The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect on October 21, 2024. It is the first federal rule specifically targeting fake reviews, and it carries real teeth: civil penalties of up to $53,088 per knowing violation, with courts authorized to award compensation to harmed consumers on top of that. On December 22, 2025, the FTC sent warning letters to 10 companies for potential violations, marking the first public enforcement action under the rule and a clear signal that the agency is moving from rulemaking to active monitoring.
For businesses that generate reviews, for practitioners who advise them, and for ORM firms explicitly, this rule is not optional reading. The FTC's Q&A guidance confirms that advertising agencies, public relations firms, review brokers, and reputation management companies can all be liable under the rule. The reach is broader than most realize, and the conduct it prohibits is more common than most would admit.
This article covers what the rule prohibits, what it permits, how the December 2025 enforcement action changes the risk picture, and what compliance looks like in practice.
What the Rule Covers and Why It Exists
The rule exists because fake, false, and otherwise deceptive reviews have, in the FTC's own words, "polluted the marketplace." Consumers rely on reviews to make purchasing decisions. BrightLocal's 2026 Local Consumer Review Survey found that 97% of consumers read reviews for local businesses, and 41% "always" read reviews before engaging with a business. That dependence creates the exact conditions that review manipulation exploits: a consumer who trusts reviews is a consumer who can be misled by manufactured ones.
The rule addresses this by establishing specific prohibited categories of conduct, all enforceable through civil penalties for knowing violations. It covers fake reviews at every point in the review ecosystem: creation, purchase, sale, distribution, and suppression. It also covers fake social media engagement indicators, which place a broader range of digital marketing manipulation within its scope.
The full text of the rule is available at 16 CFR Part 465. The FTC has also published a Q&A guide for businesses that addresses specific compliance questions in plain language.
What the Rule Prohibits
Fake or False Reviews and Testimonials
The rule prohibits reviews and testimonials that misrepresent: (1) whether the reviewer actually used or experienced the product or service; (2) whether the reviewer's experience was positive or negative when represented as the opposite; or (3) any other material aspect of the reviewer's experience. This covers the full range of fabricated content: reviews written by people who never purchased the product, reviews that describe fictional experiences, and reviews that accurately describe an experience but misrepresent its sentiment. Source: 16 CFR Part 465.2(a).
Buying or Conditioning Reviews on Sentiment
The rule prohibits offering compensation or other incentives that are conditioned, either explicitly or implicitly, on a reviewer expressing a particular sentiment. The key word is "conditioned." Offering a gift card in exchange for any review is permitted with proper disclosure. Offering a gift card specifically in exchange for a five-star review, or only to customers who leave positive feedback, violates the rule. The same applies to negative conditioning: paying someone to leave a negative review of a competitor is equally prohibited.
This provision directly targets review-gating arrangements in which businesses route dissatisfied customers to private feedback forms while directing satisfied customers to public review platforms when routing is tied to incentives. The explicit link between the incentive and the positive outcome is the violation.
Insider Reviews Without Disclosure
Company officers, managers, employees, and agents, as well as their immediate relatives, cannot write or post reviews of the company's products or services without clearly and conspicuously disclosing their material connection. The disclosure must be sufficiently prominent for a reasonable consumer to notice. Burying a disclosure in terms of service or placing it in small print below the review does not satisfy the requirement.
This provision also applies to businesses that disseminate testimonials from insiders without disclosure, even if the business did not write the testimonial itself. If the company knew or should have known about the connection and published the testimonial without disclosure, it bears liability.
Company-Controlled Review Websites
A business cannot operate or promote a review website, platform, or section of its own site as if it were an independent third-party source when the business controls the content, selection, or curation of the reviews. The deception is in the false claim of independence, not in collecting reviews on owned platforms. A clearly branded testimonials page does not violate the rule. A website designed to appear as an independent review source while actually being controlled by the company being reviewed does.
Suppression of Negative Reviews
The rule explicitly prohibits businesses from preventing or removing negative reviews through threats, intimidation, false accusations, or similar means. This includes threatening legal action against reviewers for negative reviews when the business lacks a legitimate legal basis for that threat, submitting false reports to platforms to have negative reviews removed, and using non-disparagement clauses in consumer contracts to suppress review content.
This provision also captures a practice common in some reputation management contexts: falsely reporting a review as policy-violating to trigger removal, even though the business knows the review does not actually violate platform policy. The conduct underlying the false report is what the rule targets, not the reporting mechanism itself.
Fake Social Media Influence Indicators
The rule extends beyond reviews to prohibit purchasing, selling, or distributing fake indicators of social media influence: followers, friends, connections, subscribers, views, plays, likes, shares, reposts, and similar engagement signals generated by bots, fake accounts, or hijacked accounts. This provision brings a substantial category of digital marketing manipulation within FTC enforcement reach, separate from the review-specific provisions.
WHO IS COVERED
The rule's liability extends well beyond the business whose products are being reviewed. Per the FTC's Q&A guidance, advertising agencies, public relations firms, review brokers, and reputation management companies can all be liable. Specifically: any entity that writes, creates, or sells a fake review; any entity that provides compensation conditioned on a particular review sentiment; any entity that engages in review suppression; and any entity that misuses fake social media influence indicators. The ORM industry is explicitly named. Practitioners who advise clients on review strategy or who manage review generation programs operate within the rule's scope.
What the Rule Permits
The rule prohibits specific deceptive practices. It does not prohibit asking customers for reviews, running review generation programs, or managing a business's presence on review platforms. Understanding the permitted lane matters as much as understanding the prohibited one.
Businesses may: ask any customer for a review of their genuine experience; offer incentives for reviews as long as the incentive is not conditioned on positive sentiment and the incentive relationship is disclosed; respond to reviews, both positive and negative; flag reviews that genuinely violate platform policies for removal; and use reputation management tools that generate authentic review requests through legitimate channels. The FTC's Q&A also confirms that hosting consumer reviews on a business's own website does not create liability for fake reviews submitted by others, as long as the business did not write or purchase those reviews.
The key distinction throughout is between facilitating genuine customer feedback and manipulating the review record. A systematic review request program that contacts every customer after every transaction, asks for honest feedback, and does not condition any incentive on the outcome is permitted, fully compliant, and represents the right approach.
The December 2025 Enforcement Action: What Changed
On December 22, 2025, the FTC sent warning letters to 10 companies for potential violations of the Consumer Review Rule, marking its first public enforcement action under the rule. (Source: FTC press release, December 22, 2025.) The companies were not publicly identified, but the FTC published a template warning letter that describes the categories of conduct that triggered the warnings: compensating employees for obtaining five-star reviews from friends and family, and soliciting reviews from individuals who had no actual experience with the company's products or services.
The warning letters are not formal findings of violations. They direct recipients to cease non-compliant practices and submit a compliance plan within five business days. The significance is not in the letters themselves but in what they signal: the FTC is actively monitoring the marketplace, taking complaints, and building enforcement cases. Warning letters typically precede civil enforcement actions.
The civil penalty figure updated in the December 2025 action is $53,088 per knowing violation, slightly higher than the $51,744 figure in the original August 2024 rule announcement. The FTC adjusts civil penalties annually for inflation. At $53,088 per violation, a business with a systematic fake review program, or a reputation management firm operating one on a client's behalf, faces penalties that compound quickly with the number of violations. (Source: FTC Business Guidance Blog, December 22, 2025.)
For practitioners, the December 2025 action creates a specific disclosure obligation. Any client engagement that involves review generation, review monitoring, or review-adjacent tactics needs to be reviewed against the rule's requirements. A firm that has not audited its client programs against the rule's prohibited categories since October 2024 is operating without an adequate compliance framework.
Compliance in Practice: What to Audit and What to Change
Review Request Programs
Audit every review request workflow for conditional incentives. If any request ties a reward, discount, or benefit to a positive outcome, or implicitly routes reviewers through a satisfaction filter before directing them to a public platform, that flow needs to be revised. The request should go to every customer after every transaction; the language should ask for honest feedback rather than positive feedback, and any incentive offered must be disclosed and not conditioned on sentiment.
Employee and Insider Reviews
If employees, managers, officers, or their family members have written reviews of the business on any public platform, those reviews must include a clear and conspicuous disclosure of the material relationship. The disclosure cannot be buried. If existing insider reviews lack adequate disclosure, the business should consider whether to add disclosure or remove the review.
Third-Party Review Programs
If the business has worked with any agency, ORM firm, or marketing vendor on review-related programs, those programs need to be reviewed against the rule. The liability does not stay with the vendor. A business that benefited from a non-compliant program run by a third party on its behalf has exposure under the rule, particularly if it knew or should have known the program involved prohibited conduct.
Suppression Practices
Review any policies or practices regarding the reporting of negative reviews to platforms. Reporting a review that genuinely violates platform policy is legitimate. Systematically flagging negative reviews with the intent to trigger removal, regardless of actual policy violations, is a pattern that creates exposure. Document the basis for every removal request.
Social Media Engagement
Audit any paid social media growth programs for signs of fake engagement. Purchased followers, manufactured engagement metrics, and bot-generated activity all fall within the rule's scope. This is an area where vendor relationships carry particular risk, because the business purchasing the service may not have full visibility into how the engagement is generated.
Related reading: Review Generation Strategy: How to Ask, When to Ask, and What the FTC Actually Requires | Fake Reviews: How to Identify Them, Report Them, and Survive Them | Review Velocity: Why Getting 50 Reviews in One Week Can Hurt You | The DON'Ts of Reputation Management