The FTC Fake-Review Rule and Google’s Review Policies: What Your Medspa Must Stop Doing in 2026

The FTC can now fine a business up to $53,088 per violation for fake or manipulated reviews, and Google says it blocked or removed more than 292 million policy-violating reviews in 2025 alone. If your medspa is still offering discounts for five-star reviews, filtering unhappy patients away from Google, or letting staff pad your rating, 2026 is the year that catches up with you. In this post I break down what the FTC’s fake-review rule actually bans, where Google’s policies go even further, and the compliant review system I recommend instead.

One note before we start: I run a marketing agency, not a law firm. This article is general information to help you ask the right questions, not legal advice — for decisions about your specific clinic, talk to a licensed attorney.

Why I’m writing this now

The rule itself is not new. The FTC finalized its Trade Regulation Rule on the Use of Consumer Reviews and Testimonials — 16 CFR Part 465 — in August 2024, and it took effect on October 21, 2024. What changed is enforcement. On December 22, 2025, the FTC sent warning letters to ten companies flagging practices it believes violate the rule, demanded written confirmation of corrective steps within five days, and cited civil penalties of up to $53,088 per violation (the original $51,744 figure, adjusted for inflation). Law firms tracking the agency — Benesch, Venable, Crowell & Moring, DLA Piper — all read those letters the same way: the education phase is over, and enforcement actions are next.

Google moved in parallel. In April 2026 it updated its Business Profile review policies to explicitly ban staff review quotas and asking customers to name employees in reviews, and it deployed Gemini-powered enforcement that catches violating reviews before they publish, not after. Between a federal regulator with per-violation fines and a platform that can suspend the profile your bookings depend on, the risk math for shortcuts has completely changed. I covered the broader regulatory picture in my medspa advertising compliance guide for 2026; this post goes deep on reviews specifically.

What the FTC rule actually bans

Per the FTC’s own announcement and the rule text, 16 CFR Part 465 prohibits six things that matter for a medspa:

• Fake or false reviews. Reviews from people who do not exist, never used your service, or misrepresent their experience. The FTC explicitly includes AI-generated reviews here. Writing them, buying them, or knowingly publishing them all count.
• Buying positive (or negative) reviews. You cannot provide payment, discounts, free add-ons, or any other incentive that is conditioned — expressly or by implication — on the review saying something positive. “Leave us a 5-star review and get $25 off your next visit” is a textbook violation.
• Insider reviews without disclosure. Reviews from your officers, managers, or employees — and from their immediate relatives — must clearly disclose the relationship. Your injector’s sister leaving an undisclosed five-star review is a rule violation.
• Fake independent review sites. Running a website that pretends to offer independent reviews of medspas while you secretly control it.
• Review suppression. Using unfounded legal threats, intimidation, or false accusations to get negative reviews taken down. The rule also bans representing that the reviews displayed on your site are all or most of the reviews you received when you’ve suppressed the negative ones.
• Fake social media indicators. Buying followers, likes, or views to misrepresent your influence for commercial purposes.

Two nuances worth knowing. First, the FTC rule does not ban incentivized reviews outright — only incentives tied to sentiment (and any material connection still has to be disclosed under the FTC’s endorsement guides). Second, enforcement so far has targeted businesses and platforms, not tools: the FTC’s November 2024 order against Sitejabber went after publishing checkout-moment “ratings” as if they were reviews from people who had actually received the product, while in December 2025 the agency set aside its earlier order against Rytr, an AI writing tool. The message I take from that: regulators are aiming at businesses that use fake or misleading reviews, and “our software vendor did it” will not protect you.

Where Google is stricter than the FTC

This is the part most medspa owners miss. Even where the FTC leaves room, Google’s Business Profile policies do not:

• All incentivized reviews are banned. Not just sentiment-conditioned ones. Any payment, discount, gift, raffle entry, or loyalty points in exchange for a Google review violates policy — including offering something to revise or remove a negative review.
• Review gating is explicitly banned. Pre-screening patients by sentiment — the “How was your visit?” survey that routes happy patients to Google and unhappy ones to a private feedback form — is prohibited and now actively enforced.
• The April 2026 update added more. Directing staff to hit a review quota, pressuring patients to review while still on premises, and asking customers to mention a staff member by name or include specific keywords are all now explicitly against policy.

Consequences escalate: review removal first, then temporary loss of the ability to receive new reviews, public warning banners on your profile that every prospective patient can see, temporary unpublishing, and full suspension for repeat violations. For a clinic where the Business Profile drives most new-patient calls, a warning banner alone is a conversion problem I would not wish on anyone.

Legal vs. illegal: the comparison table

The medspa-specific traps I keep seeing

Auditing medspa marketing, the same patterns come up again and again, usually installed years ago by a previous agency:

• The front-desk iPad funnel. A tablet asks “How was your experience?” — thumbs up goes to Google, thumbs down goes to a private form. That is review gating, and many white-label “reputation software” tools still ship with it turned on by default. Check yours this week.
• The launch-week staff push. New location opens, everyone on payroll plus spouses leaves five stars. Undisclosed insider reviews — a named FTC prohibition.
• The $99 “reputation vendor.” Packages of guaranteed reviews sold on Instagram or Fiverr. The December 2025 warning letters flagged disseminating reviews a business knew or should have known were fake — outsourcing the fraud does not outsource the liability.
• The defamation-letter reflex. Sending legal threats over an honest two-star review now implicates the rule’s suppression provision. There are legitimate removal paths for reviews that violate Google’s content policies; intimidation is not one of them.
• The HIPAA collision. This one is unique to clinics: replying to a review with anything that confirms the reviewer was a patient or references their treatment can create a separate federal privacy problem. Keep responses generic, take specifics offline. I cover response scripts in my medspa reputation management guide.

The compliant review-generation checklist

Here is the system I set up instead. It is slower than the shortcuts, and it works — a consistent ask-everyone process typically converts 10–20% (est.) of patients into reviewers, which compounds fast at medspa visit volumes.

1. Ask every patient, every time. No sentiment filtering, no cherry-picking. An automated text or email 2–4 hours post-visit with a direct link to your Google profile. Volume plus consistency beats manipulation — the mechanics are in my medspa review velocity playbook.
2. Kill every incentive tied to Google reviews. No discounts, gift cards, raffle entries, or loyalty points. Today.
3. Audit your gating. Open your reputation software and disable any sentiment pre-screen ahead of the review ask. Internal feedback surveys are fine — as long as everyone still gets the same public review invitation.
4. Screen for insider reviews. If staff or their relatives have reviewed you without disclosure, ask them to remove those reviews. Update onboarding so new hires know the policy.
5. Write it into your SOP and train the front desk. No pressuring patients in the chair or at checkout, no “mention Priya by name,” no monthly review quotas for staff.
6. Vet any vendor touching your reviews. Get written confirmation they do not gate, incentivize, or generate reviews. If they guarantee a number of reviews per month, walk away.
7. Handle negatives without threats. Respond professionally within 24–48 hours, never confirm patient status, flag genuine policy violations through Google’s official process, and let the rest stand.
8. Be honest on your own website. If you showcase testimonials, do not state or imply they represent all your feedback, and keep records showing each one is genuine and used with consent.
9. Document everything. The FTC gave its warning-letter recipients five days to confirm corrective action in writing. Dated SOPs, training notes, and vendor agreements are what let you answer that letter calmly.

If you’ve already done some of this

Do not panic, and do not pretend it never happened. Stop the non-compliant practice immediately, document the date you stopped, remove what you can (incentive offers on your site, gating flows, undisclosed insider reviews), and get a compliant system running so your review velocity does not crater. Regulators and platforms are both visibly more interested in ongoing conduct than in a practice you shut down and corrected. And if the exposure looks material — say, hundreds of incentivized reviews — that is an attorney conversation, not a marketing one. For how reviews fit into the bigger patient-acquisition picture, my medspa marketing hub is the place to start.

Want a second set of eyes on this for your clinic? Book a free strategy call or call/text me at +91 97297 12388.

Frequently asked questions

Is it illegal to ask patients for reviews?

No. Asking every patient for an honest review is legal under the FTC rule and allowed by Google. The problems start when you filter who gets asked, attach incentives, dictate content, or pressure patients on premises. A neutral, consistent ask sent to everyone is the safest and, in my experience, the highest-volume approach anyway.

Can I offer a discount or gift card for a review?

Not for Google reviews — Google bans all incentivized reviews regardless of sentiment, and violations can cost you the reviews, your ability to receive new ones, or the profile itself. The FTC rule bans incentives conditioned on the review being positive. Even sentiment-neutral incentives elsewhere require clear disclosure under FTC endorsement guidance, so my practical advice is simple: no incentives for reviews, anywhere.

What exactly is review gating?

Pre-screening customers by sentiment before deciding who gets the review link — typically a “How was your visit?” survey that sends happy patients to Google and routes unhappy ones to a private form. Google explicitly prohibits it, and under the FTC rule, suppressing negatives while presenting your displayed reviews as representative is a violation. If your reputation software has a sentiment gate, turn it off.

Can my employees or their family members review my medspa?

Only with a clear, conspicuous disclosure of the relationship — the FTC rule specifically covers reviews by insiders and their immediate relatives, and Google treats them as a conflict of interest. In practice, an “I work here” five-star review persuades nobody, so I tell clients to keep staff and family out of the review profile entirely.

What are the actual penalties if the FTC acts against my clinic?

The FTC can seek civil penalties of up to $53,088 per violation as of the December 2025 warning letters (adjusted periodically for inflation), and each fake or manipulated review can potentially count as its own violation — so exposure scales with volume. Before fines, you would likely see a warning letter demanding written proof of corrective action within days, which is exactly why documented SOPs matter.

Do reviews from before October 2024 put me at risk?

The rule took effect October 21, 2024, but misleading reviews still live on your profile remain part of your ongoing public representation, and deceptive-practices law under the FTC Act existed long before this rule. If you know specific reviews are fake or undisclosed insider reviews, get them removed rather than betting nobody looks backward.

How do I get a genuinely unfair negative review taken down?

Use the legitimate paths: flag reviews that violate Google’s content policies (spam, off-topic, conflicts of interest, harassment, reviews of the wrong business) through your Business Profile, and respond publicly with a calm, HIPAA-safe reply for everything else. What you must not do is threaten legal action without grounds, intimidate the reviewer, or offer payment for removal — the first two implicate the FTC’s suppression provision and the third violates Google policy.