FTC Fake Review Rule Compliance Audit: A Step-by-Step Checklist for E-Commerce Brands

# FTC Fake Review Rule Compliance Audit: A Step-by-Step Checklist for E-Commerce Brands

The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials became effective October 2024. Enforcement actions began in early 2025. Civil penalties are $51,744 per violation.

That is not $51,744 per campaign or per quarter. Per violation. A single email campaign asking 10,000 customers to leave reviews with inadequate disclosure could theoretically expose a brand to $517 million in penalties.

Most e-commerce brands have not audited their review practices against the actual rule text. They are operating on assumptions from blog summaries and agency reassurances. This guide provides the actual audit checklist.

What the rule prohibits (the short version)

The FTC's rule specifically prohibits:

1. Fake reviews — reviews by someone who did not have actual experience with the product/service
2. AI-generated reviews — using AI to create or substantially modify reviews attributed to human consumers
3. Buying reviews — paying for positive reviews (including through product gifting without proper disclosure)
4. Review suppression — selectively suppressing negative reviews while displaying positive ones
5. Review gating — routing satisfied customers to review platforms while diverting dissatisfied customers to private channels
6. Insider reviews — reviews from employees, owners, or agents without disclosure of the relationship
7. Fake social proof — buying followers, fabricating engagement metrics, or misrepresenting review counts
8. Testimonial misrepresentation — claiming a testimonial represents typical results when it does not

The 15-point compliance audit

Section A: Review generation practices

Audit point 1: Review solicitation flow

Check: Does your review request process treat all customers equally regardless of their likely satisfaction?

Red flags: - Post-purchase email that first asks "How was your experience?" and only routes happy customers to the review platform - NPS survey that triggers review requests only for promoters (9-10 scores) - Any conditional logic between satisfaction measurement and review request

This is review gating — and it violates both FTC rules and Google's policies. The audit must map the complete flow from purchase to review request and verify there is no conditional branching based on sentiment.

Audit point 2: Incentive disclosure

Check: Are ALL incentives for reviews properly disclosed?

Red flags: - Discount codes offered for reviews without clear, conspicuous disclosure on the review itself - Loyalty points awarded for reviews without disclosure in the review text - Contest entries for reviewers without disclosure - Free products sent to "brand ambassadors" who review without explicit relationship disclosure - "Review for a chance to win" campaigns without disclosure requirements

The FTC requires disclosure AT THE POINT OF THE REVIEW — not just in the email requesting it. If the review itself does not contain the disclosure, you are non-compliant.

Audit point 3: Review request timing and pressure

Check: Are review requests designed to capture authentic experiences?

Red flags: - Requesting reviews before the customer has meaningfully used the product - Multiple follow-up requests that create pressure to review - Making future purchases, account access, or customer service contingent on leaving a review

Section B: Review content practices

Audit point 4: AI-generated content

Check: Is ANY review content on your platforms AI-generated or AI-modified?

Red flags: - Using AI to "improve" or "polish" customer-submitted testimonials - Generating synthetic reviews for new products to overcome the "zero review" problem - Using AI to rewrite negative reviews as positive ones - Chatbot-generated "reviews" presented as consumer feedback - AI summaries of reviews presented as actual customer quotes

This is an absolute prohibition. There is no disclosure that makes AI-generated reviews compliant. They simply cannot exist.

Audit point 5: Insider reviews

Check: Have any employees, contractors, family members, or business partners left reviews without relationship disclosure?

Red flags: - Employee reviews on Google, Trustpilot, or product pages without "employee" or "insider" disclosure - Investor or board member reviews without relationship disclosure - Agency partner reviews without client relationship disclosure - Founder/CEO "reviews" of their own product positioned as customer testimonials

Search your review platforms for names matching your employee directory. Check IP addresses of reviews left through your own review system.

Audit point 6: Testimonial substantiation

Check: Do testimonials on your site represent typical customer results?

Red flags: - Using exceptional results ("I lost 30 pounds!") without indicating typicality - Cherry-picked testimonials that represent top-1% outcomes - Before/after photos representing atypical results - Revenue/savings claims from testimonials without basis

If a testimonial represents atypical results, you must clearly disclose what typical results look like.

Section C: Review display practices

Audit point 7: Selective review suppression

Check: Are all legitimate reviews displayed, including negative ones?

Red flags: - Manual approval process that consistently rejects negative reviews - "Moderation" criteria applied more strictly to negative reviews - Removing reviews that mention competitor products - Hiding low-star reviews behind "most helpful" or "most recent" sorting - Removing negative reviews after offering the customer a refund/replacement (quid pro quo suppression)

Note: You CAN remove reviews that are clearly fake, contain threats, or violate platform terms. You CANNOT remove reviews simply because they are negative or unflattering.

Audit point 8: Review gating in display

Red flags: - Homepage widgets that only show 4-5 star reviews - Product pages that default to showing positive reviews first - Marketing materials using review counts that exclude low-star reviews ("Over 500 five-star reviews!" when you have 800 total reviews) - Review collection tools that only publish reviews above a threshold

Audit point 9: Star rating accuracy

Check: Does your displayed star rating accurately reflect all reviews?

Red flags: - Averaging only displayed reviews (excluding suppressed ones) - Rounding up aggressively (4.26 displayed as 4.5) - Combining product variants to dilute negative reviews of one variant - Resetting review counts after a product "refresh" that is the same product

Section D: Third-party review practices

Audit point 10: Agency and vendor compliance

Check: Are third parties acting on your behalf compliant?

Red flags: - Marketing agencies purchasing reviews "for" you - Amazon listing optimisation services that include "review packages" - Influencer campaigns without review disclosure requirements in contracts - PR agencies soliciting positive reviews from journalists or contacts

You are liable for review violations committed by agents acting on your behalf — even if you did not explicitly authorise the violation. Your contracts must prohibit non-compliant practices.

Audit point 11: Review platform terms

Check: Are you compliant with platform-specific review rules (beyond FTC)?

Red flags: - Violating Amazon's "Request a Review" button usage guidelines - Violating Google's conflict-of-interest policies for business reviews - Using review platforms in ways that violate their ToS (which can trigger platform penalties independent of FTC action)

Section E: Documentation and process

Audit point 12: Review policy documentation

Check: Do you have a written review policy that employees can reference?

Required elements: - Clear statement of what practices are prohibited - Process for identifying and removing fake/violating reviews - Disclosure requirements for any incentivised reviews - Employee review guidelines - Escalation process for edge cases

Audit point 13: Monitoring system

Check: Do you have ongoing monitoring for compliance?

Required elements: - Regular audits of new reviews for insider/fake patterns - Monitoring of third-party vendors' review practices - Tracking of review solicitation conversion rates (unusual rates may indicate manipulation) - Alerts for review patterns that suggest purchased reviews

Audit point 14: Training records

Check: Are relevant team members trained on review compliance?

Required training for: - Marketing team (solicitation practices) - Customer service team (review request interactions) - Product teams (review display and moderation) - Agency partners (contractual requirements) - Social media managers (testimonial usage)

Audit point 15: Incident response plan

Check: Do you have a plan for when a violation is discovered?

Required elements: - Immediate remediation steps (remove violating content, cease violating practice) - Internal investigation process - Legal counsel notification trigger - Consumer notification if applicable - Documentation of remediation for potential FTC inquiry

Calculating your exposure

To understand your risk profile:

1. Count the number of reviews that may violate any of the 15 audit points
2. Multiply by $51,744
3. That is your theoretical maximum exposure

Most e-commerce brands discover 50-500 potentially non-compliant reviews on their first audit — representing $2.5M to $25M in theoretical exposure. The actual enforcement penalty will be lower, but the legal defence costs alone justify a proactive audit.

Priority remediation order

If your audit reveals multiple issues, fix them in this order:

1. AI-generated reviews (absolute prohibition, easiest to detect, most attention from FTC)
2. Review gating (Google is also cracking down, so dual enforcement risk)
3. Undisclosed incentives (high volume = high penalty multiplier)
4. Insider reviews (easy to identify and remove)
5. Suppression practices (requires process change, not just content removal)
6. Testimonial substantiation (grey area, lower enforcement priority so far)

What the FTC enforcement looks like in practice

Based on enforcement actions from late 2025 through early 2026:

• The FTC has prioritised AI-generated reviews and review suppression as initial enforcement targets
• Penalties have ranged from $250K to $4.3M in settled cases
• Consent decrees require 20 years of compliance monitoring
• The FTC frequently discovers violations through competitor complaints

The investigation process typically starts with a Civil Investigative Demand (CID) — essentially a subpoena for your review practices documentation. Having a completed audit with remediation evidence is the strongest possible position if this arrives.

Ongoing compliance monitoring

A one-time audit is insufficient. Build ongoing monitoring:

• Monthly: Review solicitation flow audit (has anything changed in your email sequences?)
• Quarterly: Sample 50 recent reviews across platforms for compliance indicators
• Annually: Full 15-point audit with documentation update
• Trigger-based: After any marketing campaign involving reviews, any new agency partner, or any platform policy change