The FTC's Fake Review Rule: What Every Local Business Must Know (2026)

For years, buying fake reviews was a quiet industry. Agencies sold 5-star packages. Employees posted under customer aliases. Disgruntled critics got legal threats to take their reviews down. All of it sat in a grey zone that the FTC flagged as concerning but rarely pursued beyond high-profile settlements.

That grey zone closed on October 21, 2024. The FTC's Consumer Reviews and Testimonials Rule — 16 CFR Part 465 — is now binding federal law. Civil penalties of up to $53,088 per fake review. Each review counts separately. And the first enforcement wave landed in December 2025, ending the question of whether the agency would actually move.

This is the full picture: what's banned, who's liable, what the penalties actually look like, what December 2025 signaled, and the exact compliance posture every local business should have by the end of this year.

What the FTC's fake review rule is

The Consumer Reviews and Testimonials Rule was finalized by the FTC on August 14, 2024, and took effect 60 days later on October 21, 2024. It covers reviews and testimonials across every major US platform — Google, Yelp, Amazon, Trustpilot, specialized industry review sites, and social media endorsements. The rule's authority derives from Section 5 of the FTC Act, which prohibits unfair or deceptive acts in commerce, codified into specific prohibitions under 16 CFR Part 465.

What makes the rule different from general FTC guidance: it specifies the prohibited conduct concretely and sets civil penalties the agency can seek per violation. Prior to this rule, the FTC could pursue deceptive review practices case-by-case but without a clear per-violation penalty framework. Now the framework exists.

The 6 things the rule bans

1. Fake or false consumer reviews and testimonials

Reviews and testimonials by non-existent reviewers, AI-generated personas, or people who never interacted with the product or service. The rule captures both outright fabrication and "embellishment" where the reviewer's experience has been materially misrepresented. Penalties attach to the business that created, purchased, or knowingly used the fake content.

2. Buying or selling fake reviews

Covers both sides of the market — the business paying for fake reviews and the service providing them. Standard review-farm packages, reward-card schemes (gift card in exchange for a 5-star review), and direct contracts with foreign review mills all fall here. The rule applies even if the reviewer ultimately writes something resembling a real experience — the payment and lack of disclosure are the violation.

3. Insider reviews without disclosure

Reviews by the business's employees, family, contractors, or anyone with a material financial connection, when the connection is not clearly disclosed. The rule allows these reviews to exist — a barista writing "I work here and the pastries are amazing" is fine — but requires up-front disclosure. Undisclosed insider reviews are per-violation penalties.

4. Review suppression

Using threats, legal intimidation, contract terms, or targeted harassment to silence legitimate negative reviews. This section overlaps with the Consumer Review Fairness Act but expands it. "We'll sue you if you don't take this review down" letters, non-disparagement clauses (already void under CRFA), and bulk DMCA takedowns of legitimate reviews all qualify.

5. Fake indicators of social media influence

Buying followers, likes, views, engagement, or similar social-proof signals. Agencies selling Instagram followers, YouTube view bots, and fake engagement packages for small business social media are on the wrong side of this rule. The business purchasing the service bears liability, not just the provider.

6. Misrepresenting controlled websites as independent

Operating review sites, comparison sites, or "independent consumer advocate" pages that are secretly owned by or controlled by the business being reviewed, without clearly disclosing the relationship. Common in affiliate-heavy industries. The fix is disclosure — the practice itself is not banned if the connection is transparent.

Penalty math — how fines scale

The $53,088-per-violation figure is not hypothetical. It's the statutory maximum under the rule (adjusted annually for inflation — this is the 2026 figure). The FTC has discretion on what to actually seek, but the framework is built so that each individual fake review counts as its own violation, which changes the math dramatically at scale.

A business that posted 50 fake reviews across multiple platforms faces a theoretical maximum exposure of $2,654,400. Actual enforcement outcomes depend on severity, cooperation during investigation, good-faith remediation, and consumer harm — but the statutory ceiling is what frames settlement negotiations. Historically, FTC enforcement actions settle at 10–40% of statutory maximums, which is still a six- or seven-figure exposure for any meaningful scale of violations.

Who is liable under the rule

Three tiers of liability exist under the rule:

• Businesses that create, purchase, or use fake reviews. Direct purchase, reward-card programs, discount-for-review schemes, and paid review packages all trigger liability regardless of whether the review content itself is accurate.
• Businesses that use employee or insider reviews without disclosure. Even well-intentioned "staff morale campaigns" where employees post reviews about their own workplace are violations without disclosure. The rule does not require the review to be negative or harmful — the disclosure failure alone is the violation.
• Businesses that suppress legitimate negative reviews. Cease-and-desist letters to reviewers, aggressive DMCA takedowns of legitimate critical content, non-disparagement clauses in consumer contracts, and retaliatory lawsuits against reviewers all create exposure. Legitimate defamation suits against provably false statements remain legal — the full picture is in our Google review legal guide.

Platforms (Google, Yelp, Amazon) have separate obligations under Section 465.7 of the rule, but those sit outside what most local businesses need to worry about. Your liability window is what you do or pay for.

The December 2025 warning letters

In December 2025, the FTC sent its first enforcement-wave warning letters to more than ten businesses across retail, healthcare, and home services. The letters confirmed the FTC was investigating potential violations of the rule — fake testimonials, incentivized 5-star reviews, and employee-generated content without disclosure — and formally requested compliance.

Warning letters are the FTC's first-order enforcement tool. They do not impose penalties directly but they create a documented compliance expectation: a business that receives a warning letter and continues the practice has demonstrably willful conduct on the record, which hardens any subsequent formal enforcement action and reduces the scope for settlement discounts.

The practical signal for other local businesses: enforcement has begun. The period where "everyone does it and nothing happens" was a defensible posture is over.

The compliance checklist for local businesses

Six steps to close your exposure window by the end of Q2 2026:

1. Audit existing reviews. Go through your Google, Yelp, and any other platform review pages. Identify any reviews you know or reasonably suspect came from employees, family, paid services, or incentive programs without disclosure. The fact that they're still up doesn't matter — the FTC cares about the conduct, not whether the content remains visible.
2. Remove what you control. Ask employees and family who posted reviews to remove them, or add clear disclosure. End any active "review for discount" programs.
3. Purge contract language. Check consumer-facing contracts, terms of service, and intake forms for non-disparagement clauses, review-assignment language, or penalty-for-negative-reviews terms. These are already void under CRFA; they're also enforcement bait under the new rule.
4. Cancel fake-indicator subscriptions. Any services providing followers, likes, or engagement for your social accounts — cancel. The liability here is per-violation on indicators the same way it is on reviews.
5. Document your legitimate review generation. Keep records of your request process — what emails go to customers asking for reviews, what timing, what incentive (if any, and disclosed), and sample customer opt-in language. Good-faith compliance posture is what reduces exposure in the event of an investigation.
6. Focus on genuine customer reviews going forward. The rule does not restrict legitimate review generation. Our guide to 2026 fake review statistics covers what the ratio of real-to-fake looks like across major platforms — the reason to invest in genuine reviews is both compliance and competitive advantage.

Frequently asked questions

The FTC rule is strict, but it's also predictable. Businesses that generate reviews honestly — no paid reviews, no undisclosed insiders, no contract-based suppression — have nothing to worry about. Businesses that don't are operating with a clock running, and the December 2025 letters are the first visible tick.