Google Review Policies & Legal Compliance: What Every Business Owner Must Know

Most business owners treat Google reviews as a marketing asset — a score, a star rating, a badge for the website hero section. Few treat them as what they have become: published advertising claims that are subject to federal enforcement, platform penalties, and state-level consumer protection laws.

That shift happened fast. Since 2023, the Federal Trade Commission has shifted its enforcement posture from "educating businesses about fake reviews" to "suing businesses and review brokers." Meanwhile Google's Business Profile and Maps policies have hardened in parallel, and the two rulebooks do not always say exactly the same thing. That gap is where most business owners get burned: they read one policy, assume it clears them, and then get hit by the other.

This guide is the reconciliation. It is written for the owner of a business with 5 to 500 employees who has someone — maybe themselves — asking customers for reviews, and who wants to know precisely where the lines are, what the penalties actually look like, and what to change on Monday morning. Every recommendation here is written to be implementable without hiring a law firm. Where the law is genuinely unsettled or where a platform's policy and the FTC's differ, I will say so plainly rather than pretending there is a clean answer.

Why Review Compliance Is a Legal Problem, Not a Marketing Problem

Here is the mental model that prevents most of the damage. A customer review is not private speech that the platform merely hosts — it is a commercial communication published by your business. The FTC's Endorsement Guides, 16 CFR Part 255, treat it exactly that way: an endorsement, subject to truthfulness, substantiation, and disclosure rules. Google's policy treats it as business content subject to a representation standard: everything a review says about your business must be something you can actually stand behind.

So there are three enforcement bodies that can act on the same review, and they do not share a case file.

The practical implication: Google penalties are cheap for Google to impose and ruinous for you to absorb; FTC penalties are expensive for the government to impose and expensive for you to absorb too. You want to stay out of both. The cheapest possible moment to fix a non-compliant review request process is before you deploy it.

The Plain-English Compliance Matrix

This is the master reference. Save it, and check any new tactic against it before you deploy it. If a tactic is not on the Green list and not on the Yellow list, it is almost certainly Red.

Green: The Unconditional Ask

The green zone is generous because the FTC and Google both decided the honest market should not be constrained. Any tactic here works because it does not touch sentiment.

• The universal ask. Every customer gets the same request at the same point in the journey. No exceptions, no segments. "Hi, thanks for your visit — if you're willing to leave us a Google review, here's the link: [URL]."
• Direct links to the review form. Google provides a per-location review URL in the Business Profile dashboard (e.g., https://g.page/[YOUR-ID]/review). Use that exact URL everywhere. It skips the search box and it is unambiguously a Google-native ask.
• QR codes on receipts, tables, packaging, business cards, and counter stands. The QR code must resolve directly to the review form. A QR code that resolves to your own website page which then asks a screening question is gating, no matter how innocent the design looks.
• Neutral follow-up emails. "We're writing to ask whether you'd like to leave us a Google review. Here's the link." No "we'd love to hear how we did — especially if things went well!" No "we hope you were satisfied." No sentiment adjacent phrasing, because sentiment adjacent phrasing is where teams get creative and creative gets audited.
• Asking for both a public review and a private testimonial. You can ask a customer to leave a Google review and ask them to email you feedback privately. Both requests go to everyone. The private channel is not a filter — it is a separate, always-available option that exists for everyone.
• Embedding and displaying real reviews on your site. Displaying authentic reviews in a widget, on a landing page, in a case study, or in a paid ad is fine. Displaying reviews you know to be fake is a Section 5 problem regardless of platform.

Yellow: Permitted With Conditions, Risky Without Them

Yellow tactics are where most of the gray-area legal risk lives. Each has a compliant version and a non-compliant version, and the difference is usually one sentence of design.

Staff review incentives

Offering something of value in exchange for a review sits at the intersection of Google's "incentivized reviews" prohibition and the FTC's 2024 rule, which specifically prohibits offering free products, gifts, discounts, or incentives in exchange for a review when the incentive is conditioned on the review's content or sentiment.

The FTC's position as of the 2024 final rule is more permissive than it was in 2022-2023 guidance, which treated any incentive for any review as suspect. Google has separately moved toward allowing incentives provided the incentive is not tied to a rating. In practice, both regimes point at the same safe design:

• Offer the incentive for the act of reviewing, not for a positive review.
• Never condition on sentiment: not "leave us 5 stars," not "if you were happy," not "we'll send the gift if you recommend us."
• Never offer a variable incentive that scales with rating or requires a minimum star threshold.
• Never run the offer inside a system that decides who gets asked based on sentiment — even if the incentive itself is sentiment-blind.
• Document it. Have a written policy saying who gets the offer, how it's funded, and the exact wording used.

Selective review timing

This is the most common accidental violation, and it is nearly always unintentional. It looks like this:

• Asking only customers whose invoice or job ticket shows a positive outcome.
• Asking only customers who smiled, did not complain, or did not call the support line.
• Asking only customers who received a discount, a free add-on, or a service recovery — because they "should be happy."
• Having staff decide, case by case, whether a customer seems like a good review candidate.
• Asking at a point in the process that systematically excludes anyone who had a problem — e.g., asking only at the end of a smooth transaction while problems get routed to support.

The pattern is unmistakable to a regulator and increasingly to Google's automated systems: a business whose reviews arrive at a 4.9 average with a suspiciously narrow distribution and a review velocity curve that never dips. Legitimate businesses have bad reviews. A profile with 400 reviews, a 4.8 average, zero reviews below 3 stars, and a 30-day gap where no reviews arrived at all is a machine-readable fingerprint of gating or fabrication.

In-store review kiosks

A kiosk at the counter with a screen saying "Rate your experience" is permissible when it sends all feedback to Google — that is, when it is a pure conduit and you cannot see, filter, or intervene in what the customer submits. It becomes gating when the kiosk asks a satisfaction question first and then routes based on the answer. Google has historically been tolerant of neutral kiosk hardware and intolerant of kiosks that intercept sentiment.

Compliance checklist for kiosks: the device has no customer-facing sentiment question; it opens the Google review form directly; staff cannot override, skip, or substitute the flow for particular customers; there is no paper fallback that differs from the digital path; and you are not also collecting the same feedback privately and using it to decide anything.

Red: The Banned Playbook

Everything in this zone should be terminated immediately if you find it running, and reviewed for the record. There is no version of these tactics that is safe.

Review gating

Gating is the practice of asking a customer for a public review only if they have indicated satisfaction, and steering unsatisfied customers to a private feedback channel you control. Google's policies treat this as prohibited content. The FTC's 2024 rule treats it as review suppression — specifically, it prohibits conditioning the solicitation of a review on the sentiment of the review, and it prohibits suppressing negative reviews through a routing scheme. It is the single most common enforcement trigger in the FTC's review cases, and it is trivially provable, because your own routing logic is the evidence.

Paid reviews, review farms, and AI-generated reviews

Buying reviews is prohibited under Google policies and is a Section 5 deceptive practice under the FTC Act. The 2024 final rule adds explicit prohibitions on purchasing reviews and on using AI to generate fake reviews. Practically, you also cannot buy reviews from "customers" who were given something in exchange — the FTC's 2024 enforcement actions have consistently treated that as a purchase in substance. If a review arrived as a consequence of money changing hands, in any form, it is paid and it is illegal. The FTC's actions against review brokers have included firms selling "custom" reviews, AI-generated reviews, and platform-based "5-star for $50" services, and the FTC has named both the broker and the businesses that bought from it.

Employee reviews

This one surprises people, because it has a narrow compliant version. Google permits employees of a business to leave reviews, provided the review is posted through a Google account displaying as "Google User" rather than under a personal name. Google also permits employees to be offered the same review incentive as other customers, as long as the business does not require the review to be positive. What is prohibited: paying or directing employees to write positive reviews, having staff write reviews on behalf of customers, and having employees post as customers. The FTC adds a disclosure rule: if an employee is solicited to review, and the review is used in advertising, the material connection should be disclosed. If in doubt, have employees post as "Google User" and do not run any kind of sentiment campaign on them.

Review swaps and reciprocity schemes

"Leave me a 5-star review and I'll leave you one" is illegal. It is paid (or reciprocal) compensation conditioned on positive sentiment. It also exposes you to the FTC's 2024 prohibition on soliciting or purchasing negative reviews, because sophisticated swap rings are usually an exchange of positive-for-negative. Two independent legal theories, one habit, and an audit trail in the participants' emails that a state AG would enjoy reading.

The FTC Endorsement Guides and Civil Penalties

What the Endorsement Guides actually cover

16 CFR Part 255 is the FTC's guidance on what counts as an endorsement and what disclosures are required. Two thresholds matter for review programs.

First: material connection disclosure. If there is any connection between a reviewer and the business that could affect the weight or credibility of the review — a free product, a discount, a gift card, a paid membership, a family relationship, a financial interest — that connection must be disclosed. And the disclosure must be "clear and conspicuous" to the consumer, both in the review itself and in your use of it. Burying "I got a free coffee" in the fourteenth line of a 900-word blog post is not clear and conspicuous. Failing to disclose a material connection is itself a violation, independent of whether the review is truthful.

Second: the review must be truthful and the endorsement must be substantiated. If a review says "this cured my chronic back pain in three days" and you print that on your homepage as a testimonial, you have made the endorsement your own and you need reasonable basis to believe it. Testimonials with health claims, income claims, or comparative claims attract disproportionate scrutiny, and in 2024-2025 the FTC has increasingly treated testimonials themselves as the deceptive act, rather than requiring proof that the underlying claim is false.

The 2024 final rule: what it changed

In August 2024, the FTC finalized the first-ever rule specifically on consumer reviews and testimonials, adding them to the Commission's Red Flag Rule (16 CFR Part 465). Finalized rules carry an important legal advantage: violating one is itself a violation of a Federal Trade Commission order, which means civil penalties are available without the FTC having to prove that the conduct was unfair or deceptive under Section 5 on a fresh record.

The rule's core prohibitions, in plain English:

What a violation actually costs

Civil penalties for violations of a Commission order are assessed per violation, and the maximum adjusts for inflation each January. As of the brief for this article, the figure commonly cited is $51,744 per violation — verify the current year's number on the FTC's website before you quote it to a client, a board member, or your own risk register, because it changes annually.

Here is why "per violation" is where owners get underestimate the exposure. Each fake review, each incentivized review, each gated request that routed a dissatisfied customer away from Google, and each review that fails a required disclosure is potentially its own violation. The math is not theoretical:

Two practical mitigations that materially reduce this exposure and that cost nothing but documentation: voluntary self-reporting of a fix (the FTC has repeatedly settled cases with no penalty where a company self-corrected and demonstrated compliance going forward), and a documented, written review-solicitation policy (which is direct evidence of the "reasonable procedures" requirement and, when the FTC or a state AG asks how you prevent fake reviews, your answer is a document rather than a guess).

How Google enforces compliance — and why it hits without warning

Google does not need to be a regulator to cause serious damage. Its enforcement is free for Google to deploy and can be commercially catastrophic for you. In practice, Google removes reviews and suspends profiles through a mix of:

• Automated pattern detection. Review velocity spikes, sudden rating distributions, review clusters with similar phrasing or timing, and profiles whose review mix diverges sharply from comparable businesses.
• User and customer reports. A customer you gated can screenshot the flow and report it. So can a competitor, an agency that lost a client, or an aggrieved ex-employee.
• Third-party investigations. Google's policy and enforcement teams receive analyses from the FTC, state AGs, and academic researchers, and they act on that material.
• Sanctions ranges. From single-review removal, to a feature suspension (you can be prevented from responding or soliciting), to profile suspension pending verification, to outright profile deletion with no guarantee of reinstatement. In a paid-ads context, disapproval of ads that contain review claims, up to account termination for a pattern of policy abuse.

The consequence chain matters more than the sanction itself. A deleted Business Profile removes you from Maps, breaks your Knowledge Panel and local pack visibility, severs the reviews that feed your schema markup, breaks hundreds of inbound links to your GBP, and usually takes months and a verification process to get restored — if you get restored at all. For a business where the local pack drives 30-50% of leads, that is a business-ending event with no invoice attached.

The Truth About Review Gating

Let me be direct, because review gating is the most common violation in the industry and it is defended on grounds that sound reasonable every single time it is caught.

The defense: "I'm just trying to protect my business. I send unhappy customers to a form so they can tell me privately, and happy customers to Google so they can post publicly. Nothing is hidden — the customer chooses."

Why it fails — four independent reasons:

1. You are the party deciding, and that decision is the violation. The 2024 FTC rule prohibits conditioning solicitation of a review on the sentiment of the review. Your routing logic is literally a sentiment-conditioned solicitation, whether or not the customer ends up posting. You have substituted your judgment for the consumer's and the platform's.
2. Suppression by proxy. A gated system systematically reduces the volume of negative reviews on your public profile. Even if every positive review is real, the profile no longer reflects the true distribution of customer experience — which is the entire value proposition of a review platform and the specific harm the FTC identifies in suppression provisions.
3. It requires a private channel you control. Gating is technically only possible if you have somewhere to send the "no" customers. That means you are operating a private feedback pipeline, and the feedback you receive is now data you can suppress, use, or selectively publish — which pulls you further toward the "review suppression" prohibition and creates a second evidentiary record of your own.
4. It is trivially provable and trivially discoverable. Your routing logic lives in a spreadsheet, a Zapier flow, a form, or an email template. A regulator requesting documents asks for the process, not the outcomes. "Please provide the criteria used to determine which customers receive a link to Google and which do not" is a one-line request that ends careers.

There is one nuance worth acknowledging so you do not overcorrect: the timing of an ask is a legitimate operational decision, and asking a customer for a review while they are mid-complaint is a bad customer experience and can inflate negative volume for reasons unrelated to your service quality. The compliant framing is that you ask every customer the same thing at a consistent point in the standard journey — a moment chosen for operational reasons, documented in your policy — rather than an ask that is individually curated based on your read of how the customer feels. A uniform, written, journey-stage-based policy passes scrutiny. A per-customer judgment call does not.

Industry-Specific Risk Profiles

The same tactic carries very different risk depending on what you sell and who is watching. Here is the calibration I would use.

Agency and Contractor Liability: Stopping Fake Reviews From Happening on Your Behalf

Most owners assume the risk is theirs alone. It is not entirely, but it is largely yours — and the transfer is only partial. If your agency buys reviews on your behalf, you are the business making the deceptive claim to consumers, and you are the one with the profile, the ad account, and the revenue. The agency may have indemnity language; that language allocates cost between you and the agency. It does not prevent the FTC from coming after your business. Regulators do not care whose employee clicked "purchase."

More importantly, the most common way agencies cross the line is not a rogue purchase order. It is a "review growth" service offered at a menu price, described in a sales deck in euphemisms: "review engine," "reputation seeding," "review funnel," "sentiment-routed campaigns," "review acceleration." Every one of those is a way of saying review gating, review brokerage, or both. If an agency pitch contains the words "we'll get you to 4.9 in 30 days" combined with "full control over which reviews go public," you are being offered illegal services.

Due diligence: the eight questions to ask before hiring any reputation agency

1. "Show me the mechanism, not the case study." How exactly does a customer end up (or not end up) with a link to Google? If they cannot explain it in one sentence with no sentiment conditions, that is the answer.
2. "Do you place reviews on my behalf, on a customer's behalf, or on a reviewer's behalf?" All three answers are illegal for different reasons. There is no compliant version of "yes."
3. "What do you do with customers who do not want to leave a five-star review?" If the answer involves routing, filtering, follow-up, or recovery of sentiment, stop.
4. "Do you pay anyone — including your own staff — for reviews?"
5. "Will you put in writing that you do not engage in gating, incentivization, purchased reviews, review swaps, or suppression?"
6. "Will you audit and provide a full transaction log for every review placed, including reviewer source, timestamp, and content?" An agency that refuses is an agency you do not hire.
7. "What is your position on the removal of reviews from my profile, and will you cooperate with an investigation by Google, the FTC, or a state AG?"
8. "Will you provide indemnity, and is it backed by insurance?"

Two things to note about that clause. First, indemnity without insurance is a promise, not protection — a two-person agency frequently cannot pay a $51,744-per-violation judgment, so the indemnity protects you only if there are assets behind it. Second, indemnity clauses allocate cost; they do not allocate regulatory scrutiny. Even with a perfect clause, if the FTC investigates your profile and finds $40,000 of purchased reviews, the FTC brings the case against you, and your recourse against the agency is a separate, slower proceeding.

Contractor and freelancer controls

Individual freelancers, contractors, and offshore review-selling operations are a common source of exposure, and they are also the easiest to police internally because they are usually individuals with a direct relationship to you.

• Require written certifications of compliance in the engagement contract, and hold back a meaningful portion of payment until any review-placement activity has been reconciled.
• Audit the source, not just the output. Any review that arrives from a device or account that does not plausibly belong to a real customer of yours is a red flag worth escalating.
• Run a retrospective review authenticity check. A sample of reviews by volume-weighted rating: if a disproportionate share of 5-star reviews have no photo, no business reply, no question, and were posted within a compressed window, that cluster deserves scrutiny. Note that photo/question behavior alone is not proof — use it to prioritize review, not to convict.
• Maintain a review provenance log: for every request sent, who was it sent to, when, by which channel, with what wording version. This is the single most valuable compliance artifact you can own, because it is the difference between "we have no idea how that happened" and "here is exactly what we do."

The 15-Point DIY Compliance Audit for Local Business Websites

Run this quarterly, and after any change to your review process, your agency relationship, or your website's review display. Each item has a pass condition and a fail remedy. Print it. It takes about 40 minutes for a local business.

1. Request universality. PASS: every customer who receives a product or service receives an identical review request. FAIL: any segment (VIP, high-value, service-recovery, refund-received, long-tenure) is excluded or handled differently. Remedy: move request-sending into your CRM or POS workflow, not into a person's judgment.
2. Sentiment neutrality of all written copy. PASS: no ask contains "if you were happy," "if you were satisfied," "we hope everything went well," or "we'd love to hear how much you enjoyed us." FAIL: any such phrase exists in an email, SMS, script, or webpage. Remedy: replace with a flat, unconditional ask. Keep a version-controlled library of approved wording.
3. No routing, branching, or "are you happy?" screens. PASS: one destination for every customer. FAIL: any form, automation, or manual step that branches on satisfaction. Remedy: delete the branch; route everyone to the same Google link.
4. No gating software installed. PASS: a plain audit of every review-related app, form, popup, QR code, and automation on your site and in your CRM shows no sentiment screening, no smart routing, no "review funnel." FAIL: a gated widget or feedback-routing tool is live. Remedy: remove it, and audit your historical data for how many customers were screened.
5. QR codes resolve directly to the Google review form. PASS: scanning each QR code lands on the Google review URL. FAIL: any QR lands on your own landing page that asks a screening question or captures an email first. Remedy: replace with a direct Google review URL.
6. No purchased, incentivized, or reciprocal reviews. PASS: written certification from every employee, contractor, and vendor, plus a documented review of the last 12 months of ask mechanics. FAIL: any gift card, discount, free item, raffle, or swap is connected to a review. Remedy: terminate it and reconstruct your provenance log.
7. Sentiment-conditioned incentives are absent. PASS: no incentive varies by rating, is tied to a rating threshold, or requires a minimum score. FAIL: "if you leave us 5 stars" appears in a script. Remedy: make the incentive strictly for the act of reviewing, and keep it out of sentiment conversations.
8. Written review-solicitation policy exists and is enforced. PASS: a dated document names the owner, the approved wording, the trigger point, the channels, the incentive (if any) and its conditions, and how exceptions are handled. FAIL: no document, or a document nobody follows. Remedy: write one page, get leadership to sign it, and train on it.
9. Employee review policy is explicit. PASS: a written rule stating employees may review as "Google User," that staff may never write reviews for customers, that no employee may be paid or pressured, and that family/insider reviews used in advertising are disclosed. FAIL: staff are posting reviews, or a staff member manages a personal account for the business. Remedy: issue the policy and audit every employee-linked Google account.
10. Review provenance log exists for the trailing 12 months. PASS: you can produce, on request, who was asked, when, by what channel, with which wording. FAIL: no log, or it is only a logo on a marketing site. Remedy: start logging today; treat it as a compliance control, not a marketing asset.
11. Agency and vendor certifications are current. PASS: every firm touching your reviews has signed a compliance addendum covering the FTC rule, Google's policies, and no-gating. FAIL: any vendor touches reviews without a signed addendum. Remedy: suspend their review-related work until signed.
12. Testimonial claims on your website are substantiated. PASS: every quoted testimonial that makes a performance, health, income, or comparative claim has a substantiation file. FAIL: testimonials are quoted verbatim with superlatives and no substantiation. Remedy: add substantiation files, or remove the claim.
13. Material-connection disclosures are present where required. PASS: any review that mentions receiving a gift, discount, or free service either includes the disclosure in the review or your display of it carries a clear disclosure. FAIL: a "free product" review is displayed as an ordinary customer review. Remedy: add disclosure text adjacent to the review, not buried in a page footer.
14. Negative review handling is a process, not a deletion habit. PASS: a documented process to respond publicly, resolve privately, and — only where genuinely appropriate and where Google's removal rules are actually met — request removal with a documented reason. FAIL: staff delete, ignore, or "flag to suppress" negative reviews. Remedy: never ask Google to remove a review merely because it is negative; that is suppression and it is a violation.
15. No suppression tactics on the technical side. PASS: no schema markup, no review aggregation, and no widget is configured to filter, hide, or deprioritize reviews based on rating. FAIL: your widget shows only 4-star-and-up reviews, or your site selectively omits lower-rated reviews. Remedy: show the full set, or use a defensible editorial filter applied to every review by a stated, non-sentiment criterion — and even then, disclose it.

Copy-Paste Templates You Can Use Today

1. Compliant neutral email request

Subject: A quick request about your recent [service]

Hi [First name],

Thank you for choosing [Business Name] for [service] on [date].

If you have a couple of minutes, we'd appreciate you leaving a Google review — it helps other people in the area decide who to work with. Your honest experience is what makes the reviews useful, and we're glad to receive any feedback.

Leave a review here: [DIRECT GOOGLE REVIEW URL]

If you'd rather share thoughts privately instead, you can email us at [address] and we'll read every word.

Thank you,
[Name], [Business Name]

Note what is absent: no "if you're happy," no "we hope you were satisfied," no rating request, no incentive, and a private option offered to everyone rather than as a substitute for the public ask.

2. QR card copy (counter stand, receipt footer, business card)

Enjoyed your visit? Your feedback helps other people choose well. Leave a Google review in 30 seconds — it takes less time than this card.

[QR CODE → direct Google review URL]

Prefer to tell us privately? [email address] / [phone]. We read everything and we reply to every message.

3. Staff verbal script (one line, no judgment call)

"Thanks for coming in. If you have a second, we'd love a Google review — here's the QR code, it takes about thirty seconds. If you'd rather tell us directly how we did, just say so and I'll take care of it."

The critical instruction to staff: say this line to every customer, identically. If a staff member asks "you were happy with that, right?" and then hands over the code only if the answer is positive, that is gating, and it happened in your store.

4. Disclosure line for reviews used in advertising

One review shown on this page was provided by a customer who received a complimentary [item/service]. All other reviews are from customers who paid for our service. Reviews are collected from customers without asking them to leave a positive rating.

And on the review itself, the equivalent in-review disclosure: "I received a complimentary [item] for my review."

5. If a review was left by someone you gave something to

Do not panic, and do not delete it from your site without a plan. Instead: add the disclosure, and if you want the review removed from Google, request removal using Google removal categories accurately — you generally need to demonstrate the review was incentivized in violation of policy. Keep a record of what you gave and when.

6. Neutral staff incentive acknowledgement (if you run one)

"We ask every customer for a Google review. We sometimes thank customers who take the time to review us with a [gift/discount/credits], regardless of what they say. We never ask for a positive rating or ask anyone to change a review, and we'll always ask before sharing your review in our marketing."

This goes in the body of every email that carries an incentive, in the terminal, and in the terms of any staff incentive program.

If You Think You Have Been Violating: A Remediation Playbook

Bad news, but it is manageable, and the recovery path is well trodden. Do these in order and do not skip to step four.

1. Stop the flow today. Identify every active review-request mechanism and disable anything that branches, filters, or incentivizes. Replace with the unconditional flow above.
2. Reconstruct what happened. Pull the provenance data you have — email logs, form submissions, QR analytics, payment records, agency reports. Quantify the affected volume: how many requests, how many routed away, how many reviews were incentivized, what was spent. You need numbers for regulator communication and numbers for your board.
3. Write the compliance policy. One to two pages, dated, signed, distributed, and enforced. This is also the primary evidence that you have "reasonable procedures" going forward.
4. Remediate with the platform, cooperatively. If reviews were purchased or incentivized in violation of policy, request their removal from Google, and provide the FTC and Google with an explanation. A self-initiated removal request with a candid explanation is very different from Google discovering it. If you believe a review is fraudulent and Google has not removed it, use Google's user-reported content and misrepresentation reporting channel and document your attempt.
5. Consider proactive disclosure if the exposure is material. For larger matters, a short, factual disclosure prepared with counsel is generally far less damaging than being the subject of an FTC complaint. This is a decision for you and your attorney, not for a blog post.
6. Re-certify your vendors. Execute the compliance addendum with every agency and contractor before resuming any review-related work.
7. Monitor for the next 90 days. Watch for rating-distribution anomalies, review-velocity anomalies, and any third-party report. A well-run program produces a slightly bumpy, human rating distribution. A manipulated program produces a flat, impossible one — and you now know exactly how to tell the difference.

FAQ

Can I offer a discount or free item in exchange for a Google review?

Short answer: yes, if and only if the offer is not conditioned on the review's rating, sentiment, or content, and if it is made available on the same terms to everyone you ask. Google has moved toward permitting incentives that are not sentiment-conditioned, and the FTC's 2024 final rule permits incentives for the act of reviewing while prohibiting incentives tied to a positive review. Practically: do not say "get 5 stars for a free coffee." Do say "leave us a Google review — here's a free coffee, whatever you write." Never tie the incentive to a threshold, never scale it with rating, and never let the incentive flow only to customers you believe will review positively. Given how recently this moved, keep the offer in the Yellow zone in your policy and re-check the current FTC and Google language quarterly.

Are Google reviews treated differently from Yelp, Facebook, or reviews on my own website?

For the FTC, no. The Endorsement Guides and the 2024 rule apply to any consumer review regardless of where it is posted or where you display it. A fake Yelp review that you reprint on your website is a Section 5 issue and a Part 465 issue. Google's policies, by contrast, apply only to Google surfaces, and Yelp's rules only to Yelp. Practical consequence: the platform with the strictest rules may not be the one that can hurt you legally — the FTC applies to everything, and your own website is squarely in its jurisdiction. This is also why an embedded widget that displays authentic Google reviews is legally straightforward, while a site that curates only the glowing ones is not.

What if a customer asks me to remove their review, or asks for a refund in exchange for taking it down?

Two different situations with two different answers. If a customer asks you to remove a review, you may ask for the review to removed via Google's official process — but you cannot delete it, hide it with code, filter it out of your widget, or buy it off. If a customer offers to take a review down in exchange for money, that is the "buying negative reviews" problem and you should decline; if a business pays for negative reviews to be removed, that is a distinct violation under the FTC's 2024 rule. Separately, a legitimate refund or service recovery offered on its own merits is fine, but conditioning a refund on review removal is not. Document the distinction in your policy and train staff on it, because staff will encounter this conversation and will want a script. The safe answer to "delete my review and I'll give you the refund" is: "Our policy is to offer any customer a full refund on the service; we can't tie that to a review, but if you'd like to remove the review you can request that directly from Google."

How do I display Google reviews on my website without creating a compliance problem?

Display them authentically and completely. Use a widget that pulls live from your Google Business Profile, shows the full rating distribution, includes reviewer names and dates as Google provides them, and does not filter, sort by sentiment, or hide reviews below a threshold. Do not rewrite review text in your own words, do not present a review taken from another platform as a Google review, and do not feature only the 5-star quotes in your hero section without also disclosing that selection. Do not add "verified purchase" or similar badges to reviews that are not verified purchases — the FTC's 2024 rule explicitly addresses misrepresenting the source or nature of a review, and claiming Google verification for something Google did not verify is the kind of detail that shows up in an enforcement complaint.

For a compliant, no-code embed that pulls live Google reviews onto your site, besthelptool.com generates a free widget you can place on WordPress, Shopify, Wix, Squarespace, Webflow, or any site that accepts an embed code. It displays the real reviews with their real ratings and dates and does not filter by sentiment, which is exactly the display posture the policies above require. Pair it with the unconditional ask and the provenance log, and you have a review program that would survive the 15-point audit.