Review Gag Clauses, FTC Rules, and Reputation Risk: How Businesses Should Respond to Negative Reviews Without Creating New Liability

Why Review Gag Clauses Create a Second Legal Problem

A negative review can feel unfair, incomplete, exaggerated, or commercially dangerous. A restaurant, medical-adjacent wellness business, accountant, contractor, professional service firm, salon, hotel, school, online seller, or family-owned local business may read a one-star post and immediately want leverage. The review may accuse staff of dishonesty, claim a refund was refused, describe an unsafe experience, criticize pricing, or publish a private detail. Some reviews are false or policy-violating. Some are honest criticism. Some are mixed. The first legal question is not how to silence the reviewer. The first question is what the business can prove and which response path fits the facts.

Review gag clauses are dangerous because they attack the reviewer's right to speak before the business has classified the problem. A form contract that says a customer may not post negative reviews, must pay a penalty for criticism, must assign copyright in feedback to the business, or must remove a review on demand may look useful in a template. In practice, it can violate federal consumer-review law, trigger Federal Trade Commission or state attorney general scrutiny, undercut platform credibility, and make the business look like it fears truthful criticism. Even an unused clause can be a problem if it appears in standardized terms.

The Consumer Review Fairness Act was enacted to address form-contract provisions that restrict honest reviews about a business's goods, services, or conduct. The statute is not a blanket license for defamation, harassment, privacy invasion, trade-secret disclosure, or fake reviews. It does, however, mean that a business should review its terms, invoices, booking conditions, website policies, settlement language, refund forms, and customer intake documents before threatening a reviewer. A reputation file that begins with an unlawful gag clause is weaker than one that begins with preserved evidence and careful legal analysis.

This article is general information and attorney advertising, not legal advice, consumer-protection advice, tax advice, platform-policy advice, employment advice, or a recommendation for any specific dispute strategy. Review disputes are fact-sensitive. The right response may depend on jurisdiction, contract language, platform rules, the exact words published, whether the reviewer was a consumer, whether the review is truthful, whether private information was disclosed, whether litigation is foreseeable, and whether the business has clean records. A business facing a real review dispute should preserve evidence and consult qualified advisors before deleting data, threatening legal action, imposing a fee, or contacting the reviewer.

Read the Contract Before Responding to the Review

Many businesses do not know what their own customer terms say. A legacy website template may include a nondisparagement clause. A booking form may say disputes must remain private. A service agreement may purport to ban public comments. A refund document may require the customer to remove a review. A settlement form may include confidentiality language that is too broad for the situation. A staff member may have copied old terms from another industry without asking whether consumer-review rules apply. Before anyone writes to the reviewer, the business should collect the actual contract record.

The review file should include the version of terms the customer saw, the date of acceptance, the page or document where the clause appeared, the checkout or booking flow if relevant, the invoice or receipt, the refund policy, staff scripts, text messages, emails, and any later demand or settlement language. The point is not to build a mountain of paper. The point is to know whether the business itself created a consumer-review risk before it claims the reviewer acted unlawfully. A company that threatens to enforce a void clause may create a more serious problem than the original post.

Under 15 U.S.C. Section 45b, the CRFA concerns standardized form contracts used in the course of selling or leasing goods or services and imposed without meaningful opportunity to negotiate. The statute excludes employer-employee and independent contractor contracts from the definition of form contract, but that exclusion should not be overread. A customer agreement, online terms and conditions page, purchase contract, intake form, or service policy may be different from an employment agreement. Businesses should not assume that calling a clause a nondisparagement provision, confidentiality term, brand-protection policy, or dispute-resolution promise changes the consumer-review analysis.

A practical contract audit asks five questions. First, does any term bar or restrict a consumer from reviewing the business, its products, its services, or its conduct? Second, does any term impose a fee, refund forfeiture, cancellation penalty, account closure, or other consequence for posting a review? Third, does any term claim ownership of the consumer's review content beyond a normal nonexclusive permission to use lawful feedback? Fourth, does any staff script imply that only positive reviews are welcome? Fifth, does any dispute-resolution process require review removal before the business will address a complaint? If the answer is yes, pause and get legal review before using that term.

The FTC Review Rule Adds Suppression Risk

The CRFA is not the only federal issue. The FTC's Consumer Reviews and Testimonials Rule, codified at 16 CFR Part 465, addresses fake or false reviews, paid sentiment-conditioned reviews, undisclosed insider reviews, company-controlled review sites, review suppression, and fake social-media indicators. For reputation-defense work, the review-suppression provisions deserve special attention because they focus on conduct used to prevent or remove negative consumer reviews.

Section 465.7 treats certain review-suppression conduct as an unfair or deceptive act or practice. The rule addresses unfounded or groundless legal threats, physical threats, intimidation, and public false accusations used in response to consumer reviews in an attempt to prevent a review from being created or to cause it to be removed. It also addresses misrepresentations that reviews displayed on a business's website represent most or all submitted reviews when reviews have been suppressed based on rating or negative sentiment. That matters for businesses that moderate their own review pages as well as those replying on third-party platforms.

The rule does not mean every legal threat is forbidden. The FTC's own guidance recognizes that a business can threaten legal action when it has a legitimate basis. The risk is a threat that has no evidentiary support, no lawful foundation, or no likely support after reasonable investigation. A cease-and-desist letter sent before the business has preserved the review, checked the contract, confirmed the transaction, and separated opinion from provable fact may be vulnerable. A public reply accusing the reviewer of fraud, extortion, lying, or criminal conduct without evidence can also create fresh defamation and FTC risk.

The safest mindset is simple: do not confuse reputation defense with review suppression. A business may report fake engagement, protect confidential information, respond to a false factual accusation, seek removal of platform-policy violations, or pursue legal remedies where warranted. It should not try to make ordinary criticism disappear through penalty clauses, threats, false accusations, selective display, or incentives tied to positive sentiment. The file should show that the business is correcting a legal or policy problem, not punishing criticism.

Separate Protected Criticism From Actionable Statements

A strong review response starts with exact words. A post that says "the service felt rushed" is different from one that says "the manager forged my credit-card signature." A post that says "I would not go back" is different from one that says "the business stole from me." A post that says "the clinic was dirty" may require different proof than one that publishes a staff member's home address. The business should quote each challenged sentence, identify whether it is opinion, factual assertion, mixed opinion, privacy disclosure, harassment, fake-engagement signal, off-topic content, confidential information, or a criminal accusation, and then match each classification to records.

Defamation analysis often turns on whether a statement is a provably false assertion of fact, whether a privilege or defense applies, whether the plaintiff can prove fault and harm, and what jurisdiction's law controls. New York adds anti-SLAPP considerations where a claim involves public petition and participation in a public forum or an issue of public interest. Civil Rights Law Section 76-a defines public interest broadly, and Section 70-a can affect costs, attorney's fees, damages, and related relief. That does not immunize every false review. It does mean a defamation threat should be screened before it is used as a pressure tactic.

This classification is also useful for platform reports. Google Business Profile guidance says businesses may report reviews for removal, but only reviews that violate Google's policies are eligible. Google also cautions that disagreement or dislike is not enough because negative reviews can reflect genuine customer experiences. Google Maps policies address fake and misleading content, including reviews that do not reflect a genuine experience, paid reviews, impersonation, harassment, personal information, restricted content, and other policy categories. A narrow report tied to a policy category is stronger than a broad complaint that the review is unfair.

The same chart should identify what the business will not challenge. Leaving some criticism alone can strengthen credibility. If a customer truly waited forty minutes, a reply should not deny all dissatisfaction merely because the customer also made a false statement about billing. If the review contains harsh opinion but no clear false fact, the best route may be an empathetic public response and internal service improvement. If the review includes private financial, medical, personnel, or trade-secret information, the route may be privacy or confidentiality rather than defamation. Precision is the difference between legal strategy and public irritation.

Preserve Evidence Before Reporting or Replying

Online review evidence is unstable. Reviewers edit posts. Platforms remove or hide content. Owner replies change. Ratings fluctuate. Search snippets update. A business that reports first and preserves later may lose the very record it needs to explain what happened. Before flagging, appealing, replying, demanding removal, refunding the customer, or threatening legal action, preserve the review in full context.

The basic evidence packet should include the review URL, platform, business profile, reviewer name or profile, rating, headline, body text, photos, videos, date, visible edit history, owner replies, comments, related messages, dashboard notices, and the search-result or map context if relevant. Capture desktop and mobile views when feasible. Save PDFs or full-page screenshots. Record who captured each item, when, from what account state, and where the files are stored. If the review appears on a website controlled by the business, preserve moderation logs and the criteria used to display or withhold reviews.

Then match the post to business records. Pull the service agreement, booking confirmation, receipt, invoice, payment record, refund history, chargeback file, appointment notes, staff schedule, photos, customer support messages, and any earlier complaint. Do not edit the underlying records to make them look cleaner. If a customer receipt includes personal information, preserve the original securely and use a redacted working copy for platform submissions. If litigation is reasonably foreseeable, consider a targeted litigation hold for relevant custodians and systems. Glinskylaw's article on business records and online review evidence preservation explains the broader recordkeeping discipline.

Evidence also protects the business from overreaction. A file may show that the review is from a real customer with a legitimate service complaint, even if the language is harsh. It may show that the customer never visited. It may show that a staff member promised a refund and did not record it. It may show that a platform policy report is justified but a lawsuit is not. The goal is to preserve options before anyone changes the record.

Consumer-Service Case Study: The Calm Barbershop Response

Consider a premium men's grooming studio that receives a one-star review after a crowded weekend. The reviewer says the appointment was delayed, the haircut was rushed, and the shop "steals deposits." The owner is angry because the deposit policy was disclosed, the client arrived late, and the stylist stayed past closing. The worst response would be to post private booking details, threaten a lawsuit under a no-review term, charge an additional fee for disparagement, or demand deletion before considering a refund. That response could create privacy, defamation, consumer-protection, and platform-policy problems even if the original review is partly false.

A better response starts with the file. Preserve the review. Pull the booking record, arrival time if lawfully recorded, deposit policy, payment record, staff notes, messages, and any refund discussion. Identify what is opinion and what is factual. "Rushed" may be protected criticism. "Steals deposits" may imply a provable accusation depending on context. If the shop's own terms say customers cannot post negative reviews, pause and review that clause before using it. If the deposit term was clear and the accusation is false, the business may have platform, private outreach, or legal options. If the delay was real, the public reply should acknowledge the concern without debating private details.

That same discipline applies to hospitality, grooming, beauty, wellness, and professional services in any market. A brand such as CAVERNES Bangkok competes on trust, discretion, service quality, and repeat customer confidence, so a review dispute should be handled in a way that protects future customers as well as the immediate reputation problem. The business can invite private contact, explain that it cannot discuss personal account details publicly, and state that it reviews concerns carefully. It should avoid phrases like "fake customer," "criminal extortion," or "we will sue you" unless counsel has reviewed the evidence and wording.

The case study's lesson is not that every review deserves a legal response. The lesson is that service businesses need a response protocol before the bad review arrives. Staff should know who preserves the review, who checks the transaction, who approves public language, who handles refunds, who submits platform reports, and when counsel is called. A calm protocol is faster than improvising under stress.

What a Safer Public Reply Looks Like

A public reply is not a legal brief. It should protect the business, respect the customer, avoid private details, and leave room for correction. A measured response might say that the business takes feedback seriously, has reviewed available records, cannot discuss private account details publicly, and invites the reviewer to contact a named channel. If the business has no matching record, the reply can say that it cannot locate a matching transaction based on the information visible in the review. It should not accuse the reviewer of dishonesty unless the evidence and legal review support that language.

A reply should also avoid promises that create new legal problems. Do not say "we remove all false reviews" if the platform controls removal. Do not say "this review violates the law" unless counsel has classified the issue. Do not disclose payment details, medical information, personnel records, home addresses, immigration status, family facts, or internal disciplinary decisions. Do not offer compensation publicly in exchange for removal of a truthful review. Do not ask employees, friends, or family to bury the negative review with positive reviews. The response should be calm enough that a regulator, judge, platform reviewer, or future customer could read it without concern.

Internal response language should be equally careful. Staff should not attack the reviewer from personal accounts, send repeated messages, threaten collections for criticism, revoke unrelated services, or mark the customer as banned without documenting the reason. If the review includes a real service failure, fix the failure. Consumer-review law does not prevent quality control. It prevents unlawful suppression, intimidation, deception, and penalties for honest reviews.

If the business sends a private message, it should be shorter than the evidence file. Identify the concern, offer a contact path, ask for information needed to investigate, and avoid pressure. If a legal demand is needed, it should be based on exact statements, evidence, applicable law, and a legitimate objective. Glinskylaw's article on cease-and-desist letters for online defamation explains why demand letters can help or backfire depending on timing, wording, proof, and proportionality.

Review Moderation on the Business's Own Website

Businesses that host reviews on their own websites face a related risk: selective display. A company may want to publish only glowing reviews, hide one-star complaints, or show testimonials that came from insiders without clear disclosure. The FTC Review Rule does not require a business to display every review in every circumstance. It does create risk when the business misrepresents that displayed reviews represent most or all submitted reviews while suppressing reviews based on rating or negative sentiment.

A safer moderation policy applies neutral criteria. The business can withhold reviews that contain trade secrets, confidential commercial or financial information, personal information, defamation, harassment, abusive content, obscenity, discriminatory content, clearly false or misleading claims, fake submissions, malware, or material unrelated to the product or service. The criteria should be written, applied consistently, and documented. A moderation log should show why a review was withheld, who made the decision, and whether the reason was content-neutral or tied to a recognized exception rather than dislike of criticism.

The same policy should address incentives. Offering customers a small incentive for leaving a review may be different from conditioning the incentive on a positive review, but the language matters. The FTC's guidance warns against implying that the review must be positive to receive the incentive. A phrase like "Tell us how much you loved your visit" can create risk if tied to a reward. A neutral request for honest feedback, with any incentive disclosed clearly where required, is safer than sentiment-conditioned language.

Insider reviews require equal care. Owners, managers, employees, agents, and relatives may have material connections to the business that readers should understand. A business should not ask staff or family to create undisclosed reviews, nor should it operate a company-controlled review website that falsely appears independent. A reputation strategy that relies on fake praise is fragile. It can violate platform rules, FTC rules, and ordinary customer trust.

First 72 Hours Checklist

First, preserve the review before reporting, replying, or asking for removal. Capture the URL, platform, profile, rating, text, images, date, owner replies, comments, dashboard notices, mobile view, desktop view, and search context. Second, quote each challenged sentence exactly. Do not summarize the review as "fake" or "defamatory" before classifying the words. Third, identify the reviewer relationship if known: consumer, former customer, non-customer, competitor, employee, contractor, vendor, partner, anonymous account, or unknown.

Fourth, collect the contract record: online terms, service agreement, booking policy, refund policy, intake form, receipt, emails, texts, settlement language, and any nondisparagement or confidentiality term. Fifth, check for review gag clauses, penalty provisions, review-removal conditions, intellectual-property grabs, and staff scripts that imply only positive reviews are acceptable. Sixth, pull transaction evidence: invoice, payment record, appointment log, service note, refund history, support ticket, chargeback file, staff schedule, photographs, and customer communications.

Seventh, classify the route. Is this a platform-policy report, private customer-service response, public reply, defamation analysis, privacy issue, confidentiality issue, fake-review problem, consumer-protection audit, insurance notice, litigation hold, or no-escalation matter? Eighth, draft the public reply separately from the legal file. Keep private evidence out of public text. Ninth, review the business's own review-generation practices, incentives, insider reviews, website moderation, and training. Tenth, decide the objective: correction, removal, customer resolution, evidence preservation, policy compliance, legal demand, lawsuit, or service improvement.

Bottom Line

A business does not have to accept every false, fake, harassing, confidential, or policy-violating review. It does have to choose the right tool. Review gag clauses, penalty fees, overbroad nondisparagement terms, public false accusations, and groundless legal threats can create new liability while failing to remove the review. The stronger response is disciplined: preserve the post, read the contract, separate opinion from fact, check platform rules, audit review practices, and choose the legal route only after the evidence supports it.

The best reputation file is not the loudest. It is chronological, sourced, and fair. It respects honest consumer criticism while challenging false factual accusations. It keeps customer information private. It documents platform reports and business records. It treats FTC compliance as part of reputation protection rather than a separate checklist. That approach gives counsel, platforms, insurers, and business leadership a cleaner record to evaluate.

This article is general information and attorney advertising. It does not create an attorney-client relationship and should not be relied on as legal, consumer-protection, tax, accounting, platform, employment, insurance, or litigation advice. Businesses facing a real consumer-review dispute, defamation concern, platform-report issue, contract audit, FTC compliance question, or threatened lawsuit should consult qualified advisors familiar with the facts, documents, jurisdiction, platform rules, privacy duties, and deadlines.