Reviews and the law: the FTC rule, gag clauses, Section 230 and HIPAA
Five sets of US rules touch what a business may do about a review. None of them gives a business the right to have a review removed. Several of them punish the wrong way of trying. This hub links our pages on each, all sourced to the primary documents. We remove reviews the lawful way, by reporting rule breaches to Trustpilot. It is general information, not legal advice.
Updated
100% risk-free. You only pay for the reviews that come down.
Short answer
Five sets of US rules apply to reviews. The FTC's Consumer Review Rule bans fake reviews, paid sentiment and suppression by threat, with penalties of up to $53,088 per violation. The Consumer Review Fairness Act voids contract terms that gag customers. Section 230 shields platforms from liability for what users write. Defamation law reaches false statements of fact that cause harm. HIPAA limits what a health provider may say in a reply. Flagging a review under a platform's own rules is lawful under all of them.
Key facts
The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, has been in effect since October 21, 2024.
The civil penalty under the rule is up to $53,088 per violation.
Source: FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025, Federal Trade Commission
The Consumer Review Fairness Act voids form-contract terms that ban or penalize honest customer reviews.
Source: Consumer Review Fairness Act: What Businesses Need to Know, Federal Trade Commission
Section 230 says a platform is not treated as the publisher of content provided by its users.
HHS settled with a provider for $30,000 in 2023 after it disclosed patient information in replies to negative online reviews.
The FTC's final order against the telehealth company NextMed, in December 2025, required a $150,000 payment.
The five rules at a glance
| Rule | What it does | What it means for a business |
|---|---|---|
| FTC Consumer Review Rule, 16 CFR Part 465 | Bans fake reviews, incentives tied to sentiment, undisclosed insider reviews and review suppression | No threats, no intimidation, no bought reviews. Penalties per violation |
| Consumer Review Fairness Act, 15 U.S.C. § 45b | Voids contract terms that ban, fine or take ownership of customer reviews | No gag clauses in your terms, refund policy or intake forms |
| Section 230, 47 U.S.C. § 230 | Says a platform is not the publisher of what its users write | You cannot usually sue the review site. A claim is against the writer |
| State defamation law | Gives a claim over false statements of fact that cause harm | Opinions are protected. Truth is a defense. Litigation is slow and public |
| HIPAA Privacy Rule | Limits disclosure of protected health information by covered entities | A reply must not confirm that a reviewer is a patient |
The FTC's Consumer Review Rule
The rule took effect on October 21, 2024. Its section on review suppression covers groundless legal threats, physical threats, intimidation and knowingly false accusations used to stop or remove a review. The FTC's guidance says the rule covers reputation management companies as well as the businesses that hire them.
- What the FTC's Consumer Review Rule means for review removal goes through the rule section by section, with the NextMed case.
- Whether review removal is legal, method by method sorts flagging, paying reviewers, threats, gag clauses and lawsuits by what the law allows.
The case to know is NextMed. In July 2025 the FTC said the telehealth company had suppressed negative Trustpilot reviews by selectively challenging critical reviews, offering gift cards for changes and making refunds depend on removal. The final order in December 2025 required a $150,000 payment. Our GLP-1 page sets that conduct next to the compliant alternative.
The Consumer Review Fairness Act
A 2016 law about contracts. If your terms say a customer may not post a negative review, that term is void, and offering it is unlawful.
- The Consumer Review Fairness Act, explained for online brands covers what it bans, its exceptions and a five-point check of your own terms.
- Incentivized reviews: what Trustpilot, Google and the FTC allow draws the line between an incentive for a review and an incentive for a good one.
- Review gating: what it is and why it is banned covers the survey that sends happy customers one way and unhappy ones another.
Section 230 and defamation
These two decide whether a lawsuit is possible and against whom.
- When you can sue over a bad review, and when you cannot. It covers the elements of defamation and the line between fact and opinion. It also explains why the platform is rarely the defendant and what a legal letter may lawfully say.
For the choice between the two routes, see our comparison of a law firm and a removal service. We also have a page on one defamation firm's published approach.
HIPAA in replies
A reply that confirms someone is a patient, or mentions their treatment, can disclose protected health information. It does not matter that the patient said it first. HHS settled a case over replies to online reviews in 2023.
- How to reply to 1-star reviews without sharing health information has a four-part reply framework and examples by complaint type.
- How to respond to negative reviews is the general version, with four templates and the rule that keeps a health brand safe.
The FTC's health products guidance adds a second limit. It treats statements on the internet and in social media as advertising, so a reply should not make health claims. Each of our pages for health categories has a section on reply limits.
Where Trustpilot's own rules fit
Trustpilot's guidelines are not law, and they are often stricter than the law. Trustpilot bans any incentive for a review, where the FTC's rule bans incentives tied to a sentiment. Trustpilot treats negative-only flagging as misuse, and the FTC described the same conduct as suppression. A method should pass both tests. Our Trustpilot hub covers that platform's side, and our Google reviews hub covers Google's, where incentives for reviews are banned as well.
We work inside these rules
We report only reviews that break the platform's published rules, through Trustpilot's flagging tool or Google's report tool. We work across star ratings, on a schedule, and never flag a whole profile in one batch. We do not contact reviewers, pay anyone, draft legal letters or write reviews. The main Trustpilot review removal page and Google review removal page explain the process.
We are not a law firm. When an audit finds a review that looks like a legal question, we say so and suggest you speak to counsel.
Frequently asked questions
Asking a platform to remove a review that breaks its rules is lawful, and the FTC's guidance says its rule does not stop that. Threats, intimidation, paying reviewers and gag clauses are not. Our guide on whether review removal is legal sorts each method.
The FTC's review rule, because the agency's first Trustpilot-related case was against a GLP-1 telehealth brand. HIPAA is second, because a careless public reply can disclose that someone is a patient.
No. These pages describe published rules and link to them. We are not a law firm. For a decision about your own case, speak to a lawyer.
Primary sources used on this page
- 16 CFR Part 465: Rule on the Use of Consumer Reviews and Testimonials. Electronic Code of Federal RegulationsLast verified
- FTC Publishes Inflation-Adjusted Civil Penalty Amounts for 2025. Federal Trade CommissionLast verified
- Consumer Review Fairness Act: What Businesses Need to Know. Federal Trade CommissionLast verified
- 47 U.S. Code § 230: Protection for private blocking and screening of offensive material. Legal Information Institute, Cornell Law SchoolLast verified
- OCR agreement with a provider that disclosed patient information in response to negative online reviews. U.S. Department of Health and Human ServicesLast verified
- FTC Approves Final Order against Telehealth Provider NextMed (December 3, 2025). Federal Trade CommissionLast verified
Changes to this page
- First published, linking five guides and two comparisons.