Fake Review Laws for Doctors: The FTC Rule, the UK Ban, and What Counts as Review Gating

Nobody sets out to break review law. They buy a reputation tool, it ships with a five-star filter turned on by default, and two years later the practice has a page full of glowing reviews and no idea that the mechanism producing them is the problem.

Both the United States and the United Kingdom now have specific, enforceable rules on this, and both arrived within the last two years. If your review process was designed before 2024, it is worth a fresh look.

01The US rule, and what it actually bans

The FTC's Rule on the Use of Consumer Reviews and Testimonials, codified at 16 CFR Part 465, was finalised in August 2024 and took effect on 21 October 2024. It carries civil penalties, which is the practical change — the FTC could act on deceptive reviews before, but the rule makes monetary penalties far easier to obtain.

Six things it prohibits:

Fake or false reviews. Reviews by people who do not exist, who never used the service, or who misrepresent their experience. This explicitly covers AI-generated reviews.

Buying reviews conditioned on sentiment. Paying or giving anything of value in exchange for a review that expresses a particular view — positive or negative. Paying a competitor's critic is as prohibited as paying a fan.

Insider reviews without disclosure. Reviews by employees, owners, their immediate families or agents require a clear and conspicuous disclosure of the relationship.

Company-controlled review sites presented as independent. A best doctors in the city site you own and do not disclose.

Review suppression. Using unfounded legal threats, physical threats, intimidation or false public accusations to prevent or remove a negative review — and misrepresenting that the reviews displayed represent all or substantially all reviews when negative ones have been suppressed.

Fake social media indicators. Bought followers, bought views, sold engagement, where the buyer knew or should have known they were fake.

02Where gating sits: the rule stops, the platform starts

The rule does not use the phrase review gating, and it is worth being precise about that rather than repeating the claim that gating is now illegal in the US.

What the rule reaches is suppression by threat or intimidation, and the misrepresentation of a filtered set of reviews as if it were the whole picture. A quiet process that only ever invites happy patients to Google is not named in the text.

But three other things apply. The FTC's general Section 5 authority over deceptive practices is not limited by the new rule. If your website says see what our patients say above a set of reviews that only ever came from patients pre-screened as satisfied, that framing is the misrepresentation. And Google's own review policies prohibit discouraging negative reviews or selectively soliciting positive ones — enforcement there means losing reviews or the profile, which for a local practice is a more immediate risk than a federal investigation.

A practical test that covers all three: would the patient who had a bad experience have been asked in the same way, at the same moment, through the same channel? If the answer is no, it is gating, whatever the vendor calls it.

03The UK ban

The Digital Markets, Competition and Consumers Act 2024 brought fake reviews into the list of banned commercial practices, with the relevant consumer-protection provisions coming into force on 6 April 2025.

Two features make it sharper than what came before. The Competition and Markets Authority can now impose penalties directly, without going to court, up to ten per cent of global turnover. And the ban covers not only submitting or commissioning fake reviews but hosting or publishing them without taking reasonable steps, and concealing that a review was incentivised. The CMA has published guidance on what reasonable steps look like.

For clinicians in the UK there is a second layer. The GMC's Good Medical Practice governs how doctors present themselves, the CAP and ASA codes govern advertising claims including testimonials, and CQC registration brings its own requirements — including displaying your rating accurately, which means as it is, not dressed up.

04India, briefly

There is no dedicated fake-review statute. What exists: the Central Consumer Protection Authority under the Consumer Protection Act 2019, which has acted on misleading advertising, and IS 19000:2022, the Bureau of Indian Standards framework for online consumer reviews, which is voluntary but is the reference point a regulator would reach for.

On the clinical side, the National Medical Commission's professional-conduct rules restrict advertising and the use of testimonials by registered practitioners. Check the current text at source rather than quoting a summary: the NMC withdrew its 2023 professional conduct regulations shortly after notifying them, and the position has been unsettled since.

05The privacy trap in the reply box

This is the one that catches good practices, and it is entirely separate from review law.

A patient posts an unfair review. The practice replies: you missed two appointments and were discharged from the list. Every word may be true. In the US, that reply has just disclosed protected health information to the public, and the HHS Office for Civil Rights has announced settlements with providers who revealed patient information when responding to online reviews. In the UK it is a confidentiality breach under GMC guidance. In India it is personal data processed without a lawful basis under the DPDP Act 2023.

The safe reply does three things and stops: acknowledges that the person is unhappy, does not confirm or deny that they were ever a patient, and gives an offline route with a named contact. Nothing about the visit. Nothing about the record. Our guide to handling negative reviews has the templates, and the HIPAA compliance page covers the US-specific exposure — note that if your practice is not US-facing, HIPAA is not your rule and you should be working from DPDP or UK GDPR instead.

06What to do instead of gating

Ask everyone, identically. Same point in the pathway, same channel, same wording, no pre-screening. The uncomfortable truth is that this produces a slightly lower average rating and a far more credible profile — and patients are better at spotting an implausibly perfect page than practices assume.

Separate the survey from the review request. An internal experience survey is a legitimate quality tool. It stops being legitimate the moment its score decides who gets the review link.

Do not condition value on content. If you incentivise at all, incentivise the act of reviewing regardless of what it says, and disclose it — then check the platform, because Google prohibits incentivised reviews outright, which usually ends the discussion.

Staff and family reviews. Legal in the US with clear and conspicuous disclosure. The simpler rule is not to.

AI. Never to generate a review. For drafting replies it is fine, provided a human approves every one and no patient detail ever goes into the prompt.

Keep a log. Who was asked, when, through what channel. If a regulator or a platform ever asks how your reviews were obtained, that record is the answer. Most practices cannot produce it.

The system we build for clients follows exactly this shape — described on the Google reviews page and in the reputation management system — and the automation sits in review generation, which is the part that makes asking everyone practical rather than aspirational.

07Which rule applies to you

Practices with patients in more than one country, and medical tourism operators in particular, often assume one rule covers everything. It does not.

The FTC rule reaches conduct affecting US commerce, which includes a clinic outside the US advertising to American patients. The DMCC provisions reach traders dealing with UK consumers, which includes an overseas clinic marketing to people in Britain. A hospital in Gurugram running English-language campaigns aimed at patients in London and Chicago is, in practice, inside both.

What that means operationally is simpler than it sounds: build the process to the strictest version and you satisfy all of them. Ask everyone, disclose every connection and incentive, never suppress, never generate, keep the log. There is no market where that process is a problem.

The reverse is not true. A process designed around the weakest applicable rule will fail somewhere, and it will fail in the market where the penalties are largest.

08Audit what you already have

Five checks, in an afternoon:

Read your reputation vendor's contract and settings. Does it route by rating? Many do, by default, and describe it as feedback routing.

Look at the tablet in reception and the QR card at the desk. What does the flow actually do at three stars?

Check your website's review widget. Does it claim to show all reviews while pulling from a filtered source?

Look at your own reply history for disclosed patient details.

Ask whether anyone has ever purchased reviews, on any platform, at any point. If yes, that is a conversation for counsel, not for the marketing team.

None of this is expensive to fix. It is only expensive to ignore.

---

If you want a review of how your practice collects, displays and responds to reviews — and whether the process would survive a regulator or a platform audit — get a free audit and we will send the findings whether or not you work with us. Or book a strategy call to rebuild the process properly.