Review reply compliance checker: catch the sentence that could cost you

Why the reply, not the review, is what costs you

A bad review is the customer’s speech. The reply under it is yours: published under your business name, attributable, archived, and read by regulators, platform moderators and every future customer who scrolls past. The review can say almost anything. The reply has rules, and the record of businesses paying for breaking them is short, specific and growing.

The clearest record is dental. In 2019 the HHS Office for Civil Rights settled with Elite Dental Associates for $10,000 over a Yelp reply that confirmed a patient’s name, treatment and insurance details. In December 2022 it settled with New Vision Dental for $23,000 over the same pattern repeated across the practice’s review replies, and noted that the practice had identified patients by full name when they had posted under a moniker. Neither reply had to be false to be a violation. Confirming that the reviewer was a patient at all is the disclosure, and a reviewer describing their own visit does not authorize the practice to confirm it.

Bargaining is the other federal line. The FTC’s Consumer Reviews and Testimonials Rule, 16 CFR Part 465, has been in force since October 21, 2024. Section 465.4 bans compensation or incentives conditioned, expressly or by implication, on a review expressing a particular sentiment, with civil penalties per violation. “We will refund you once you update your review” breaks it in a single sentence. “Call me and I will refund the difference” does not, because nothing is conditioned on the review, and that is exactly the line the checker draws: an incentive, a review word and a condition or a change verb in the same sentence. Section 465.7 covers the other direction, review suppression: a groundless legal threat, intimidation, or a public false accusation made to get a review taken down.

The platforms publish rules of their own and enforce them by removing the reply, and sometimes the profile. Yelp’s business support says public comments should not be used to launch personal attacks, advertise, or offer an incentive to change a review, and its DOs and DON’Ts tell owners not to pressure, pay, bully or sue people into changing or removing critical reviews. Tripadvisor’s Management Response guidelines remove responses that offer personal gain such as gifts, services or money, and do not allow responses that threaten a reviewer, accuse a reviewer of review fraud, speculate about a reviewer’s identity or include identifying details, or contain links unless relevant to the review; lists and bullets simply will not display. Trustpilot’s Guidelines for Businesses ask businesses to engage with reviews professionally and politely. Google publishes no reply length, but third-party documentation quotes the form’s own error text, “Replies cannot be greater than 4000 characters”. Facebook has no platform-specific rule in this set; the regulatory and style rules still run there.

Five business types, four rulebooks: what you may never confirm

The checker offers six business types. Five are regulated, and they share one principle with four sources behind it: the fact that this person was your patient, client or customer is itself confidential. Healthcare and dental practices sit under the same source, which is why five types have four rulebooks.

Healthcare and dental: the HIPAA Privacy Rule

Anything that confirms this person was treated here discloses protected health information without authorization: “your appointment”, “when you came in”, “your crown”, “your balance”. The checker blocks every one of them for healthcare and dental, and it warns on a greeting by name, even a first name, because in a medical or dental setting a name is a public act of identification. The two HHS settlements above are the source, and they are the only published enforcement in this set that is specifically about review replies.

Legal: ABA Formal Opinion 496 and Model Rule 1.6

The opinion, from January 2021, says a negative online review does not trigger the self-defense exception in Model Rule 1.6, so a public reply may not disclose information relating to the representation, or anything that could lead to it, including the fact that this person was a client. The checker blocks “your case”, “your hearing”, “your settlement” and every phrase that confirms the relationship. The opinion’s own suggestion is the compliant reply: say that professional obligations prevent you from responding to the specifics, and invite the reviewer to contact you directly.

Financial services: the GLBA Privacy Rule

Under the Gramm-Leach-Bliley Act Privacy Rule, a financial institution may not share nonpublic personal information about a consumer with nonaffiliated third parties outside the notice and opt-out process. A public reply that confirms this person holds an account, took a loan or filed a return with you is a disclosure to everyone who reads it. The checker warns on “your account”, “your loan”, “your application” and the rest.

Veterinary: the AVMA Principles and state practice acts

HIPAA does not cover animals, which is the most common reason a clinic assumes it has no duty. The AVMA Principles of Veterinary Medical Ethics direct veterinarians to safeguard medical information within the confines of the law, and state practice acts make a breach of confidentiality grounds for discipline. The checker warns on anything that names the pet’s condition, treatment or outcome, or confirms the client relationship.

The checker blocks the HIPAA and legal findings and warns on the financial and veterinary ones. The difference is how directly each source speaks to review replies: HHS has settled over them and the ABA has written an opinion about them, while the GLBA Privacy Rule and the AVMA Principles are general confidentiality duties the checker is applying to a reply. Treat a warning in those two trades as a line to remove, not a judgment call; the severity reflects how specific the source is, not how safe the reply is.

The compliant pattern is the same across all four rulebooks, and it is what the fix text on each finding points at: speak to your policies and process in general terms, never confirm a visit, a diagnosis, a procedure, a matter or a bill, and give a named staff member the reviewer can call directly. Our guide to responding to reviews you are not allowed to discuss walks through a compliant reply for each trade.

What the checker cannot judge

It is a set of 34 deterministic rules, and it is worth being exact about what that does and does not cover.

Truth. The checker never sees the review and has no idea what happened. A disclosure is a disclosure whether your account is accurate or not, and a false claim about the reviewer phrased in a way no rule recognizes passes in silence. Nothing here verifies a fact.

Tone in context. A law firm describing a practice area, a quotation of the reviewer’s own words, a refund you genuinely owe: each can trip a pattern that is innocent in context, which is why every card shows the flagged text so you can decide. In the other direction, a reply can pass every rule and still read as cold, defensive or sarcastic to the next customer, and no pattern catches that.

Whether a rule binds you. Whether your practice is a HIPAA covered entity, which state’s confidentiality rules apply to you, whether a platform’s moderators will act on a particular reply: the checker applies the strict reading of each published source and leaves the determination to you and your adviser.

What it has no rule for. The rules cover the lines that have cost businesses money or replies. They are not a complete list of everything that can go wrong, so a clean result means nothing matched, not that nothing is wrong. The same input always produces the same output, which makes the checker easy to trust and impossible to mistake for judgment.

How to use it

Set the business type and the platform first. More than half the rules run only for certain business types or platforms, and the verdict on the same text changes with them. Then paste the reply exactly as you would post it, signature included, since two of the style checks look at the sign-off.

Read top down. A block finding is a rewrite, not an edit. A warning is a line to change before posting. Info is style, and the next reader is the one grading it. Each card shows the exact text that triggered it, a fix that points at a rewrite rather than a template, and the source with the date it was last checked. The rules table under the findings marks every source “read” or “snippet”; a snippet source deserves a second look before you rely on its exact wording.

The checker re-runs as you type, so edit until the block and warn groups are empty, then read the whole reply once more as a customer would. For the part no rule can write for you, start with the negative review playbook and the legal line on review responses, and if your replies go out in more than one voice, write the voice down so the next person checking a reply is checking the same thing you would.