured October 27, 2026.

The ZDR passage cuts both ways. Anthropic also says ZDR "may also prevent us from producing records for subpoenas, regulatory examinations, or incident-reporting obligations." Our take: on ZDR traffic, plan as if your own logs are the only record of what Claude was sent and what it returned.

What to check this week

Re-read your use against the usage policy. Pay attention to the high-risk use case requirements and to anything your end users can do through your product. Anthropic says it "cannot uniformly verify" its customers' end users, so write down who your users are and what you let them do before Anthropic asks.
Get ZDR scope in writing, per model. Ask your account team which current and planned models your ZDR terms cover, and what retention applies where they don't. Record the answer in your data retention policy.
Keep a tested fallback. The June export restrictions took two models away from every customer until they were lifted. Our export ban post has a dependency checklist.
If you sell to the federal government, clear Claude first. Read our Pentagon blacklist post with its October update, and our guide to the DoW's new LLM contract rules.
Log the investigation in your vendor file. Note the date of the demand, and set a reminder to look for a consent order or complaint. Our FTC enforcement tracker lists how past AI cases ended.

Anthropic S-1 legal proceedings: on September 25, 2026 the D.C. Circuit ruled 2-1 that the Section 4713 supply-chain risk designation was proper; Anthropic filed for rehearing en banc

Screenshot: Anthropic PBC Form S-1, risk factors, Department of War litigation. Captured October 27, 2026.

What people said

Not everyone reads the risk factors as warnings. In the r/ClaudeAI thread on the filing, which had 372 comments when we read it, one user wrote: "Standard risk-factor language - every S-1 has it, it's there for legal cover, not a prediction." That's fair for most of the section. The five items above are different because they describe things that already happened, with dates.

No embed: the FTC has published no statement or video on the demands, and Anthropic's announcement is the filing itself, which we link and quote.

What we could not confirm

We did not see the civil investigative demand or the testimony demands; the FTC has not published them, and the S-1 describes them in one sentence. We don't know which executives were named or when testimony is due. The S-1 doesn't say which model classes need retention beyond ZDR. An investigation is not a finding, and nothing in the filing says Anthropic broke the law.