The FTC review rule for therapy practices

For OT, PT and SLP practices seeing children, adults or both: since October 21, 2024, the FTC’s review rule has banned fake reviews, rewards tied to positive reviews, undisclosed insider reviews and threats used to remove reviews. Google also bars any incentive and asking only happy patients, and HIPAA keeps a covered practice’s replies free of patient details.⁠^1,2,3

What does the FTC review rule ban for therapy practices?

It bans six kinds of conduct around consumer reviews and testimonials, and each one reaches a therapy practice as it reaches any business that sells services. The Rule on the Use of Consumer Reviews and Testimonials went into effect on October 21, 2024, and its definition of a business covers an individual, partnership, corporation or other commercial entity that sells products or services.⁠^1,15 A star rating with no text counts as a consumer review.⁠¹⁵

The rule binds businesses, not the families who post, and agencies, review brokers and reputation management companies are not immune, so outsourcing review work does not move the risk off the practice.⁠¹

Does the FTC review rule apply to a small private practice?

Yes: the rule defines a business as including an individual who sells services, so a solo OT, PT or SLP is covered as fully as a multi-location group.⁠¹⁵ What differs between pediatric and adult care is who writes: usually a parent for a child and the patient for an adult. The insider sections turn on the writer’s relationship to the business, so the same words can be an ordinary review from a parent and a rule problem when the owner asked her sibling to post them without a disclosure.⁠⁷

What penalties can a practice face for breaking the rule?

Civil penalties for knowing violations, which the FTC’s December 2025 warning letters put at up to $53,088 per violation.⁠^1,4 The rule creates no private right of action, so a patient cannot sue under it, and a warning letter is not a formal finding that the recipient broke the rule.⁠^1,4

Health care is within reach: in a July 2025 case against a telemedicine company, the FTC alleged fake testimonials by employees and family members, selective solicitation of positive reviews, and refunds or gift cards for removing negative ones, and the company and its principals agreed under a proposed order to pay $150,000.⁠¹⁶

Which review practices do the FTC and Google each allow?

The FTC rule sets the legal floor and Google’s policy sits above it, so a practice asking for Google reviews follows the stricter of the two, and a covered practice adds HIPAA to both.

What happens to a Google profile that breaks the review policy?

Google removes the violating reviews and may restrict the profile: no new reviews or ratings for a set period, existing reviews unpublished for a set period, or a warning telling people that fake reviews were removed.⁠¹⁸ Google says it emails the owner before applying a restriction, and the business can appeal.⁠¹⁸ The Google Business Profile troubleshooting guide covers working through other profile problems.

What counts as a fake review or testimonial for a practice?

Any review or testimonial that misrepresents that the reviewer exists, that they had experience with the practice, or what that experience was.⁠⁵ When it announced the rule, the FTC named AI-generated reviews by people who do not exist among those it covers.⁠¹⁹ In a therapy practice, these all cross the line:

• A review "from a parent" written by staff, a marketer or a software tool about a child the practice never saw.⁠⁵
• A composite success story built from several cases and presented as one family’s or one adult patient’s experience.⁠⁵
• A real review edited to sound better: the Endorsement Guides bar presenting an endorsement out of context or reworded so as to distort the person’s experience.⁠²⁰
• Reviews bought from a broker, or posted by a vendor from accounts it controls.⁠⁵

An obviously fictional scenario is not an endorsement, so a clearly labeled example on a service page is fine, as long as no real family’s name or photo is attached.⁠²¹ Removing a name from a real case does not make it anonymous: health information still counts as identifiable when there is a reasonable basis to believe it can identify the person.⁠²²

Can a practice draft a review for a family to post?

No: a review the practice writes is the practice’s words presented as the family’s experience. The rule bars a business from writing a review that misrepresents the reviewer’s experience, FTC staff say a business should not supply testimonial text without a reasonable basis to believe it is true to the person’s experience, and Google bars merchants from requesting that specific content be included in a review.⁠^1,2,5 That rules out "suggested wording" in a request and any prompt to name the therapist, since Google lists staff soliciting reviews that identify a staff member as a violation.⁠² A family that names the therapist on its own has done nothing wrong.

Can a therapy practice offer anything in return for a review?

Not on Google, and nowhere may the reward depend on a positive review. The FTC rule bans compensation or incentives conditioned, expressly or by implication, on a review expressing a particular sentiment, and FTC staff say paying for five-star reviews violates it even when the reviewer adds a disclosure, on the practice’s own site or a third-party platform.⁠^1,6 An implied condition counts: the staff example is a coupon offered with "Tell us how much you loved your visit".⁠¹

The rule’s definition of buying a review lists money, gift certificates, products, services, discounts, coupons, contest entries or another review as examples, so treat a free screening, a raffle entry or a better place on the waitlist the same way.⁠¹⁵ A reward offered to every reviewer whatever the rating is not banned by the rule, but FTC staff warn that failing to disclose it can violate the FTC Act.⁠^1,23 Google ends the question for most practices: merchants may not offer payment, discounts or free goods or services for posting any review, or for revising or removing a negative one, and Yelp asks the same.⁠^2,17,24 The workable rule is to offer nothing.

Removal works the same way: paying a family to change or remove a truthful negative review is outside the rule, but FTC staff say it may violate the FTC Act, and Google bars it, so never tie a refund, a waived balance or a schedule change to what a family posts.⁠^1,2

Can a practice ask only the families it expects to be happy?

No: the FTC rule does not name the practice, but FTC staff say it could violate the FTC Act, and Google bans selectively soliciting positive reviews outright.⁠^1,2 The Endorsement Guides describe the pattern: inviting only customers who gave very positive feedback to post reviews may be unfair or deceptive if it makes the posted reviews substantially more positive, while inviting all recent customers is not.⁠¹³

In a therapy practice, selective asking rarely looks deliberate: a clinician choosing which families to ask, a request sent only at planned discharges so families who stopped early never get one, or a front-desk habit of asking the parents who seem pleased. Google adds three limits a practice can break without meaning to: no requiring or pressuring people to leave ratings while on the premises, no asking staff to collect a certain number of reviews, and no asking for content that identifies a staff member.⁠² Pick a trigger every patient reaches regardless of outcome, such as a set number of days after the evaluation, or send the request at every discharge, planned or not.

Can a satisfaction survey decide who gets the review link?

No: routing high scores to a public review site and low scores to a private form is the selective solicitation Google bars and the pattern the Endorsement Guides describe.⁠^2,13 Keep the private survey for finding problems, but either send the review request to everyone whatever they answered or leave review links out of the survey entirely. Yelp asks businesses not to request reviews after collecting feedback through surveys or contact forms at all.⁠²⁴

Can staff, owners or their relatives review the practice?

Under the FTC rule, an owner or manager may review the practice only with a clear and conspicuous disclosure of the relationship; the rule’s one exception is a testimonial whose audience can already see the relationship. On Google, the review breaks the conflict-of-interest policy either way.⁠^2,7 Officers include owners, and immediate relatives are spouses, parents, children and siblings.⁠¹⁵ An officer or manager who asks relatives or employees for reviews violates the rule when the reviews appear without a disclosure and the officer or manager discouraged one, did not tell them to disclose, or saw an undisclosed review and did nothing.⁠⁷

A disclosure a reader must click or hover to see does not count; one in the first line of the review does.⁠^1,15 Even disclosed insider reviews that materially raise the average star rating can violate the FTC Act, FTC staff warn, and Google does not allow reviews based on current or former employment, contractual relationships or family ties.⁠^1,2

One overlap catches therapy practices: a staff member who is a patient, or whose child is. If that person gets the same request every family gets, FTC staff say the generalized solicitation exemption applies, but Google’s conflict-of-interest policy still covers current employment.⁠^1,2 The simplest policy is that employees and their households do not review the practice; they can help write the service pages instead, in the practice’s own voice. The Endorsement Guides say an employer should train employees on this.⁠²³

Can referral partners or vendors post reviews of a practice?

Not as consumer reviews on Google, where a contractual, consultory or other professional affiliation can be a conflict of interest.⁠² That can include a referring physician, the billing service and the marketing agency; an agency’s staff also count as the practice’s agents under the FTC rule, so their testimonials need a disclosure of the relationship when it is not otherwise clear.⁠^1,7 A referral partner who wants to speak for the practice can do it in the practice’s own materials, under their own name and role.

What counts as suppressing a review under the FTC rule?

Using a groundless legal threat, a physical threat, intimidation, or a public accusation the business knows is false or makes with reckless disregard for the truth, to stop a review being written or to get one removed.⁠⁹ FTC staff say intimidation can include abusive communications and character assassination, and that a business may still threaten legal action when it has a legitimate basis, which a groundless threat by definition lacks.⁠^1,15

A health practice holds one lever other businesses do not: its records. The Endorsement Guides list threatening reviewers with the disclosure of embarrassing information, or with baseless lawsuits, as an unfair or deceptive practice, and for a covered practice, revealing anything from the record would also be a disclosure the Privacy Rule does not permit.⁠^3,13 Never mention a reviewer’s attendance, balance or diagnosis to pressure them, in public or in private.

The rule leaves open replying publicly without false accusations, contacting a reviewer to resolve the problem they raised, and asking satisfied reviewers to update a review.⁠¹ Reporting needs a basis: the Endorsement Guides call routinely flagging negative reviews as fake without one an unfair or deceptive practice, and FTC staff warn against misusing reporting tools to remove honest reviews.⁠^13,25 A review that genuinely breaks a platform policy goes through that platform’s reporting route with the policy named, and the guide to reporting a fake or abusive Google review covers doing that without exposing patient information. Whether a review is defamatory is a question for the practice’s attorney, not for a reply.

Can intake paperwork stop patients from posting reviews?

No: the Consumer Review Fairness Act makes it illegal for a company to use a form-contract provision that bars or restricts a customer’s reviews, imposes a penalty or fee on a reviewer, or takes their intellectual property rights in the review.⁠¹¹ Check the intake packet, financial and cancellation policies, telehealth consent and any package agreement, and remove such a clause even if it was never enforced; a violation is treated the same as violating an FTC rule.⁠¹¹

The Act still allows prohibiting or removing reviews that contain private information, including medical information, or that are clearly false, though an opinion you disagree with is unlikely to be clearly false; it does not cover employment or independent contractor agreements.⁠¹¹

Does the rule cover reviews shown on the practice’s website?

Yes, in two ways: a review page on the practice’s own site must not hide reviews by rating while implying it shows all or most of them, and reviews the practice features in its marketing become testimonials.⁠^1,9 Withholding reviews is not suppression when the criteria apply equally to every review regardless of sentiment, such as a review containing another person’s personal information or one the practice reasonably believes is fake.⁠⁹ That fits a pediatric case: a parent’s review that names the child or the child’s diagnosis can be withheld, provided every review with another person’s details is treated the same way.

Selection matters more than order: FTC staff say organizing reviews is not suppression, but burying negative reviews or using unrepresentative ones in marketing could be deceptive.⁠¹ Their guide for sites that feature reviews says to publish all genuine reviews, not edit them to change the message, not feature the positive ones more prominently, and explain how ratings are calculated.⁠²⁶ A widget that pulls in only five-star Google reviews raises every one of those questions, plus the privacy question below; the website content checklist covers the rest of a practice site.

What is a company-controlled review website under the rule?

A website, organization or entity the business controls that it presents as giving independent reviews or opinions of a category that includes its own services.⁠⁸ FTC staff say it reaches a fake seal program a company awards to its own products, and that a disclosure cannot cure an express claim of independence.⁠¹ For a practice, that means no owner-run "top therapists" list and no award badge the practice or its agency invented.

What changes when a practice reuses a review as a testimonial?

The review becomes the practice’s own advertising, so the practice answers for its truth, for whether it represents what patients generally experience and, if the practice is a HIPAA covered entity, for the patient’s authorization. FTC staff say reviews featured in advertising become testimonials, outside the exemption for merely hosting reviews, and the Endorsement Guides, the FTC’s interpretation of how the FTC Act applies to endorsements and testimonials, treat the two alike.⁠^1,21

Two of the Guides’ principles apply to every practice testimonial. A testimonial about a central result is likely to be read as the result patients generally achieve, so the practice needs support for that or must clearly disclose the results patients can generally expect, and consumer endorsements are not themselves competent and reliable scientific evidence.⁠¹³ Any connection between the patient and the practice that readers would not expect, such as a family relationship or a free or discounted service, must be disclosed clearly and conspicuously.⁠²³

A parent’s line that a child "was talking in sentences within a month" implies a result other families should expect, as does an adult’s "back to running in two weeks". Use such a review only with support or an accurate statement of what patients generally experience, and never trim its qualifying words.⁠^20,26

When does a testimonial need the patient’s HIPAA authorization?

Before a covered practice uses it: a patient’s words and identity in the practice’s advertising disclose that the person received care there, and HIPAA’s definition of identifiable health information includes information about the provision of health care to an individual.⁠²² A covered entity may use or disclose that information only as the Privacy Rule permits, and HHS describes an authorization as the document required for uses and disclosures the rule does not otherwise allow, generally purposes other than treatment, payment or health care operations.⁠^3,27 HHS’s marketing guidance separately requires written authorization, with limited exceptions, for marketing uses, though communications about a practice’s own services can fall outside that definition.⁠^28,29 Get the authorization first, and let the privacy officer decide any case that looks different.

A valid authorization is its own plain-language document that describes the information (the review text, the name or initials, any photo), who discloses it, to whom, for what purpose and until when, with the signature and date.⁠¹⁴ It may not be combined with the intake consent or made a condition of treatment, and the patient may revoke it in writing.⁠¹⁴ For a child, the parent or guardian who has authority to make the child’s health care decisions signs as personal representative, subject to the exceptions in the rule, and the form describes that authority; for an adult, the adult signs, or their own personal representative does.⁠^3,14 A public review is not a substitute for any of this.

What do the OT, PT and SLP ethics codes say about testimonials?

They add duties of accuracy and confidentiality of their own. ASHA’s Code of Ethics defines advertising as any communication with the public about services, bars misrepresenting services or their results, bars promising the results of any treatment directly or by implication, and allows disclosing confidential information only when legally authorized or required.⁠³⁰ APTA’s Code for physical therapists and assistants requires truthful, accurate information about services in any form of communication and bars disclosing confidential information except as the patient authorizes or the law permits or requires.⁠³¹ AOTA’s Code of Ethics names veracity among its guiding principles and puts its enforceable behaviors in the Standards of Conduct of the 2025 Code, which an OT practice should read before publishing a testimonial.⁠³² Read each state licensing board’s advertising rules as well.

How does HIPAA limit a practice’s review requests and replies?

A covered practice may not confirm, add to or correct anything about a reviewer’s care in public, even when the reviewer posted it first: it may disclose protected health information only as the Privacy Rule permits, and the fact that someone was a patient is information about the provision of care to them.⁠^3,22

HHS has acted on practices that answered reviews. Manasa Health Center, a New Jersey practice providing adult and child psychiatric services, agreed to pay $30,000 after HHS’s investigation indicated it had disclosed four patients’ protected health information in responses to their negative Google reviews.⁠¹² New Vision Dental agreed to pay $23,000 after a complaint alleged its Yelp replies gave patients’ full names where reviewers had used screen names and added visit and insurance details; the covered conduct included failing to implement policies on releasing patient information on social media and public platforms.⁠³³ Neither agreement is an admission of liability.⁠^12,33

Google’s reply tips, written for every kind of business, suggest addressing the reviewer by name and acknowledging their specific feedback; a covered practice skips both and keeps to Google’s other tip, never sharing a reviewer’s private information.⁠¹⁷ Reply wording for positive and negative reviews is in the guide to requesting and responding to reviews.

Requests raise a disclosure question too: a review tool that receives the patient list, with names, contact details and visit dates, handles information that links people to care. HHS permits sharing protected health information with a business associate engaged for such services once a contract or other written arrangement gives satisfactory assurances, so ask the privacy officer whether the tool needs a business associate agreement before the first upload.⁠³⁴

Does HIPAA apply to a self-pay therapy practice?

Only if the practice transmits health information electronically in connection with a covered transaction, which is what makes a health care provider a covered entity.⁠²² A practice that never does may fall outside HIPAA, but the confidentiality duties in the ASHA and APTA codes do not depend on how a practice is paid, and the FTC rule applies either way.⁠^15,30,31 Settle the HIPAA question with a privacy lawyer rather than by assumption, and keep replies general regardless.

How should a practice ask for reviews without breaking a rule?

Ask every patient or family the same way, at the same point in care, through the same channel, with nothing offered and nothing steered. That is a generalized solicitation, which the rule exempts from its purchased and insider review provisions, and Google allows soliciting reviews of genuine experiences without incentives or attempts to influence the rating or content.⁠^2,5,7 A stated hope for positive reviews in a request sent to everyone is not unfair or deceptive under the Endorsement Guides, and Google suggests a review link or QR code.⁠^13,17

For a child, the request goes to the parent or guardian the practice already corresponds with, never to the child; for an adult, to the adult unless they have named someone else, as the request and response guide explains. Keep the message free of any diagnosis, service or result, and ask reviewers to leave out private health details: Google’s personal information policy lists medical information about yourself or others among prohibited content.⁠²

On DrSensory, families write the reviews on a paid listing and the clinic can reply publicly; the hub advises asking everyone and offering nothing for it, and the profile guide covers how that works on a listing.⁠^35,36

Do Yelp and other review sites allow practices to ask?

Not all of them, so the request names only platforms whose rules allow it. Yelp asks businesses not to ask anyone for reviews, whether customers, mailing list subscribers, friends or family, says staff should never compete to collect them, and tries to identify requested reviews and not recommend them.⁠²⁴ FTC staff tell businesses to learn each platform’s rules before asking, noting that some ban reviews from connected or incentivized people even when the review discloses the connection.⁠²⁵

What should a practice’s written review policy say?

Who may ask, when and how; what nobody may offer; who may not review the practice; who replies and what a reply never contains; and how reviews are reported, displayed and reused. The Endorsement Guides advise businesses to guide the people who speak for them, monitor what they post and act on problems, and say an employer should train employees about posting.⁠^20,23 A one-page policy, signed by everyone who touches reviews, does that.

How do you check a review vendor or marketing agency?

Ask exactly what the vendor does in the practice’s name, because the FTC rule reaches agencies and reputation firms, and FTC staff warn that a business can be held responsible for what such companies do on its behalf and that review platforms could suspend or remove its accounts and listings.⁠^1,25 A sales page that says "HIPAA compliant review software" answers none of the questions below, so ask each one and keep the written answers with the contract.

Watch for offers that map onto the rule: review packages, drafted review text, a survey step that sends only happy respondents to Google, staff leaderboards, follower growth packages and any promise of a star rating. Buying followers or views the buyer knew or should have known were fake, where they materially misrepresent its influence for a commercial purpose, is itself a violation.⁠¹⁰

How do the rules apply to a pediatric and an adult practice?

The rules are the same; the situations differ, because a child’s review is usually written by a parent and an adult’s by the patient. The two practices below are hypothetical.

Both owners ended up with the same three habits: one request to everyone, nothing offered, and replies that say nothing about anyone’s care.

Sources

1. Federal Trade Commission. The Consumer Reviews and Testimonials Rule: Questions and Answers (FTC staff business guidance, November 2024). Checked October 26, 2026.
   Show the passageHide the passage

   “The Commission’s Rule on the Use of Consumer Reviews and Testimonials, which went into effect on October 21, 2024”; “The rule authorizes courts to impose civil penalties for knowing violations”; “Our staff guidance isn’t definitive or comprehensive, and it doesn’t provide a safe harbor from potential liability.”; “Ordinary consumers can’t be liable under the rule for what they say or don’t say in reviews or testimonials.”; agencies, public relations firms, review brokers and reputation management companies “are not immune from liability under the rule”; “No, the rule does not provide a private right of action.”; “a business shouldn’t provide the text for a testimonial without a reasonable basis to conclude that the text is truthful about the testimonialist’s experience”; on asking only happy customers: “The rule does not contain a specific prohibition against such conduct. But this practice could violate the FTC Act.”; “When featured in that context, consumer reviews become testimonials and the exemption for review hosting does not apply to them.”; “The rule does not prohibit giving incentives for reviews, as long as there isn’t an express or implied requirement that the reviews have to express a particular sentiment. But remember that failing to disclose incentives could be a violation of the FTC Act.”; implied conditions include “Tell us how much you loved your visit to John’s Steakhouse and get a $5 coupon”; paying consumers to change or remove truthful negative reviews “may violate the FTC Act as an unfair or deceptive act or practice”; on insiders who disclose: “if these reviews materially increase the average star rating of a product, the business could be violating the FTC Act even with such disclosures”; “I own a small business. Can I ask my family members to write consumer reviews of my business? Yes, but ask them to clearly and conspicuously disclose their relationship to your business.”; an email to all recent customers that reaches a few employees did not violate the section, which “exempts generalized solicitations to purchasers”; of paying for 5-star reviews with a disclosure: “No. That conduct would violate Section 465.4. Note also that this section applies whether the reviews appear on your website or third-party review platforms.”; “The term ‘agents’ is meant to apply to people like representatives of advertising agencies, public relations firms, and review management firms.”; “Is a disclosure in the first line of a consumer review unavoidable? For the purposes of this rule, the Commission would consider such a disclosure to be unavoidable.”; “Yes, you can respond publicly to the review, and yes, you should watch what you say.”; “You can threaten a legal action if you have a legitimate basis for doing so.”; intimidation “can include abusive communications, stalking, character assassination, and sexual harassment”; asked whether the rule prohibits contacting customers who post negative reviews to resolve the reported issues: “No. It also does not prohibit simply asking satisfied customers to update their reviews.”; “Organizing reviews is not suppressing reviews under the rule.”; “the use of non-representative consumer reviews in marketing could be deceptive in violation of Section 5 of the FTC Act”; of a company-controlled site, “you would violate this section if the website has an express claim of independence, because that false express claim can’t be cured by your contradictory disclosure”.
2. Google. Prohibited & restricted content (Maps User Generated Content Policy Help; read with each section expanded). Checked October 26, 2026.
   Show the passageHide the passage

   Fake engagement includes “Reviews or ratings that have been paid for, directly or in kind.” Rating manipulation includes “Content that is based on a conflict of interest. A conflict of interest may include current or former employment, a contractual or consultory relationship, or other professional or personal affiliations that demonstrate a conflict of interest (such as industry competitors, familial relationships, etc.).” “We do not allow merchants to: Offer incentives – such as payment, discounts, free goods and/or services - in exchange for posting any review or revision or removal of a negative review. Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers”; “When soliciting reviews, merchants should not require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included.” This includes “Merchants requesting that staff solicit a certain number of reviews” and “Merchants requesting that staff solicit reviews that include specific content, including content that identifies a staff member.” “We do allow merchants to: Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review.” Under personal information, prohibited content includes “Personally identifiable information and other personal information about yourself or others including financial information, medical information or personal identification information.”.
3. 45 CFR. §164.502, Uses and disclosures of protected health information: General rules (eCFR; Title 45 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   (a): “A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart”; (g)(1): a covered entity must “treat a personal representative as the individual for purposes of this subchapter”; (g)(3)(i): “If under applicable law a parent, guardian, or other person acting in loco parentis has authority to act on behalf of an individual who is an unemancipated minor in making decisions related to health care, a covered entity must treat such person as a personal representative”, with stated exceptions.
4. Federal Trade Commission. FTC Warns 10 Companies About Possible Violations of the Agency’s New Consumer Review Rule (press release, December 22, 2025). Checked October 26, 2026.
   Show the passageHide the passage

   The letters “warn them that Rule violations can result in the filing of a federal lawsuit or other legal action, and civil penalties of up to $53,088 per violation”; they “are not formal determinations that the recipients have violated the Consumer Review Rule”.
5. 16 CFR. §465.2, Fake or false consumer reviews, consumer testimonials, or celebrity testimonials (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   (a): it is a violation “for a business to write, create, or sell a consumer review, consumer testimonial, or celebrity testimonial that materially misrepresents, expressly or by implication: (1) That the reviewer or testimonialist exists; (2) That the reviewer or testimonialist used or otherwise had experience with the product, service, or business that is the subject of the review or testimonial; or (3) The reviewer’s or testimonialist’s experience”; (b) covers a business that purchases a consumer review, or disseminates a testimonial, “which the business knew or should have known materially misrepresented” those things; (c) covers a business that procures “a consumer review from its officers, managers, employees, or agents, or any of their immediate relatives, for posting on a third-party platform or website” when it knew or should have known the review misrepresented them; (d): (b) and (c) “do not apply to: (1) Reviews or testimonials that resulted from a business making generalized solicitations to purchasers to post reviews or testimonials about their experiences with the product, service, or business; or (2) Reviews that appear on a website or platform as a result of the business merely engaging in consumer review hosting.”.
6. 16 CFR. §465.4, Buying positive or negative consumer reviews (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   “It is an unfair or deceptive act or practice and a violation of this part for a business to provide compensation or other incentives in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment, whether positive or negative, regarding the product, service, or business that is the subject of the review.”.
7. 16 CFR. §465.5, Insider consumer reviews and consumer testimonials (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   (a): a violation “for an officer or manager of a business to write or create a consumer review or consumer testimonial about the business or one of the products or services it sells that fails to have a clear and conspicuous disclosure of the officer’s or manager’s material relationship to the business, unless, in the case of a consumer testimonial, the relationship is otherwise clear to the audience”; (b)(1) covers a business disseminating a testimonial by “one of its officers, managers, employees, or agents” without that disclosure; (c)(1): a violation “for an officer or manager of a business to solicit or demand a consumer review about the business or one of the products or services it sells from any of their immediate relatives or from any employee or agent of the business” when the resulting review lacks a disclosure and the officer or manager “(A) Encouraged the prospective reviewer not to make such a disclosure, (B) Did not instruct that prospective reviewers disclose clearly and conspicuously their relationship to the business, or (C) knew or should have known that such a review appeared without such a disclosure and failed to take remedial steps”; (c)(2): it “does not apply to generalized solicitations to purchasers for them to post reviews about their experiences”.
8. 16 CFR. §465.6, Company-controlled review websites or entities (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   A violation “for a business to materially misrepresent, expressly or by implication, that a website, organization, or entity that it controls, owns, or operates provides independent reviews or opinions, other than consumer reviews, about a category of businesses, products, or services including the business or one or more of the products or services it sells.”.
9. 16 CFR. §465.7, Review suppression (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
   Show the passageHide the passage

   (a): a violation “For anyone to use an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation in response to a consumer review that is made with the knowledge that the accusation was false or made with reckless disregard as to its truth or falsity, in an attempt to: (1) Prevent a review or any portion thereof from being written or created, or (2) Cause a review or any portion thereof to be removed”; (b): a violation for a business to misrepresent that the reviews displayed in a portion of its website dedicated to reviews “represent most or all the reviews submitted to the website or platform when reviews are being suppressed (i.e., not displayable) based upon their ratings or their negative sentiment”; a review is not suppressed when withheld on criteria “applied equally to all reviews submitted without regard to sentiment”, such as a review containing “The personal information or likeness of another individual” or one the seller reasonably believes is fake.
10. 16 CFR. §465.8, Misuse of fake indicators of social media influence (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    A violation “for anyone to: (a) Sell or distribute fake indicators of social media influence that they knew or should have known to be fake” or “(b) Purchase or procure fake indicators of social media influence that they knew or should have known to be fake and that materially misrepresent their influence or importance for a commercial purpose”; §465.1(j) lists “followers, friends, connections, subscribers, views, plays, likes, saves, shares, reposts, and comments” among indicators of social media influence.
11. Federal Trade Commission. Consumer Review Fairness Act: What Businesses Need to Know (business guidance, February 2017). Checked October 26, 2026.
    Show the passageHide the passage

    The Act “makes it illegal for a company to use a contract provision that: bars or restricts the ability of a person who is a party to that contract to review a company’s products, services, or conduct; imposes a penalty or fee against someone who gives a review; or requires people to give up their intellectual property rights in the content of their reviews”; “(The law doesn’t apply to employment contracts or agreements with independent contractors, however.)”; it is OK to prohibit or remove a review that “contains confidential or private information – for example, a person’s financial, medical, or personnel file information”; “it’s unlikely that a consumer’s assessment or opinion with which you disagree meets the ‘clearly false or misleading’ standard”; “a violation of the CRFA will be treated the same as violating an FTC rule defining an unfair or deceptive act or practice”; “Remove any provision that restricts people from sharing their honest reviews, penalizes those who do, or claims copyright over peoples’ reviews (even if you’ve never tried to enforce it or have no intention of enforcing it).”.
12. U.S. Department of Health and Human Services, Office for Civil Rights. Manasa Health Center LLC Resolution Agreement and Corrective Action Plan (content last reviewed June 5, 2023). Checked October 26, 2026.
    Show the passageHide the passage

    Manasa “is a practice located in Kendall Park, New Jersey that provides adult and child psychiatric services”; the covered conduct: “Manasa impermissibly disclosed the PHI of four (4) patients in response to their negative reviews posted on Google Reviews. See 45 C.F.R. § 164.502(a).”; “HHS has agreed to accept, and Manasa has agreed to pay HHS, the amount of $30,000”; “This Agreement is not an admission of liability by Manasa.”.
13. 16 CFR. §255.2, Consumer endorsements (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a): “Consumer endorsements themselves are not competent and reliable scientific evidence.”; (b): an endorsement relating a consumer's experience on a central attribute “will likely be interpreted as representing that the endorser’s experience is representative of what consumers will generally achieve”; without substantiation for that, “the advertisement should clearly and conspicuously disclose the generally expected performance in the depicted circumstances”; (d): “In procuring, suppressing, boosting, organizing, publishing, upvoting, downvoting, reporting, or editing consumer reviews of their products, advertisers should not take actions that have the effect of distorting or otherwise misrepresenting what consumers think of their products”; (e)(10)(i): threats “with the disclosure of embarrassing information, with baseless lawsuits” to coerce deletion of negative reviews “amount to an unfair or deceptive practice”; (e)(10)(ii): a manufacturer that “routinely flags negative reviews of its products as fake without a reasonable basis for believing that they actually are fake”: “This misuse of the reporting option is an unfair or deceptive practice.”; (e)(11): a marketer that invites only purchasers who gave very positive feedback to post online reviews, while unhappy purchasers are simply thanked, “may be an unfair or deceptive practice if it results in the posted reviews being substantially more positive than if the marketer had not engaged in the practice”; “If, in the alternative, the marketer had simply invited all recent purchasers to provide feedback on third-party websites, the solicitation would not have been unfair or deceptive, even if it had expressed its hope for positive reviews.”.
14. 45 CFR. §164.508, Uses and disclosures for which an authorization is required (eCFR; Title 45 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a)(1): “Except as otherwise permitted or required by this subchapter, a covered entity may not use or disclose protected health information without an authorization that is valid under this section.”; (a)(3)(i): “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing”, except face-to-face communications and promotional gifts of nominal value; (b)(3): “An authorization for use or disclosure of protected health information may not be combined with any other document to create a compound authorization”, except as listed; (b)(4): “A covered entity may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization”, except as listed; (b)(5): “An individual may revoke an authorization provided under this section at any time, provided that the revocation is in writing”; (c)(1) core elements include “A description of the information to be used or disclosed that identifies the information in a specific and meaningful fashion”, “A description of each purpose of the requested use or disclosure”, “An expiration date or an expiration event” and “Signature of the individual and date. If the authorization is signed by a personal representative of the individual, a description of such representative’s authority to act for the individual must also be provided.”; (c)(3): “The authorization must be written in plain language.”.
15. 16 CFR. §465.1, Definitions (Rule on the Use of Consumer Reviews and Testimonials; eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a): “Business means an individual who sells products or services, a partnership that sells products or services, a corporation that sells products or services, or any other commercial entity that sells products or services.”; (d): “For the purposes of this part, consumer reviews include consumer ratings regardless of whether they include any text or narrative.”; (f): a consumer testimonial is “an advertising or promotional message” that consumers are likely to believe reflects the experiences of a consumer; (c)(4): “A disclosure is not clear and conspicuous if a consumer must take any action, such as clicking on a hyperlink or hovering over an icon, to see it.”; (i): “Immediate Relative means a spouse, parent, child, or sibling.”; (k): “Manager means an employee of a business who supervises other employees or agents and who either holds the title of a ‘manager’ or otherwise serves in a managerial role.”; (l): “Officers include owners, executives, and managing members of a business.”; (m): “Purchase a consumer review means to provide something of value, such as money, gift certificates, products, services, discounts, coupons, contest entries, or another review, in exchange for a consumer review.”; (p): an unfounded or groundless legal threat is “a legal threat based on claims, defenses, or other legal contentions unwarranted by existing law or based on factual contentions that have no evidentiary support”.
16. Federal Trade Commission. FTC Takes Action Against Telemedicine Firm NextMed Over Charges It Used Misleading Prices, Fake Reviews, and Deceptive Weight Loss Claims (press release, July 14, 2025; a proposed consent order). Checked October 26, 2026.
    Show the passageHide the passage

    The complaint alleges the operators “published fake testimonials created by hired individuals, employees, and family members” and “distorted consumer reviews by flagging negative reviews without a basis, selectively soliciting positive reviews from satisfied customers, and providing refunds or gift cards in exchange for customers changing or removing negative reviews”; “NextMed and its principals will pay $150,000”.
17. Google. Tips to get more reviews (Google Business Profile Help). Checked October 26, 2026.
    Show the passageHide the passage

    “Offering incentives, like free or discounted goods or services, in exchange for customers to post reviews, change reviews, or remove negative reviews is considered fake & misleading content and is strictly prohibited.”; “To leave reviews, you can ask customers to visit a Google link or scan a QR code.”; “Personalize your reply: Address the reviewer by name and acknowledge their specific feedback.”; “Protect privacy and avoid personal attacks: Never share a reviewer’s private information or engage in personal attacks.”.
18. Google. Business Profile restrictions for policy violations (Google Business Profile Help). Checked October 26, 2026.
    Show the passageHide the passage

    If a business owner has violated the Fake Engagement policy, restrictions may be placed on the profile “(in addition to removing the violative reviews)”, including “Business Profile will not be able to receive new reviews or ratings for set period of time”; “Business Profile’s existing reviews or ratings will be unpublished for set period of time”; “Business Profile will display a warning to let consumers know that fake reviews were removed”; “We will notify business owners via email if we plan to apply a restriction to their profile.”; “Businesses have the ability to appeal our decision.”.
19. Federal Trade Commission. Federal Trade Commission Announces Final Rule Banning Fake Reviews and Testimonials (press release, August 14, 2024). Checked October 26, 2026.
    Show the passageHide the passage

    The final rule “addresses reviews and testimonials that misrepresent that they are by someone who does not exist, such as AI-generated fake reviews, or who did not have actual experience with the business or its products or services, or that misrepresent the experience of the person giving it”; “The final rule prohibits a business from using unfounded or groundless legal threats, physical threats, intimidation, or certain false public accusations to prevent or remove a negative consumer review.”.
20. 16 CFR. §255.1, General considerations (Guides Concerning Use of Endorsements and Testimonials in Advertising; eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a): “Endorsements must reflect the honest opinions, findings, beliefs, or experience of the endorser.”; (b): “the endorsement may not be presented out of context or reworded so as to distort in any way the endorser’s opinion or experience with the product”; (d): advertisers should “(1) Provide guidance to their endorsers on the need to ensure that their statements are not misleading and to disclose unexpected material connections; (2) Monitor their endorsers’ compliance; and (3) Take action sufficient to remedy non-compliance and prevent future non-compliance”.
21. 16 CFR. §255.0, Purpose and definitions (Guides Concerning Use of Endorsements and Testimonials in Advertising; eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a): “The Guides in this part represent administrative interpretations of laws enforced by the Federal Trade Commission for the guidance of the public in conducting its affairs in conformity with legal requirements. Specifically, the Guides address the application of section 5 of the FTC Act, 15 U.S.C. 45, to the use of endorsements and testimonials in advertising.”; (c): “The Commission intends to treat endorsements and testimonials identically”; (g)(2), of a commercial in which two unidentified shoppers praise a product: “This obviously fictional dramatization would not be an endorsement.”.
22. 45 CFR. §160.103, Definitions (eCFR; Title 45 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    Covered entity includes “A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.”; “Disclosure means the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information.”; individually identifiable health information is information that “Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual” and “(i) That identifies the individual; or (ii) With respect to which there is a reasonable basis to believe the information can be used to identify the individual.”.
23. 16 CFR. §255.5, Disclosure of material connections (eCFR; Title 16 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    (a): “When there exists a connection between the endorser and the seller of the advertised product that might materially affect the weight or credibility of the endorsement, and that connection is not reasonably expected by the audience, such connection must be disclosed clearly and conspicuously. Material connections can include a business, family, or personal relationship. They can include monetary payment or the provision of free or discounted products”; (b)(8), of an employee posting about the employer's product: “To limit its own liability for such posts, the employer should engage in appropriate training of employees.” and the disclosure requirements “would apply equally to employees posting their own reviews of the product on retail websites or review platforms”.
24. Yelp. Don’t Ask for Reviews (Yelp Support Center, part of Yelp’s Content Guidelines). Checked October 26, 2026.
    Show the passageHide the passage

    “Don’t ask anyone to review your business, be it customers, mailing list subscribers, friends, family, etc.”; “Your staff should never compete to collect reviews.”; “Don’t ask for reviews after requesting customer feedback in other places like surveys or contact forms.”; “Don’t offer freebies, discounts, or payment in exchange for reviews”; “you can’t offer incentives for users to remove reviews”; “Yelp’s software tries to identify any reviews that appear to have been requested, and not recommend them.”.
25. Federal Trade Commission. Soliciting and Paying for Online Reviews: A Guide for Marketers (business guidance, January 2022). Checked October 26, 2026.
    Show the passageHide the passage

    “Before you ask people for reviews, know the rules of the platforms and websites on which those reviews may appear.”; “Some platforms and websites prohibit reviews from people with personal or financial connections to the seller, or who got an incentive for the reviews – even if the reviews disclose that connection or incentive.”; “Don’t ask your staff to write reviews of your business, at least not without ensuring that they disclose in their review that you employ them and asked them to write it.”; “Don’t ask for reviews only from customers you think will leave positive ones.”; “Many review platforms have reporting mechanisms that allow businesses to flag for the platform when a review may be fake, defamatory, or otherwise in violation of the platform’s terms of service. Don’t misuse this option to get rid of honest, negative reviews.”; of SEO and reputation management companies: “you can be held responsible for what they do on your behalf, and review platforms could suspend or remove your accounts and listings”.
26. Federal Trade Commission. Featuring Online Customer Reviews: A Guide for Platforms (business guidance, January 2022). Checked October 26, 2026.
    Show the passageHide the passage

    “Don’t edit reviews to alter the message. For example, don’t change words to make a negative review sound more positive.”; “Treat positive and negative reviews equally. Don’t subject negative reviews to greater scrutiny.”; “Publish all genuine reviews and don’t exclude negative ones.”; “Don’t display reviews in a misleading way. For example, it could be deceptive to feature the positive ones more prominently.”; “Clearly and conspicuously disclose how you collect, process, and display reviews, and how you determine overall ratings, to the extent necessary to avoid misleading consumers.”.
27. U.S. Department of Health and Human Services, Office for Civil Rights. What is the difference between “consent” and “authorization” under the HIPAA Privacy Rule? (HIPAA FAQ; content last reviewed December 28, 2022). Checked October 26, 2026.
    Show the passageHide the passage

    “an ‘authorization’ is required by the Privacy Rule for uses and disclosures of protected health information not otherwise allowed by the Rule”; “An authorization is a detailed document that gives covered entities permission to use protected health information for specified purposes, which are generally other than treatment, payment, or health care operations”; “With limited exceptions, covered entities may not condition treatment or coverage on the individual providing an authorization.”.
28. U.S. Department of Health and Human Services, Office for Civil Rights. Marketing (HIPAA Privacy Rule guidance, 45 CFR 164.501 and 164.508(a)(3); content last reviewed July 26, 2013). Checked October 26, 2026.
    Show the passageHide the passage

    “With limited exceptions, the Rule requires an individual’s written authorization before a use or disclosure of his or her protected health information can be made for marketing.”; “This exception to the marketing definition permits communications by a covered entity about its own products or services.”.
29. 45 CFR. §164.501, Definitions (eCFR; Title 45 up to date as of October 23, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “marketing means to make a communication about a product or service that encourages recipients of the communication to purchase or use the product or service”; marketing does not include communications made for treatment and health care operations purposes such as one “To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication”, “except where the covered entity receives financial remuneration in exchange for making the communication”.
30. American Speech-Language-Hearing Association. Code of Ethics (2023; effective March 1, 2023). Checked October 26, 2026.
    Show the passageHide the passage

    Principle of Ethics I, Rules of Ethics: “Individuals shall protect the confidentiality of information about persons served professionally or participants involved in research and scholarly activities. Disclosure of confidential information shall be allowed only when doing so is legally authorized or required by law.”; “Individuals may make a reasonable statement of prognosis, but they shall not guarantee—directly or by implication—the results of any treatment or procedure.” Principle of Ethics III, Rules of Ethics: “Individuals shall not misrepresent diagnostic information, services provided, results of services provided”; “Individuals’ statements to the public shall adhere to prevailing professional standards and shall not contain misrepresentations when advertising, announcing, or promoting their professional services, products, or research.” Terminology: advertising is “Any form of communication with the public regarding services, therapies, research, products, or publications.”.
31. American Physical Therapy Association. APTA Code of Ethics for the Physical Therapy Profession (Standards of Conduct and Aspirational Illustrative Examples). Checked October 26, 2026.
    Show the passageHide the passage

    “1.2 Physical therapists and physical therapist assistants shall protect patients’ and clients’ confidential information and not disclose that confidential information except as authorized by the patient or client or as permitted or required by law.”; “6.1 Physical therapists and physical therapist assistants shall provide information about their services that is truthful and accurate and shall not make misleading representations in any forms of communication, including billing.”; “3.D Physical therapists and physical therapist assistants shall strive to be accountable for the accuracy and truthfulness of information they disseminate, including in the use of emerging technologies, such as social media and artificial intelligence.”.
32. American Occupational Therapy Association. Ethics (Practice Essentials; the page links the AOTA 2025 Occupational Therapy Code of Ethics, doi:10.5014/ajot.2025.79S302, PMID 41343290). Checked October 26, 2026.
    Show the passageHide the passage

    “Occupational therapy personnel, including occupational therapists, occupational therapy assistants, and students, have an obligation to demonstrate ethical conduct that reflects professional values when working with clients, families, caregivers, administrators, colleagues, policymakers, payers, and other health care professionals.” AOTA’s Code of Ethics Core Values and Principles infographic (© 2025) lists veracity among the guiding principles and states: “Sanctionable offenses and violations of ethical standards are addressed separately under the Code’s Standards of Conduct, which outline specific and enforceable behaviors.”.
33. U.S. Department of Health and Human Services, Office for Civil Rights. New Vision Dental Resolution Agreement and Correction Action Plan (content last reviewed December 14, 2022). Checked October 26, 2026.
    Show the passageHide the passage

    The complaint alleged the practice “habitually disclosed PHI when it responded to patient posts sometimes providing full names where only Yelp monikers were used by the patients and including detailed information about patient visits and insurance that may not have been previously mentioned in their initial reviews”; “OCR confirmed that NVD had been posting responses to reviews that compromised PHI”; covered conduct included “NVD failed to implement policies and procedures with respect to PHI, including releasing PHI on social media/public platforms”; “NVD has agreed to pay HHS, the amount of $23,000”; “This Agreement is not an admission of liability by NVD.”.
34. U.S. Department of Health and Human Services, Office for Civil Rights. Business Associates Frequently Asked Questions (FAQs) (content last reviewed October 21, 2026). Checked October 26, 2026.
    Show the passageHide the passage

    “Generally, business associates are persons, other than a workforce member of a covered entity, that are engaged by a covered entity to carry out certain health care activities and functions or to provide certain services that involve the use or disclosure of PHI.”; “The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a ‘business associate agreement,’ or BAA), that the business associate will appropriately safeguard the information”.
35. DrSensory. DrSensory for therapists (the For Therapists hub). Checked October 26, 2026.
    Show the passageHide the passage

    “DrSensory is a directory families use free to find occupational therapy, physical therapy and speech therapy clinics”; “A paid listing adds your own description, logo, up to five photos, hours, reviews with your replies, and inquiries that come to you instead of to the DrSensory team.”; “families can review you”; “Publish, and ask families for reviews the honest way: everyone, with nothing offered in return.”.
36. DrSensory. Therapy Clinic Directory Pricing. Among the claimed listing’s features: “Collect and display reviews”, described as “Gather and show reviews from the families you work with, and reply publicly.”; the comparison table lists “Reply to reviews” as No on an unclaimed listing and Yes on a claimed one; “We do not verify clinical quality.”. Checked October 26, 2026.

Medical disclaimer. This page is for general educational purposes and does not constitute medical advice, diagnosis, or treatment. It is general guidance on running a therapy practice, not legal, compliance or privacy advice. Whether a particular review request, reply or testimonial complies depends on its facts, which the practice’s lawyer or privacy officer decides.