Legal
FTC rules for customer reviews: what you can and cannot hide
The FTC’s rule on consumer reviews took effect on 21 October 2024, and it bans five specific practices: writing or buying fake reviews, paying for reviews conditioned on a particular sentiment, publishing insider reviews without disclosing the relationship, running a supposedly independent review site about your own products, and suppressing negative reviews. Only the last one touches what most businesses actually do with a widget on their homepage, and it is narrower than the panic around it suggests. It does not ban a hide button. It bans two things: strong-arming a reviewer into taking a review down, and telling visitors that what they see is everything when you have filtered by rating.
That distinction matters because the practice it targets turns out to be rare. We store 1,376,535 reviews for 3,694 business accounts across 53 sources, and every one of those accounts can, in principle, tell us to stop showing a given review. On 17 August 2026, 3,862 reviews were switched off. That is 0.28% of everything we hold, and the largest single act of suppression in the whole database removed five-star reviews.
This is not legal advice and we are not lawyers. It is what the ledger looks like from the side that has to implement the rule.
What the rule covers, in the order it will bite you
The rule is codified at 16 CFR Part 465 and it applies to businesses selling to US consumers, whether or not the business is in the US. Five prohibitions, and the risk is not evenly spread across them.
| Practice | What is prohibited | How likely you are doing it |
|---|---|---|
| Fake reviews and testimonials | Writing, selling, buying or disseminating reviews from people who do not exist or never used the product, including generated text | Low, unless someone bought a package |
| Buying sentiment | Paying for a review conditioned on it being positive, or on it being negative about a rival | Low, but incentive emails drift here |
| Insider reviews | Reviews by employees, their relatives or the owner, without a clear disclosure of the connection | Common, usually by accident |
| Company-controlled review sites | Running a site that looks independent while it is your own, and using it to praise your products | Rare |
| Review suppression | Threats and intimidation to remove a review, or claiming a filtered display is all or most reviews | Common, and usually invisible to the person doing it |
The insider row is the one that catches ordinary companies. A launch where the founder asks the team to leave honest reviews is not a fraud scheme, but every one of those reviews needs the relationship disclosed, and a widget that displays them among customer reviews with no marker is where a defensible intention becomes a misrepresentation.
The suppression rule is about a claim, not a button
Read the suppression provision closely and it splits in two.
The first half is about coercion: you cannot use unfounded legal threats, physical threats, intimidation or false public accusations to prevent a review from being written or to get one removed. This is behaviour, not display, and it is what enforcement actions in this area have historically been built on.
The second half is about representation: you cannot claim that the reviews on a page represent all or most of the reviews submitted when you have suppressed reviews based on their rating or on negative sentiment. Note what is doing the work in that sentence. The violation is the claim. Filter without the claim and you are outside the provision; make the claim while filtering by rating and you are inside it, even though every individual review on the page is genuine.
And the rule is explicit about what you may still take down. Reviews that are defamatory, harassing, abusive, obscene, discriminatory in the ways the rule lists, that contain someone’s personal information or trade secrets, that are clearly false or misleading, or that are simply unrelated to what you sell are all outside the prohibition. You are not required to publish any of them. Nothing in the rule forces you to host abuse.
The practical translation for anyone running a review widget is short: keep a reason, and do not dress a curated wall in language that implies completeness. “What our customers say” is a heading. “All 412 reviews, unfiltered” is a claim you have to be able to defend.
What suppression actually looks like across 1.4 million reviews
Here is the part no one writing about this rule can show you, because it requires a database of other people’s decisions. These are our production numbers, measured on 17 August 2026.
One account distorts everything, so it goes first rather than in a footnote. A UK eBay merchant holds 8,614 eBay reviews with us and has hidden 3,029 of them. Every single one is five stars. The explanation is not a mystery once you know how that source works: eBay writes automated feedback on the buyer’s behalf when a transaction closes cleanly, so the merchant’s stream fills with identical positive entries that no human typed. That merchant accounts for 78% of every hidden review in our database, and what they suppressed was manufactured praise. The single biggest act of review suppression we can observe is a business deleting fake positives, which is the same thing the first prohibition in the rule is trying to achieve.
Take eBay out, take our own two internal accounts out, and the remaining picture is this: 1,173,754 reviews, of which 630 are hidden. Roughly one review in every 1,863.
| Rating | Reviews stored | Hidden by the business | Share hidden |
|---|---|---|---|
| 1 star | 49,406 | 219 | 0.44% |
| 2 stars | 18,372 | 53 | 0.29% |
| 3 stars | 33,642 | 69 | 0.21% |
| 4 stars | 91,455 | 23 | 0.025% |
| 5 stars | 973,023 | 265 | 0.027% |
The gradient is real and it points exactly where you would expect. A one-star review is hidden sixteen times more often than a five-star one, and the rate falls cleanly with every step up until it hits the floor at four stars. Businesses do lean on the bad ones. Anyone claiming otherwise has not looked.
But look at the size of the effect. Two hundred and nineteen one-star reviews were hidden, out of 49,406. And the denominator that decides whether this is a widespread practice is not the review count, it is the business count: 1,514 accounts hold at least one one-star review, and 16 of them have ever hidden one. That is 1.1%. Ninety-nine businesses in a hundred, holding a review that actively costs them money, leave it up.
Two honest caveats, because the number is lower than it looks. Moderating reviews from external sources such as Google or Facebook is a feature of our top tier, which 714 accounts are on, so most accounts could not have hidden a Google review even if they wanted to. And we can only see decisions made inside our panel. A business that gets a review removed at the source, or that never connects the source carrying its worst reviews, leaves no trace here at all. Selective connection is the suppression method our data cannot measure, and it is almost certainly more common than the hide button.
The mechanism we built, and why it is shaped like the rule
Since a display claim is what creates liability, the useful thing a review tool can do is make the claim provable. Ours works like this, and the design is deliberate enough to be worth copying even if you build your own.
Hiding a review requires a reason drawn from a closed list of five: the review was removed at the source, it is a duplicate of one already displayed, it is unlawful or abusive, it belongs to a different business or location, or it contains a third party’s personal data. There is no “other reason” option, and its absence is the whole point. Those five map onto the carve-outs the rule grants, so a hide that cannot be described by one of them is a hide the rule probably does not protect.
Every hide and unhide writes an append-only entry recording the review, the reason, the star rating, who acted, and the average rating and review count both before and after the change. That last pair exists to answer the first question a regulator asks, which is whether the average shown to customers was moved by the removals. The write is transactional: if the log entry fails, the review stays visible. A review hidden with no recorded basis is worse than a click that has to be repeated. Unhiding needs no justification and does not erase anything, because the ledger is a history of events rather than a current state.
The star rating is stored on every entry for the same reason. The question that decides a suppression case is whether low ratings were removed disproportionately, and that is a query, not an opinion.
The caveats, since this section is ours to oversell. The log is new, so it holds only the recent decisions rather than the historical 3,862, which is why the numbers above come from the review table itself. And a closed reason list constrains what happens inside the panel; it cannot stop anyone from choosing never to connect the source that carries their bad reviews.
What to change on your site this week
Four things, in the order they take least effort.
Check your headings for accidental completeness claims. “Every review we have received” next to a widget showing your best twelve is the exact shape the rule describes, and it is usually left over from a copywriter, not a decision.
Check that your average matches your source. If the star summary on your page was computed before you filtered anything and the list beneath it was filtered afterwards, the number is a misrepresentation even though no individual review is false. Our Google reviews widget computes the average from exactly the set on the page, so the two cannot drift apart.
Mark insider reviews. If the founder, staff or their families have reviewed the business, the relationship needs disclosing wherever the review is displayed, not only where it was collected.
Connect every source you have, not the flattering ones. This is the recommendation that costs something and the one that removes the most risk, because a display that covers everything cannot be a selective display. It also happens to help: businesses with more than one source have more reviews to show and a rating that reads as earned rather than curated, which is the whole argument in how to get reviews on your website.
The short version
The FTC rule does not ban moderation and it does not require you to publish abuse. It bans coercing reviews out of existence, and it bans telling visitors that a filtered wall is the full record. Our data says the second is the risk worth auditing, because deliberate rating-based suppression is already vanishingly rare: 630 hidden reviews out of 1,173,754, and 16 businesses out of 1,514 that had a one-star review and did anything about it.
If you want a display that survives the question, the parts that matter are a full set of connected sources, an average computed from what is on the page, and a recorded reason behind anything you take down. You can create an account, connect your sources and have that running today. The free plan carries up to 100 reviews without a card and the pricing page covers the tiers where moderation and its audit log live. On the neighbouring legal question of where your reviews may come from in the first place, we wrote is it legal to embed Google reviews, and the line between an API and a crawler is set out in scraping reviews: is it legal.
FAQ
Is it illegal to delete bad reviews from my own website?
Deleting is not the act the rule names. What it prohibits is forcing a review down with groundless legal threats or intimidation, and telling visitors that what they see is all or most of your reviews when you have filtered by rating or sentiment. Removing a review because it is defamatory, obscene, contains someone else's personal data, or has nothing to do with what you sell is expressly outside the prohibition. The dangerous version is removing a review purely because it is two stars, and then leaving a claim on the page that implies nothing was removed.
Does the FTC rule apply to Google reviews embedded on my site?
The suppression provision is aimed at reviews submitted to you, on a site or portal you control, so a widget pulling a public Google profile is not the core case. The representation half still reaches you. If you display a filtered selection of your Google reviews under a heading that reads like a complete record, or next to an average that no longer matches the profile it came from, the claim is yours regardless of where the text originated. The safe pattern is simple: show everything the source shows, and let the average be computed from what is on the page.
Do I have to display reviews I think are fake?
No, and the rule says so directly. It carves out reviews that are clearly false or misleading, unrelated to the product or service, harassing, obscene, or discriminatory, and it does not require you to publish them. The practical difficulty is proving later which category a given removal fell into, which is why a closed list of permitted grounds recorded at the moment of the click is worth more than a policy page written afterwards.
What are the penalties for breaking the FTC review rule?
Because it is a trade regulation rule rather than guidance, violations can carry civil penalties, and the statutory maximum is adjusted for inflation each January. It stood at $51,744 per violation when the rule took effect in October 2024. Penalties are not the whole exposure. State consumer protection law, platform terms and, for anyone selling into the EU, the Omnibus Directive's separate requirement to disclose how you verify reviews all sit on top of the federal rule.