GoodRepWhat Legal Issues Should Local Businesses Know About With Review Management?
The legal landscape around online reviews is wider than most owners realize. Most of it comes down to four areas: incentives, gating, defamation responses, and disclosure.
Online reviews sit at the intersection of platform policy, consumer protection law, and (occasionally) defamation. Most local business owners interact with that intersection without knowing it: they offer a discount for a review, they screen customers before sending them to the review form, they consider suing over a one-star post. Each of those moves has legal consequences that aren't well-publicized but are real.
This post is a plain-English overview of the four legal areas that come up most for local SMBs. It is not legal advice. For anything specific to your situation, the answer is to talk to a lawyer who handles consumer-facing or marketing law in your state.
Key takeaways
- Review incentives: discounts, gift cards, or contest entries for reviews violate FTC, Google, Yelp, and Facebook rules.
- Review gating: routing only happy customers to the review form is prohibited by Google and Yelp.
- Negative review responses: privacy law and HIPAA constrain what you can say about a customer in public.
- Defamation suits: legally available, almost never strategically smart.
- The downside of getting it wrong: removed reviews, account suspension, FTC enforcement, or publicity that compounds the original problem.
Issue 1: Review Incentives Violate FTC and Platform Rules
The most common legal misstep among local businesses is offering something in exchange for a review. A discount on the next visit. A gift card. An entry into a contest. All of it is technically prohibited under several overlapping rule sets.
The FTC's endorsement guidelines require that any material connection between an endorser and the business (including a discount or gift card) be clearly disclosed. A customer review prompted by a discount is a material connection. Most customers don't disclose it, and most businesses don't tell them they need to. That's the violation.
Beyond the FTC, every major platform has its own prohibition. Google's review policies prohibit "incentivized reviews." Yelp specifically calls out "compensation in exchange for reviews." Facebook's recommendations policy is similar. Enforcement varies, but when platforms catch incentivized review patterns, the response can include removing all the affected reviews (not just the incentivized ones) and suspending the business profile.
What is allowed: asking for a review without offering anything in return. A direct, polite request after a transaction is the legitimate pattern. How to ask for reviews without violating platform rules covers the compliant version.
Issue 2: Review Gating Is Explicitly Prohibited
"Review gating" is the practice of asking customers a satisfaction question first, then routing only the happy ones to the public review form (and unhappy ones to a private feedback channel). It looks reasonable on the surface. It's prohibited.
Google's policy against gating is direct: "Don't discourage or prohibit negative reviews or selectively solicit positive reviews from customers." Yelp has the same policy. The reason is that gated reviews produce a public profile that doesn't represent the actual customer experience. Both platforms can detect gating patterns, and the consequence usually starts with removing the affected reviews.
The line between gating and a legitimate satisfaction survey is whether the routing is sentiment-based. A survey that asks "how was your experience" and then sends every respondent the same review link is fine. A survey that sends 5-star raters to Google and 2-star raters to a "tell us privately" form is gating.
The compliant version of the same goal: ask every customer for a review, respond carefully and well to the negative ones that come in, and let the volume of positive ones move the average naturally.
Issue 3: Privacy Law Constrains Negative Review Responses
When a customer leaves a negative review, the natural impulse is to set the record straight. In some industries, doing that creates legal exposure.
The clearest case is healthcare. HIPAA prohibits a covered entity from disclosing protected health information without patient authorization, and that includes confirming or denying that someone was a patient. A medical practice that responds to a negative review with "We see you were treated by Dr. Smith on March 14 and the procedure went exactly as documented" has just disclosed PHI. The OCR has fined practices for exactly this. Reviews for medical practices goes into the constraint in more detail.
Healthcare is the most regulated example, but the principle extends. Legal practice (attorney-client privilege constrains what you can disclose), addiction treatment (42 CFR Part 2 has its own confidentiality rules), and mental health services all have stricter disclosure rules than ordinary consumer businesses. Reviews for professional services covers the broader pattern.
The safe response in any regulated context is the same: acknowledge the feedback in general terms, express that you take concerns seriously, and invite the person to contact you directly to discuss further. No specifics, no confirmation of the relationship, no facts about the engagement.
Issue 4: Defamation Suits Are Available, Rarely Smart
A genuinely false negative review can rise to defamation under state law. Defamation generally requires a false statement of fact (not opinion), publication to a third party, fault on the part of the publisher, and damages. A review that claims you committed an illegal act, made false credentials claims, or otherwise stated something verifiably false might meet the standard.
The legal action is available. The strategic problem is that it almost never improves the business situation. Suing a customer over a review tends to produce media coverage, draw attention to the original review, attract additional negative reviews from people who side with the customer, and generate a permanent association between your business name and the lawsuit. The Streisand effect is well-documented.
There are a small number of cases where a defamation claim is the right answer (a coordinated false review campaign by a competitor, for example). For ordinary disgruntled-customer reviews, the better path is to use the platform's reporting mechanism for content that violates platform policies (impersonation, off-topic content, hate speech, conflict of interest), respond calmly and professionally, and let the volume of legitimate reviews do its work. Disputing fake reviews covers what's actually achievable through platform processes.
Anti-SLAPP laws in many states also create real risk for the plaintiff in a review-related defamation suit. If the suit is dismissed under an anti-SLAPP motion, the business may end up paying the customer's legal fees.
Issue 5: The Federal Consumer Review Fairness Act
Worth knowing about: the federal Consumer Review Fairness Act of 2016 makes it illegal for businesses to use form contracts that prohibit customers from posting honest reviews. If your terms of service, customer agreement, or release form includes a non-disparagement clause that bars negative reviews, that clause is unenforceable and the business itself is exposed to FTC and state attorney general enforcement. The fix is to remove any such clause from standard agreements.
This is more common in service industries than retail (contractor agreements, tutoring contracts, gym memberships have all surfaced as enforcement examples), but it's worth a one-time review of any contract template the business uses with customers.
What Compliant Review Management Looks Like
The picture above sounds like a list of things you can't do. The compliant version is shorter than it looks.
Ask every customer for a review with no incentive offered. Send all customers the same direct link to your Google review form. When a negative review comes in, respond calmly and in general terms, especially in regulated industries. Use platform reporting for reviews that violate platform policies. Keep contracts free of non-disparagement clauses. Skip the lawsuit unless the case is unusually clear.
Most local businesses doing review management this way are fully compliant without thinking about it. The legal exposure usually arises from shortcuts (incentives, gating, contract clauses) that promise faster results and deliver the wrong kind of attention.
The Bottom Line
The legal issues around review management aren't usually obscure. They're the predictable consequences of incentive-shaped, gating-shaped, or aggressive responses to bad reviews. The compliant version of review management is also the version that performs better long term: every-customer asks, calm responses, platform reporting for genuinely false content, no contract clauses that pretend to silence reviewers.
When something feels like a shortcut, it's usually the issue.
This post is general information, not legal advice. For any specific situation, talk to a lawyer in your state who handles marketing or consumer-facing law.
GoodRep keeps the day-to-day work compliant by default: every-customer asks, no gating logic, audit logs for responses, and reporting workflows for reviews that violate platform policies. $39/month, 14-day free trial. Start free.