How to get more Google reviews without breaking the rules

Most businesses short on reviews are not short on happy customers. They are short on a routine: nobody asks, or someone asks only the regulars who seem pleased, or requests go out in a burst and stop. This playbook sets up one way of asking that every customer receives, and the replies to post afterward.

What customers say they look for in reviews

BrightLocal’s 2026 Local Consumer Review Survey asked 1,002 US adults how they use reviews. It is a vendor survey and every answer is self-reported, so read the figures as what people say they do, not as measured choices.

• Being asked is normal. 78% said a business had asked them to write a review in the past 12 months. 65% of all respondents had been asked and wrote at least one review afterward, which is 83% of those who were asked. Neither is a response rate: it does not mean 83 of every 100 texts you send come back as reviews. 28% of all respondents said they always write one when asked, up from 16% in 2025.
• Count matters. 47% said they won’t use a business with fewer than 20 reviews.
• Age matters more than it did. 74% look for reviews from the last three months, 32% from the last two weeks (20% the year before) and 18% from the last week.
• The rating bar went up. 68% need at least 4 stars (55% in 2025) and 31% will only use a business rated 4.5 or higher (17% in 2025).
• Replies are expected. 89% expect owners to respond. 80% said they are likely to use a business that responds to all of its reviews, 42% are unlikely to use one that never replies, and 50% are put off by generic or templated replies.
• Reviews send people to your website. Asked what they were likely to do after reading positive reviews, with more than one answer allowed, 54% chose visiting the business’s website, up from 32% when BrightLocal last asked in 2019.

What Google, Yelp and the FTC allow

This section relies on platform policies and federal rules. This is not legal advice; confirm with counsel before you change how your business asks for reviews.

The strictest rules here are the platforms’ own, not the law: Yelp bars asking at all, and Google bars far more than the FTC does.

Google. The Google Maps User Generated Content Policy bars a merchant from offering any incentive for posting a review or for changing or removing a negative one; discouraging negative reviews; trying to “selectively solicit positive reviews”; requiring or pressuring customers to review while on the premises; asking for specific content; asking staff to solicit a set number of reviews; and asking staff to solicit reviews with content that identifies a staff member. Reviews from current or former employees or their family are conflicts of interest. Asking for genuine reviews with no incentive and no attempt to steer the rating or content is allowed. Google’s listed penalties can include a period with no new reviews, existing reviews unpublished for a period, and a warning to consumers that fake reviews were removed.

Yelp. Its Content Guidelines say “Businesses should never ask customers to write reviews”, bar reviewing your own business or employer, and bar offering an incentive to change a review. So this routine sends people to Google, and you reply to Yelp reviews without asking for them.

The FTC rule. The Consumer Reviews and Testimonials Rule, 16 CFR Part 465, took effect October 21, 2024. Its scope is narrower than many blogs claim:

• A business may not provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, reviews expressing a particular sentiment, positive or negative (465.4). Google bans incentives of any kind, so for a Google review the answer is still none.
• No one may use an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation made knowingly or with reckless disregard for the truth, to prevent a review or get it removed (465.7(a)).
• Reviews that come from asking purchasers generally are exempt only from some provisions: buying fake reviews, procuring staff or relative reviews the business knew or should have known were misleading, and two of the insider-solicitation provisions (465.5(b)(1) and (c)(1)). There is no exemption for a business writing fake reviews itself, or for an officer or manager posting their own review without disclosing the relationship.

The FTC staff’s questions and answers on the rule add four points. The rule has no specific ban on asking only customers you think are happy, but that practice could violate the FTC Act. An incentive with no sentiment requirement is not prohibited by the rule, but failing to disclose it could violate the FTC Act. Agencies and reputation firms can be liable. Offering an incentive to take down a negative review could be unfair. The FTC’s own example of a hidden sentiment condition: “Tell us how much you loved your visit … and get a $5 coupon”.

Enforcement so far is allegations and settlements, not court findings. On December 22, 2025 the FTC sent warning letters to 10 unnamed companies; the letters are not determinations that anyone broke the rule, but they warned of civil penalties of up to $53,088 per violation. In July 2025 the FTC announced a proposed $150,000 settlement with the telehealth firm NextMed (final order December 3, 2025). The complaint alleged it flagged negative reviews without a basis, asked only satisfied customers, and gave refunds or gift cards to customers who changed or removed negative reviews. A settlement is not an admission; the order bans selectively soliciting reviews from customers more likely to be positive.

Ask every customer, the same way, at the same moment

The safest program is also the simplest: every completed job, visit or order triggers the same request, and nobody decides who gets it. That satisfies Google, and it is what the FTC’s Endorsement Guides describe as fine: inviting all recent purchasers is not unfair or deceptive, even if the business says it hopes for positive reviews.

Tie the trigger to a status your software already records:

• Home services: job marked complete or invoice paid.
• Clinics and med spas: patient checked out.
• Studios and salons: appointment closed at the register.
• Restaurants: online or catering order delivered. Diners at a table get the card described below.

Timing, from practice rather than measurement. Send the request the same day, usually within a couple of hours of the status change. Send one reminder two or three days later if the link was not opened, then stop. Never send at night; a request that lands at 11 p.m. reads as careless.

The text message. Name the visit and ask for honesty, not stars:

Hi Laura, it’s Dana from the office. Thanks for having us out to fix the water heater today. If you have a minute, would you leave an honest review on Google? It helps neighbors decide who to call.

The direct Google review link goes on its own line underneath. There is no mention of five stars, no request to name the technician and nothing offered in return. Email works the same way, with a subject such as “How did today’s visit go?” and one button to the review page.

Send review texts only to customers who agreed to receive texts from you, keep the “Reply STOP to opt out” line, and honor an opt-out however it arrives. The FCC’s consent rules in 47 CFR 64.1200 treat marketing messages differently from informational ones. This is not legal advice: which side a review request falls on is a question for counsel; if your consent may not cover it, use email.

The in-person mention. The person who did the work can say the request is coming:

“That’s everything. You’ll get a text from Dana in the office later with a link to Google. If you’d write an honest review, good or bad, we’d appreciate it.”

What staff never say: “Could you mention me by name?”, “Five stars would really help me out” or “Can you do it now while I’m here?” The first two ask for specific content, and Google separately bars a business from asking staff to collect reviews that identify a staff member. The third is the on-premises pressure Google prohibits.

At the counter or table. A card or table tent with a QR code to your Google review page is fine; the customer decides whether and when. Handing over a tablet and waiting while they type is not. For restaurants, salons and studios, that card is the in-person ask.

Never in the request: a discount, a raffle entry, a donation per review, or a line telling unhappy customers to contact you first, which in front of the review link works as a filter.

Take the gate out of your review software

If your review tool asks for a rating first, then sends high scorers to Google and everyone else to a private form, turn that off.

The Endorsement Guides (16 CFR 255.2, Example 11) say a marketer that collects feedback first and invites only purchasers who gave very positive feedback to post public reviews may be acting unfairly or deceptively if that makes the posted reviews substantially more positive. Google bars it as selective solicitation, and the NextMed order bans the same pattern.

• Every customer sees the same public Google link, whatever rating they gave.
• A private feedback option can sit beside the public link, never in place of it.
• Delete any “rate us first” screen and any automation that messages low scorers differently.

Agencies running review software for clients: the FTC staff say reputation firms can be liable too. Put no-gating and no-incentive settings in writing for each client account.

Keep reviews coming every week, not in bursts

With 74% of BrightLocal’s respondents looking for reviews from the last three months, a profile whose newest review is from spring can look stale by fall. In Whitespark’s 2026 Local Search Ranking Factors survey, 47 experts ranked 187 factors, and a steady flow of reviews over time, rather than bursts, came 14th for the local pack and Maps. High Google ratings ranked 6th, the number of reviews with text 9th and recency 11th. That is expert opinion gathered by a vendor, not Google data.

An automatic trigger follows job volume, so the flow stays steady. If reviews drop while jobs did not, the trigger is broken: a status nobody uses, an expired integration, a lapsed text number.

Never fill a slow month with reviews from friends, staff or family. Google treats them as conflicts of interest, and the FTC rule’s exemption for general asking does not cover reviews a business writes itself.

The reply routine

Reply to every review, positive and negative, within one business day, and write each one fresh. The target comes from what customers say they expect (19% the same day, 32% by the next day, 81% within a week), not from a study; no research backs the popular 24-hour rule. Whitespark’s experts ranked owner responses 122nd of 187 for pack ranking but 17th for conversion: replies are for the next reader, not the algorithm. Keywords in replies ranked 182nd.

Half of BrightLocal’s respondents dislike templated replies, so change the details every time.

Positive, non-medical:

Thanks, Gloria. Glad the new disposal is quiet and the crew left the kitchen clean. Dana

Negative. Name the problem, own your part, give a person to contact offline. Do not argue in public, suggest the review is fake or hint at legal action; 465.7(a) bars groundless legal threats and knowingly false accusations aimed at removing a review.

Mr. Patel, I’m sorry our technician arrived well after the window we gave you, and that nobody called to warn you. That’s on us. I’m Tom, the service manager, and I’d like to put it right. Please call the office and ask for me. Tom

After the problem is fixed, you may ask whether they would like to update the review, with nothing offered. The FTC staff say this is not prohibited by the rule, though that is not a safe harbor, since the FTC Act still applies. Google bars incentives for changing a review, not the question.

I’m glad we got the leak sorted on Thursday. If your review no longer reflects how it ended, you’re welcome to update it. Either way, thank you for telling us.

Flagging. Report a review only when it breaks platform policy, such as one from a current or former employee. The Endorsement Guides (Example 10) say routinely flagging negative reviews as fake without a reasonable basis is unfair or deceptive.

Replies for clinics: what HIPAA means for a review reply

This section relies on HIPAA and HHS enforcement records. This is not legal advice; confirm with counsel and your privacy officer.

HIPAA reaches a practice that is a covered entity, which in practice means a provider that conducts standard electronic transactions such as insurance billing; some cash-pay med spas may not be. Ask counsel which side you are on, and use the wording below either way.

The HHS Office for Civil Rights has taken at least four enforcement actions over providers’ replies to online reviews, and only one was a civil money penalty:

• Elite Dental, 2019: a $10,000 settlement over Yelp replies.
• Dr. U. Phillip Igbinadolor, D.M.D. & Associates, 2022: a North Carolina dental practice that disclosed a patient’s PHI on a webpage in response to a negative review. OCR announced a $50,000 civil money penalty; the practice had not responded to OCR’s data request or subpoena.
• New Vision Dental, December 2022: a $23,000 settlement.
• Manasa Health Center, June 2023: a New Jersey psychiatric practice paid $30,000 and agreed to a two-year corrective action plan. Its reply to a negative review included the patient’s mental health diagnosis and treatment, and OCR found three other patients’ information disclosed the same way. OCR’s director said disclosing PHI in reply to negative reviews is “not allowed”.

That is three settlements, which the practices agreed to, and one penalty, announced after a practice ignored the investigation.

A reputation-services firm audited 80,300 Google review replies from 4,019 medical and dental practices in California and the Pacific Northwest and published the results in HIPAA Journal in August 2026. It estimated about 26% contained language disclosing or confirming patient information; of the replies checked by hand, 58% confirmed the reviewer was a patient or had visited and 41% disclosed a clinical detail. Treat it as a warning, not a rate: the author founded the firm that ran it, only about a tenth of replies were checked by hand, and the article says it is not a national rate or a legal finding.

The rule: acknowledge the feedback, never the care. Do not confirm that the reviewer is a patient, had a visit or has a condition, even if they said so. “We’re glad your knee is feeling better” confirms all three.

Thank you for taking the time to share your feedback. We appreciate it.

Thank you for your feedback. Privacy rules prevent us from discussing any individual’s situation online. Please call our practice manager, Renee, at the main office number.

Use the same wording whether or not the reviewer is actually a patient. Then:

• Audit old replies with your privacy officer before you edit or delete any. A reply that already disclosed something is a privacy matter, not a wording fix.
• Put the review vendor under a business associate agreement. A business associate creates, receives, maintains or transmits PHI on a covered entity’s behalf (45 CFR 160.103), and may handle it only with written assurances (45 CFR 164.502). A tool that receives patient names and numbers to send review requests should, in practice, be under one. Confirm with counsel.

Staff, family and owner reviews

The policy in one line: employees, owners and their relatives do not review the business, and nobody asks them to.

Under the FTC rule, an employee who is a genuine customer and gets the automatic request falls under the exemption for general asking, but Google still treats employee reviews as a conflict of interest, so leave staff off the request list. An owner or manager who posts a review must disclose the relationship; there is no exemption for that. Never reward, require or track employee reviews. The FTC’s December 2024 complaint against Leader Automotive Group alleges managers “threatened to withhold bonuses” from employees who would not post fake reviews and paid bonuses for posting them. Those are allegations, not findings.

Fake competitor listings in home repair

On May 11, 2026 the Justice Department, on behalf of the FTC, and Illinois sued Chicago-based Premium Home Service (B.E.S.T. GDR LLC) and its owner. The complaint alleges it created thousands of profiles for home-repair companies that did not exist, under keywords such as electrical services, plumbing, heating and cooling and garage door repair, and posted fabricated five-star reviews to dilute real customers’ one-star reviews. These are allegations against the listing operation itself, but they show why a rival with no real address and a week’s worth of five-star reviews deserves a report to Google, never fake reviews in reply.

What the research can and cannot tell you

Two studies get quoted far beyond what they measured.

• Using Seattle restaurant revenue from 2003 to 2009, Harvard Business School’s Michael Luca estimated in a 2011 working paper that a one-star increase in Yelp rating leads to a 5 to 9% increase in revenue for independent restaurants; chains were unaffected. It says nothing about a roofer, a clinic or a present-day Google rating.
• In a peer-reviewed 2017 study of Texas hotels, Proserpio and Zervas found that hotels which began responding to reviews saw a 0.12-star rise in TripAdvisor ratings, 12% more reviews, and fewer but longer negative ones. Hotels only, reviews to December 2013: a direction for others at most, never the size.

Stop repeating “70% of consumers will leave a review if asked” (no current source), “responding to reviews earns 35% more revenue” (untraced) and “one star means 5 to 9% more revenue” for a trade or clinic (a restaurant finding).

The weekly review routine

Fifteen minutes each week, with one owner and a backup.

• Compare requests sent with jobs, visits or orders completed. They should match; if not, find the broken status or integration.
• Note the date of the newest Google review. If it is more than two weeks old, check the trigger first.
• Reply to anything unanswered and read last week’s replies side by side. If they sound alike, rewrite the next ones.
• Follow up every open negative: did the named contact reach the customer, and is it fixed? Only then ask about an update.
• Monthly, open the review tool’s settings: no rating screen, no score filter, no incentive wording in any template.
• Scan your profile for reviews from staff, relatives or non-customers, and your category in Maps for listings that look invented.
• Clinics: monthly, the privacy officer reads a sample of replies and confirms none confirms a visit or a condition.

Questions owners ask about getting more reviews

Is it legal to ask customers for Google reviews?

Yes, asking every customer for an honest review with no incentive and no steering is allowed by Google’s policy and fits the FTC rule’s treatment of general requests to purchasers. Trouble starts with asking selectively, offering something in return or pressuring people on the spot.

Can I offer a discount or gift card for a review?

Not for a Google review, because Google bars any incentive for posting, changing or removing one. The FTC rule is narrower and targets incentives tied to a sentiment, but an undisclosed incentive could still violate the FTC Act, so offer nothing.

Can I ask customers for Yelp reviews?

No, Yelp’s Content Guidelines say businesses should never ask customers to write reviews. Reply to the ones you get and point requests at Google.

Can my review software only send happy customers to Google?

No, Google calls that selectively soliciting positive reviews, and the Endorsement Guides say it may be unfair or deceptive when it makes posted reviews substantially more positive. Show everyone the same public link.

Can staff ask customers to mention them by name?

No, Google bars asking for specific content and bars asking staff to collect reviews that identify a staff member. If a customer names someone unprompted, thank them.

How can a clinic reply to a review without breaking HIPAA?

Thank the reviewer for the feedback without confirming they are a patient, had a visit or have a condition, and move any complaint to a call with a named manager. OCR has taken at least four enforcement actions over review replies, so confirm your wording with counsel.

How many Google reviews does a business need?

There is no official number, but 47% of BrightLocal’s 2026 respondents said they won’t use a business with fewer than 20 reviews, and 74% look for reviews from the last three months. A steady few each week beats a large total that stopped growing.

Sources

Checked on October 3, 2026. Rules and fees change, and many are set state by state or city by city: confirm the current requirements with the agency that issues them before you apply.

• BrightLocal, Local Consumer Review Survey 2026 (vendor survey of 1,002 US adults)
• Google Maps, User Generated Content Policy (fake engagement and conflicts of interest)
• Google Business Profile Help, restrictions for policy violations on reviews
• Yelp, Content Guidelines
• eCFR, 16 CFR Part 465, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials
• FTC, Consumer Reviews and Testimonials Rule: Questions and Answers (November 2024)
• eCFR, 16 CFR 255.2, Endorsement Guides, consumer endorsements (Examples 10 and 11)
• FTC press release, warning letters to 10 companies under the Consumer Review Rule (December 22, 2025)
• FTC press release, action against NextMed over fake and manipulated reviews (July 14, 2025)
• FTC press release, FTC and Illinois action against Premium Home Service over fake listings and reviews (May 11, 2026)
• FTC press release, FTC and Illinois action against Leader Automotive Group (December 2024)
• HHS OCR, Manasa Health Center settlement over replies to negative online reviews (June 5, 2023, archived)
• HHS OCR, four HIPAA enforcement actions including the Igbinadolor civil money penalty (March 28, 2022, archived)
• HHS OCR, Elite Dental settlement over social media disclosures (October 2, 2019, archived)
• HHS OCR, New Vision Dental resolution agreement (archived)
• HIPAA Journal, study of healthcare review replies (Robert Couts, August 18, 2026; vendor study)
• 45 CFR 160.103, definition of a business associate (Cornell LII)
• 45 CFR 164.502, uses and disclosures of PHI, business associate assurances (Cornell LII)
• 47 CFR 64.1200, FCC telephone and text consent rules (Cornell LII)
• Whitespark, 2026 Local Search Ranking Factors (expert survey, published November 2025)
• Michael Luca, Reviews, Reputation, and Revenue: The Case of Yelp.com (HBS Working Paper 12-016, 2011)
• Proserpio and Zervas, Online Reputation Management: Estimating the Impact of Management Responses (Marketing Science, 2017)