Reviews under enforcement: fix your flow

A vendor email landed in three of our clients’ inboxes this month offering “guaranteed five star velocity” for a monthly fee. It is a good reminder that the market for shortcuts never actually closed, it just got quieter about what it sells.

The Federal Trade Commission’s rule on fake reviews and testimonials has been in force since October 2024. It is not new any more, which is exactly when businesses drift back into old habits, and it carries the ability to seek civil penalties per violation rather than a warning letter. Meanwhile the platforms have their own policies, which are stricter than the rule in places, and a policy violation costs you the reviews whether anyone at the FTC ever hears about it.

Holiday weekend, quiet office. Good time to go through the review flow properly.

Where the exposure actually is

Almost none of our clients buy reviews. The exposure sits in the ordinary stuff nobody thinks of as fake:

• The launch reviews from staff, spouses and the owner’s brother that got the listing off zero years ago.
• The contest that rewards a review only if it is a good one.
• The testimonial page on the website, assembled from things a few people said, next to stock photography.
• The widget that shows the four and five star reviews under a heading implying that is all of them.
• The unhappy customer who gets a private feedback form while the happy one gets a review link.

Every one of those is cheap to fix while it is housekeeping and expensive to fix once it is a response to a complaint.

Incentives: it is the condition, not the gift

The part that trips people up is that the incentive itself is not always the problem. The problem is conditioning it on the sentiment.

“Leave us a five star review and get entered to win” conditions a prize on the review saying something good. So does a staff bonus paid on star counts, which is the version we see most often now, because it hides inside the compensation plan where nobody reviews it for advertising compliance. If the front desk earns more when the star average goes up, you have built a machine that pressures customers and filters the unhappy ones, whatever the script says.

Separately, Google’s own policies prohibit incentivized reviews outright, so the incentive question is usually settled before the federal rule is even reached.

The pattern that has not changed in years: ask everybody, ask well, incentivize nothing.

Staff reviews, and the version of them people miss

Reviews and testimonials from owners, managers, employees and their immediate families need the relationship disclosed clearly. Managers also cannot solicit reviews from staff without making the disclosure rules plain, and cannot push undisclosed insider reviews out into the world.

Go and read your oldest reviews this week. The first ten on most local listings are insiders, written in good faith before any of this existed. Take them down. It is a five minute job today.

The newer version of the problem is a team member who leaves a glowing review of the business they work at from a personal account, because a manager asked the team to “support the practice online”. Same rule, same disclosure, and now it is easier to spot, because reviewer profiles are public and a competitor with a grudge can do the checking for free.

AI on both sides of the review

Two different things get called the same thing, and only one of them is fine.

Generating review text is out. A review written by software, or by you on behalf of a customer for them to approve, is a review that misrepresents a real experience. The fact that a real customer clicked submit does not make the words theirs. This includes the polite-sounding version where a tool drafts the review from the appointment notes and texts it over for a one tap post.

Drafting a reply with a tool is fine, with conditions. We use drafting in the accounts we run, and the rules are strict:

1. A person reads, edits and approves every reply before it posts. No autoposting, ever.
2. The reply never asserts facts about the visit that nobody verified. No invented names, dates, treatments or promises.
3. No protected health information, no confirming someone is a patient, and for dental and medical clients the reply says nothing a state board would flag.
4. Vary the structure. Twenty replies with identical rhythm and the same closing sentence read as machine output to customers, and read as a pattern to the platforms.
5. Negative reviews get written by a human from the start. Those are the ones people actually read.

The tell we look for when we audit a new account is a run of replies posted within minutes of each review, all the same length, all ending the same way. It is not against any rule on its own. It just tells you nobody was home.

What a compliant flow looks like

• Everyone gets asked, with the same message. No pre-screening question deciding who sees the review link.
• The ask goes out fast, while the job or the visit is fresh, by text if you have valid consent for it and by email otherwise.
• The link goes to the public profile. Not to a middle page that sorts people by mood.
• Nothing is offered in exchange, and the request says so in plain words if your team is used to offering things.
• Insiders disclose, or do not post.
• Every review gets a reply, human approved, within a couple of days.
• The website shows a live unfiltered feed, or clearly labels a selected set and links to the full profile.
• One person owns it. A flow with no owner becomes whatever the busiest team member improvises.

What to do this month

• Read your first twenty reviews and remove or disclose anything from staff, family or the owner.
• Check every incentive in the building, including staff bonuses and contests, and remove anything tied to sentiment or star counts.
• Turn off autoposted replies. Move to draft, edit, approve, post.
• Audit the testimonial page on your website and the review widget on the homepage against what a stranger would assume they represent.
• Delete the gating step, if you still have one, and send the same request to everyone.
• Write the flow down on one page, give it a name and an owner, and hand it to whoever runs the front desk.

A compliant review flow is not a smaller review flow. The businesses with the best review profiles we work on ask everybody, every time, and answer like people, which also happens to be what makes the reviews useful to the software reading them for local search. If you want it to run without anyone remembering, that is a fifteen minute job in your CRM and the only part of this worth automating.