Why should a store read the rule itself?
Most stores hear about this rule second hand, from a review app's blog or a newsletter, and those summaries tend to stop at "don't buy fake reviews". The rule is longer than that. It also covers who in your company may post a review, what you may say to a customer who left a bad one, and how your review page may hold some reviews back. You can break it without writing a single fake review.
The text is short. Part 465 has nine sections and fits on a few screens. We read it on 3 November 2026 in the eCFR version that is up to date as of 30 October 2026, together with the FTC's question-and-answer page for businesses and its press releases. What follows is the rule's own text in plain words, not legal advice. If a point decides something for your business, read the section itself or ask a lawyer.
What does the FTC fake reviews rule ban?
Section 465.1 defines the terms and 465.9 says the parts stand on their own if a court strikes one down. The bans sit in between. One definition matters for every row: a consumer review includes a bare star rating with no text, so the rules about hiding and buying reviews apply to star counts too.
| Section | What it bans | What a store does about it |
|---|---|---|
| 465.2 | Writing, creating or selling reviews from people who do not exist, never used the product, or did not have the experience described. Buying such reviews, or getting them from staff or their family for another site, when you knew or should have known | Publish only what real customers wrote. Never paste in reviews from a writer, an AI tool or your team |
| 465.3 | Nothing. The section is marked reserved | No action |
| 465.4 | Rewards that depend on the review being positive, or negative | Same reward for any rating, or no reward |
| 465.5 | Reviews by officers or managers without a clear note of who they are, and pushing staff or relatives to review without that note | Owners and managers do not review their own products. Staff who do, say so in the review |
| 465.6 | Presenting a review site or "independent" ranking you own or control as independent | Do not run a comparison site that ranks your own products as if it were neutral |
| 465.7(a) | Groundless legal threats, physical threats, intimidation or knowingly false public accusations meant to stop or remove a review | Reply to a bad review in public, and keep threats out of it |
| 465.7(b) | Showing your reviews as if they were most or all of them while you hold some back for their stars or negative tone | Hide only for reasons that apply to every rating |
| 465.8 | Selling or buying fake followers, likes, views and other fake social media numbers for business use | Do not buy followers or likes for the shop's accounts |
Two exceptions run through 465.2 and 465.5. A business that sends the same general request to all its buyers ("tell us how it went") is not liable for what they choose to write, and neither is a business that only hosts reviews. That is why an automatic review email after every order is fine, while a hand-picked list of happy customers is a different matter, as the next part shows.
Does the rule cover AI-written reviews?
Yes, though the text never says "AI". Section 465.2 is about reviews that misrepresent whether the reviewer exists or used the product, and it does not care how the words were produced. The FTC's press release of 14 August 2024 says the rule is meant to deter AI-generated fake reviews.
So a review that a tool writes "in the voice of a customer" is a fake review, even if a real customer bought the product. The same goes for rewriting a short real review into a longer, warmer one. The rule does not address AI that works on top of real reviews and says so, such as a labelled summary of what buyers wrote, a translation marked as one, or a reply draft you send under your own name. Those are not reviews, but a summary that leaves out the complaints can still mislead. Our test of AI review summaries shows where those summaries go wrong.
Can you ask only happy customers for reviews?
The rule itself does not forbid it. The FTC's Q&A page says it "does not contain a specific prohibition against such conduct", and then warns that the practice could still break the FTC Act under the Endorsement Guides. For Google reviews the answer is simpler: Google's content policy, read on 3 November 2026, lists "selectively solicit positive reviews from customers" among the things merchants may not do.
The safe pattern is the one 465.2(d) protects: ask every buyer, the same way, at the same point after delivery. Our guide to when to send the review request covers that timing. Holding the request back while a customer's complaint is still open is a grey area. It is not a sentiment test on the review, but it does keep some unhappy buyers out of the pool, so be ready to explain why you do it and how long the hold lasts.
What about rewards for reviews and hiding bad ones?
These two points, 465.4 and 465.7(b), are the ones stores ask about most, and we cover them at length in can you offer a discount for a review. In short, a reward is allowed when it does not depend on the rating, and the FTC's Q&A adds that a reward you do not disclose could still be deceptive.
Hiding is allowed for reasons that apply to every rating. The rule lists them: trade secrets, defamatory or abusive content, someone else's personal information, discriminatory content, clearly false content, reviews you reasonably believe are fake, and reviews unrelated to what you sell. Sorting is not hiding; the FTC's Q&A says "organizing reviews is not suppressing reviews under the rule", but it also warns against an order that makes the negative ones hard to find.
Does the rule require verified buyers?
No. Part 465 has no verification duty, and the FTC's Q&A page does not mention one. The duty in the rule is negative: do not publish what you know or should know is fake.
The EU is different. A shop that sells to EU customers must say whether and how it checks that reviews come from buyers, which our article on the Omnibus Directive and verified reviews explains with notices you can copy. A "Verified buyer" label is a claim of its own, so it should appear only on reviews you can tie to a real order.
What should a store's review setup do?
Here is the rule turned into settings and habits. The section numbers point back to the table above; the line about sorting comes from the FTC's Q&A.
- Ask every buyer through the same automatic email, not a list you pick by hand (465.2(d)).
- If you give a reward, give it for any rating, say so in the request, and show a label on the review (465.4).
- Keep a short written moderation policy with the reasons you hide reviews, and use only those reasons, for 1 star and 5 stars alike (465.7(b)).
- Show reviews newest first by default, and let shoppers filter to the low ones.
- Tell staff and family not to review your products, or to say who they are when they do (465.5).
- Answer bad reviews in public with facts, never with a threat. Our guide to responding to negative reviews has wording that works (465.7(a)).
- Never import reviews you cannot trace to a customer, and never let a tool write them (465.2).
Our article on why bad reviews help sales makes the business case for the hardest line on that list.
How does Formgong's review setup line up?
We checked our own code against each point. Review emails go to every buyer of a connected store. Opt-outs and consent rules can skip a buyer, and a second order within 14 days waits its turn, but there is no setting that picks customers. The one hold works like this: if the buyer has an open help-chat ticket or an unanswered message to one of the store's forms, the email waits a day and checks again, and after 14 days it is skipped. That hold looks at the open question, never at a rating, and it is the closest thing to selective asking that the product has.
When review coupons are on, every review that comes through the order email gets the label "Received a store coupon for reviewing", and the coupon goes out whatever the stars. A review sent through the order link gets "Verified buyer", because it is tied to that order and that product. Reviews imported from another app keep a "Verified buyer" label only if the file says so, and we cannot check that file for you. None of the four publishing modes looks at the stars, and in the AI mode the model is never shown the rating. Hiding a review needs one of six reasons (Spam or fake, Duplicate, Not about your business, Personal data, Threats, hate or harassment, Test), and only test, spam and duplicate reviews can be deleted.
That is where we differ from some review tools. Trustindex's page on buying Google reviews, read on 3 November 2026, warns readers about the FTC and in the same layout lists "Hide your negative reviews" among its features. Formgong has no such switch, and "negative" is not one of the reasons the hide button accepts. A list cannot stop an owner from picking "Threats, hate or harassment" for a review that is only critical, so keeping the policy honest is still your job.
Did we miss a part of the rule?
If your lawyer reads a section differently, or you have seen how the FTC applies it to a small store, write to support@formgong.com. We will correct this page and say what changed.
Frequently asked questions
When did the FTC fake reviews rule take effect?
On 21 October 2024. The FTC announced the final rule on 14 August 2024, and it is published as 16 CFR Part 465.
What is the penalty for fake reviews under the FTC rule?
Courts can impose civil penalties for knowing violations. The FTC's December 2025 warning letters put the figure at up to $53,088 per violation.
Is it illegal to ask only happy customers for reviews?
The rule has no specific ban on it, but the FTC says it could break the FTC Act. Asking every buyer the same way is the safe pattern.
Can I remove negative reviews from my website?
Only for reasons that apply to every rating, such as abuse, personal data, fake or unrelated content. Removing a review because it is negative is suppression.
Is this article legal advice?
No. It is the rule's text and the FTC's own pages in plain words, read on 3 November 2026. Ask a lawyer about your own case.
Sources and documentation
Official references for this guide: Formgong: Can you offer a discount for a review?, Formgong: Do EU stores have to say if reviews are verified?. Review moderation, where data is stored.
Related guides
- Lovable form submissions to email and Telegram
- HTML contact form without a backend: a working example
- How to send website form submissions to Telegram
- Contact form not sending email? Check where it stops
- Managing website leads in Telegram without a CRM
- Form backend for Lovable, Bolt, v0, Cursor
- Telegram bot for a contact form: build or skip?
- GDPR form backend: 7 checks before you choose
- Lovable form not sending email? 6 fixes
- Netlify Forms not working? React and Bolt fixes
- Stop contact form spam without a CAPTCHA
- GitHub Pages contact form: a working setup
- Mailto Form in HTML: Why It Fails and What to Use
- HTML form to Google Sheets: 2 free methods
- Webflow form submission limit: what to do at 50
- Turnstile vs reCAPTCHA vs hCaptcha for forms
- Contact Form 7 and Elementor forms to Telegram
- Squarespace contact form not sending email?
- Shopify contact form: where do messages go?
- Google Form to Telegram: free Apps Script way
- Wix contact form not sending email? Fixes
- EU / GDPR Formspree alternatives compared
- HTML form action attribute explained
- How do HTML forms work? The HTTP request
- Types of Injection Attacks on Web Forms (2026)
- Indirect Prompt Injection in MCP
- MCP Rug Pull Attack: Detect Tool Changes
- Form without a backend: 7 ways that work
- Thank-you page after form submission (HTML)
- Indirect Prompt Injection Examples (2023–2026)
- Indirect Prompt Injection via Email
- What Is Tool Poisoning in MCP?
- WordPress contact form without a plugin
- Send email from frontend JavaScript
- How to Prevent Indirect Prompt Injection
- Honeypot Form Field: How to Add One That Works
- Contact Form with File Upload (HTML, No PHP)
- Angular contact form without a backend
- Send form submissions to Slack or Discord without Zapier
- Verify a form webhook signature (HMAC-SHA256)
- Contact forms that send nothing: 793 AI-built sites tested
- v0 contact form that actually sends: 3 ways
- How we tested AI-built contact forms, and 12 bugs we hit
- Cloudflare vs Netlify free plan: hosting that never pauses
- EmailJS 412 “Gmail_API: Invalid grant”: reconnect Gmail
- Resend “You can only send testing emails”: verify a domain
- Supabase Edge Function blocked by CORS policy: 3 causes
- Formspree “Form not found” and other errors: fixes
- Web3Forms errors: “Invalid access key” and 403 explained
- How to add customer reviews to your website for free
- Getform not working? “This form has been deleted” and more
- Next.js contact form not working? 6 errors, reproduced
- Webflow form not sending email? What to check, tested
- FormSubmit not working? “This form needs Activation” fix
- Contact form “TypeError: Failed to fetch”: causes and fixes
- WooCommerce product enquiry form
- Contact Form 7 vs WPForms
- Gravity Forms alternative free
- WordPress contact form block
- 535-5.7.8 Username and Password not accepted (Gmail)
- 535 5.7.3 Authentication unsuccessful: Office 365 SMTP
- Nodemailer “Missing credentials for "PLAIN"”: the fix
- Nodemailer “Greeting never received”: port 465 fix
- Nodemailer SSL “wrong version number”: the port fix
- Nodemailer “self-signed certificate in certificate chain”
- Nodemailer ECONNREFUSED 127.0.0.1:587: missing SMTP host
- SendGrid “authorization grant is invalid”: 401 fix
- Mailgun 401 Forbidden: why the API rejects your key
- “Edge Function returned a non-2xx status code”: the fix
- Next.js “Body exceeded 1 MB limit”: Server Action fix
- Unexpected token '<', "<!DOCTYPE "... is not valid JSON
- “TypeError: Body is unusable”: body has already been read
- Turnstile “timeout-or-duplicate” and other siteverify errors
- Turnstile vs hCaptcha vs reCAPTCHA: speed and size tested
- Judge.me reviews not showing on Shopify: how to fix it
- Judge.me review carousel not showing: how to fix it
- Yotpo reviews not showing on Shopify? Check the app embed
- Loox reviews not showing on product page: how to fix
- Shopify reviews not showing: what to check first
- How to show reviews on Shopify
- GDPR for website forms: what each type of form needs
- WooCommerce reviews not showing: how to fix it
- Stamped.io reviews not showing on Shopify: how to fix it
- Etsy reviews not showing: why and what to do
- Trustpilot widget not loading: how to fix TrustBox
- Yotpo problems in 2026: what merchants report
- Contact Form 7 “error trying to send your message” fix
- Elementor form “Your submission failed because of an error”
- Framer form not sending email or not working: what to check
- Carrd contact form not working: plans, spam and errors
- Google review link not working: what customers see and why
- tawk.to widget not showing on your website: causes and fixes
- How to add questions and answers to your product page
- “Failed to send a request to the Edge Function”: fixes
- Next.js “Failed to find Server Action”: what it means
- Brevo “unauthorized: Key not found” 401: the fix
- Amazon SES “Email address is not verified”: the fix
- Shopify contact form not working: how to fix it
- Judge.me alternative for WooCommerce after the 2025 shutdown
- Free WooCommerce review plugins compared on the free version
- WooCommerce review reminder emails without a paid plugin
- Add Voice Recording to a Website Form
- Contact Form 7 spam: how to stop it
- WPForms not sending email: how to fix it
- Contact form emails going to spam: how to fix it
- HTML form not submitting: how to fix it
- Contact form not working: how to find the fault
- Webflow form spam: how to stop it
- Website form to Notion: how to set it up
- Website form to WhatsApp: what works and what does not
- What 1-star reviews say about AI support chatbots
- Which free form backend gives you the most submissions?
- Elfsight reviews widget not showing? Check the view limit
- Next.js contact form backend vs Server Actions
- Review stars not showing in Google search results
- How to stop duplicate form submissions
- How to see which form leads came from ChatGPT
- What happens when a form webhook fails
- When to send a review request email after an order
- How to collect video testimonials for free
- Add contact form sign-ups to Mailchimp or Klaviyo
- How to migrate from Formspree without losing submissions
- How to get a Google review link for your business
- What is a headless form backend?
- Is it safe to put a form access key in your HTML?
- AI chatbot that answers only from your website
- Minified React error #441 in Next.js
- Squarespace product reviews after Judge.me
- Accessible contact form checklist for WCAG 2.2
- How to ask a client for a testimonial by email
- How to respond to negative reviews, with examples
- 429 Too Many Requests on a contact form
- MCP server for forms in Cursor and Claude
- Can you offer a discount for a review?
- Do EU stores have to say if reviews are verified?
- Webflow form backend options compared
- How to add review schema JSON-LD to a product page
- How to turn a customer review into an Instagram post
- How to make a QR code for Google reviews
- Live chat or chatbot for a small business website
- Why people abandon your contact form halfway
- Which form backend do AI assistants pick? 54 answers
- PHP mail() not sending email, even when it returns true
- What “Failed to fetch” means, tested in three browsers
- 405 Method Not Allowed when you submit a form
- Send a contact form to more than one email address
- What is review syndication, and who needs it?
- How to save HTML form data to a database
- NetworkError when attempting to fetch resource
- Send product reviews to Google Merchant Center
- PHPMailer not working on a live server
- AI review reply generator: does it help?
- React 19 contact form with useActionState
- Astro Actions or a form backend?
- Is no-reply@wixsiteautomations.com legit?
- Where to find the Judge.me review widget code
- AI review summaries: what shoppers actually see
- Photo reviews for WooCommerce, and the GPS inside them
- Review request email templates you can copy
- Reviews in AI search: what ChatGPT and Perplexity cite
- Lead capture form with UTM tracking, built and tested
- Form design best practices, with our own form data
- Client intake form template with file upload
- What is social proof? Meaning and examples
- What is user-generated content (UGC)?
- Benefits of negative reviews for your store
- How to get your first reviews as a new store
- How to use customer reviews in your marketing
- How to get more customer reviews
- React form validation without a library, tested
- jQuery submit form with validation
- reCAPTCHA v3 setup with the server score check
- Shopify social proof that shoppers can check
- HTML file input: accept, multiple, capture and size checks
- How to add hCaptcha to a form, with the server check
- How to add invisible reCAPTCHA to a form
- Bug report form template with browser details
- How to show reviews on your homepage
- Do reviews increase sales? What the studies show
- HTML input types and what each one sends
- HTML textarea, tested in a real form
- HTML dropdown menu in a form, tested
- Do reviews help SEO? What Google says and shows
- How to add a review carousel people can read
- Product review examples that help shoppers decide
- Which trust badges actually mean something
- Customer satisfaction survey with CSAT and NPS
- JavaScript FormData and what fetch actually sends
- JavaScript form validation without a library
- Server-side form validation and what it catches
- Email validation in JavaScript, tested on 33 addresses
- Zod form validation with FormData, tested
- Store reviews vs product reviews
- How to send review requests through Klaviyo
- How to tag customer reviews by topic and mood
- Custom review form questions worth asking
- Online reputation management for small businesses
- HTML radio button groups and what they send
- HTML label tag and what screen readers hear
- HTML autocomplete attribute, tested with Chrome autofill
- HTML fieldset and legend, and what disabled leaves out
- HTML button tag and what a form button sends
- Vite contact form that still works after the build
- How to test a contact form, end to end
- How to embed a Google Form, and what it loads
- Customer feedback questions that get real answers
- How to convert a file to base64 in JavaScript
- FilePond with a form backend, and when to skip it
- Bootstrap form validation and server errors
- Tailwind form validation, tested in three browsers
- Donation form in HTML, and where the payment goes
- How to ask for a review in person or by text
- Which review sites matter for your business
- What are customer reviews, and which kinds count
- Online review statistics, checked at the source
- Best review app for Shopify and WooCommerce
- Why Gmail sends your self-hosted mail to spam
- htmx contact form that sends to another domain
- AI form builders tested, from prompt to sent form
- Headless WordPress forms with Contact Form 7, tested
- React Hook Form watch vs useWatch, and what gets sent
- Elfsight widget not working? It vanishes when views run out
- Jotform not sending emails? Check Jotform's bounce list
- Typeform not working? A white box means a blocked script
- Positive review response examples that don't sound copied
- How to remove a Google review when you can't delete it
- Google reviews not showing up? 8 causes to check in order
- Is buying Google reviews illegal? Even a review swap counts
- Which reviews can you hide? A review moderation checklist
- Average star rating: what 4.8 from 5 reviews means
- Reviews on a product page: where and how many to show
- SaaS testimonials: 3 of 27 had a number in them
- Do reviews reduce returns? Not when they're too good
- Testimonial examples for business: what makes one believable
- Testimonial questions to ask clients, by type of business
- Testimonial page design: a page or a section?
- Testimonial advertising rules: what the FTC requires
- Form submission canceled because the form is not connected
- Input type date format dd/mm/yyyy: what you can change
- How to disable textarea resize, or allow only vertical
- How to prevent Enter from submitting a form
- form.submit() vs requestSubmit(): what submit() skips
- Custom HTML checkbox CSS that doesn't break required
- How to reset a form after submit, and what reset() keeps
- Input type number maxlength not working? What to use
- How to create an HTML form, step by step
- Best form builder: free plans and branding, checked
- Best WordPress contact form plugin: 10 free ones compared
- How to increase form conversion rate: start with the count
- Form backend vs form builder: which one do you need?
- WordPress contact form not sending email? 3 plugins tested
- Contact Form 7 webhook? Turning it on switched our email off
- Gravity Forms webhook: what it sends and the URLs it rejects