The FTC fake review rule, one year in: what actually got enforced

The FTC’s Consumer Reviews and Testimonials Rule - the “fake review rule” - took effect October 21, 2024, with civil penalties of up to $53,088 per violation. For its first fourteen months, enforcement was theoretical. Then it wasn’t: on December 22, 2025, the FTC sent its first warning-letter sweep to ten companies, and in January 2026 it announced a settlement with Growth Cave - a $48.6 million judgment in the first case alleging a violation of the rule.

So one year in, the picture is: real enforcement, aimed (so far) at egregious actors, with a per-violation penalty number that makes the math terrifying for everyone else. If you run a small business, the list of things you actually need to change is short and specific. Here it is, after a quick look at what year one actually punished.

What the rule bans, in one paragraph

Buying or selling fake reviews. Reviews from insiders - owners, employees, their relatives - without clear disclosure of the relationship. Company-run review sites dressed up as independent. Suppressing negative reviews through threats or intimidation. And buying fake social-media engagement to inflate influence. None of this was exactly legal before; the rule’s contribution is that each instance now carries that five-figure civil penalty, per violation, without the FTC needing to prove a prior order was violated.

Year one’s enforcement record

The December 2025 sweep was warning letters, not fines - ten companies, identities not disclosed. Warning letters are the FTC’s cheapest tool, but they do something quietly important: they establish that the recipient knows. Knowledge is what turns subsequent violations into clean penalty cases. A warning letter is the FTC pre-loading its next, much more expensive move.

Growth Cave is the expensive move. In January 2026 the FTC announced a settlement with the business-opportunity seller and its founder: a $48,597,538 judgment (largely suspended for inability to pay) and a permanent ban from selling business opportunities. The headline number gets the attention. The useful detail is buried in the allegations: among other things, Growth Cave re-used the same customer testimonials across different products, and ran testimonials from insiders without disclosure.

Read that again, because it’s not exotic fraud. Recycling a good testimonial onto a new service page is something thousands of ordinary businesses have done without a second thought. That’s what makes Growth Cave worth your ten minutes - the first rule case in history turned partly on a marketing habit you might have.

What a normal business actually changes

Five items. Most businesses need two of them.

• Testimonials stay attached to what they praised. A review of your teeth-whitening service doesn’t promote your new aligner program. Audit your site: every testimonial tied to the product it described, with nothing invented and nothing borrowed.
• Insider reviews get disclosed or deleted. Employee and family reviews without disclosure are violations - and the business that solicited or knowingly kept them carries exposure. The full mess of employee reviews has its own guide.
• Never buy reviews, obviously - but also never buy “review removal.” Services promising to delete negatives often operate through fraudulent takedown claims, and the suppression provisions cut close to that territory.
• Don’t threaten reviewers to make negatives disappear. Legal-sounding letters demanding removal of honest opinions are now a named federal no-no, not just a bad look.
• Incentives can’t be conditioned on positivity. “Leave us a 5-star review for 10% off” was already a platform violation; conditioned incentives are squarely in the rule’s sights too. The details live in our piece on whether discounts for reviews are legal.

A worked example of how cheap compliance usually is: Juniper Lane, a three-chair salon-spa in Asheville, ran its audit in February after the Growth Cave coverage. Findings: a “client love” page with 20 testimonials, 14 of which had been copied from its old massage-only location onto pages for services that location never offered, plus two reviews from a stylist’s sister. The fix took an afternoon - 14 testimonials removed, 6 re-homed to the right service pages, two awkward texts sent. Total cost: zero dollars and one slightly thinner testimonial page that now can’t hurt them.

The part nobody tells you

The rule covers fake reviews you receive, not just ones you commission. If a review is from an insider or is plainly fabricated and you know it, featuring it in your marketing - screenshots in ads, quotes on the homepage - moves the liability to you. The safe posture is boring: treat your review profile as evidence you didn’t curate. Respond to everything, promote the aggregate (“4.7 across 300 reviews”), and let individual quotes carry dates and service names.

And notice what the rule conspicuously doesn’t regulate: your responses. The reply box under every review remains the one lever that’s unlimited, free, and entirely yours - the negative review playbook covers how to use it, and if you’re staring at a review you suspect is fake, there’s a template set for responding to suspected fakes without accusing anyone of anything you can’t prove.

Year one’s lesson is simple: the FTC went after the worst actor first, exactly as agencies do, and the second wave is already in the mail. Be the business the rule was written to protect, not the one it was written about.