The Consumer Review Fairness Act: What Every Business Needs to Know in 2026

The Consumer Review Fairness Act is one of those laws that most business owners have never heard of — until they violate it. Signed into federal law in December 2016, the CRFA exists for a single purpose: to prevent businesses from using contracts, terms of service, or legal threats to suppress honest customer reviews. Before the CRFA, some businesses included non-disparagement clauses in their customer agreements — contractual provisions that prohibited customers from posting negative reviews, threatened fines for critical feedback, or required customers to waive their right to review the business publicly. The CRFA made all of those practices illegal.

What makes the CRFA important for businesses in 2026 is not just what it prohibits — it is the intersection between the CRFA, the FTC's newer fake review rule (finalized August 2024), and Google's independent content policies. These three regulatory layers operate simultaneously, and understanding where each one begins and ends is the difference between managing your online reputation legally and exposing your business to federal enforcement action. This guide covers the full scope: what the CRFA bans, what it does not restrict, how it interacts with the FTC rule and Google's policies, the enforcement history, and the practical implications for every business that receives online reviews.

What is the Consumer Review Fairness Act?

The Consumer Review Fairness Act (15 U.S.C. 45b) was passed by Congress with bipartisan support and signed into law on December 14, 2016. The law amends Section 5 of the FTC Act by declaring that any contractual provision that restricts a consumer's ability to post an honest review is void from inception — meaning it was never enforceable, regardless of whether the customer signed it.

The scope of protection is broad. The CRFA covers written reviews (Google, Yelp, Facebook, industry-specific platforms), verbal reviews (word-of-mouth recommendations or warnings), social media posts, photographs, and video content. If a customer shares their honest experience with a business in any public or semi-public forum, the CRFA protects that expression from contractual retaliation.

The operative word in the statute is "honest." The CRFA protects reviews that reflect the customer's genuine experience and opinion. It does not protect fabricated reviews, reviews posted by people who were never customers, reviews motivated by a conflict of interest (competitors, former employees with a personal grievance), or reviews that contain demonstrably false statements of fact. This distinction is critical — it means a business can still take action against fake, fraudulent, or defamatory reviews without running afoul of the CRFA.

Enforcement authority rests with the Federal Trade Commission and state attorneys general. The FTC treats CRFA violations as unfair or deceptive practices under Section 5 of the FTC Act, which means the full range of FTC enforcement tools — consent orders, civil penalties, compliance monitoring — applies to businesses that include prohibited clauses in their customer agreements.

What the CRFA bans: the four prohibited practices

The CRFA targets four specific categories of business conduct. Each one represents a practice that was common enough before 2016 to warrant federal legislation.

1. Non-disparagement clauses. These are contractual provisions that prohibit customers from posting negative reviews or critical public commentary about a business. Before the CRFA, non-disparagement clauses appeared in terms of service agreements, rental contracts, medical practice intake forms, service agreements, and online checkout terms. Some were explicit ("Customer agrees not to post negative reviews about Company"), while others were buried in dense legal language that most customers never read. Under the CRFA, every non-disparagement clause that restricts honest reviews is void — it has no legal effect, and a business cannot enforce it regardless of whether the customer signed the agreement.

2. Gag clauses threatening legal action. Some businesses went beyond non-disparagement provisions and included clauses that explicitly threatened legal consequences — lawsuits, financial penalties, or collections actions — if a customer posted a negative review. One widely publicized pre-CRFA case involved a hotel that charged guests $500 for each negative review posted online. The CRFA made this practice illegal. A business cannot include any contractual term that threatens legal action against a customer for posting an honest review, even if the business labels the term as a "liquidated damages" provision or a "service agreement compliance clause."

3. Contracts requiring customers to waive review rights. This category covers agreements that require customers to surrender their right to post reviews as a condition of doing business. Examples include terms of service that state "By purchasing this product, you agree not to post any public review," or service agreements that require customers to submit feedback exclusively through private channels. The CRFA voids these waiver provisions — customers cannot be required to give up their review rights as a condition of a commercial transaction.

4. Penalties for posting negative reviews. The broadest category covers any form of retaliation or penalty imposed on a customer for posting a review. This includes financial penalties (charging a fee or sending to collections), service denial (refusing future service to a customer who posted a negative review), or any other punitive action taken in response to honest feedback. The CRFA does not require the business to have a contractual clause — any retaliatory penalty triggered by a customer's honest review falls within the statute's prohibitions.

What the CRFA does not restrict: your rights as a business

The CRFA is frequently misunderstood as a blanket prohibition on managing online reviews. It is not. The law targets a specific category of behavior — contractual suppression and retaliation against honest reviewers — while leaving every legitimate review management practice intact. Understanding what the CRFA allows is just as important as understanding what it prohibits.

Responding to reviews. The CRFA places no restrictions on a business's ability to respond publicly to any review — positive, negative, or neutral. A well-crafted response to a negative review is one of the most effective reputation management tools available. Responding demonstrates professionalism, provides context for future customers, and can often resolve the underlying issue. Google's own review management guidelines encourage businesses to respond to all reviews, including negative ones.

Flagging reviews for platform policy violations. Every major review platform — Google, Yelp, Facebook, TripAdvisor — has its own content policy that operates independently of the CRFA. If a review violates Google's content policy (spam, off-topic content, conflict of interest, personal information exposure, profanity, or fake engagement), the business can flag it through Google's official reporting channels. The CRFA protects the reviewer's right to post honest feedback — it does not override a platform's right to enforce its own content standards.

Pursuing defamation claims for false statements of fact. The CRFA protects opinions and honest experiences. It does not protect verifiably false factual claims. If a reviewer posts a statement that is demonstrably untrue — not a matter of opinion, but a factual assertion that can be proven false — the business may still pursue a defamation claim through the courts. The line between protected opinion ("worst service I've ever experienced") and actionable defamation ("this business commits insurance fraud") depends on state law, but the CRFA does not eliminate defamation as a legal remedy. For a deeper analysis of where reviews cross from protected speech into actionable defamation, the legal distinctions matter significantly.

Using professional review removal services. Hiring a service like Flaggd to dispute policy-violating reviews through official platform channels is fully legal under the CRFA. Professional services do not suppress honest reviews — they identify reviews that violate platform policies and file formal disputes using the same reporting tools available to any business owner. The distinction is between suppressing honest feedback (prohibited) and removing content that independently violates platform rules (permitted).

Encouraging customers to leave reviews. The CRFA does not restrict businesses from asking satisfied customers to post reviews. A business can include "Leave us a Google review" cards, send post-service email requests, or display review prompts at point of sale. The restriction applies only to review gating — selectively directing only happy customers to public review platforms while routing dissatisfied customers to private feedback channels. Review gating violates Google's policies and potentially the FTC's endorsement guidelines, though the CRFA itself focuses on suppression and retaliation rather than solicitation practices.

CRFA vs. FTC fake review rule: how the two laws work together

The CRFA (2016) and the FTC fake review rule (finalized August 2024) address opposite sides of the same problem — review integrity. Understanding their relationship eliminates the confusion that leads many business owners to believe they cannot take any action against problematic reviews.

The CRFA protects the supply side of the review ecosystem. It ensures that genuine customers can share their honest experiences without contractual interference or retaliation from the businesses they review. Its target is the business that tries to suppress real reviews through legal or contractual mechanisms.

The FTC fake review rule protects the demand side. It ensures that consumers reading reviews can trust that the reviews are genuine — not fabricated, incentivized, or posted by undisclosed insiders. Its targets are businesses that buy fake reviews, incentivize positive reviews without disclosure, post reviews on their own listings through fake accounts, or suppress negative reviews through undisclosed third-party reputation management services.

The practical implication for businesses is that neither law prevents legitimate review management. The CRFA says you cannot suppress honest reviews through contracts or retaliation. The FTC rule says you cannot manufacture fake reviews or buy positive ones. Neither law prevents you from flagging policy-violating reviews, responding professionally to criticism, pursuing defamation claims for false factual statements, or using professional services to dispute reviews that violate platform policies. The laws create guardrails on both sides — protecting authentic reviews from suppression and protecting consumers from deception.

CRFA and Google's review policies: where the lines are

This is where most of the confusion lives — and where the practical implications for day-to-day review management are highest. Google's content policy is not federal law. It is a private company's terms of service, enforced by Google's own moderation team. The CRFA does not modify, override, or interact with Google's content policy in any direct way. They operate on parallel tracks.

Google's content policy prohibits reviews that contain spam or fake content, off-topic material, restricted content, illegal content, sexually explicit material, offensive or threatening language, dangerous or derogatory content, impersonation, and conflict of interest. When a business flags a review through Google's reporting tool, Google evaluates the review against its own policy — not against the CRFA, not against the FTC fake review rule, and not against state defamation law. The question Google asks is narrow: does this review violate our published content policy?

This independence cuts both ways. A review that is protected by the CRFA (an honest negative experience) can still be removed by Google if it independently violates Google's content policy — for example, if an otherwise honest review includes profanity, personal information, or off-topic content. Conversely, a review that violates the CRFA's protections (one posted under duress from a non-disparagement clause) would not be flagged or removed by Google because Google does not enforce the CRFA — that is the FTC's job.

The practical framework for businesses is straightforward. When dealing with a negative review, ask two separate questions: (1) Does this review violate Google's content policy? If yes, flag it through Google's reporting tool. (2) Does this review contain verifiably false statements of fact that rise to the level of defamation? If yes, consult an attorney. What you cannot do under any circumstances is threaten the reviewer, include non-disparagement clauses in your agreements, or penalize a customer for sharing their honest experience — regardless of whether the review also happens to violate Google's policy.

One scenario that creates particular confusion: a customer leaves an honest but harshly negative review, and the business owner wants it gone. The CRFA says the business cannot contractually suppress or penalize the reviewer. Google's policy says the review stays up as long as it does not violate content guidelines. The business's recourse is limited to responding professionally, encouraging future positive reviews to offset the negative one, and accepting that legitimate negative feedback is protected. This is by design — the CRFA exists precisely to prevent businesses from removing genuine customer feedback through extralegal means.

FTC enforcement: real cases and real penalties

The FTC has demonstrated through multiple enforcement actions that the CRFA is not symbolic legislation. Several high-profile cases between 2017 and 2023 established clear precedent for how the agency interprets and enforces the law.

In one early enforcement action, the FTC targeted an online retailer that had included non-disparagement provisions in its terms of sale. Customers who purchased products from the company's website unknowingly agreed to a clause prohibiting negative reviews. When customers posted negative feedback on third-party platforms, the company threatened legal action and, in some cases, sent accounts to collections for "violation" of the non-disparagement agreement. The FTC's consent order required the company to remove all non-disparagement language from its contracts, notify affected customers that the clause was void, and submit to compliance monitoring for a multi-year period.

Subsequent enforcement actions expanded the scope. The FTC pursued cases against businesses in the home services industry, hospitality sector, and professional services that included review-suppression clauses in various forms — from explicit non-disparagement provisions to subtler formulations that required all feedback to be submitted through private channels. In each case, the FTC's position was consistent: any contractual mechanism that restricts a customer's ability to share honest feedback publicly constitutes an unfair or deceptive practice under Section 5 of the FTC Act.

The penalty structure has escalated over time. Early CRFA enforcement actions focused on consent orders and compliance requirements. More recent cases have included financial penalties ranging from tens of thousands to hundreds of thousands of dollars. The FTC has signaled through public statements and enforcement guidance that repeat offenders and businesses that combine CRFA violations with other deceptive practices (such as fake review generation) can expect significantly higher penalties.

State attorneys general have added another enforcement layer. Several states have brought independent actions under their consumer protection statutes against businesses that used non-disparagement clauses, sometimes in coordination with FTC investigations and sometimes independently. California, New York, and Illinois have been particularly active in pursuing these cases, often targeting businesses with a high volume of customer transactions where the non-disparagement clause affected thousands of consumers.

The compliance implications are direct. Every business that uses customer-facing contracts — terms of service, service agreements, rental contracts, intake forms, purchase agreements — should audit those documents for any language that could be interpreted as restricting review rights. Even language that was not intended as a non-disparagement clause can trigger enforcement if the FTC determines that a reasonable consumer would interpret it as restricting their ability to post honest feedback. When in doubt, remove the language. The cost of an FTC enforcement action — in legal fees, penalties, and reputational damage — is orders of magnitude higher than whatever perceived benefit a non-disparagement clause was supposed to provide.

Frequently asked questions

The Consumer Review Fairness Act establishes a clear boundary: businesses cannot use contracts, legal threats, or retaliatory penalties to suppress honest customer feedback. That boundary has been tested through multiple FTC enforcement actions, and the agency's position is unambiguous. But the CRFA is not a blank check for reviewers to post anything they want without consequence. Fake reviews, defamatory statements of fact, and content that violates platform policies all remain actionable through the appropriate channels — Google's content policy for platform violations, the courts for defamation, and the FTC itself for manufactured reviews under the 2024 fake review rule. The businesses that navigate this landscape most effectively are the ones that understand where each regulatory layer begins and ends: the CRFA protects honest reviewers, Google's policy governs what stays on the platform, the FTC rule targets fake reviews, and state defamation law addresses false statements of fact. Knowing the difference is how you manage your online reputation without crossing a line that invites federal enforcement.