On 21 October 2024, the Federal Trade Commission's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect. It's the most significant U.S. regulation of online reviews ever enacted — and it changes the compliance landscape for every business that collects, displays, or relies on customer reviews.
This post explains what the rule covers, what it means for your business, and why the verification method you choose now determines your regulatory exposure.
# What the rule prohibits
The rule targets six categories of deceptive conduct:
# 1. Fake or false reviews
The core prohibition: reviews that misrepresent that the reviewer had genuine experience with a product or service. This covers:
- Reviews written by someone who never used the product
- AI-generated reviews presented as human-written (when they misrepresent experience)
- Reviews of a different product than the one being reviewed
What it means: If a review on your site claims a customer used your product and they didn't, you're exposed — even if you didn't write the review yourself.
# 2. Buying or selling reviews
The rule bans buying, selling, or brokering reviews — including "incentivized" reviews where the incentive (discount, gift card, free product) is conditioned on sentiment. You can still offer incentives for leaving any review, but you cannot offer incentives specifically for positive reviews.
What it means: "Leave us a 5-star review and get 20% off your next order" is explicitly illegal under the rule. "Leave us a review and get 20% off" is still allowed — but the incentive must not be tied to the content or star rating.
# 3. Undisclosed insider reviews
Company employees, officers, managers, and their immediate relatives must disclose their relationship to the business when posting reviews. Reviews from insiders that appear to be from ordinary customers are prohibited — even if the review content is truthful.
What it means: Your employees can review your product, but they must clearly disclose that they work for you. A review from "John D." that's actually from your CTO is a violation, regardless of whether John genuinely loves the product.
# 4. Misrepresented review sites
The rule prohibits a business from misrepresenting that a website or entity it controls provides independent reviews of its own products. This is the SiteJabber problem: collecting reviews at the point of sale and presenting them as if they reflect genuine post-purchase experience.
What it means: If you control the review collection process, you cannot misrepresent what the reviews represent. "Verified Buyer" must mean something real and honest.
# 5. Review suppression
The rule bans threatening, intimidating, or falsely accusing someone to prevent or remove a negative review. It also prohibits a business from misrepresenting that the reviews on its site represent all reviews submitted when negative reviews have been suppressed.
What it means: You can't hide negative reviews and pretend only positive ones exist. If you display a subset of reviews, you must be transparent about how that subset is selected.
# 6. Fake indicators of social media influence
The rule prohibits buying or selling fake followers, likes, views, or other social media influence indicators for commercial purposes. This extends the fake-review logic to social proof more broadly.
# Penalties
The FTC can seek civil penalties of up to $51,744 per violation. A "violation" could be each individual fake review — meaning the exposure for a business with hundreds of questionable reviews is substantial. And the FTC has shown willingness to act: the SiteJabber order in November 2024 demonstrated that the agency will pursue platforms, not just the businesses that post fake reviews.
# How this interacts with other regulations
# UK: Digital Markets, Competition and Consumers Act 2024
Effective April 2025, the UK's DMCC Act makes it explicitly illegal to:
- Submit or commission fake reviews
- Fail to disclose paid or incentivized reviews
- Offer services that write or procure fake reviews
The Competition and Markets Authority (CMA) can fine businesses up to 10% of global turnover for violations. UK enforcement is expected to be aggressive.
# EU: Digital Services Act
The DSA requires "very large online platforms" to assess and mitigate systemic risks including disinformation. Fake reviews, when they distort consumer decisions at scale, fall under this mandate. Platforms face fines of up to 6% of global annual revenue.
# Global trend
The regulatory direction is clear and accelerating: Australia (ACCC), Canada (Competition Bureau), and South Korea (KFTC) are all advancing fake-review regulations. By 2027, most major markets will have some form of fake-review prohibition with meaningful penalties.
# What this means for your review collection strategy
The FTC rule changes the risk calculus for every review collection method:
# Open platforms (Level 0–2 on the verification spectrum)
If your reviews are collected on an open platform — where anyone can post without proof of purchase — you have no structural protection against fake reviews appearing on your profile. A competitor, a disgruntled ex-employee, or a troll can post a fake negative review. A review farm can post fake positive reviews. You can flag them, but by the time they're removed, the damage is done.
The FTC won't penalize you for someone else's fake review of your business. But the platforms themselves face increasing pressure, and the reviews that damage your reputation are the same ones that create compliance risk for the platform.
# Merchant-supplied verification (Level 3)
If your reviews are verified against your own order data — as with most Shopify apps, Trustpilot invitations, and Yotpo's MAP system — you have stronger protection, but the verification chain still runs through data you control. The FTC's concern isn't that you'll game your own system; it's that the appearance of independent verification, when the data is merchant-supplied, can mislead consumers about how strong the verification actually is.
# Processor-attested verification (Level 4)
If your reviews are verified against an independent payment processor — Stripe confirming the charge occurred — you have structural FTC compliance. The verification doesn't depend on data you supply. The attesting party is a regulated financial institution, independent of your business. And the review can't exist without a verified, non-refunded payment.
This is the only verification method where "verified" means "an independent third party confirms the transaction." It's the strongest compliance position available under the rule.
# Practical steps to take now
Audit your current reviews. Do you know which reviews on your site came from verified purchasers and which didn't? If you can't answer that, you have a compliance gap.
Document your verification method. Write down — publicly, ideally — exactly what "verified" means on your review collection. Ambiguity is a risk. Transparency is a defense.
Separate verified from unverified. If you display reviews from multiple sources, clearly distinguish which are purchase-verified and which aren't. Don't let an unverified review benefit from the trust signal of a verified badge.
Review your incentive practices. If you offer incentives for reviews, make sure they're not conditioned on sentiment. Document that they aren't.
Move toward independent verification. The safest long-term position is reviews verified against an independent source — a payment processor, not your own records. The FTC rule rewards structural compliance over reactive moderation.
# The bottom line
The FTC's fake-review rule is a regulatory inflection point. It doesn't just penalize bad actors — it changes the definition of what makes a review trustworthy. "Verified" is no longer a marketing term you can define however you want. It's a claim that now carries regulatory weight.
The businesses that win under this rule aren't the ones with the best fake-review detection. They're the ones whose verification method makes fake reviews structurally impossible.
Further reading: The Fake Review Problem: Why Detection Will Never Be Enough · What Does "Verified Buyer" Actually Mean? · Stripe Verified Reviews