The FTC fake reviews rule.

What the rule is

The Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) is a US Federal Trade Commission trade regulation rule. The Commission voted for it 5–0 on 14 August 2024, it was published in the Federal Register on 22 August 2024, and it took effect on 21 October 2024. It hasn't been amended since.

It matters because it's a rule, not guidance. Fake reviews were already unlawful under the FTC Act, but a rule violation lets the FTC ask a court for civil penalties straight away. The FTC's older Endorsement Guides (16 CFR Part 255, revised in 2023) still apply too. They're the FTC's interpretation of the law rather than binding rules, and they cover more ground, such as influencers and whether results are typical.

Most of the rule applies to any business: anyone selling products or services. The FTC says ordinary consumers aren't liable for what they write, but agencies, review brokers and reputation firms are “not immune”.

Your own testimonials count

The rule separates consumer reviews (posted to a site or section built for reviews) from consumer testimonials: any advertising or promotional message people are likely to believe reflects the experience of a real customer. The quotes on a SaaS homepage are consumer testimonials.

In the FTC's words: “A business that puts testimonials on its own website is ‘disseminating’ them and is not merely ‘hosting’ them. When such testimonials are fake or false, the business should face potential liability.”

For testimonials you publish, the test is whether you knew or should have known they were fake or false. The FTC says this doesn't create a general duty to investigate every testimonial, but clear red flags you ignore can make you liable.

What's banned

In plain English, section by section:

• §465.2 Fake or false reviews and testimonials. Writing, creating or selling ones that misrepresent that the reviewer exists, that they used the product, or what their experience was. Buying them, or publishing testimonials you knew or should have known were fake or false, is also banned.
• §465.4 Buying positive (or negative) reviews. Offering anything of value in exchange for a review that has to express a particular sentiment. “Leave a five-star review for 10% off” is the classic example.
• §465.5 Undisclosed insider reviews. Reviews or testimonials from officers, managers, employees or agents, or their close relatives, without a clear disclosure of the relationship.
• §465.6 Fake “independent” review sites. Presenting a site you control as an independent source of reviews for your own product category.
• §465.7 Review suppression. Using threats, intimidation or false public accusations to stop or remove a review, or implying that the reviews on your review page are most or all of those submitted when you've filtered out negative ones.
• §465.8 Fake social proof. Buying or selling fake followers, views and other social media indicators for a commercial purpose.

What it means for SaaS testimonials

Rewarding customers for testimonials

The ban on sentiment-conditioned rewards (§465.4) applies to consumer reviews, not testimonials, according to the FTC. That isn't a loophole: if you give anything of value for a testimonial, the Endorsement Guides expect you to disclose it clearly, and the testimonial still mustn't be fake or false.

Employees, friends and family

A testimonial from an employee, officer, manager or agent needs a clear and conspicuous disclosure of the relationship, unless it's already obvious. Online, the FTC says a disclosure must be unavoidable: not hidden behind a click or a hover. The FTC's answer for family members is “yes, but ask them to clearly and conspicuously disclose their relationship.” Friends aren't named in the rule, but the Endorsement Guides cover any business, family or personal relationship a reader wouldn't expect.

AI-written testimonials

The rule's text doesn't mention AI, but the FTC's explanation published with it says “AI-generated reviews are covered.” A testimonial attributed to a customer who doesn't exist, or that misstates a real customer's experience, is fake or false however it was produced. The FTC also says a business “shouldn't provide the text for a testimonial without a reasonable basis to conclude that the text is truthful.” Separately, in December 2025 the FTC set aside an earlier order against Rytr, an AI writing tool, saying the facts didn't support the original allegations. That decision was about the tool maker, not about businesses publishing fake testimonials.

Editing a customer's words

The rule has no editing section, but the Endorsement Guides do. Quotation marks tell readers they're seeing the customer's exact words, and an endorsement “may not be presented out of context or reworded so as to distort in any way the endorser's opinion or experience.” Our reading is that an edit that changes what the customer actually experienced could also fall under §465.2.

Only showing the good ones

The suppression ban in §465.7(b) covers review pages that imply they show most or all reviews. Picking your best quotes for marketing isn't covered by that section, but the FTC warns that non-representative reviews in marketing could still be deceptive under the FTC Act. The rule doesn't specifically ban asking only happy customers for reviews (“review gating”), but the FTC says it could violate the FTC Act and has banned it in an order (NextMed, 2025). If a testimonial is about a key result, the Endorsement Guides may also require you to say what results people can generally expect.

Penalties

The maximum civil penalty is $53,088 per violation, the 2025 inflation-adjusted figure. In September 2026 the FTC confirmed it will keep applying the 2025 levels during 2026. Each day a violation continues can count as a separate violation, and courts weigh things like how culpable the business was and its ability to pay.

To win penalties the FTC must show the business had actual knowledge, or knowledge fairly implied by the circumstances, that what it did was prohibited. That's a higher bar than the “should have known” test for the violation itself.

Enforcement so far

• 22 December 2025: warning letters. FTC staff wrote to 10 companies about possible violations. The FTC stressed these weren't formal findings.
• July 2026: TruHeight. The FTC's final order against the maker of TruHeight supplements relied on the rule: employee-written five-star reviews on the company's own website (§465.2) and a 10% discount offered for five-star reviews (§465.4). The order carries a $4 million judgment, of which $750,000 is payable; the rest is suspended because of inability to pay.
• May 2026: Premium Home Service. The Department of Justice filed a civil penalty complaint for the FTC, alleging fake reviews written, bought and sought from employees and relatives. The case was still pending when we checked.
• October 2026: Digital Forensics Corp. The FTC sued, alleging violations of the rule including review suppression, thousands of fake reviews and bought reviews. A court granted a temporary halt; the case is ongoing.

None of these cases involves a SaaS company. They do show the FTC is now using the rule, including for reviews on a company's own website.

A practical checklist

1. Make sure every testimonial on your site is from a real customer who actually used the product.
2. Keep a record of where each one came from, and the customer's permission to use it.
3. Quote exactly, or edit only in ways the customer agrees still say what they meant.
4. Disclose clearly if the person works for you, is related to you, or got anything of value for it, right next to the quote.
5. Never make a reward depend on the review or testimonial being positive.
6. Don't publish AI-written or ghost-written quotes you can't tie to a real customer.
7. Don't imply a curated selection is everything customers said.
8. Check the whole site, including old landing pages, for quotes nobody can account for any more.

That last point is where HasReceipts comes in. It ties each testimonial to a real, paying customer through your billing, keeps the customer-approved wording locked with the original on record, and scans your whole site for quotes it can't back. It doesn't make you compliant on its own, but it makes “where did this quote come from?” easy to answer.

This guide explains the rules in plain English. It isn't legal advice; for decisions about your business, talk to a lawyer in the relevant country.