Is Buying Google Reviews Legal in 2026? The Law, the Penalties, and What Works Instead

On 14 August 2024 the US Federal Trade Commission announced a final rule that made buying a fake review a federal violation with civil penalties attached. It took effect on 21 October 2024 and sits in the Code of Federal Regulations at 16 CFR Part 465. The following spring, on 6 April 2025, the consumer provisions of the UK Digital Markets, Competition and Consumers Act 2024 came into force and handed the Competition and Markets Authority the power to fine a business directly for commissioning fake reviews. Inside a single year, two of the largest consumer markets moved fake reviews from a platform policy problem to a legal one.

This page covers what those rules say, who they apply to, and what happens in practice. LitFame sells social media engagement services and has never sold Google reviews. The larger half of the page is about methods that produce real reviews at volume, because those survive an audit, a platform sweep and a regulator.

The short answer, jurisdiction by jurisdiction

Buying Google reviews is illegal in the United States, the United Kingdom and the European Union. The mechanism differs in each place, and so does the enforcement appetite.

What changed between 2024 and 2026 is the enforcement route. Before the FTC rule, the agency argued each case as a deceptive practice under Section 5 of the FTC Act and could rarely extract money from a first-time violator. A trade regulation rule changes that, because a knowing violation opens the door to civil penalties. The UK went further, letting its regulator impose a fine without going to court first.

What the FTC rule actually prohibits

16 CFR Part 465 is short, and reading it section by section matters, because each covers different conduct and a business can trip one while sitting clear of the others. Section 465.3, which would have covered repurposed reviews, was left reserved when the Commission declined to finalise it.

• Section 465.2 covers fake or false consumer reviews, consumer testimonials and celebrity testimonials. Paragraph (a) reaches writing, creating or selling one that materially misrepresents that the reviewer exists, that they had the experience described, or what that experience was. Paragraph (b) reaches a business that purchases a review about itself, or disseminates a testimonial about itself, which it knew or should have known misrepresented any of those three. Paragraph (c) reaches procuring reviews from insiders for posting on a third-party platform. Generalised solicitations to purchasers and mere review hosting are carved out of (b) and (c). The final rule states that AI-generated reviews are covered.
• Section 465.4 covers buying positive or negative sentiment. Paying for a review is treated differently from paying for a particular opinion. An express or implied requirement that the review be positive is the thing the section targets.
• Section 465.5 covers insider reviews and testimonials. Paragraph (a) applies to an officer or manager who writes one about the business without a clear and conspicuous disclosure of the relationship. Paragraph (b) applies to a business that disseminates an insider testimonial without that disclosure when it knew or should have known of the relationship. Paragraph (c) applies to an officer or manager who solicits reviews from employees, agents or immediate relatives and then encourages non-disclosure, gives no instruction to disclose, or spots an undisclosed review and does nothing. Generalised solicitations are carved out.
• Section 465.6 covers company-controlled review sites presented as independent.
• Section 465.7 covers suppression. Paragraph (a) reaches an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation made knowing it was false or with reckless disregard, used to stop a review being written or to get one removed. Paragraph (b) reaches a business that misrepresents that the reviews on its own site are most or all of those submitted while withholding some by rating or negative sentiment.
• Section 465.8 covers fake indicators of social media influence. It reaches selling, distributing, purchasing or procuring followers, views or similar indicators that the party knew or should have known were fake and that materially misrepresent influence or importance for a commercial purpose.

Two things follow. The rule is about misrepresentation of experience and identity, so asking a genuine customer to write about a genuine visit is untouched by it. And it catches the chain, in separate paragraphs. The Commission said in the final rule that someone in the business of writing, creating, selling or brokering reviews can be liable under Section 465.2(a), while the purchasing business sits in Section 465.2(b).

Who is liable and how the penalties work

The writer of a fake review is liable. So is the vendor who sold it, and so is the business that bought it. That last point is the one most owners miss. The rule sets the bar for a purchasing business at knew or should have known. FTC staff guidance from November 2024 gives examples of what puts a buyer on notice: reviews appearing so quickly after purchase that they are unlikely to reflect real experience, an unusually large number in a very short period, or reviews that refer to the wrong product. That guidance also says the rule imposes no general duty to investigate every review.

That standard matters because the usual defence is that the business hired an agency and never knew how the reviews were produced. If forty five-star reviews land in nine days on a profile that averaged one a month, that is the kind of clear indication the guidance describes, and not looking into it is what engages the should have known limb. A defence needs written evidence of what you asked the vendor and what it told you.

On penalties, be careful with the numbers you read online. Civil penalties under the FTC Act are set per violation by statute, adjusted for inflation, and published in the Federal Register. The January 2025 adjustment set the maximum at $53,088 for a knowing rule violation, and the Office of Management and Budget cancelled the 2026 adjustment across federal agencies, so that figure still stands. Two limits matter more than the headline. Recovering a penalty requires actual knowledge, or knowledge fairly implied from objective circumstances, a higher bar than the knew or should have known standard that makes the conduct a violation at all. And the Commission said in the final rule that courts decide how to count violations in a case and may impose per-violation amounts well below the maximum. The exposure is open-ended in a way a cease-and-desist never was, and it is not a fixed sum multiplied by your review count.

One timing point is worth holding onto. A trade regulation rule bites on conduct from its effective date, so a purchase completed before 21 October 2024 has to be pursued under the older Section 5 deception theory. Reviews bought before then and still on your profile are a separate question. Leaving them on a third-party profile is not itself a fresh purchase. Featuring them in your own advertising is different, because FTC staff guidance treats a paid or incentivised review as a consumer testimonial, and Section 465.2(b) reaches a business that disseminates a testimonial it knew or should have known was false.

The UK: a banned practice with direct CMA enforcement

The Digital Markets, Competition and Consumers Act 2024 lists fake reviews among the commercial practices banned outright, so a regulator need not prove that any particular consumer was misled. Paragraph 13 of Schedule 20 covers submitting a fake review or one that conceals having been incentivised, commissioning another person to submit or write either, offering traders services that do or facilitate that, and publishing reviews in a misleading way. Its own examples of the last are withholding negative reviews while publishing positive ones, giving one greater prominence than the other, and omitting information relevant to how a review came to be written, including that the writer was commissioned.

The Act also requires anyone publishing consumer reviews to take such reasonable and proportionate steps as are necessary to prevent the publication of fake and concealed incentivised reviews and to remove them. The CMA set out what that looks like in its fake reviews guidance, CMA208, of 4 April 2025: a published policy prohibiting fake reviews and stating the approach to incentivised ones, risk assessments, and processes for detecting, investigating and acting on banned content. That duty attaches to any site displaying customer reviews.

The enforcement change is the substantial one. Since 6 April 2025 the CMA can investigate a consumer protection breach, decide it and impose a fine without seeking a court order. The ceiling for a substantive breach is 10 per cent of global annual turnover, and turnover includes revenue outside the UK and that of controlled and controlling companies, so the UK arm of a group is measured against the group. The CMA spent the regime’s first three months supporting compliance rather than enforcing, then reviewed more than a hundred websites, and on 27 March 2026 opened its first fake and misleading review investigations, into Autotrader, Feefo, Dignity, Just Eat and Pasta Evangelists.

The EU: the Unfair Commercial Practices Directive

The EU handled fake reviews earlier, through an existing instrument. Directive (EU) 2019/2161, the Omnibus Directive, added entries to Annex I of the Unfair Commercial Practices Directive, the blacklist of practices unfair in all circumstances. Point 23b prohibits claiming that reviews come from consumers who actually used or bought the product without taking reasonable and proportionate steps to check that they do. Point 23c prohibits submitting fake reviews or endorsements, commissioning someone else to submit them, and misrepresenting consumer reviews to promote a product. Those provisions have applied since 28 May 2022.

Because the UCPD is a directive, penalties are set by each member state’s implementing law and enforced by national consumer authorities. The prohibition is uniform across the bloc while the fine and the pace of investigation depend on the country you sell into.

Google’s policy is a separate system from the law

A business can comply with the FTC rule and still lose its reviews. Google enforces its own policies on its own timetable, using signals no regulator has, and needs no legal finding. Its Maps content policy names fake engagement and conflict of interest among its prohibited categories, and the standard running through both is whether a contribution reflects a genuine experience at the place.

Three practices catch honest businesses that never bought a thing.

Incentives. Google’s prohibited and restricted content policy for Business Profiles tells merchants not to offer incentives such as payment, discounts, free goods or services in exchange for posting any review, or for the revision or removal of a negative one. That is stricter than Section 465.4, which targets paying for a particular sentiment rather than paying for a review as such. A raffle entry open to anyone who leaves feedback may be defensible under US law and still break Google policy.

Review gating. Gating means surveying customers first and routing only the happy ones to your Google review link while unhappy ones go to a private feedback form. Google tells merchants not to discourage or prohibit negative reviews or selectively solicit positive ones. Much local review software was built around gating. If your provider describes a sentiment filter, a happiness check or smart routing before the request, you are gating.

Conflict of interest. Google’s policy names current and former employment, contractual and consultancy relationships, and other professional or personal affiliations. Asking your staff to review the business is a policy violation on its face, separate from the FTC’s disclosure requirement for insiders.

What Google actually does when it finds fake reviews

Removal is the least of it. Google’s published page on Business Profile restrictions lists what can happen to a profile found to have violated its fake engagement policy: the profile can be blocked from receiving new reviews or ratings, its existing reviews and ratings can be unpublished, and the profile can display a warning telling consumers that fake reviews were removed. Google says only that the first two run for a set period, without publishing durations. The undertakings Google gave the CMA in January 2025 go further for UK businesses, describing escalating sanctions that include deleting all of a profile’s reviews for six months or longer where the conduct repeats.

Consider the third. A consumer-facing warning turns an invisible policy problem into a visible trust problem where people decide whether to call you. A profile that quietly loses reviews recovers. One carrying a notice about removed fake reviews cannot reply its way out of it.

Detection is retrospective. Google runs sweeps that reassess review histories, so purchased reviews often outlast the vendor’s refill window and vanish months later. The account-level signals are consistent enough that you can learn to read them yourself before handing anyone money: recycled profiles, no local photos, a review history spanning four countries in a week.

Appeals exist: Google notifies owners before applying a restriction and describes a re-review process. Assume it takes weeks and that the reviews do not come back.

Why buying reviews fails as a commercial bet before the law even applies

Set aside the FTC, the CMA and Google. The economics still fail, for four reasons.

The first is that a purchased review says nothing. Reviews convert because they contain specifics: the name of the technician, what went wrong and how it was fixed, the wait on a Tuesday. A writer who has never been to your business produces the generic register, and readers who skim for detail discount it.

The second is the rating ceiling. A flat 5.0 with nothing substantive underneath tends to convert worse than a slightly lower average carrying detailed complaints answered well, which is one of the counterintuitive parts of how social proof persuades. Shoppers read negative reviews on purpose, and a profile with none reads as filtered.

The third is recency. What a shopper reads is dominated by recent reviews, so a block bought in March carries little weight by September. You are renting, and the rent recurs.

The fourth is that buying reviews hides your operational problems from you. A business with a clear complaint pattern about response times has been handed a free diagnostic. Paper over it with purchased praise and the defect stays, the customers it costs keep leaving, and the signal that would have shown you where to look is gone. The same curve runs on social platforms, where the risk profile of bought engagement is cheap now, expensive later.

What works instead: building a review engine that runs on its own

Every business with a strong review profile built it the same way, by making the ask systematic instead of occasional. The share of served customers actually asked is usually the biggest lever available, and in most businesses nobody has measured it.

Ask at the moment of relief. There is a short window right after a problem is solved or a job is signed off when the customer feels best about you. Asking by email two days later produces far less than asking at the counter, or in the van before you drive away.

Put a person in the ask. A named employee saying reviews genuinely help them out beats an automated SMS. Ask out loud first, then send the link while the conversation is fresh.

Reduce the number of taps to one. Google provides a short review link and a QR code for every Business Profile. Every extra step costs you a share of the people who intended to follow through.

Give the customer something to write about. A blank box is intimidating. Asking what they thought of the turnaround time hands people a starting sentence without dictating a sentiment, which keeps it clear of Section 465.4 and inside Google policy: you steer the topic, the customer supplies the opinion.

Assign the metric to someone. Reviews per week, tracked by location and employee, reviewed in the same meeting as revenue. Anything unowned decays. The full build, cadence and templates included, sits in the local business review playbook.

Reply to everything. Replies are visible to every future reader. A customer who watches you answer a complaint with specifics learns that writing to you produces a response.

The same architecture transfers to surfaces running different filters. Yelp asks businesses not to solicit at all, and its software moves reviews it judges to have been prompted into a not recommended section where they do not count toward the star rating, so Yelp needs its own approach. Build the Google process first: it feeds the map pack, and the staff habits port everywhere else.

Incentives, employees and disclosure, done correctly

Do not offer anything of value in exchange for a Google review. No discount, no free coffee, no prize draw, no loyalty points, no donation per review. Google makes no exception for a small incentive or one offered regardless of rating. If you want an incentive programme, run it on feedback that stays inside your own systems, separate from anything touching your Business Profile.

Do not ask employees, family members or contractors to review the business. Google treats it as a conflict of interest and removes it. In the US, Section 465.5(c) targets an officer or manager who solicits such reviews and then fails to see that the relationship is disclosed. These are also among the easiest reviews for Google to identify, because the accounts and devices cluster.

Do not gate. Ask every customer for feedback and every customer for a review, in that order, with no branching between them. Using the answer to decide who gets the review link is what makes it gating.

Do put your incentive on internal behaviour. Rewarding staff for the number of requests they make is clean. Rewarding them for five-star reviews received creates the pressure that produces the conduct the rule and the policy prohibit.

Handling negative reviews without stepping into suppression

Section 465.7(a) of the FTC rule prohibits using an unfounded or groundless legal threat, a physical threat, intimidation, or a knowingly or recklessly false public accusation to stop a review being written or to get one removed. It is narrow and leaves you plenty of room, so know where the line sits.

Reporting a review to Google for a genuine policy violation is legitimate. Reviews that are off-topic, that come from someone who was never a customer, that carry personal information, or that form part of a competitor attack all have a reporting route, and using it is the intended mechanism. Replying in public with your account of what happened is the most valuable thing you can do with a bad review.

Contacting a customer to resolve the underlying complaint is legitimate. It stops being legitimate when you pair it with a demand: a refund conditional on deleting the review, a letter asserting a defamation claim you have no intention of bringing, or any hint of consequences for leaving it up. Fix the problem, say so, and let the customer decide whether to update what they wrote.

One note on volume. The best protection against a damaging review is a steady inflow of new ones, because a single one-star against four hundred is arithmetic and against eleven is a verdict.

Frequently Asked Questions

Is buying Google reviews illegal in the United States?

Yes. The FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on 21 October 2024. Section 465.2(a) reaches writing, creating or selling a fake review, and Section 465.2(b) reaches a business that purchases one about itself, so the business placing the order is exposed alongside the vendor fulfilling it. Civil penalties are available for knowing violations, though the Commission has said courts decide how many violations a case involves and may set amounts below the maximum.

Can I be fined if my marketing agency bought the reviews without telling me?

Possibly. The FTC applies a knew or should have known standard, and its staff guidance gives examples of what puts a buyer on notice: reviews appearing so quickly after purchase that they are unlikely to reflect real experience, an unusually large number in a very short period, or reviews that refer to the wrong product. Recovering a civil penalty needs the higher showing of actual or fairly implied knowledge. Keep written records of what you instructed the agency to do and what it told you about sourcing.

What can the CMA do to a UK business that buys reviews?

Since 6 April 2025 the CMA can investigate a consumer protection breach, decide it and impose a fine without first obtaining a court order. The ceiling for a substantive breach is 10 per cent of global annual turnover, calculated on worldwide rather than UK revenue. Fake reviews are a listed banned practice, so no proof of consumer harm is needed.

Is offering a discount for a Google review against the rules?

It breaks Google policy, which tells merchants not to offer incentives such as payment, discounts or free goods in exchange for posting a review or for revising or removing a negative one, with no exception for small or rating-neutral incentives. The FTC analysis differs: Section 465.4 targets paying for a particular sentiment, so an unconditional incentive can be lawful while still breaking Google policy.

What is review gating and why does it matter?

Review gating means surveying customers first and sending only the satisfied ones to your public review link while unhappy ones go to a private form. Google tells merchants not to discourage negative reviews or selectively solicit positive ones, so gating breaks policy. Much local review software was built around it, so check whether your provider describes a sentiment check or smart routing before the request goes out.

What happens to a Google Business Profile caught with fake reviews?

Google’s published policy on Business Profile restrictions lists three outcomes: the profile can be blocked from receiving new reviews or ratings for a set period, existing reviews and ratings can be unpublished for a set period, and the profile can display a public warning that fake reviews were removed. Google does not publish the durations. That warning is the most damaging, because it appears where purchase decisions happen.

Can I ask my employees to leave a review?

Google treats employee reviews as a conflict of interest and removes them, covering current and former employment along with contractual and consultancy relationships. In the United States, Section 465.5(c) makes it a violation for an officer or manager to solicit reviews from employees or immediate relatives and then discourage disclosure, give no instruction to disclose, or spot an undisclosed review and take no remedial step. Employee accounts cluster in ways Google detects easily.