Website Testimonials and the FTC: What You Can and Cannot Publish in 2026

Most business owners think the fake review crackdown is an Amazon problem. It is not. The rule the Federal Trade Commission finalized in 2024 reaches the testimonial section of an ordinary company website, the quotes on a services page, and the review widget a developer installed and nobody has looked at since.

It also does far less than the panicked coverage suggests. A lot of what agencies now tell clients is banned is not banned by this rule at all. Knowing which is which is worth an afternoon, because the parts that do apply are cheap to get right at build time and awkward to fix after someone complains.

The 30-second answer

You can put testimonials on your website. What you cannot do is invent them, buy them, or hide the fact that the person praising you works for you. The FTC's Rule on the Use of Consumer Reviews and Testimonials took effect on October 21, 2024, and it bans fake or false reviews and testimonials, paying for a particular sentiment, undisclosed insider reviews, company-controlled sites posing as independent, bullying reviewers into silence, and buying fake followers. Courts can impose civil penalties of up to $53,088 per violation for knowing violations. The rule's much-discussed ban on hiding negative reviews is narrower than people think: it applies to a reviews section you host, not to a curated wall of happy quotes on a landing page. Curating your marketing is legal. Fabricating it is not.

What actually changed in 2024

The FTC announced the final rule on August 14, 2024, and it was published in the Federal Register on August 22 as 89 FR 68034. The text now lives at 16 CFR Part 465, and it took effect on October 21, 2024.

Deceptive reviews were already illegal before this, under Section 5 of the FTC Act, and the agency brought cases and recovered money under it. What a trade regulation rule adds is a more direct lever: civil penalties against knowing violators, rather than having to build the case from scratch as unfair or deceptive conduct each time. The current maximum is $53,088 per violation, set out in the penalty table at 16 CFR 1.98.

Two words in that sentence matter. Knowing, because the rule is aimed at businesses that understood what they were doing rather than at honest mistakes. And per violation, because the count is not one penalty per company.

Lina M. Khan, then chair of the FTC, described the harm this way when the rule was announced: "Fake reviews not only waste people's time and money, but also pollute the marketplace."

A review is not a testimonial

Almost every mistake we see starts here. The rule defines these as two different things and applies different provisions to each.

A consumer review is an evaluation submitted by a customer and published on a site or section dedicated to collecting and showing such evaluations. Your Google profile is full of reviews. So is the star-rating block on a product page, if customers submit to it.

A consumer testimonial is an advertising message that reads as the opinion or experience of a customer. The quote card on your homepage is a testimonial. Nobody submitted it to a review system. You chose it, designed it, and published it as marketing.

The FTC's own staff guidance puts it bluntly in its questions and answers on the rule: most consumer reviews are not consumer testimonials, and most consumer testimonials are not consumer reviews. If you take one thing from this article, take that sentence, because the rules that got the most attention apply to reviews, while the thing on your website is usually a testimonial.

The six things the rule bans

Stripped of the legal scaffolding, Part 465 prohibits six categories of conduct.

Fake or false reviews and testimonials. Writing, creating or selling a review or testimonial that misrepresents that the person exists, that they used your product or service, or what their experience was. Buying them or spreading them counts too, when you knew or should have known.

Buying sentiment. Providing compensation or incentives conditioned, openly or by implication, on the review being positive or negative.

Undisclosed insider reviews and testimonials. Quotes from your officers, managers, employees, agents or their immediate relatives, without a clear disclosure of the relationship.

Company-controlled review sites posing as independent. The FTC's own example is a company that invents a seal program and then awards the seal to its own products.

Review suppression. Two flavors: bullying a reviewer with groundless legal threats, intimidation or knowingly false public accusations, and misrepresenting that the reviews shown in your review section are all of them when you filter by sentiment.

Fake social media indicators. Selling or buying followers, likes and views generated by bots or hijacked accounts, to misrepresent influence.

Notice what is absent. Nothing here requires you to publish every kind word you receive, run a review section, or show a star rating.

Real people, real quotes, real faces

The most common violation we find on a site audit is not a fabricated quote. It is a real quote attached to a face that belongs to a stock photography model.

The Endorsement Guides at 16 CFR Part 255 deal with this directly. An advertisement presenting endorsements by people represented as actual consumers should either use actual consumers, or clearly and conspicuously disclose that the people shown are not. A smiling headshot next to a client quote represents that person as the client. If the headshot came from a stock library, the page is making a claim that is not true, and the disclosure that fixes it defeats the purpose of using the photo.

The same logic applies to generated faces. A model that produces a photorealistic person who has never existed is a faster way to arrive at the same problem.

The FTC's July 2025 case against telemedicine firm NextMed shows what this looks like when it goes wrong. Among the charges, the agency alleged the company used testimonials and before-and-after photos from people who were not its clients. The company and its principals agreed to pay $150,000 and to stop misrepresenting reviews.

The fix is unglamorous and it is what we do on every build: initials or no image at all, unless the client has given you a real photograph. An honest text card converts better than a face nobody believes anyway.

When your own team is the testimonial

Section 465.5 is the provision most likely to catch a small business acting in good faith. If an officer or manager writes a review of the business, it needs a clear and conspicuous disclosure of the relationship. If you publish a testimonial from an employee or an agent without disclosing it, and you knew or should have known, that is on you.

Clear and conspicuous has a specific meaning in the rule, and it is stricter than most disclosure design. The disclosure has to be unavoidable. The definition says outright that a disclosure is not clear and conspicuous if a consumer has to click a hyperlink or hover over an icon to see it. An asterisk leading to a footnote at the bottom of the page does not satisfy it. Text in the first line of the review does.

There are two sensible escape hatches. The first is that no disclosure is needed when the relationship is already obvious to the audience, for example when the person is filmed in company uniform in the company's office. The second is the generalized solicitation carve-out, and it is broader than people expect.

The FTC's staff guidance works through the exact scenario: you email all recent customers asking for a review, a few of them happen to be employees, and they post without disclosing. That is not a violation of this section. The answer does not change if you offered an incentive to everyone who received the email, as long as the incentive was not conditioned on saying something nice.

One caution the guidance adds is easy to miss. Insider reviews with proper disclosures can still create a problem under the FTC Act if they materially lift your average star rating, because plenty of people read only the number.

How to ask for reviews without buying them

Asking customers for reviews is normal, effective and legal. Paying for a verdict is not. The line sits exactly at whether what you offer depends on the sentiment.

A discount for anyone who leaves a review, positive or negative, is on the safe side of the rule. A discount for a five-star review is not. Neither is a prize draw for customers who "share what you loved", because the condition is implied by the wording. The rule explicitly covers incentives conveyed by implication.

BrightLocal's Local Consumer Review Survey 2026, which surveyed 1,002 US adults, gives a sense of how common each behavior is.

Seventy-eight percent were asked for feedback in the previous year and fifty-nine percent were offered some reward for it, which are both fine. Eleven percent were offered an incentive specifically to write a positive review, which is the conduct the rule bans. That is a meaningful share of the market doing something that now carries a penalty exposure.

If you want the volume without the risk, ask everyone, ask soon after the work is delivered, and make the ask identical regardless of how you expect the customer to feel. We build that request into the delivery step of client projects rather than leaving it to a marketing afterthought.

Can you show only your best testimonials

Yes, and this is where most published guidance is wrong.

The suppression provision is narrow by its own terms. It applies to reviews displayed in a portion of your website or platform dedicated in whole or in part to receiving and displaying consumer reviews. The FTC's staff guidance is explicit that the provision does not prohibit the selective use of particularly positive consumer reviews in marketing materials.

So the wall of glowing quotes on your homepage is not a violation of the suppression rule. Our own site has one.

The caveat is real, though, and the same guidance states it. Using reviews that are not representative of what customers generally experience can still be deceptive under Section 5 of the FTC Act, and the Endorsement Guides say an ad relating one customer's experience on a key attribute will be read as a claim that the experience is typical. If your average client sees nothing like the outcome in your featured quote, the quote needs context, not just a disclaimer.

If you do run a review section that collects customer submissions, the equal-treatment principle governs. You may withhold reviews for reasons applied to every submission regardless of sentiment, such as reviews containing personal information, abusive or discriminatory content, confidential commercial information, content you reasonably believe is fake, or content unrelated to what you sell. What you may not do is filter by rating and then imply the survivors are the full set.

The review widget that cost $4.2 million

The clearest illustration of that distinction predates the rule. In January 2022 Fashion Nova agreed to pay $4.2 million to settle allegations that it blocked negative reviews of its products from its website. It was the FTC's first case about concealing negative reviews.

The mechanism is what web teams should sit with. According to the complaint, the retailer used a third-party review management interface configured to post four and five star reviews automatically while holding lower-rated ones for approval. From late 2015 until November 2019, those hundreds of thousands of held reviews were never approved.

Nobody had to write a fake review. Somebody chose a default in an admin panel. That default is still shipped by review plugins today, usually described as moderation, and it is the single setting we check first when we inherit a site with a reviews section.

The other two cases in that chart show how varied the exposure is. Leader Automotive Group and its parent AutoCanada agreed in December 2024 to turn over $20 million over a set of allegations in which bogus reviews sat alongside junk fees and bait-and-switch pricing. NextMed's total was $150,000. Reviews were one charge among several in both, so neither figure is a price list for a fake testimonial.

Enforcement has not stopped. In May 2026 the FTC and the state of Illinois sued a Chicago company over thousands of fabricated home-repair business listings padded with invented five-star reviews to dilute genuine one-star ones. The company has not been found liable, and a complaint is only the government's side of the story.

Answering a bad review without making it worse

You are allowed to reply to critics, and you should. The rule restricts how, not whether.

What it prohibits is using an unfounded or groundless legal threat, a physical threat, intimidation, or a public accusation you know to be false, in order to stop a review being written or to get one taken down. Groundless has a definition: contentions unwarranted by existing law, or factual claims with no evidentiary support.

Threatening to sue over a genuinely defamatory review is still available to you, because that threat has a legitimate basis. Sending a takedown letter to every unhappy customer is the thing that turns a bad week into an enforcement matter. The FTC's guidance also notes that intimidation is not limited to physical threats and can include abusive communications and character assassination.

Contacting a customer privately to fix the underlying problem is fine, and so is asking a satisfied customer to update an old review. What draws attention is offering someone money to delete a negative review, which the guidance flags as a possible unfair practice even though the rule does not ban it outright. NextMed was alleged to have offered gift cards to consumers to remove or change negative reviews, and to have conditioned refunds on it.

The results claim hiding inside your testimonial

A testimonial that contains a number is two claims at once: that the customer said it, and that the number is achievable.

The Endorsement Guides require substantiation for the second one. If a quote describes an outcome on a central attribute of what you sell, it will be read as representative of what customers generally get. Where you cannot substantiate that, the guides call for a clear disclosure of the performance customers should generally expect, and that disclosure has to change the overall impression rather than sit in small print.

This is why we are careful with our own numbers. We say that Cornerstone Healing Center saw 20% more website conversions after we redesigned their site, and that we built Eden Digital and it grew revenue 10X, because those are specific results for named clients that we can point to. We do not present either as what a new client should expect, because we have no basis for that claim, and a reader who signs up expecting 10X is a refund request in slow motion.

Regulated industries carry more weight here. If you market treatment, therapy or medical services, a patient testimonial describing outcomes needs care that a plumbing testimonial does not, and several state boards have their own restrictions on top of federal law.

Who is actually on the hook

The business, and often the people it hires.

The FTC's guidance confirms that advertising agencies, public relations firms, review brokers and reputation management companies are not immune. An agency that writes a fake testimonial, runs an incentive program conditioned on positive sentiment, or handles review suppression for a client can be liable in its own right. We include ourselves in that. It is one of the reasons we will not implement a review filter that hides one-star submissions, whoever asks.

Two limits are worth knowing. Ordinary consumers cannot be liable under the rule for what they write, and there is no private right of action, so a competitor cannot sue you under this rule directly. That does not stop them complaining to the FTC, or suing under other law.

We are a design and development studio, not a law firm, and none of this is legal advice. For anything with real money attached, ask a lawyer who practices advertising law.

What we put on client sites

Our standing rules are short. Real names or initials, never invented ones. A real photograph or no photograph. Verbatim quotes, trimmed for length but never for meaning, with the client's written permission to publish. Any employee, investor or founder quote labelled as such in the visible text. Numbers only where we can point at the source. Review widgets configured to publish everything that passes the same content policy, or not installed at all.

None of that is expensive. It is a set of decisions made during the design phase, which is why our flat $1,499 build and our monthly partnership both include it rather than pricing it as an extra. For businesses in local services, where reviews are most of the buying decision, we treat the proof section as a first-class part of the layout rather than a strip at the bottom.

The honest counterpoint: if what you actually want is a site that looks more established than the business currently is, we are the wrong studio. Proof is the one part of a website that cannot be designed into existence.

A 20 minute audit of your own site

Open your site and check six things.

One, does every testimonial correspond to a real person who really bought from you, and can you produce the permission. Two, is every photograph next to a quote a photograph of that person. Three, is any quote from staff, family or an investor labelled in the visible text rather than a tooltip. Four, does any incentive you offer for reviews depend on the review being positive. Five, if you host a review section, does anything filter submissions by rating or sentiment. Six, does any published number in a quote have a source you could show a regulator.

Most sites we audit fail two and three. Those are also the two cheapest to fix, usually inside an hour, which makes them a strange thing to still be carrying.

If the audit turns up more than a couple of problems, the underlying issue is usually that the site was assembled from a template with placeholder content that nobody replaced, in which case the testimonials are the symptom. Our piece on why traffic does not turn into leads covers what else tends to be wrong on those pages, and our guide to ADA website compliance covers the other rulebook that reaches the same markup.