The Fake Review Rule Nobody Told Small Business Owners About: 16 CFR 465 in Plain English

What the FTC fake review rule actually is

On August 14, 2024, the Federal Trade Commission announced a final rule that, for the first time, makes specific fake-review practices a direct violation of a Trade Regulation Rule rather than a matter to be argued case by case. The rule was published in the Federal Register (2024-18519) and took effect on October 21, 2024. Its formal citation is 16 CFR Part 465, the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials.

The mechanical change matters more than the headline. Before this rule, the FTC policed deceptive reviews under the general deception and unfairness authority of Section 5 of the FTC Act, which required the agency to build each case from the ground up. A Trade Regulation Rule is different: once a practice is named in the rule, a violation can carry civil penalties without the agency re-litigating whether the conduct is deceptive in the abstract. That is what puts a specific dollar figure, up to $51,744 per violation, behind conduct that many operators still treat as ordinary marketing.

The rule was not written for large platforms alone. It reaches any business whose reviews or testimonials are created, procured, or suppressed in the prohibited ways, which places the ordinary local service business squarely inside its scope.

The five practices 16 CFR 465 prohibits

The rule is easier to comply with once it is read as a list of concrete behaviors rather than a general instruction to be honest. As summarized from the rule text, five practices are named, and each has a direct analog in how local businesses already collect and manage reviews.

• Fake or fabricated reviews: reviews that claim to come from a real customer who does not exist, or from a person who never actually used the product or service, including fake reviews written by an AI system.
• Review gating and sentiment-conditioned incentives: screening customers by how they feel first and routing only the happy ones to a public platform, or offering a reward that is conditioned on leaving a positive review.
• Undisclosed insider reviews: reviews written by officers, managers, employees, or their immediate relatives that are presented as independent customer opinion without disclosing the connection.
• Review suppression: using unfounded legal threats, physical threats, intimidation, or false accusations to prevent or remove honest negative reviews.
• Fake social-media indicators: buying or selling followers, views, or other indicators of influence generated by bots or hijacked accounts to misrepresent a business or its standing.

Are fake reviews illegal now, and what $51,744 per violation means

The short answer is that the named practices are now prohibited by a federal rule that authorizes civil penalties, which is a stronger legal position than the case-by-case deception theory that preceded it. The rule sets a maximum civil penalty of up to $51,744 per violation, a figure the FTC adjusts for inflation over time.

The caveat is what "per violation" means in practice. The rule is recent, and the enforcement record that would settle whether a violation is counted per fake review, per campaign, or per transaction is still thin. Treating the maximum as an automatic multiplier against every bad review would overstate what has actually been imposed. The defensible reading is narrower and still serious: the ceiling is high enough that a systematic practice, a gating funnel running for months, or a batch of fabricated testimonials, represents genuine financial exposure rather than a theoretical one.

Two further points keep the picture accurate. First, these are civil penalties, not criminal charges, and the FTC has historically pursued patterns and systems rather than isolated mistakes. Second, the rule sits on top of, and does not replace, the platform policies of Google, Yelp, and others, which enforce their own bans on gating and fake reviews independently and far more frequently than any regulator does.

Why owner-operated businesses carry the most exposure

The uncomfortable structural fact is that this rule lands hardest on the businesses least equipped to absorb it, and that is not an accident of enforcement so much as a property of where fake reviews come from in the first place.

The seminal empirical study of review fraud, Luca and Zervas in Management Science (2016), examined Yelp and found that a business is significantly more likely to commit review fraud when its organic reputation is weak, when it has few reviews or a recent run of bad ones, and when local competition intensifies. Chain businesses, which gain less marginal benefit from any single platform, committed fraud less often. The behavior concentrates, in other words, precisely among small independent operators under competitive pressure.

That is the exact profile of the owner-operated med spa, the home-services contractor, the two-chair dental practice, and the solo law firm. The temptation to buy a few reviews, to route unhappy customers to a private form, or to have a family member post a glowing testimonial is strongest for the businesses whose next customer is decided by the rating. The rule now attaches a federal penalty to the behavior that structural pressure makes most likely, in the segment that can least afford the penalty, which is why the exposure is not hypothetical for this audience.

Review gating and incentives: the rules most owners break without knowing

The practice that catches the most honest operators by surprise is review gating, because it was sold to them as a best practice by reputation tools for years. Gating is any workflow that asks customers how they feel before deciding where to send them, then routes the satisfied ones to Google or Yelp and diverts the unhappy ones to a private feedback form. It feels reasonable. It is now named as a prohibited practice.

One doctrine, two surfaces: astroturfing and dark patterns

It helps to see the fake review rule as one application of a broader legal idea rather than an isolated regulation. Review manipulation and interface manipulation are the same underlying problem expressed on two different surfaces, and the FTC treats them under the same unfairness and deception doctrine.

On the interface side, the design-research and legal community has a name for manipulative design that pushes a user toward an action they would not otherwise take: dark patterns, a category coined by Harry Brignull in 2010 and now actively monitored by the FTC and consumer advocates. On the reputation side, the parallel is astroturfing: manufacturing the appearance of organic customer sentiment that does not exist. Both exploit the same gap, the distance between what a system appears to reflect (free customer choice, genuine sentiment) and what it actually reflects (an engineered incentive structure). Recognizing the shared doctrine is useful because it tells a business owner where the line sits: the rule is not hostile to marketing, it is hostile to the specific act of making a signal say something the underlying reality does not support.

How aggressively will it be enforced?

A rigorous piece has to separate what the rule says from how forcefully it will be applied, because those are different questions with different confidence levels.

The rule text and its penalty authority are established and on the books. The intensity and durability of enforcement are less certain. The FTC launched a distinct enforcement lane called Operation AI Comply in September 2024, targeting deceptive AI claims, and named actions against DoNotPay and Evolv Technologies followed. Yet the agency also reopened and set aside its own 2024 Rytr consent order in December 2025, citing a change in administration posture. That reversal is evidence that federal enforcement priorities shift with the political calendar, and that treating any single administration's aggressiveness as a fixed floor would be a mistake.

The prudent conclusion is not to gamble on lax enforcement. A rule stays enforceable regardless of how often it is invoked, private platform policy enforces the same prohibitions far more routinely than any regulator, and a business that builds its reputation the compliant way is insulated from both. The uncertainty is about the odds of being pursued by the FTC specifically, not about whether the underlying conduct is prohibited or whether Google will remove gated reviews. Compliance is the strategy that is correct under every version of the enforcement future.

What a compliant review operation looks like

Put the pieces together and a compliant review operation is a short, testable checklist rather than a legal seminar. Every review comes from a real, identified customer who actually used the service. No step in the request flow screens customers by sentiment before deciding where to send them. No incentive is conditioned on positivity, and any material connection is disclosed. Honest negative reviews are answered, never suppressed by threat. Followers and engagement are earned, never purchased.

Most owner-operated businesses fail this checklist not through bad intent but through inheritance: an old reputation tool with a built-in gating step, an agency that set up a sentiment funnel years ago, a family member who left a review without disclosure, or a reflex to threaten a reviewer over an unfair one-star. The gap is rarely deliberate, which is exactly why it goes unseen until someone maps where every review actually comes from and how each one was solicited. That mapping is the first step, and it is worth doing before the exposure becomes a matter for a regulator or a platform to raise first.