The Regulated Review: How the FTC, State Medical Boards, and Bar Associations Each Police Testimonials Differently

One asset, three sets of testimonial advertising rules

A published review is a small thing with a large legal surface. The same five-star quote on a homepage can be governed by federal consumer-protection law, by a state board that licenses the person being praised, and by a professional-conduct code that treats advertising as a fiduciary matter. Which of those apply depends entirely on what the business does, and the three regimes were written by different bodies, for different reasons, with different tests for what counts as a violation.

This is why a single national playbook for reviews is incomplete for the verticals where trust is hardest to verify. A home-services firm faces one regime. A med spa faces two. A law firm faces a third that is stricter than most owners expect. The practical error is not usually malice, it is assuming the rule you have heard of is the only rule that governs you. This piece reads the three regimes side by side, using their actual text, so a practice can locate itself and see which testimonial advertising rules it is actually operating under.

A note on scope before the substance: what follows is an academic reading of public regulatory text, not legal advice, and none of it substitutes for a qualified professional's review of your specific situation. The regimes overlap and turn on facts and jurisdiction. The purpose here is to make the structure legible, so you know which questions to ask.

The federal floor: the FTC rule governs every reviewed business

The first regime is federal and applies to essentially every business with an online reputation. In 2024 the Federal Trade Commission finalized a rule making fake and deceptive consumer reviews and testimonials a specified unfair or deceptive act, effective October 21, 2024. It followed a 2023 revision of the FTC's Endorsement Guides, which extended long-standing endorsement principles to review manipulation: buying, suppressing, boosting, or organizing reviews in ways that distort what a consumer would otherwise conclude.

The reach is the important part. This is not a rule for review platforms; it applies to every reviewed local business that publishes, solicits, or shapes the testimonials on its own profiles. It names specific practices as violations and attaches civil penalties to them per violation, which is what converts reputation work from a soft growth exercise into a compliance envelope. The prohibited set includes reviews from people who never had the experience, bought or sold reviews, undisclosed insider reviews from owners and staff and their close relatives, incentives conditioned on the review being positive, and selectively suppressing negative reviews while displaying the favorable ones.

For the purposes of the three-regime map, treat the FTC rule as the floor. It is the layer every practice stands on. A med spa and a law firm are subject to it in exactly the same way a restaurant is, and then they carry additional obligations on top. So the first question that matters for any business is not "does the FTC rule apply to me" (it almost certainly does), but "which regimes stack on top of it".

The medical layer: a testimonial is a medical-advertising act, and supervision is the hidden variable

The second regime is the one most med-spa and dental owners underestimate, because it does not present itself as a rule about reviews at all. In the United States, aesthetic and cosmetic-medical procedures are legally the practice of medicine. That single fact pulls the entire advertising and testimonial question inside a state medical (or, for dentistry, dental) board's jurisdiction, alongside licensing, scope of practice, and physician supervision.

What makes this layer genuinely hard is that its central variable, physician supervision, is set state by state and varies sharply. In some states the medical director must be closely tied to the practice, for example within a fixed distance and physically on site for a minimum number of hours each week. In others, where nurse practitioners hold full independent scope-of-practice authority, there is effectively no supervision requirement at all. The gap between those two poles is not cosmetic. It changes who is lawfully performing and standing behind the procedure a testimonial is praising.

The attorney layer: an affirmative truthfulness standard, not just a no-lying rule

The third regime is the strictest, and it catches practitioners off guard because it goes further than "do not lie". Attorney advertising is governed by professional-conduct rules, of which the American Bar Association's Model Rule 7.1 is the template adopted in most states. Rule 7.1 sets an affirmative truthfulness standard: a communication about a lawyer's services is prohibited if it is false or misleading, and a statement can be misleading even when it is literally true.

Two mechanisms in the rule do the work. A true statement is treated as misleading if it omits a fact necessary to keep the communication as a whole from being misleading. And a truthful statement is misleading if it would lead a reasonable person to a conclusion for which there is "no reasonable factual foundation". Applied to testimonials, this is a high bar. A genuine, unpaid client testimonial that reads "she won my case and got me everything I asked for" can be perfectly true about one matter and still misleading if it invites a reasonable prospective client to conclude that similar results are generally attainable, because past results do not furnish a reasonable factual foundation for that inference.

Rule 7.2 adds a second constraint specific to how testimonials and referrals may be procured. It bars a lawyer from giving anything of value for a recommendation, with narrow exceptions, including that a lawyer may participate only in qualified, unbiased not-for-profit lawyer referral services. In plain terms, the mechanisms by which a business in another vertical might amplify or incentivize endorsements are, for lawyers, additionally constrained by the conduct rules on paying for recommendations. Most states also require or expect explicit disclaimers on results-based testimonials. The net effect is that a law firm operates under the FTC floor and a professional-conduct ceiling at the same time, and the ceiling is lower than the floor.

Reading the three regimes side by side

Laid against each other, the regimes differ on four axes that determine what a practice may publish: who writes the rule, what the core test is, what triggers a violation, and who can be published about. Seeing them in one view is what prevents a practice from applying the wrong test to its own testimonials.

• Source and reach. The FTC rule is federal and near-universal in reach. State medical and dental board rules are state-specific and reach only licensed clinical practices. The attorney-advertising rules are state-adopted professional-conduct codes and reach only licensed lawyers and firms.
• The core test. The FTC regime asks whether the review is authentic and un-manipulated. The medical regime asks whether the advertised procedure and the practice behind it are lawfully licensed and supervised. The attorney regime asks whether the communication, true or not, could mislead a reasonable person, and whether it was procured in a permitted way.
• What triggers a violation. Under the FTC rule, fabrication, incentivized positivity, insider concealment, and suppression trigger it. Under the medical regime, an unlawful supervision or scope-of-practice arrangement can taint the advertising of the underlying service. Under the attorney regime, a true but unqualified results claim, or paying for a recommendation, can trigger it without any dishonesty about the underlying facts.
• The stacking rule. These regimes are additive, not alternative. A restaurant faces one. A med spa faces the FTC floor plus the state medical layer. A dental practice faces the FTC floor plus the state dental-board layer. A law firm faces the FTC floor plus the professional-conduct ceiling. The strictest applicable regime sets the standard your process has to meet.

Why three regimes and not one: the credence-good problem

The multiplicity is not bureaucratic accident. It tracks a structural feature of exactly these verticals. Legal services, dental care, and medical aesthetics are credence goods: the buyer typically cannot verify quality before purchase, and often cannot fully verify it afterward. A patient generally cannot assess a clinician's competence by looking, and the peer-reviewed record shows patients frequently cannot even accurately identify a provider's credentials and qualifications when choosing an aesthetic provider. Rule 7.1 exists precisely because a prospective client cannot independently test a lawyer's claims before engaging.

When a buyer cannot verify quality directly, the regulatory apparatus substitutes institutional guardrails for the verification the buyer cannot perform. The FTC rule guarantees the testimonial is at least a real, un-manipulated signal. The state medical board guarantees the person behind the praised procedure is licensed and supervised. The attorney-conduct rules guarantee the firm's claims cannot exploit a prospective client's inability to judge them. Read this way, the three regimes are three answers to the same problem: in markets where the buyer is structurally in the dark, society polices the signals the buyer is forced to rely on.

This is also why reputation work done this way is not merely good ethics in these verticals, it is the only method that functions. Tactics that manufacture, buy, or exaggerate testimonials are simultaneously against platform policy, against the FTC rule, and, for regulated professionals, against their board's conduct rules. The compliant path is not a constraint bolted onto the growth path. In credence-good markets it is the growth path, because a real, defensible reputation is what a buyer who cannot verify anything else is actually buying.

What compliant publication looks like under each regime

The practical output of the three-regime map is a short set of design rules that let a practice publish testimonials it is entitled to publish. They compound: satisfy the floor, then add the layer that applies to you.

What this evidence does and does not settle

The regulatory text is public record and, in that sense, established. The FTC rule is in force with real penalties. Rule 7.1 and 7.2 are the ABA model text adopted, with variations, across most states. The legal characterization of aesthetic procedures as the practice of medicine, and the state-by-state variance in physician supervision, are established facts, though the granular supervision requirements are documented largely through compliance-practitioner and industry sources rather than a single academic dataset, and the enforcement-focus observation is a professional read of current regulator behavior.

What the evidence does not settle is your specific obligation. Whether a given regime applies to your business, and exactly how, is fact-specific and jurisdiction-specific, and state adoptions of the ABA model rules differ in their particulars. This framework is built to make the structure legible and to tell you which questions to route to qualified counsel, not to answer them for your matter. Because this domain is legal-adjacent, publication-grade decisions here warrant a formal legal review before you act on them.

The defensible conclusion is narrower and more useful than a blanket rule: the businesses most exposed to a testimonial misstep are the ones that assume a single regime governs them when two or three do. Mapping which regimes apply, then engineering a review process to satisfy the strictest applicable one, is how a practice publishes reviews it is actually entitled to publish.