If AI Engines Are Buying Their Own Citation Sources, Your GEO Strategy Has to Follow the Money.

Whose content an AI answer is allowed to cite is no longer an open question with an open answer. It's being decided by contract, by court order, and by regulation, and this summer all three moved at once. For anyone whose job is to show up in AI answers, that isn't legal news happening off to the side. It's the boundary of where you're allowed to appear.

The EU's transparency rules for AI-generated content take effect on August 2, 2026. The FTC has floated a policy statement that treats undisclosed steering of what a model says as possible deception, open for public comment through the end of July. And in the case that will decide whether training on journalism is fair use, the New York Times just asked a federal judge to sanction OpenAI. Most coverage files these under legal news for the general counsel. For a marketer the through-line is simpler and more urgent, because the same contracts, rulings, and rules are all settling one question that lands straight on your visibility, which is which sources an answer is allowed to name. They draw that boundary along three lines, contract, court order, and regulation.

The Licensing Layer

Contract is the most direct of the three. When OpenAI signed News Corp in 2024, in a deal reported to be worth more than $250 million dollars over five years though both companies' own releases name no price, it bought the right to surface The Wall Street Journal, Barron's, and the New York Post inside ChatGPT, not just a stack of training data. Digiday's running timeline of major publisher-AI deals runs to roughly sixteen in 2025 alone, from Amazon feeding licensed editorial into its Rufus shopping assistant to Microsoft paying publishers per use. That list is the set of domains each engine is contractually comfortable citing, which makes it a media target list. If you're fighting for a finance answer against a source ChatGPT is paid to surface, out-ranking it from your own site is the wrong game, and getting quoted inside it is the right one.

The clearest example is Reddit. Google paid it $60 million dollars a year to train on its users' posts, and a platform an engine pays to learn from is a platform that engine reaches for. The lesson isn't about one forum. For a lot of brands the move with the most upside isn't another pass of on-site optimization but earned, genuine presence in the licensed communities the engines already lean on, Reddit among them, and increasingly YouTube and LinkedIn. The word doing the work there is genuine, and there's now a federal rule that enforces it.

The FTC's fake-reviews rule, in force since October 2024, bans AI-generated reviews and testimonials from people who don't exist or never used the product, and it carries civil penalties up to $51,744 per violation. Seeding synthetic reviews to steer what a model says about you is a per-se deceptive practice now, not a growth tactic, and it comes with a price. Authentic presence in the communities engines cite is the strategy, and manufacturing that presence with fake accounts is how you get fined.

The Litigation Line

The lawsuits draw the second boundary, and this is where a marketer's read pulls away from a lawyer's. The marquee case, the New York Times against OpenAI and Microsoft, is still unresolved on the central question of whether training on copyrighted journalism is fair use, and it turned sharp in July when the newspaper group asked the court to sanction OpenAI, alleging it had claimed for two years that it couldn't search its systems for the plaintiffs' content when an employee already had. OpenAI calls the allegations "blatantly false." Underneath the procedure, the fight is about regurgitation, verbatim output, the exact mechanism by which your page can be reproduced inside an answer with no click back to you.

The case a GEO operator should watch even more closely is Dow Jones and NY Post against Perplexity. It goes at retrieval directly, the copying of live pages into a RAG index, and it adds a claim the training suits don't, hallucinated text falsely attributed to the plaintiffs under their own trademarks. That's the legal test of a problem you can't write your way out of, being cited wrongly, with words a model invented put in your brand's mouth and no clean way to force a correction. Fact discovery runs through July 2026.

The rulings that do exist point one way without settling the war. In Bartz v. Anthropic, a federal judge held that training on lawfully acquired books is transformative fair use while building a library from pirated copies is not, and Anthropic settled in September 2025 for at least $1.5 billion dollars. The lesson the engines are drawing is that provenance matters, that clean licensed material is safer to cite than scraped material, which strengthens the position of authoritative sources a brand can stand behind. The first ruling to reject an AI fair-use defense outright, Thomson Reuters against Ross Intelligence and now on appeal, turned on market substitution, the idea that when an output stands in for a visit to the original, that cuts against fair use. That is the legal spine under every zero-click complaint. And in Britain, Getty's case against Stability AI went the other way in late 2025, with the court holding that model weights aren't a copy of the training images, a reminder that the answer changes by jurisdiction and a global brand can't assume one rulebook. There is still no final American verdict on the core question, and anyone who tells you the fair-use fight is over is selling something.

The Disclosure Rules

Regulation draws the third line, and it's shifting from guidance to rules with dates attached. The FTC's July policy statement treats undisclosed output steering, altering what a model says without saying so, as possible deception under Section 5. It aims at model developers, not advertisers, so it's easy to overread, but the signal is plain enough. A federal regulator now considers the accuracy of an AI answer to be consumer-protection territory. The EU AI Act is more concrete for anyone marketing into Europe. Its Article 50 transparency duties apply from August 2, 2026, requiring AI-generated marketing content, promotional copy, ad imagery, chatbot sales assistants, to be disclosed and machine-readably marked as AI. And it leaves one carve-out worth building around, that public-interest text is exempt from the disclosure duty when it had genuine human review with editorial responsibility. Keeping a human editor on AI-assisted content stops being only a quality call and becomes a compliance one.

None of this is AI taking the marketer's job. The job is getting bigger, expanding to cover the terms under which your content gets cited, whether that citation is even accurate, and what you're required to disclose about your own AI-assisted work. The open web used to be the level field everyone optimized against. It's becoming a guest list, written partly by contract, partly by court order, partly by regulation, and the work now is to earn a spot on it honestly and to make sure that when an engine names you, it gets you right.