Legal
Buy Google reviews: what it actually costs when you get caught
You can buy Google reviews. Packages are advertised openly, they are cheap, and for a few weeks they work. The question worth answering is not whether it is possible but what arrives afterwards, and the answer is three separate bills: the regulator’s, the platform’s, and one from your own website, which turns out to be the one nobody plans for. This post is about all three, and about what bought reviews actually look like from inside a database that holds 1,377,104 of them.
We are not lawyers and this is not legal advice. It is what the pattern looks like from the side that has to store other people’s reviews and put them on their sites.
What a bought review looks like in a database
Start with the evidence, because the legal argument is easier to take seriously after it.
We store reviews for 3,696 businesses across 53 sources. The Google slice is 384,146 reviews belonging to 2,903 business profiles. On 18 August 2026 we ran one query against it: find any review text of at least 60 characters that appears more than once on the same business profile under more than one reviewer name. Two different people, word for word the same review, same business.
That query returns 520 distinct texts, covering 1,074 reviews on 220 business profiles. As a share of everything Google-sourced we hold, it is 0.28%. Copy-paste reviews are rare, and their rarity is precisely what makes them findable: a signal at a quarter of a percent stands out from the noise instead of drowning in it.
The distribution is where it stops being abstract. Four profiles account for 188 of those 1,074 reviews, which is 17.5% of the total from 1.8% of the affected profiles. Here is what those four look like, anonymised, because the point is the shape and not the names.
| Profile | Google reviews stored | Repeated under a second name | Share of that profile’s feed | Rating on every repeat |
|---|---|---|---|---|
| A | 915 | 72 | 7.9% | 5 stars |
| B | 1,481 | 53 | 3.6% | 5 stars |
| C | 97 | 32 | 33.0% | 5 stars |
| D | 101 | 31 | 30.7% | 5 stars |
Three details make this more than a curiosity.
Every single one of those 188 reviews is five stars. Not one is a four, not one is a three. Genuine duplicated wording, the kind that happens when two customers both write “great service, fast delivery”, would spread across ratings the way real reviews do. This does not spread. It is entirely made of praise.
The repeated texts are not short. Among those four profiles the longest text appearing under two different names runs 914 characters, and there is a 538-character one that shows up three times under three names. Two customers can independently produce “highly recommend”. Nobody independently produces the same 900-character paragraph twice.
And the copies are spaced out. On profile D, whose entire stored feed of 101 reviews is five stars, the duplicated pairs sit on separate days across several months, two here, two there. Somebody was careful. It was still the first thing a single query surfaced.
Why this matters more than it looks
The scan above cost about two minutes of database time on ordinary hardware, using nothing but the review text and the reviewer’s display name. We do not see the reviewer accounts, their posting history, their device fingerprints, their IP ranges or the timing of the click that submitted the review. Google sees all of it.
So the honest framing is not “we caught these businesses”. It is: the weakest possible detector, run by a third party working from a partial copy of public data, already separates the pattern out. Whatever the seller of a review package told you about undetectable delivery, the floor for detection is this low.
Two caveats, because the number deserves them. Repeated text is a signature, not proof: a customer who reviews the same business twice under a slightly different display name would land in this set, and so would a genuine reviewer who reuses their own wording. And our copy only grows. If Google already removed a fake review at the source, we may still be holding our imported version of it, so this data says nothing about what Google has cleaned up.
There is also an innocent way to produce thousands of identical reviews, and it is worth knowing about because it looks identical to the guilty version. eBay writes feedback text on the buyer’s behalf when a transaction closes without a comment. One template phrase, “Order delivered on time with no issues”, appears 12,221 times in our database across 24 seller accounts. It is machine written and completely legitimate, which is why we filter that specific family of text out at import rather than counting it as a review. The lesson for anyone weighing a review package: duplicate text is so cheap to detect that platforms build entire pipelines around it, and the pipelines run whether or not you deserve to be caught by them.
Bill one: the regulator
The legal position changed in all three major markets within eighteen months, and the regimes stack rather than replace each other.
| Where | Instrument | In force since | Ceiling |
|---|---|---|---|
| United States | FTC rule on consumer reviews, 16 CFR Part 465 | 21 October 2024 | Civil penalties per violation; the statutory maximum was $51,744 at the start and is adjusted each January |
| United Kingdom | Digital Markets, Competition and Consumers Act 2024 | 6 April 2025 | Up to 10% of global annual turnover, imposed by the CMA directly |
| European Union | Unfair Commercial Practices Directive, as amended by the Omnibus Directive | 28 May 2022 | At least 4% of annual turnover for widespread infringements |
Two features of the UK regime deserve attention even if you are not in the UK, because they show where enforcement is heading. Fake reviews are a banned practice, meaning nobody has to prove that a consumer was actually misled; the act itself is unfair by definition. And the CMA no longer needs a court, it fines directly. Our guide to the FTC rules on displaying customer reviews covers the American half of this in detail, including the four other prohibitions that catch ordinary businesses by accident.
Bill two: the platform
This is the expensive one and it arrives faster than any regulator.
In January 2025, after a CMA investigation, Google committed to a specific set of sanctions against UK businesses that use fake reviews to inflate their star rating. A warning label on the business profile, visible to anyone who looks the business up. A block on receiving any new reviews at all. And for repeat offenders, deletion of every review on the profile for at least six months. Google reports to the CMA on compliance over a three-year period, so this is not a policy page that quietly lapses.
Read the third sanction again. Not the fake ones: all of them. A business that bought forty reviews to top up a genuine four hundred loses the four hundred as well, along with the star rating that took years to build, and it loses them at the exact moment a warning label is telling searchers why. The bought reviews cost a few hundred euros. The cleanup costs the asset.
Bill three: your own website
The bill nobody budgets for is the one your own site sends you.
Posting a fake review to a platform and displaying it on your homepage are two different acts. The second one is yours, unambiguously, and it is the one the FTC rule and the EU blacklist reach most directly, because a review shown on your site next to your prices is a commercial claim you are making about your own business. If you embed your Google feed, whatever is on the profile lands on the page you control, under your logo, with your average rating computed from it.
That is also the reason a cleanup is never complete. Take the fakes off your website and they remain on the profile, where the regulator and the platform both look. Leave them on the profile and they flow back into every widget you install. There is no configuration of a Google reviews widget that makes a bought review safe to show, ours included. The only fix is at the source.
What actually works instead
The reason people buy reviews is almost never fraud for its own sake. It is that asking feels slow and the competitor down the road has 300 and you have 11. Three things move that number without a bill attached.
Make asking a two-second act. Most customers who would happily review you never find the form. A short link straight to the review box removes the entire obstacle, and our Google review link generator builds one, with a QR code, for free and without an account.
Collect what you already have. Almost every business has reviews sitting on sources it has never looked at, and 77.5% of the accounts we host connect exactly one. The arithmetic in how to get reviews on your website is blunt: a second and third source usually doubles the visible count in an afternoon, at zero risk, using reviews you already earned.
Display all of it honestly. A page that shows every source you have, with an average computed from exactly what is on it, is the display that survives both the regulator’s question and a customer’s scepticism. You can create a free account, connect Google and whatever marketplaces you sell on, and have that page live today; the pricing page covers the tiers, and the free plan carries up to 100 reviews without a card. On where reviews may legally come from in the first place, scraping reviews: is it legal sets out the line between an API and a crawler.
The short version
Bought reviews are detectable by the cheapest method available: identical text under two different names, which we found on 220 profiles inside our own database using one query and two minutes of compute. The regulators moved between 2022 and 2025 and the ceilings are now percentages of turnover, not fixed fines. Google’s own sanctions can wipe every review you have, genuine ones included, for at least six months. And the display on your own website is a separate claim that the cleanup on the platform does not fix.
Eleven honest reviews shown well beat three hundred that a single SQL query can pick apart.
FAQ
Can Google actually tell that reviews were bought?
Detection does not depend on reading minds, it depends on patterns that a database query finds in seconds. The cheapest signal is repeated text: the same wording posted under two different reviewer names on the same profile. We found 520 such texts across the 384,146 Google reviews we store for customers, and the scan took roughly two minutes of database time on ordinary hardware. Google runs on the raw profile data, sees the reviewer accounts behind each review, and has every incentive to run far more expensive checks than that. Assume the pattern is visible.
What is the penalty for fake reviews in 2026?
It depends on where your customers are, and the three main regimes stack rather than compete. In the US, the FTC rule on consumer reviews took effect on 21 October 2024 and carries civil penalties per violation; the statutory maximum stood at $51,744 when the rule started and is adjusted for inflation each January. In the UK, fake reviews became a banned practice under the Digital Markets, Competition and Consumers Act 2024 on 6 April 2025, and the CMA can now fine up to 10% of global annual turnover without going to court. In the EU, the Omnibus amendments put fake reviews on the blacklist of always-unfair practices, with penalties of at least 4% of annual turnover for widespread infringements.
What happens to my existing Google reviews if I am caught?
That is the part people underestimate. Under the commitments Google gave the CMA in January 2025, a business found to be boosting its star rating with fake reviews can get a warning label on its profile visible to anyone searching, can be blocked from receiving any new reviews, and for repeat offences can have all of its reviews deleted for at least six months. The bought reviews are not removed in isolation. The genuine ones you spent years earning go with them.
Is it illegal to display bought reviews on my own website?
Displaying them is a separate act from posting them, and in the US and EU it is the display that most directly reaches you as the seller. A widget on your homepage is a commercial claim you are making about your own business, so a fabricated review shown there is a misrepresentation regardless of who typed it. This is also why the risk survives cleanup: if you embed your Google feed and the fakes are still on the profile, they land on the page you control, under your logo.