A landscaping company pays its crew leader a $50 bonus for every five-star Google review he can talk a customer into leaving. A boutique med spa quietly hides the "leave a review" link on its receipts from anyone who seemed unhappy at checkout, and only texts the link to customers who smiled on the way out. A three-location pizza chain has an employee post glowing reviews from her own account, using her maiden name so nobody notices she's the manager's daughter.
None of these business owners think of themselves as running a scam. They think of themselves as doing normal marketing. As of October 2024, the Federal Trade Commission disagrees — and as of December 2025, it started sending letters that prove it.
The Rule That Changed Everything About Online Reviews
For years, the FTC's stance on fake and manipulated reviews lived in loosely enforced guidance documents. Businesses that got caught mostly got a stern talking-to. That changed when the FTC's Rule on the Use of Consumer Reviews and Testimonials (16 C.F.R. Part 465) took effect on October 21, 2024. Unlike guidance, a codified rule gives the FTC a much more direct legal weapon: the ability to seek civil penalties for violations without having to prove a company acted with the kind of deliberate deception that older, murkier enforcement actions required.
On December 22, 2025, the agency used that weapon for the first time in a public way — sending warning letters to ten companies flagged for likely violations. The letters weren't polite reminders. They demanded a designated compliance owner, a written remediation plan, and confirmation within five business days that the company had started fixing the problem. And they spelled out, in plain numbers, what happens next: civil penalties of up to $53,088 per violation.
That figure isn't a typo, and it isn't a one-time cap — it's per violation. A restaurant with forty incentivized five-star reviews sitting on its Google profile isn't looking at one violation. It's looking at forty.
Six Things the Rule Actually Prohibits
The Consumer Review Rule doesn't ban having reviews, asking for reviews, or even responding to bad ones. It targets six specific, well-defined categories of conduct:
1. Fake or fabricated reviews
You can't write, buy, or solicit a review from someone who never used your product or service — or one that misrepresents what that person actually experienced. Liability attaches whenever a business "knew or should have known" the review was fake, which is a lower bar than it sounds. If your marketing agency is quietly generating reviews on your behalf and you never asked how, that's not a defense.
2. Rewards tied to a positive rating
This is the one that trips up the most small businesses, because it feels so harmless: "Leave us a 5-star review and get 10% off your next visit." The FTC doesn't care that the discount is real and the offer is disclosed. The problem is the conditioning — tying the reward to a specific sentiment rather than just to the act of leaving a review at all. Disclosure doesn't cure it. The only compliant version is an incentive offered equally regardless of whether the review is glowing or scathing, and even that carries real risk if it's not handled carefully.
3. Undisclosed insider reviews
Owners, managers, and employees can leave honest reviews of their own employer — but they have to say who they are. A stylist posting a five-star review of the salon she works at, without disclosing she's on payroll, is now a rule violation, not just an awkward LinkedIn moment.
4. Fake "independent" review sites
If your company runs a site that claims to offer impartial comparisons or reviews of your own products, and it doesn't conspicuously disclose that you own it, that's covered too.
5. Suppressing negative reviews
Filtering your review requests so only happy customers get asked, threatening legal action to force a takedown, or routing unhappy customers to a "private feedback form" instead of the public review page while routing happy ones to Google — all of it falls under review suppression. Outsourcing your review management to a third-party vendor doesn't create a shield; the FTC has been explicit that the business is still on the hook.
6. Fake social proof
Buying followers, views, or engagement to inflate the appearance of popularity is treated the same way as buying fake reviews — because it serves the same deceptive purpose.
Who Actually Has to Worry About This
Here's the detail that surprises most owners: there is no small-business carve-out. The rule doesn't distinguish between a Fortune 500 e-commerce brand and a single-location dry cleaner. If you're a sole proprietor with a Google Business Profile, the same $53,088-per-violation ceiling technically applies to you as it does to a national chain — though in practice, the FTC has signaled it will weigh context and good-faith effort. That's a factor in how aggressively they pursue a case, not a legal exemption from the rule itself.
The businesses most exposed tend to share a few traits:
- Service businesses that live and die by star ratings — restaurants, contractors, salons, med spas, auto shops, dentists — because review volume and average rating drive so much of their organic discovery.
- Anyone using a review-management or reputation-management vendor, since those tools sometimes automate exactly the kind of selective solicitation ("send review requests only to customers who rated their visit 4 stars or higher in a post-visit survey") that the rule now prohibits.
- Franchises and multi-location operators, where a policy set at headquarters — like a bonus tied to location review scores — can create the same violation across dozens of storefronts simultaneously, multiplying the per-violation exposure.
The examples in the FTC's December warning letters were notably unglamorous: companies compensating employees for pulling in five-star reviews from friends and family, and businesses soliciting reviews from people who'd never actually bought anything. These aren't sophisticated fraud rings. They're the kind of shortcuts a busy owner takes without thinking too hard about it.
What to Actually Do This Week
You don't need outside counsel to get most of the way to compliant. Start here:
-
Audit your review requests. If your point-of-sale, CRM, or review-management tool has any setting that filters who gets asked for a review based on how satisfied they seemed, turn it off. Everyone gets asked, or no one does.
-
Kill any reward tied to a star rating. "Leave a review and get 10% off" (no rating condition) is safer ground than "Leave us 5 stars and get 10% off." Even then, treat incentivized reviews as a genuinely risky category and consider whether you need the incentive at all — organic review volume from simply asking every customer is usually enough.
-
Check who's posting on your behalf. If an employee, owner, or family member has ever left a review of your business without disclosing the relationship, ask them to edit it or take it down.
-
Stop threatening negative reviewers. Sending a cease-and-desist over a bad review, or offering a refund contingent on the review coming down, is exactly the suppression conduct the rule targets.
-
Put it in writing. A one-page internal policy — "we ask every customer for a review, we never condition anything on the star rating, employees disclose their relationship when reviewing us" — is the kind of documentation that turns a warning letter into a five-day fix instead of a lawsuit.
Why This Belongs in the Same Conversation as Your Books
Review compliance might feel like a marketing problem, not a bookkeeping one — until you notice how many businesses run review incentives through an expense account. A $50 "review bonus" paid to an employee in cash, a stack of gift cards bought specifically to hand out for good reviews, a line item buried in "marketing" that's actually funding exactly the conduct the FTC just started fining people for. If regulators or an auditor ever ask what a recurring expense was for, "incentivizing five-star reviews" is not the paper trail you want attached to your books.
That's the broader lesson: the businesses with the cleanest, most transparent records are also the ones best positioned to catch a compliance problem — in marketing, payroll, or anywhere else — before it becomes a $53,088-per-violation problem. Plain-text accounting makes every transaction traceable back to what it actually paid for, in a format you control rather than one buried inside a vendor's dashboard.
Keep Your Finances as Transparent as Your Reviews
As FTC enforcement of the Consumer Review Rule ramps up, the businesses most exposed are often the ones with the least visibility into their own spending — where a "marketing" line item could be masking exactly the kind of conduct now carrying real penalties. Beancount.io offers plain-text accounting that gives you complete transparency and control over your financial data, so every dollar is traceable, auditable, and yours. Get started for free and see why developers and finance professionals are switching to plain-text accounting.