The Complete Google Review Policy & Compliance Playbook: Preventing Suspensions, Disappearing Reviews & FTC Penalties

Executive Summary: The High-Stakes Regulatory Landscape in 2026

Review management has graduated from a marketing tactic to a regulated legal activity. In 2026, a business owner who manipulates consumer reviews is not merely risking a Google algorithm penalty — they are operating in a domain now actively policed by the Federal Trade Commission, state attorneys general, and private plaintiffs. The compounding risk is that Google's enforcement and the FTC's enforcement are not independent events. A review wipe performed by Google's automated spam systems produces a paper trail (timestamps, clusters, IP-grouped reviewers, solicitation metadata) that is exactly the kind of evidence a plaintiff or a state AG would use to establish pattern intent. Google's removal is the discovery exhibit; the FTC case follows.

Three separate failure modes now threaten a business, and each requires a different remedy:

• Algorithmic suppression — reviews you paid for, or received through improper channels, are deleted in batches without notice. The profile still ranks, but the review velocity curve has a visible cliff, and the missing reviews were load-bearing for local pack placement and for resistance to competitor suspension attempts.
• Profile suspension and reinstatement failure — a sufficiently severe pattern (or a single egregious tactic) escalates from review removal to profile suspension, which removes the profile from Maps, Search, and the local pack entirely. Reinstatement is discretionary, evidence-driven, and frequently denied.
• Regulatory liability — the FTC's Rule on the Use of Reviews and Testimonials (16 CFR Part 465) and the Consumer Review Fairness Act of 2022 (CRFA) create per-violation exposure, state AG enforcement, and a private right of action. This is the failure mode that survives the business.

This playbook is written for business owners, agency leaders, and local SEO managers who need a defensible operating standard — one that survives a forensic audit by Google's trust & safety team, a civil investigative demand from the FTC, and a deposition. It is organized so that you can (1) understand the machine, (2) audit your current program, (3) remediate exposed tactics, and (4) recover value that has already been lost.

The FTC's Trade Regulation Rule on Fake Reviews: Penalties, Scope & Enforcement Reality

The FTC's final rule, issued August 22, 2024 and effective October 21, 2024, sits at 16 CFR Part 465. It is not guidance — it is a trade regulation rule under Section 18 of the FTC Act, which is materially more dangerous than a policy document. A violation is a violation of a rule, which carries civil penalties, state attorney general enforcement, and (critically) private right of action under the consumer review provisions of the FTC Act.

What the rule actually prohibits

The rule targets eight categories of conduct. Understanding them precisely is more useful than memorizing the list, because the categories are defined by facts — not labels — and legitimate operators frequently violate them without using the vocabulary of the rule.

A note on the $51,744 figure: this is the FTC's inflation-adjusted per-violation civil penalty rate for violations of order and rule violations under Section 19 of the FTC Act and 16 CFR 1.98. The FTC adjusts this figure annually for inflation, so the 2026-adjusted number may differ. Treat $51,744 as the planning figure and confirm the current-year rate at ftc.gov/legal-library/browse/rules/penalties-civil-monetary-penalties before relying on it in a financial memo or board deck. What does not change is the multiplier logic.

How the penalties compound: the math that actually matters

The headline number is misleading on its own. The FTC does not treat a review campaign as a single violation. Enforcement documents and consent orders show a consistent pattern of per-review, per-posting, per-day counting. A business with 400 reviews that were incentivized does not face a $51,744 problem; it faces a theoretical $20.7 million problem. In practice, the FTC has historically negotiated down to a figure tied to ability to pay, but the opening number used in a complaint is what appears in the civil investigative demand and in the press release, and that number is frequently cited in litigation against the same business and its officers.

Three additional multipliers deserve attention from a risk-management perspective:

1. Officer-level and entity-level stacking. Individual officers and owners can be personally liable in addition to the entity. A complaint naming the owner personally is a qualitatively different event than a corporate fine, particularly for a closely held LLC or a family business.
2. State AG parallel enforcement. CRFA and the Part 465 rule are both enforceable by state attorneys general. This is not theoretical risk-sharing; multiple state AGs have paralleled FTC conduct in review cases.
3. Private right of action. Because the FTC's review rules are trade regulation rules under Section 18, violations are actionable under the private enforcement provisions of the FTC Act. A single consumer or class plaintiff can sue. This is the channel most likely to produce a judgment that is not covered by an FTC consent order's limitations clause, and it is the channel least understood by small businesses.

Google's Machine Learning Spam Architecture: How the Review Filter Works Under the Hood

Google has never published the architecture of its review abuse detection, and this playbook will not pretend otherwise. What follows is a synthesis of Google's own public statements, the published terms of the Google Maps Platform APIs and Terms of Service, the observable behavior of large-scale review removals, and the published research literature on reviewer-behavior classification. Treat the policy statements as authoritative and the mechanism statements as well-substantiated inference, clearly labeled.

Google's public position is that it uses machine learning to identify unusual review patterns, and that these systems operate alongside human review. The functional consequence is important: the removal of a batch of reviews is not a punishment, it is a probability update. Nothing is "flagged as bad" in a disciplinary sense; a cluster of reviews is scored as unlikely to be genuine and removed, and the profile's trust state is adjusted. That is why the recovery playbook below is about restoring statistical plausibility rather than filing appeals one review at a time.

The four layers of the review filter

IP footprinting, Wi-Fi clustering, and the "venue trap"

The single most under-appreciated mechanical risk in local services is that multiple reviewers sharing one IP address is not evidence of review manipulation — it is evidence of review manipulation in Google's model, because legitimate local customers are distributed across residential ISPs, mobile carriers, and venue Wi-Fi networks. When dozens of reviews arrive from a single public IP within a short window, the system treats that IP as a single reviewer expressed many times.

The venue trap is a specific and highly damaging variant. Consider a restaurant that places a tablet on the counter where guests are asked to leave reviews. Every review from that tablet carries the same venue public IP and the same venue Wi-Fi SSID/BSSID and the same device fingerprint. If forty guests review that week, Google sees one device with a single identity producing a burst of reviews. This pattern is nearly identical to a paid review farm, because functionally it is one: a single actor soliciting many reviews from a shared origin. The reviews are individually truthful and the business is not a fraud — but the signal is identical to fraud, and the system does not distinguish. In practice this is why in-store tablet review programs produce sudden, total review-velocity cliffs.

Related structural traps in the same family:

• Campus/office Wi-Fi traps — offices, co-working spaces, salons with a single guest network, and multi-tenant buildings concentrate customers behind a single egress IP.
• Agency-operated device pools — a team of five reviewers on five devices on one hotel Wi-Fi, or a review broker's pre-warmed device farm with a shared VPN egress, produces reviewer correlation that no individual review betrays.
• Recently registered accounts — a reviewer's account age, verification state, and contribution history all feed the trust score. A new account with no prior contributions, on a new device, at a new IP, posting to your business first, is close to a worst-case vector.

Account trust scores, velocity thresholds, and device fingerprinting

Rather than a single "trust score," the effective model behaves as a product of several bounded features. Reasoning from observed removals, a review's survival probability falls sharply when several of the following coincide:

• The reviewer's account is new, unverified, or has a low lifetime posting volume.
• The device is new to the business's review graph (no prior review from that device or app install).
• The network egress is shared, commercial, or geographically inconsistent with the business location.
• Review volume for the business exceeds its own trailing baseline by an order of magnitude inside a short window.
• Text similarity across the batch is high (a template, an AI-generated variant set, or a "review funnel" landing page).
• Review content contains commercial signals: pricing, discount code, service menu, or a CTA to book a "special offer."
• The review arrived during a paid-acquisition burst, and the business's own landing pages included a review-gate variant during that window.
• Business category requires site presence or staff, and the reviewer has no plausible service relationship (e.g., a laptop-repair business with a "locksmith" review).

On velocity specifically, note that there is no published universal "safe" number. The operative quantity is the ratio of new reviews to the business's own historical baseline, combined with the diversity of the underlying reviewer graph. A 40-review week for a dental practice with a 3-review/month baseline is a red flag even though 40 reviews is unremarkable for a restaurant. A 25-review week for a restaurant with a 60-review/week baseline is unremarkable in absolute terms but dangerous if 25 of those came from one IP.

The 7 Fatal Review Tactics That Trigger Automatic Algorithmic Wipes

Each tactic below is fatal for a specific, identifiable mechanical reason. Understanding the mechanism matters more than memorizing the list, because agencies routinely iterate: they will replace tactic #1 with a "sophisticated" version that has the same fingerprint.

1. Review gating (sentiment conditioning). Asking only satisfied customers to review — via a post-purchase email sent only to happy customers, a CSAT-triggered "sorry you didn't love us" deflection, or a QR code placed only on the counter of satisfied customers. Google and the FTC both treat this as suppression. Mechanically, it creates a review set with zero negative reviews, which is the single most abnormal property of the distribution. Google's models and the FTC's rule both key on it. Additionally, the *artifact* — a "leave a review" link that is only sent under condition of satisfaction — is a documentable fact if a plaintiff can show the flow logic or the email segmentation.
2. In-store kiosk tablets (shared-device review stations). One device, one network egress, one device fingerprint, dozens of "different" reviewers. This is the single highest-frequency cause of catastrophic batch wipes in local services. It is a concentrated-review-velocity pattern, and no individual review is defective, which is why the pattern is not visually detectable in the review feed — only in the network and device layers.
3. Wi-Fi network traps. Explicitly soliciting reviews from customers while they are on a shared venue or office network, or sending review links via Wi-Fi-based marketing that spikes activity to a single egress IP. Frequently combined with #2 to disguise the shared-device signal, which makes it materially worse: the review set is both device-concentrated and network-concentrated.
4. Incentive giveaways (gift cards, discounts, free services, contest entries). "Leave a review, get a $25 gift card" and "5-star review, 20% off" are prohibited by both Google and Part 465, with the FTC rule expressly covering undisclosed incentives. Mechanically, incentivized reviewers are disproportionately low-loyalty accounts, and their genuine experience is unreliable — which is exactly the definition of a review that should not count. Google also detects promotional language and offer codes inside review text. Note the distinction that matters legally: giving a gift for a review of any sentiment is still prohibited if the review itself is not genuine, but even fully genuine reviews purchased with incentives are non-compliant under both Google policy and the FTC rule when the incentive is undisclosed.
5. Employee, owner, and contractor reviews (undisclosed insider reviews). A genuine review of a genuine experience is still a violation under Part 465 if the material connection is not clearly disclosed. The review must also come from a genuine customer to survive Google's filter — employee reviews typically have a telling pattern (off-peak submission times, near-zero device diversity, professional vocabulary, review count correlated with hiring cycles) and are removed routinely.
6. Review brokerage, purchased reviews, and AI-generated review content. Buying reviews from a marketplace, farming reviews via "review tasks" on microtask platforms, or using generative models to mass-produce variations. AI variants defeat naive duplication detection (each text is unique) but not semantic-embedding detection, which clusters paraphrases into the same template. Google's models have repeatedly been updated specifically to catch this, and the FTC's 2024 guidance extended the rule to AI-generated fake reviews of a genuine product — meaning an AI-written review of a real experience is still prohibited if the person did not have that experience.
7. Cross-business review syndication and "campaign" arbitrage. A large agency running the same acquisition playbook across a client roster (or a franchise network running it across locations) produces a correlate: reviews appearing across unrelated businesses on the same day, from the same device population, with parallel phrasing. Google has used co-occurrence analysis to detect agency-level networks. This is the tactic that most often escalates from review removal to full profile suspension, because it signals coordinated inauthenticity rather than occasional bad acquisition.

Why Legitimate Reviews Disappear (And How to Diagnose False Positives)

Not every removal is an enforcement action, and treating them as such wastes enormous remediation effort. A review can vanish for reasons that have nothing to do with fraud, and a large share of "my honest reviews got deleted" complaints are one of five diagnosable categories.

Two diagnostic mechanisms deserve a note because they change what evidence you collect. First, the Google Business Profile API and the reviews endpoint expose the current set of reviews but not removal reasons; there is no public API for "why was this removed." Any inference must therefore be reconstructed from your own campaign records. Second, reviewer contribution history is publicly observable — for a given reviewer, you can see what else they have written. A reviewer whose entire public output is a single 5-star review of a business they plausibly never visited is a strong indicator; a reviewer with a multi-year, multi-business history is far more likely to have been caught in a batch. This is your single most useful forensic tool, and it is free.

The Consumer Review Fairness Act (CRFA) & Non-Disparagement Clauses: Legal Landmines

Congress enacted the CRFA in December 2022 as an amendment to the FTC Act. It took effect in two stages: the contract provisions applied to contracts entered into on or after July 16, 2024, and the FTC's implementing rule (16 CFR Part 465, Subpart B) became effective October 21, 2024. The Act addresses a category of conduct that Google policy prohibits only implicitly and that the FTC had historically been unable to reach as a standalone practice: the use of contract terms to suppress negative review content.

What CRFA prohibits

CRFA makes it unlawful for a person to enter into or enforce a contract or other agreement with a consumer that contains, or that purports to contain, any of the following:

• A provision that prevents, or has the effect of preventing, a consumer from reviewing the product, service, or business.
• A provision that requires a consumer to not review the product, service, or business.
• A provision that requires a consumer to not express an opinion about the product, service, or business.
• A provision that requires a consumer to express a particular sentiment, attitude, or opinion about the product, service, or business, or that penalizes a consumer for expressing a sentiment, attitude, or opinion other than a required one.
• A provision that requires a consumer to review the product, service, or business only in a particular way, including only a positive review, only a review expressing a particular sentiment, only a review in a particular location, or only a review that omits certain facts.

Enforcement reality, litigation risk, and the drafting safe harbor

CRFA violations are enforceable by the FTC and by state attorneys general, and — because the FTC implemented CRFA as a trade regulation rule — a CRFA violation is actionable under the private right of action of the FTC Act. This is the most consequential legal-development takeaway of the past three years for review operations, because private plaintiffs can now sue in federal court without showing FTC injury, and a class of customers can be the plaintiff. The private action includes a monetary-remedy provision tied to notice and a 30-day cure opportunity, so early, documented remediation materially improves outcomes.

The Act has also been litigated. The U.S. Chamber of Commerce brought a First Amendment challenge to the FTC's implementation (Free Speech Coalition v. FTC), and the litigation's posture has shifted over time through the district court and the Fifth Circuit. Because the status of that litigation continues to develop, do not treat the litigation as a reason to stop complying — treat it as a reason to have your contracts reviewed by counsel and to keep a documented remediation trail, which is valuable under either outcome. This playbook takes no position on the constitutionality of the rule.

Forensic Recovery Playbook: Step-by-Step Escalation Protocol for Vanished Reviews

Work this sequence in order. Escalating early to a high tier without a documented lower tier weakens the appeal, because Google's support organizations and its Community Product Experts both triage on whether the requester has a specific, evidence-backed claim rather than a generalized grievance.

1. Preserve everything, immediately (Day 0). Export your entire review set with timestamps, star ratings, reviewer display names, reviewer URLs, and any reply you left. Pull your campaign records: SMS/email send logs, QR code destination URLs with UTM parameters, QR code placement by location, gift card issuance logs, and staff review-writing logs. Screenshot the profile as it appeared before and after the removals. If Google is about to suspend, capture your listing data, verification docs, and listing ID. This evidence set is what you will re-assemble for the FTC or a court, so build it once, properly.
2. Build a removal timeline (Day 0–1). Plot every removal: date, time, review ID, star rating, text signature, and reviewer. Cluster them. A same-hour cluster of twelve reviews sharing phrasing is a pattern story. A single review removed with an apparent content violation is a content story. These two findings lead to entirely different escalation paths, and mixing them produces a weak appeal.
3. Test the network/device hypothesis (Day 1–2). Use the public reviewer profiles to check the other businesses your affected reviewers have written for. If several affected reviewers also reviewed a different client of the same agency on the same date, you have a cross-business correlation and a very strong narrative. If affected reviewers cluster on one venue network, you have a device/network story and an immediate remediation: kill the tablet, change the Wi-Fi solicitation, and document the change.
4. Re-appeal the removals individually (Day 2–5). Google does not publish a user-facing appeal button for review removals, which is the single most common point of confusion for affected businesses. The actual path: use Report a review on the review (if it is still visible on a maps/other surface) or open a support case describing the removal and request review. Provide the specific policy basis, the cluster evidence, and the corrected acquisition method. Individual removals are typically adjudicated by a combination of automated re-scoring and human review, and the aggregate pattern you describe is material to the outcome.
5. Escalate to Google Business Profile / Maps Platform support (Day 5–14). Submit a formal case with a structured evidence packet: timeline, methodology, cluster analysis, the corrected acquisition SOP, and a written attestation of no incentivization and no sentiment conditioning. Include your listing ID and verification documentation. Ask for a specific determination ("the reviews dated X were removed as a suspected review pattern; please review the provenance evidence").
6. Engage Google Product Experts / community channels (Day 14–30). Google's Product Expert program and the official business-owner communities include experienced moderators who can flag a case for internal escalation. These channels are effective because they reach people with escalation authority, but they are not a substitute for a formal support case, and reputation there matters. Lead with data, not grievance.
7. Escalate to profile-level review (if the profile is in purge or suspension state) (Day 14–30). If the profile's reviews have been wiped or the profile suspended, submit a reinstatement request through the Business Profile reinstatement flow, or via the support case. Reinstatement requests must address: (a) the source of the non-compliant behavior, (b) what specifically changed, (c) how the new process guarantees compliance, and (d) evidence of the change. "We have stopped doing X" is insufficient; "We have stopped doing X, replaced it with Y, verified it on date Z, and here is the new SOP" is what gets a profile back.
8. Preserve regulatory evidence and consider counsel (Day 30+). If the removals followed a sanctioned or pressured campaign, or if a non-disparagement clause was enforced against a customer, preserve everything and consult counsel on FTC/state AG notification, CRFA private action exposure, and any contract claims. The removal timeline doubles as the FTC-facing evidence of disclosure and remediation; time-stamped documentation of corrective action is the single most valuable artifact in that posture.

Copy-Paste Appeal Templates for Google Support and Community Gold Product Experts

Each template below is written to be pasted directly. Replace bracketed fields. Keep the tone factual and short — appeals written as grievances are systematically deprioritized.

Safe, Sustainable Review Velocity Guidelines by Industry

There is no safe absolute number, and any vendor selling you one is selling you a wipe. What follows is a defensible operating model expressed as a ratio to your own baseline, with an absolute floor and ceiling derived from category behavior. Treat these as starting points that must be validated against your own 12-month history.

Four cross-cutting rules apply regardless of category, and they are the operative controls:

• Never condition, prompt, or filter by sentiment. Every customer receives the same request, the same wording, and the same treatment. If your flow asks "were you satisfied?" before showing the review link, you are running a review gate, and you have created a documentable compliance defect in your own code.
• One request, one channel, one window. A single neutral request per customer, per transaction, no more. Repeated requests to the same customer are detectable and are treated as pressure.
• Provenance diversity is the objective, not volume. A week of 30 reviews from 30 distinct devices on 30 distinct networks is far safer than 8 reviews from 4 devices on 1 network. Measure the diversity of your reviewer graph, not the count.
• Never let anyone write a review who is not a genuine customer. That includes agency staff, employees, owners, family members, contractors, and any person sharing a household or device with a customer. This is a bright line with no exceptions and no "small amount" carve-out.

Comprehensive 20-Point Compliance Audit Checklist

Run this audit quarterly and after any change to your review vendor, your CRM, your in-store hardware, or your request templates. Every line requires a document, not an assertion. Mark PASS only with an artifact (screenshot, config export, policy document, log, or signed attestation).

1. No sentiment gating. Documented proof that review requests are sent identically to all customers regardless of satisfaction, with a screenshot of the unsegmented send logic. [Artifact: CRM/automation export showing segmentation is off; flow screenshot.]
2. No incentives of any kind for reviews — no gift cards, no discounts, no free services, no contest entries, no "mention us for a discount." [Artifact: written policy + review of all offer terms.]
3. No "5-star" ask anywhere in any channel — printed, verbal, email, SMS, on-site signage, or in a call script. [Artifact: signage photos, script audit, message templates.]
4. No review-solicitation request to "compensate" a complaint or negative review as a goodwill gesture. [Artifact: customer-service policy, ticket sample audit.]
5. No shared-device review stations — no tablet, no kiosk, no counter PC, no front-desk device, no "scan this QR on our iPad." [Artifact: physical site audit with dated photos.]
6. No review solicitation over shared venue Wi-Fi that concentrates egress IPs, and no Wi-Fi marketing campaigns that spike review volume. [Artifact: campaign calendar; network policy.]
7. No reviews written by employees, owners, family, contractors, or agencies on the business's behalf. [Artifact: signed attestation from all staff and a monitoring control, e.g., a blocklist of staff emails/phones checked against reviewer emails.]
8. No purchased, brokered, farmed, or AI-generated reviews, and no vendor contract that permits them. [Artifact: vendor agreement + audit right + certification.]
9. Vendor due diligence current — the agency has verified that its review-generation method is compliant with both Google policy and 16 CFR Part 465, and will disclose its methodology. [Artifact: signed compliance certificate dated within 12 months.]
10. No non-disparagement, review-suppression, or sentiment-conditioned contract language in any MSA, franchise agreement, employment agreement, or vendor addendum. [Artifact: counsel-reviewed clause inventory; redlined agreements.]
11. Every request message is neutral as to sentiment and does not request specific ratings, topics, keywords, or mention of competitors. [Artifact: current template text, versioned and dated.]
12. No keyword, competitor-mention, or "as seen in" solicitation scripts for reviewers. [Artifact: script audit, staff training log.]
13. Review velocity monitored with a rolling baseline and an automated alert at the red-flag ratio defined for the category. [Artifact: dashboard with 12-month history and alert configuration.]
14. Reviewer-graph diversity monitored — the share of new reviews arriving from previously unseen devices/networks is tracked, and a drop in diversity triggers a pause. [Artifact: diversity metric definition + 90-day trend.]
15. A live, monitored removal log exists, recording every removal with date, reviewer, and cluster attribution. [Artifact: log with 6 months of entries.]
16. Escalation SOP is documented, current, and owned by a named person, including the review-removal path, the profile-reinstatement path, and the legal-notification trigger. [Artifact: SOP, versioned, with escalation SLA.]
17. No review content solicits or contains personal information, health/legal claims, or restricted content; staff know not to embed such content in on-site prompts, and the business profile's own fields are clean. [Artifact: pre-publication checklist for on-site review prompts; quarterly Google Business Profile field audit.]
18. Customer-facing review URLs use unique or per-customer parameters (not a shared static link posted everywhere), enabling attribution of reviews to a legitimate request path. [Artifact: URL template + randomizer implementation.]
19. Response and remediation records preserved for at least 5 years — the evidence set that supports any FTC, AG, or private-action posture, including time-stamped documentation of corrective action. [Artifact: retention policy + storage location.]
20. No representation is made in any marketing or sales material that review generation is "Google-approved," "FTC-compliant," or otherwise endorsed, and no third-party marketing material claims review volume or ratings it has not verified. [Artifact: claims audit of website, ads, proposals, and social profiles.]