If your small business solicits customer reviews — and you should be — there's a federal law you need to understand in 2026. The FTC Consumer Review Rule is now in active enforcement mode, and the practices that many small businesses have used for years to manage their online reputation may be putting them at legal risk. Penalties run up to $53,088 per violation, and each individual instance of non-compliance can be counted separately.
This guide breaks down exactly what the FTC Consumer Review Rule compliance for small businesses requires, what's prohibited, and how to build a review management system that generates authentic feedback, protects your reputation, and keeps you on the right side of federal law.
What Is the FTC Consumer Review Rule?
The FTC Consumer Review Rule (16 C.F.R. Part 465) was finalized in 2024 and reached full enforcement in late 2024 and into 2025. By December 2025, the FTC had already issued warning letters to 10 companies for violations — a clear signal that the agency has moved from education to active enforcement.
The rule establishes a comprehensive framework governing how businesses can solicit, display, and manage online reviews. It applies to virtually every small business that asks customers for feedback, uses reviews in marketing, or employs any kind of review management software.
The core principle is straightforward: reviews must represent genuine, unfiltered customer experiences. Any practice that distorts this — whether by suppressing negative feedback, incentivizing positive ratings, or creating fake reviews — is prohibited.
The 7 Prohibited Practices Every Small Business Must Avoid
The FTC Consumer Review Rule explicitly prohibits seven categories of conduct. Review each carefully against your current practices:
1. Fake or AI-Generated Reviews
Creating, purchasing, or distributing reviews from individuals who did not have a genuine experience with your business is prohibited. This includes reviews written by employees posing as customers, reviews purchased from review farms, and — critically for 2026 — reviews generated by AI tools and presented as authentic customer feedback. If a review doesn't reflect a real customer's real experience, it's a violation.
2. Review Gating
Review gating is one of the most common violations among small businesses — and one of the most misunderstood. It refers to the practice of selectively soliciting reviews based on predicted sentiment: asking happy customers to leave public reviews while routing unhappy customers to a private feedback form instead.
Many reputation management software platforms built this "gating" logic into their workflows for years. If your current review request system asks customers something like "How was your experience?" and only sends satisfied customers to Google while directing dissatisfied ones elsewhere, you're engaging in review gating — and you're in violation of the FTC rule.
The fix is straightforward: send all customers to the same review platform, regardless of their predicted satisfaction level. You can still collect private feedback separately, but you cannot use that screening to filter who gets directed to public review platforms.
3. Sentiment-Conditioned Incentives
Offering incentives for reviews is permitted — but only if the incentive is not conditioned on the review expressing a specific sentiment or rating. "Leave us a review and get 10% off your next service" is acceptable (with proper disclosure). "Leave us a 5-star review and get 10% off" is a violation.
The distinction matters: you can reward the act of reviewing, but you cannot reward positive reviews specifically. Any incentive must be offered equally to all customers regardless of what they write, and the incentive must be clearly disclosed in or adjacent to the review.
4. Undisclosed Insider Reviews
If an employee, manager, owner, or immediate family member posts a review of your business, they must clearly and conspicuously disclose their relationship to the business. This applies even if the review is genuinely positive and reflects their honest opinion. The disclosure must be visible — not buried in fine print or omitted entirely.
5. Review Suppression
Using intimidation, legal threats, or contractual "non-disparagement clauses" to prevent customers from posting negative reviews or to force the removal of existing ones is prohibited. This includes threatening legal action against reviewers, requiring customers to sign agreements waiving their right to post reviews, or using any form of pressure to silence negative feedback.
6. Fake Social Media Engagement
Buying or selling bot-generated followers, likes, shares, or other engagement metrics to artificially inflate your perceived social proof is prohibited. This extends to any service that provides fake engagement metrics, even if the business owner didn't know the engagement was inauthentic.
7. Misrepresenting Review Independence
Operating or promoting a review platform that appears to be an independent third-party site but is actually controlled by your business is prohibited. If you create a "testimonials" page that looks like an independent review site, the connection to your business must be clearly disclosed.
The Review Gating Problem: Is Your Software Compliant?
Here's the compliance issue that catches most small businesses off guard: many popular reputation management platforms built review gating directly into their workflows. If you're using third-party software to manage your review requests, you need to verify that it doesn't include gating logic.
Before using any reputation management tool, get written confirmation from the vendor that:
- The platform does not filter or route customers based on predicted sentiment
- All customers receive the same review request regardless of their survey responses
- The platform supports proper incentive disclosure if you use review incentives
- The platform does not generate or post reviews on your behalf without genuine customer input
If your current software can't provide these assurances, it's time to evaluate alternatives. The FTC's enforcement posture makes this a business risk, not just a compliance checkbox.
Building a Compliant Review Management System
Compliance doesn't mean abandoning your review strategy — it means building one that's sustainable, ethical, and legally sound. Here's how to structure a compliant review management system:
Step 1: Audit Your Current Solicitation Process
Map out exactly how you currently request reviews. Who receives a request? When? Through what channel? What happens if they indicate dissatisfaction before being directed to a review platform? If there's any filtering based on sentiment, that's the first thing to fix.
Step 2: Implement Universal Solicitation
Send review requests to all customers, not just the ones you think will leave positive feedback. This feels counterintuitive — won't you get more negative reviews? In practice, businesses that solicit universally typically see their overall ratings improve, because the customers who had genuinely positive experiences (the majority, for most good businesses) are now being asked consistently.
The customers who had negative experiences often don't leave reviews even when asked — they've already moved on. But when they do leave reviews, having a system that responds promptly and professionally turns those moments into trust-building opportunities rather than reputation crises.
Step 3: Structure Incentives Correctly
If you want to offer incentives for reviews, structure them this way:
- Offer the incentive for leaving any honest review — not for leaving a positive one
- Disclose the incentive clearly in the review request and in the review itself
- Never condition the incentive on a specific star rating or sentiment
- Keep records of all incentivized review campaigns for your compliance documentation
Step 4: Create an Insider Review Policy
If employees, managers, or family members want to review your business, create a written policy that requires them to disclose their relationship. The disclosure should be in the review itself — something like "I work at [Business Name] and wanted to share my perspective as a team member." Train your staff on this requirement and document the training.
Step 5: Build Your Compliance Documentation
The FTC's most effective defense is a documented audit trail. Maintain records of:
- Your review solicitation methods and the dates they were implemented
- Written confirmation from any third-party review software that they don't use gating
- Your incentive disclosure policies and examples of compliant disclosures
- Staff training records related to review compliance
- Any changes you've made to bring previous practices into compliance
This documentation serves as your primary defense if the FTC ever inquires about your practices. Businesses that can demonstrate good-faith compliance efforts are in a significantly better position than those that cannot.
Responding to Negative Reviews: The Compliant Approach
One area where many small businesses inadvertently create compliance risk is in how they respond to negative reviews. The FTC rule prohibits suppression — but it explicitly permits and encourages professional, factual responses to negative feedback.
A compliant response to a negative review:
- Acknowledges the customer's experience without being defensive
- Offers to resolve the issue through a private channel (phone, email)
- Does not threaten legal action or demand the review be removed
- Does not include false or misleading information about the situation
- Maintains a professional, respectful tone regardless of how the review was written
Businesses that respond professionally to negative reviews actually see better outcomes than those that ignore them. Research shows that a one-star improvement in online ratings can boost revenue by 5-9%, and much of that improvement comes from how businesses handle criticism, not just from accumulating positive reviews.
Tools like MAPT's Smart Reputation system can help you maintain a consistent, professional response practice across all platforms — ensuring every review gets a timely, brand-appropriate response without requiring hours of manual effort each week.
The Business Case for Compliance
Beyond avoiding penalties, there's a strong business case for building a compliant review management system. Authentic reviews — the kind that come from a universal, non-gated solicitation process — are more credible to both consumers and AI search engines.
In 2026, AI platforms like ChatGPT and Google AI Overviews use review signals as a primary filter for which businesses to recommend. Businesses with authentic, consistent review activity across multiple platforms are far more likely to be cited in AI-generated recommendations than those with artificially curated review profiles. The compliance practices the FTC requires are, not coincidentally, the same practices that build the kind of reputation AI systems trust.
If you're building your review strategy from scratch or auditing an existing one, our posts on building a proactive review generation system and review response rate as a revenue metric offer practical frameworks that work within the FTC's compliance requirements.
For businesses that want to understand how their reputation connects to their broader digital presence, MAPT's Living Websites platform integrates reputation signals directly into your website's SEO and conversion infrastructure — so your authentic reviews work harder across every channel.
Action Steps for This Week
- Audit your current review software. Contact your vendor and ask directly whether their platform uses review gating. Get the answer in writing.
- Review your incentive practices. If you offer any incentives for reviews, verify they're not conditioned on positive sentiment and that disclosures are in place.
- Create a simple compliance document. Even a one-page summary of your review solicitation practices, dated and signed, gives you a starting point for your audit trail.
- Train your team. Make sure anyone who interacts with customers or manages your online presence understands the basics of the FTC Consumer Review Rule.
The FTC Consumer Review Rule isn't designed to make reputation management harder — it's designed to make it more honest. Businesses that build their review strategy on authentic customer feedback, transparent practices, and consistent engagement will find that compliance and strong reputation performance go hand in hand.
To learn how MAPT's compliant reputation management tools can help you build a review system that's both effective and FTC-compliant, visit Smart Reputation.