Testimonial consent rules and the FTC rule on reviews, in plain words

This article is general information for businesses that collect and publish customer testimonials and reviews. It is not legal advice and it does not cover every situation or every state law. If you have a specific question, for example about a paid endorsement program or a dispute with a reviewer, talk to a lawyer who knows your industry.

The rule is formally called the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials. The FTC announced it in August 2024 and it took effect in October 2024. It applies to businesses that sell to US consumers and to anyone who writes, buys, sells or publishes reviews and testimonials for them.

The rule does not create a brand new idea. Deceptive reviews were already illegal under the FTC Act. What the rule adds is a clear list of banned practices and the ability to seek civil penalties for each violation, rather than only ordering a company to stop. In practice, each fake review or each misleading testimonial can count separately.

The FTC Endorsement Guides, updated in 2023, still apply alongside the rule. They explain when a connection between a business and a reviewer must be disclosed and how endorsements should reflect real experience.

The rule bans writing, buying or publishing a review or testimonial that misrepresents who wrote it or what their experience was. That includes:

• Reviews or testimonials from people who do not exist.
• Reviews from people who never used the product or service.
• Testimonials that misstate what the customer actually experienced.
• Reviews and testimonials generated by AI and presented as coming from real customers.

The AI point is explicit. If a tool writes a glowing quote and you publish it under a customer's name, or under no name as if a customer wrote it, that is a fake testimonial. Using AI to help with real customer words is different: transcribing a video, suggesting which sentence to feature, or correcting a typo the customer would agree with. The test is whether the published words are still what that real customer said and meant.

This is why TestimonialManager keeps the original text and video for every answer, shows every AI suggestion to the business, and never changes the original without approval. See AI testimonial highlights for how that works.

The rule bans buying or selling fake reviews, and it bans offering compensation or another incentive on the condition that the review is positive or negative. The condition can be explicit, such as "leave five stars and get 20 percent off", or implied, such as rewarding only customers who praise you.

Incentives that do not depend on sentiment are not banned by this rule, but they still need to be disclosed under the Endorsement Guides, and many platforms forbid them entirely. Google, for example, does not allow businesses to offer anything in exchange for a review. The simplest safe policy for most businesses is to offer no incentive for reviews at all, and to ask every customer the same way.

The same thinking applies to who gets asked. Sending the Google review link only to customers you expect to be happy, a practice called review gating, is against Google's policies and can mislead buyers about your overall rating. In TestimonialManager every customer receives the same request and the same Google review link, and private feedback is an extra option, never a filter. More in review request software.

Reviews and testimonials from people closely connected to the business must say so clearly. The rule names officers and managers of the company, and it also covers reviews they solicit from employees, agents or their own relatives when they know or should know about the connection and it is not disclosed.

In plain words: if your sales manager, your brother in law or a contractor who works for you writes a review, readers need to see that connection. If you ask staff to post reviews, tell them to disclose that they work for you, and do not use their words as customer testimonials on your website.

The rule also bans company controlled review websites that claim to be independent. A "best providers in your city" page that is secretly run by one of the providers is the classic example.

A business may not use unfounded legal threats, intimidation or false accusations to stop someone from posting a negative review or to get it removed. It also may not claim that the reviews it shows on its own site represent all or most of its reviews when it has hidden negative ones for their content.

You may still decline to publish reviews that contain profanity, personal data, harassment, content unrelated to your products or services, or clearly fake content, as long as you apply the same standard to positive and negative reviews. A written moderation policy helps, and so does labeling a widget honestly, for example "selected testimonials" rather than "what all our customers say".

Two more points complete the picture. First, the rule bans selling or buying fake social media indicators, such as followers or views generated by bots or hijacked accounts, when the buyer knows or should know they are fake and uses them for commercial purposes. Second, the bans on fake reviews apply to anyone who procures them, including agencies that write or post them for clients. If you run testimonial collection for client brands, see testimonials for agencies.

The FTC rule is mostly about honesty. Consent is the other half of a defensible testimonial program: proof that the customer agreed to be quoted, in the way you quote them. Privacy and publicity laws in many states protect the use of a person's name and likeness in advertising, so written consent protects you as well as the customer.

For every testimonial, keep a record of:

• The exact words or the original video the customer submitted, unedited.
• What they agreed to: where it may appear (website, social, ads, sales material) and in what form.
• How they may be identified: full name, first name and initial, job title, company, photo, face in video.
• The date and time of consent and the device or IP address it came from.
• The wording of the consent checkbox or statement they saw at that moment.
• Any later change, such as an edit they approved or a withdrawal.
• Any relationship to your business that needs a disclosure, such as an employee or a paid partner.

Keep the record for as long as you publish the testimonial and for a reasonable period afterwards. When a customer withdraws consent, remove the quote from every place you use it and note the date.

TestimonialManager attaches this record to every answer automatically, with a timestamp, IP address and the consent wording, keeps an exportable consent log and gives each customer a withdraw link. The testimonial consent form page shows the details, and testimonial software security covers how the records are stored.

• Publish only words that real customers wrote or said, about their real experience.
• Use AI to transcribe and to suggest highlights, never to write testimonials.
• Ask every customer the same way, and give every customer the same Google review link.
• Offer no incentive tied to a positive or negative review. Prefer no incentive at all.
• Disclose any employee, family or paid relationship next to the testimonial.
• Moderate reviews by content rules that apply equally to praise and criticism.
• Keep written consent with every quote, and act on withdrawals quickly.

For the request itself, our guide on how to request a testimonial from a client includes templates written with these rules in mind, and how to ask customers for reviews covers review platforms.