It is a Monday and you are rolling out review automation for a new client, a dentist who wants more five-star ratings. You build the flow the way you always have: after a visit, text the patient, ask if they had a good experience, and if they say yes, send them to the Google review link. If they say no, route them to the office manager instead. More stars, fewer public complaints. The client loves it.
That exact flow is now illegal, and your agency is on the hook for it.
Here is the short version. Since October 2024, the FTC has a dedicated rule on consumer reviews with real civil penalties, and its 2023 Endorsement Guides already made clear that marketers and agencies share the blame when a review program is deceptive. The common “ask happy customers, hide the unhappy ones” workflow (review gating) is specifically called out, and so is paying for a particular sentiment. None of this means you stop collecting reviews. It means you build the system to ask for honesty, and the legal risk goes away. This guide is the compliance layer for every review program you run, with the request copy you can lift into your clients’ sub-accounts today.
What this article covers
- Why the FTC blames the agency, not just the client
- What one bad review program actually costs
- The FTC rulebook in plain terms
- Review gating: the mistake almost every agency makes
- Five ways review automation breaks the rules
- Steal this: the compliant request copy
- Three agencies, three compliant setups
- What happens when you get it wrong
- Objections
- FAQ
Why the FTC blames the agency, not just the client
Most agency owners assume the client owns the reputation, so the client owns the risk. The FTC does not read it that way. Its Endorsement Guides state that advertisers, their agencies, and the people who create endorsements all share responsibility for truthful claims and disclosed material connections (FTC Endorsement Guides FAQ). When your agency designs the flow, writes the copy, and presses go across a dozen accounts, you built the system that produced the endorsements, and your name sits next to the client’s.
The 2024 Consumer Review Rule goes further, turning specific practices into violations that draw civil penalties instead of conduct the FTC has to litigate case by case (16 CFR Part 465). So a sloppy funnel is no longer a client problem you wave off in the kickoff call. It is an operational risk that scales with every account you install it in.
What one bad review program actually costs
The headline number is the civil penalty. After the FTC’s 2025 inflation adjustment, a violation of the Consumer Review Rule can carry up to $53,088, and that figure did not change for 2026 (16 CFR 1.98). And it is “per violation”: the FTC can count by the piece, so a program that produces hundreds of improper reviews is hundreds of violations, not one.
Small agencies are not the FTC’s first target, and regulators rarely ask for the maximum. But the real cost is rarely the fine. It is the platform response. Google can strip every review off a profile when it detects gating or fake engagement, legitimate ones included, and suppress the listing in local results (Google contribution policies). Explaining to a client why the 180 five-star reviews you collected over eight months vanished overnight, along with their map ranking, is the conversation that ends retainers.
Statutory-maximum exposure, in USD, if each improper review counts as a separate violation at the 2025 per-violation amount. Illustrative ceiling, not a predicted fine. Source: 16 CFR 1.98.
The FTC rulebook in plain terms
Two documents govern reviews, and agencies need to know both.
The Endorsement Guides (16 CFR Part 255), updated in 2023, are the FTC’s interpretation of how endorsement law applies to reviews and testimonials. The update expanded the guidance to cover procuring, suppressing, boosting, organizing, and editing reviews, and removed the old “results not typical” safe harbor (FTC Endorsement Guides FAQ). It also makes the material-connection rule explicit: any connection between the reviewer and the business that the audience would not expect, and that could affect how they weigh the review, has to be disclosed clearly and conspicuously (Section 255.5). Free products, discounts, a chance to win a prize, and affiliate payments all count.
The Consumer Review Rule (16 CFR Part 465), finalized in August 2024 and effective October 21, 2024, is the one with teeth: it turns specific conduct into penalty-bearing violations. It has six operative sections every agency running review automation should know:
- Fake or false reviews (465.2). You cannot write, create, sell, or disseminate a review from someone who does not exist, who never used the product, or that misstates their experience, when you knew or should have known it was fake.
- Buying positive or negative reviews (465.4). You cannot pay for a review that expresses a particular sentiment. Paying for the star rating is the line, not paying for the review itself.
- Insider reviews (465.5). Officers, managers, employees, and their immediate families must disclose their relationship to the business when they review it, or it cannot be posted.
- Company-controlled review sites (465.6). You cannot run a site that pretends to offer independent reviews of your own products.
- Review suppression (465.7). You cannot use unfounded legal threats, intimidation, or false claims to get an honest negative review taken down, or bury the bad ones and imply the page shows them all.
- Fake social media indicators (465.8). You cannot buy or sell fake followers, views, or engagement to inflate perceived influence.
The practice agencies trip over most is not on that list by name, because it lives across both documents: review gating.
Review gating: the mistake almost every agency makes
Review gating is filtering who you ask based on how happy they seem. The classic version is a two-step flow: survey the customer first, send the ones who rate you highly to the public review page, and route the unhappy ones to a private form instead. It feels responsible. It is the most common way agencies break the rules, because it manufactures a rating that does not reflect reality.
The FTC’s position is that selectively soliciting positive reviews while discouraging negative ones is deceptive, because the resulting average misleads consumers. Google is blunter, prohibiting “discouraging or prohibiting negative reviews, or selectively soliciting positive reviews from customers” (Google contribution policies). Gating exposes your client twice: to a regulator and to the platform that can delete every review they have.
The fix is not to stop asking. It is to ask everyone the same way and route everyone to the same public option. You can still offer a private complaint channel, but alongside the public link, not instead of it, and never gated behind a satisfaction score. The honest version outperforms what agencies expect: volume and recency matter more to local ranking than a flawless average, and a few handled negatives make a profile look real instead of suspicious.
Five ways review automation breaks the rules
Review software is neutral. The flow you build on top of it is where compliance is won or lost. These are the five failure modes I see most when I audit a review setup, and the fix for each.
1. The satisfaction gate. The flow asks “did you have a good experience?” and branches: happy goes public, unhappy goes private. Textbook gating. Fix: remove the branch. Ask everyone the same question, give everyone the same public link, and put a “something went wrong? tell us here” line next to it, visible to all.
2. Incentives tied to a rating. “Leave us a five-star review and get $10 off” conditions the reward on sentiment, which the rule bans. Fix: drop the incentive, or offer it for any honest review regardless of rating and disclose it. “Leave an honest review, positive or not, for $10 off” is defensible. The star condition is what kills it.
3. Missing disclosure on insider or incentivized reviews. A team member reviews the client’s business, or a customer who got a free service posts a glowing review without mentioning the freebie. Fix: build the disclosure into the ask, and keep insiders out of the public request entirely.
4. Suppressing or burying the bad ones. The agency deletes negative feedback, or threatens a reviewer to pull a post. Even hiding real negatives behind a wall of solicited positives can count as suppression. Fix: respond to negatives, do not remove them. The GMB reply automation that handles this is an asset, because a well-handled complaint builds more trust than a perfect score.
5. One hand-built flow per client, no standard. The real operational failure. When every client has a bespoke funnel, you cannot audit them, and one is always non-compliant. Fix: standardize one compliant flow and install it identically everywhere, the way our review harvesting automation ships it. Compliance becomes a property of the template, not something you re-check per client.
Steal this: the compliant request copy
Lift these straight into your clients’ accounts. Every line asks for an honest review, names any incentive, and routes everyone to the same place. Swap the brackets for the client’s details.
The honest SMS request (send to every customer, no gate):
Hi [First name], thanks for choosing [Business]! Would you share an honest review of your experience? It really helps. Here is the link: [review link]. If anything fell short, reply here and we will make it right. Reply STOP to opt out.
The “make it right” line sits in the same message as the public link, available to everyone, instead of diverting unhappy customers away from it.
The honest email request:
Subject: How did we do, [First name]?
Thanks for working with [Business]. We would be grateful for an honest review of your experience, whatever it was. It takes a minute and helps other people decide.
[Leave a review button → public review link]
Had a problem? Reply to this email and we will sort it out. We read every one.
The incentive disclosure line (only if a reward is offered):
As a thank-you, leave an honest review (positive or not) and we will take $10 off your next visit. Please mention in your review that you received this offer.
That one sentence decouples the reward from the sentiment and builds the material-connection disclosure into the ask.
The negative-feedback response (public reply, not a takedown):
Thank you for the honest feedback, [Name]. This is not the experience we want anyone to have, and I would like to fix it. Please reach me directly at [email or phone] so we can make it right.
The one clause every client contract needs:
Client is responsible for the truthfulness of its products and services and for honoring any incentives offered. Agency will implement review-collection workflows that comply with the FTC Endorsement Guides and the Consumer Review Rule, including asking all customers for honest reviews without gating. Client will not direct Agency to solicit, buy, suppress, or fabricate reviews in violation of those rules.
That clause does not move liability off your desk, because the FTC does not let you contract the risk away. It sets the standard in writing, so when a client asks you to gate or buy reviews, you have a document that says no. If you send requests by email, pair this with the copy in our email compliance guide for agencies; if you request by text, use our TCPA-compliant SMS opt-in script.
Three agencies, three compliant setups
The right build depends on the size and shape of the agency. Here is how the same compliant framework plays out across three.
The solo operator or 1-to-10 shop. You run reviews for a handful of local clients with no time to audit anything, so your whole strategy is one standardized flow: an honest ask, the same public link for everyone, a visible “tell us if something went wrong” option, installed unchanged in every sub-account. Skip incentives, because they add a disclosure you have to police. One template, zero per-client decisions. It is the setup our Google review automation is designed around.
The 11-to-20 team. Now account managers build flows, which means drift. One sets up a satisfaction gate because it “gets more stars,” and you find out when a client’s profile gets flagged. Your job becomes governance: lock the flow as a master template nobody edits, make onboarding state that gating is prohibited, run a quarterly audit for any flow with a sentiment branch, and put the contract clause in every agreement.
The 20-plus agency. At this size you process reputation data across dozens of brands, and one bad pattern replicated across all of them is systemic exposure. You need the template discipline above plus a documented policy: who can approve an incentive, how insiders are excluded, how negatives are handled. And if you sell review automation as a line item, your own sales page has to describe the honest version, because the FTC can read it too.
What happens when you get it wrong
This stopped being hypothetical in 2024. The FTC settled a case against the review platform Sitejabber, alleging it collected ratings at the point of purchase, before customers had used what they bought, then used those ratings to inflate its clients’ average scores and review counts (FTC action, 2024). The order carried no money, but it banned the practice. Asking for a review before the customer has experienced the service is the exact pattern the FTC went after.
In December 2025, the FTC sent warning letters to a batch of companies, flagging incentives conditioned on a sentiment, suppressing negative reviews, and buying fake social media indicators. Recipients were reportedly given around five days to confirm in writing that they had fixed the problems, and the letters pointed to the $53,088-per-violation ceiling (Benesch analysis, 2026). Warning letters are not findings, but they usually come before enforcement.
The direction is not one-way. The FTC also set aside an earlier order against the AI writing tool Rytr, concluding that a tool that merely makes review-writing faster is not illegal by itself, and that liability turns on what someone does with it. That is the lesson for agencies: the software is not the problem, the flow you build is.
Objections
“Won’t honest requests tank my clients’ ratings?” The fear behind every gate, and it is mostly wrong. Gating inflates the average but produces a profile that looks fake: no recent negatives, a suspicious five-star wall. Asking everyone produces more reviews, fresher ones, and the occasional handled complaint that makes the profile credible. Volume and recency drive local ranking more than a tenth of a star does.
“My client insists on gating.” Show them this rule and Google’s policy, then the real downside: it is their profile that gets wiped, their ranking that drops, and their name on the FTC’s radar, while your agency shares the liability. Put the no-gating clause in the contract. If they still insist, that is a client who will blame you when it blows up.
“We already pay for a review tool. Doesn’t it handle compliance?” The tool sends the messages. It does not decide whether your flow gates, whether your incentive is tied to a rating, or whether insiders get disclosed. Those are flow decisions you own, and a tool with a built-in satisfaction gate is actively making you non-compliant. Check what it does before you trust it.
“Do I need a lawyer?” For the flow itself, no. The compliant pattern is simple: ask everyone honestly, same public link, disclose incentives, respond to negatives instead of removing them. For the contract clause and anything unusual, have counsel review it. This guide is operational guidance, not legal advice.
FAQ
FTC review compliance, answered
Is review gating actually illegal?
Yes, in practical terms. The FTC treats selectively soliciting positive reviews while discouraging negative ones as deceptive, and the Consumer Review Rule bans suppressing honest reviews. Google's policy separately prohibits gating and can remove all of a profile's reviews over it. The compliant alternative: ask every customer honestly and send everyone the same public link.
Can I offer a discount for a review?
You can offer an incentive, but it cannot be conditioned on the review being positive, and it has to be disclosed. 'Leave an honest review, any rating, for $10 off, and mention you received this offer' is defensible. 'Leave a five-star review for $10 off' is buying sentiment, which the rule bans.
Does the FTC rule apply to my agency or only to my client?
Both. The Endorsement Guides say advertisers, their agencies, and the people who create endorsements all share responsibility. When your agency designs and runs the review flow, you can be liable alongside the client, and you cannot contract that risk away.
What is the penalty for violating the Consumer Review Rule?
Up to $53,088 per violation as of 2026, under 16 CFR 1.98. Because the FTC can count violations per review, a program producing many improper reviews multiplies fast. Beyond the fine, Google can delete every review on a profile and suppress the listing, often the costlier outcome.
What do I do about existing negative reviews, and insider reviews?
Respond to negatives, do not remove them. Using legal threats or false claims to suppress an honest negative review is itself a violation. For insiders, officers, managers, employees and their families must disclose their relationship when they review the business, so the cleaner move is to exclude them from the public request entirely.
The rules are not the obstacle. The obstacle is running a hand-built review funnel for every client and hoping none crosses a line. Standardize the honest version, install it the same way everywhere, and the FTC’s rulebook becomes a one-time setup instead of a recurring worry. Your clients get more real reviews, and your agency’s name stays off the warning-letter list.