Is Review Gating Illegal? What the FTC’s Fake Review Rule Means for Your Business

Here is the honest answer, and it is more useful than a simple yes or no. The FTC’s Rule on the Use of Consumer Reviews and Testimonials does not contain a specific prohibition against asking only your happy customers for reviews. But the FTC says in the same breath that the practice may still violate the FTC Act and Google’s own policies, which are what actually determine whether your reviews stay on your profile, have become considerably stricter than the federal rule.

So “not named in the rule” is not the reassurance it sounds like. It means the practice sits in a category that regulators can reach through a broader statute, and that the platform hosting your reviews may act against you regardless of what any regulator does.

This matters because review gating was standard practice for the better part of a decade. Thousands of businesses were sold software built around it. If your review process includes a satisfaction check before the review request, an incentive programme, a staff quota, or a script asking customers to mention someone by name, this article is describing your setup and at least one part of it has probably become a violation since you built it.

This guide explains in simple terms what the rule prohibits, how it applies to review gating, what Google changed, who can be held responsible, and how to get more reviews without putting your business at risk.

| :—- |

What the FTC Rule Actually Covers

The Federal Trade Commission published its Rule on the Use of Consumer Reviews and Testimonials formally 16 CFR Part 465 in August 2024, and it took effect on 21 October 2024. It was announced as a measure to let the agency seek civil penalties against businesses that deceive consumers through reviews.

The rule sets out several categories of prohibited conduct. In plain terms:

• Fake or false reviews and testimonials. Writing, buying, selling or distributing reviews from people who do not exist or who never used the product. This explicitly covers AI-generated reviews of experiences that never happened, and it covers fake negative reviews aimed at competitors just as much as fake positive ones about yourself.
• Buying reviews with a required sentiment. Providing compensation or incentives conditioned on a review expressing a particular sentiment, positive or negative. The condition can be implied rather than stated.
• Undisclosed insider reviews. Officers, managers, employees and their immediate relatives reviewing the business without a clear disclosure of the relationship.
• Company-controlled review sites. Misrepresenting that a website or entity you control provides independent reviews or opinions about your own category.
• Review suppression. Using unfounded legal threats, physical threats, or intimidation to prevent or remove a negative review.
• Fake indicators of social media influence. Buying or selling bot followers, fake engagement, or hijacked accounts to misrepresent influence.

The penalty exposure is significant. The maximum civil penalty for the relevant FTC Act provisions currently stands at $53,088 per violation, and the practical question is what counts as a violation. Enforcement to date suggests each fake review can be treated separately, meaning a business that purchases fifty reviews is not looking at one penalty.

Where practices actually sit. The middle column is where most honest businesses are exposed.

So Where Does Review Gating Sit?

Review gating is the practice of screening customers for satisfaction before deciding who gets asked for a public review.

The classic gating funnel, and why the resulting rating misrepresents the business.

The typical implementation is familiar. After a service, the customer receives a message asking how their experience was, with a thumbs up or thumbs down. Positive responses are routed to a page inviting them to post publicly on Google. Negative responses are routed to a private feedback form, where the complaint reaches the business and never reaches a public platform.

From the inside, this feels like sensible quality control: unhappy customers get a direct line to have their problem fixed, and happy customers help attract more business. That framing is genuinely how most operators understood it.

What the FTC says

The FTC addresses this directly in its business guidance on the rule. Asked whether a business can request reviews only from customers it believes are happy, the staff answer is that the rule contains no specific prohibition against it, but that the practice could violate the FTC Act, pointing to the Endorsement Guides as the relevant standard.

This pattern repeats throughout the guidance, and it is the single most important thing to understand about the rule. Time after time, the FTC states that a described practice is not covered by the rule itself, then immediately notes it could still be an unfair or deceptive act under Section 5 of the FTC Act. The rule created a specific enforcement mechanism with civil penalties attached. It did not replace the broader statute that was already there.

Why gating is deceptive in substance

Strip away the mechanics and the problem is straightforward. Your public star rating appears to represent your customers. After gating, it represents a filtered subset of your customers, and the person reading it has no way of knowing the filter exists.

A four-point-nine average built from every customer means something. A four-point-nine average built only from customers who pressed thumbs up means something quite different, while looking identical. That gap between what a rating appears to communicate and what it actually communicates is exactly the territory Section 5 addresses.

The practical conclusion: asking whether gating is technically named in the rule is the wrong question. The right question is whether your public rating gives an accurate impression of what your customers actually think. If the answer is no because of a process you designed, you are exposed, regardless of which specific provision applies.

The Google Layer, Which Now Matters More Than the Rule

For most local businesses, the FTC is the remote risk and Google is the immediate one. A federal enforcement action against a single-location contractor is unlikely. Losing your reviews overnight is not.

Google made two significant moves in April 2026.

Gemini-powered review moderation

On 16 April 2026, Google published its 2025 Trust and Safety Report and announced new protective measures for Maps, including the deployment of Gemini models to screen contributions before publication and to catch review extortion and manipulated place edits.

The figures in that report set the context. Google reported blocking or removing more than 292 million policy-violating reviews during 2025, alongside more than a billion published, roughly one in five review attempts classified as violating policy. It also reported blocking 79 million inaccurate or unverified edits to Business Profiles and removing more than 13 million fake Business Profiles.

The relevant point for a legitimate business: this is not a system that occasionally checks. It is continuous enforcement at scale, and it produces false positives as well as true ones.

Two new prohibitions in the rating manipulation policy

On 17 April 2026, the day after that announcement, Google updated the text of its Maps rating manipulation policy, without a press release. Two clauses were added, and between them they made a large amount of routine practice into formal violations:

1. Merchants cannot direct staff to solicit a specific number of reviews. That covers quotas, internal contests, team leaderboards, and per-technician targets tied to review counts.
2. Merchants cannot direct staff to request reviews containing specific content. Google’s own example is asking customers to name a particular employee, “would you mind mentioning Sarah, she looked after you brilliantly.”

It is worth sitting with how ordinary those practices were. Bonuses tied to review counts. Leaderboards in the break room. Scripts asking customers to name their technician so the business could recognise good work. Some of the largest operators in home services and property management wrote publicly about doing both. All of it is now a policy violation.

Enforcement is not a warning letter. The escalation path runs from removing the affected reviews, to pausing new reviews on the profile, to displaying a public warning banner on your Business Profile telling prospective customers that fake reviews were detected, to suspending the profile. Businesses have reported review counts dropping by dozens with no notification at all, including short five-star reviews naming an employee, and clusters of reviews arriving within hours of each other from the same area.

If your profile has already been affected, our guide to Business Profile suspension and reinstatement covers the recovery process, but note that a suspension caused by review practices will not clear until the practice itself stops.

Who Is Actually Liable

A point that gets overlooked, and one we take seriously as an agency.

The FTC’s guidance is explicit that advertising agencies, public relations firms, review brokers and reputation management companies are not immune under the rule. An agency can be liable for writing, creating or selling fake reviews, for providing incentives conditioned on sentiment, for review suppression, or for misusing fake indicators of social media influence.

For a business owner, that cuts two ways. If a provider is running your review programme, their conduct is not a shield, you remain the advertiser. And if a provider is proposing tactics that sit in the risky column, they are proposing something that exposes both of you.

There is also a “should have known” standard worth understanding. The rule does not require you to investigate every individual review. But where there are clear indications that reviews are likely to be fake, an unusual volume appearing in a very short period, reviews arriving so quickly after purchase that they cannot reflect real experience, reviews referring to the wrong service, failing to investigate can itself create liability. Not looking is not a defence.

One reassurance: if you merely host reviews on your own website without writing or purchasing them, the rule provides an exception for that. Prompting customers to submit reviews and aggregating star ratings does not remove the exception. But the moment you take a selection of those reviews and feature them in your marketing, they become testimonials, and the hosting exception no longer applies.

We think this is worth being direct about, because reputation marketing is central to what we do. A review programme that generates volume through methods that put a client’s profile at risk is not a service. It is a liability with a monthly invoice attached.

What You Are Clearly Allowed to Do

The compliance picture is less restrictive than it first appears. A great deal of effective review generation remains entirely legitimate.

Ask everyone

Generalised solicitation to all customers is explicitly permitted, and the rule provides an exception covering it. Emailing every purchaser to ask for a review is fine, and it remains, by a wide margin, the most effective compliant tactic available. Businesses that switch from gating to asking everyone usually find their volume goes up rather than down, because the addressable pool roughly doubles.

Offer incentives, carefully

The rule does not prohibit offering an incentive for a review. What it prohibits is conditioning that incentive on the review being positive, expressly or by implication.

The implication test is where businesses get caught. Consider:

• “Tell us how much you loved your visit and get a $5 coupon”, this implies a positive review is required. The FTC uses precisely this kind of phrasing as an example of a violation.
• “Leave us a review, honest feedback either way, and we’ll send you a $5 coupon”, this does not condition the incentive on sentiment.

Two further points. Merely expecting that an incentivised review will probably be positive does not create a violation on its own. And separately from the rule, failing to disclose the incentive can violate the FTC Act under the Endorsement Guides, so disclose it.

One clear prohibition worth stating plainly: paying for five-star reviews on a third-party platform is a violation, and adding a disclosure about the incentive does not fix it.

Ask insiders, with disclosure

Employees and family members can review your business, provided they clearly and conspicuously disclose the relationship. “Clear and conspicuous” has a specific meaning here: the disclosure must be unavoidable, which means a hyperlink or a hover-over does not qualify. A disclosure in the first line of the review does.

A caution the FTC adds: even with proper disclosure, if insider reviews materially lift your average star rating, that can still be a problem, because consumers often see only the rating and never read the individual reviews.

Respond to critics, and try to fix things

Nothing prevents you from responding publicly to a negative review, contacting the customer to resolve the issue, or asking a satisfied customer to update a review they left earlier. All of that is permitted and all of it is good practice.

The limits are specific. Do not make accusations about the reviewer you know to be false or make recklessly. Do not use threats or intimidation, which extends beyond physical threats to abusive communication, character assassination and harassment. And do not make unfounded legal threats. You may threaten legal action where you have a legitimate basis for it; what the rule prohibits is a threat built on contentions unwarranted by law or unsupported by evidence.

Organise your reviews

Sorting reviews, including defaulting to five-star reviews first, is not review suppression under the rule. The FTC states this plainly. It then adds that organising reviews in a way that makes it difficult for consumers to find negative reviews could be deceptive under Section 5. The pattern again: technically outside the rule, still reachable.

How to Build a Compliant Review Programme That Still Works

This is the part that matters commercially. Compliance without volume is not a win.

1. Ask every customer, the same way, every time

One message, one link, sent to everyone. No satisfaction pre-screen, no branching logic. This is both the compliant approach and the one that produces the most reviews, because you are no longer excluding half your customers from the ask.

2. Move service recovery after the review, not instead of it

This is the single change that preserves what gating was actually good for. The genuine value of gating was catching unhappy customers before they went public. You can keep that, you simply cannot use it as a filter.

Send the review request to everyone. On the same page, below the review link, include a clear route for anyone with a problem to reach you directly. The unhappy customer now has both options and chooses. Many will take the direct route because it is faster and more likely to solve their problem. The difference is that you are offering a choice rather than making it for them.

3. Remove quotas, contests and scripts

Audit anything that ties staff compensation, recognition or targets to review counts, and anything that tells staff what to ask customers to say. Both are now explicit Google policy violations. Recognising staff for good customer feedback is fine; instructing them to generate a specific number of reviews, or reviews containing specific content, is not.

4. Watch your pacing

Fifty reviews in a week after two years of silence is a pattern that automated systems are built to detect, and it is a pattern that legitimate businesses produce accidentally when they finally get organised. Spread the initial catch-up over months rather than weeks.

5. Disclose incentives, or drop them

If you incentivise, offer the incentive for any review, state the incentive plainly, and never suggest a sentiment. If that feels like more complexity than it is worth, dropping incentives entirely is a defensible choice, most businesses find that asking consistently outperforms incentivising inconsistently.

6. Document the process

Keep a written record of your review request template, when it changed, and who receives it. If your profile is ever flagged, being able to demonstrate that every customer receives an identical neutral request is materially more useful than trying to reconstruct it afterwards.

7. Audit your website testimonials too

The hosting exception does not cover reviews you feature in marketing. If your website displays a curated selection of your best feedback presented as though it were typical, that is a testimonial question, not a hosting one, and using non-representative reviews in marketing is reachable under Section 5.

A Twelve-Point Audit You Can Run This Week

1. Does your review request go to every customer, or only some?
2. Is there any satisfaction check before the review link is shown?
3. Does any part of staff compensation or recognition depend on review counts?
4. Are staff told to ask customers to mention specific names or details?
5. Do you offer an incentive, and if so, does the wording imply a positive review is expected?
6. Is any incentive clearly disclosed?
7. Have employees or family members reviewed the business without disclosing the relationship?
8. Has anyone been asked, formally or informally, to remove or change a negative review?
9. Have you ever threatened legal action over a review without a genuine basis?
10. Are the testimonials on your website representative of your overall feedback?
11. Did a previous provider run your reviews, and do you know what they actually did?
12. Has your review count dropped unexpectedly, or has a warning banner appeared on your profile?

If any of the first nine answers concern you, change the process before you do anything else. Historic reviews collected under an old process are a smaller problem than an ongoing process that keeps producing them.

Why This Matters More Than It Used To

There is a strategic argument here that sits above compliance.

Reviews no longer only influence the person reading them. They feed the systems that decide which businesses get recommended. Your review volume, sentiment and recency inform your Map Pack position, and increasingly they inform which businesses AI assistants name when someone asks for a recommendation, a surface where there is no page two to be found on.

Which makes an artificially inflated rating a genuinely poor asset. It is fragile: one enforcement sweep and a portion of it disappears, sometimes with a public warning banner attached. It is uninformative: you learn nothing about what to fix. And it converts worse than you would think, because a wall of short five-star reviews with no substance reads as manufactured to the customers who matter most.

A review profile built by asking everyone looks different. It has a few threes and fours in it. It has responses from the business that show problems being taken seriously. It accumulates steadily rather than in bursts. It is more durable, more useful operationally, and it aligns with the experience and trustworthiness signals that both search engines and AI systems are increasingly built to reward.

The Bottom Line

The technically correct answer, that the FTC rule does not name review gating, is the least useful thing you can take from this article.

What matters is the shape of the regulation. Time after time, the FTC’s guidance says a practice is not covered by the rule, then notes it may still be deceptive under the FTC Act. The rule added penalties and specificity to a set of conduct that was already reachable. It did not create a permitted zone around everything it left out.

Meanwhile the enforcement that will actually affect your business this year is not federal. It is Google removing your reviews, pausing new ones, and in the worst case putting a banner on your profile telling prospective customers that fake reviews were detected, a genuinely damaging outcome that arrives with no warning and no appeal for the reviews themselves.

The strategic conclusion is more encouraging than the compliance one. The compliant approach and the effective approach turn out to be the same approach. Ask every customer, the same way, every time. Give unhappy customers a clear route to reach you, offered alongside the review link rather than instead of it. Drop the quotas and the scripts. Let the profile build steadily.

You will end up with more reviews, a rating that tells you something useful, a profile that survives enforcement sweeps, and a set of signals that both search engines and AI assistants are built to trust. The businesses that spent a decade optimising the appearance of their reputation are now the ones most exposed. The ones that built the actual thing are fine.

Subsilio Consulting has built reputation and review programmes for Denver businesses since 2012, and we have rebuilt several that were designed under the old rules. If you are not certain whether your current process would survive scrutiny, from a regulator or from Google, get in touch and we will audit it with you. You can also see what our own clients say about working with us, collected the way we recommend you collect yours.