Bad Online Reviews and What a Business Can Legally Do

Start with two rules that decide most bad-review disputes before you ever call a lawyer. First, an opinion is not defamation — only a false statement of fact is. "Worst service ever" or "I'd never go back" is opinion, even if it stings. "They stole my deposit" is a factual claim that can be checked, and if it's false and damaging, it can be defamation. Second, the platform hosting the review generally cannot be forced to take it down. Section 230 of the Communications Decency Act (47 U.S.C. § 230) shields the website — Google, Yelp, Facebook, an app store — from liability for what a user posted. Your dispute, if you have one, is with the reviewer, not the platform. A platform may take a review down under its own policies, but that is its choice, not something the law compels.

That combination is why a review that just feels unfair usually isn't something the law can fix. But there's a trap on the other side that catches far more business owners: trying to control reviews, rather than just responding to them, is where the real legal exposure lives.

The trap: you cannot contract your way out of bad reviews

The federal Consumer Review Fairness Act (15 U.S.C. § 45b) makes a provision in a standard-form contract void if it bars or restricts an honest customer review, imposes a penalty or fee for posting one, or grabs the customer's intellectual property rights in the review. Think terms of service, a booking agreement, a repair invoice, a rental contract — anything you hand a customer to sign without a real chance to negotiate it. These are sometimes called gag clauses or non-disparagement clauses.

Two things make this sharper than most owners expect. It isn't merely that the clause is unenforceable — offering a form contract containing one is itself unlawful, and it's treated as a violation of a rule against unfair or deceptive acts, which the Federal Trade Commission can enforce. State attorneys general can also sue on behalf of their residents. The fix is free and takes five minutes: find the clause and delete it.

What the law does not take away from you: you can still reserve the right to remove content that reveals your trade secrets or confidential business information, that contains someone's personal information, that is libelous, harassing, obscene, or discriminatory, or that is unrelated to your goods and services or clearly false. The statute also doesn't reach employer-employee or independent-contractor agreements — it's about your customer contracts. What you cannot do is forbid or punish an honest review.

The other trap: "fixing" your rating is the actual legal risk

The FTC's Rule on the Use of Consumer Reviews and Testimonials (16 C.F.R. Part 465) targets fake and manipulated reviews, and it carries civil penalties. It prohibits several things a stressed-out owner might be tempted to try:

• Fake reviews — writing, buying, selling, or disseminating a review or testimonial from someone who doesn't exist, who never used the product or service, or that misrepresents their actual experience. This includes paying to flood a competitor's listing with fake negative reviews.
• Paying for a sentiment — providing compensation or other incentives in exchange for, or conditioned expressly or by implication on, a review expressing a particular sentiment. The line is subtle and worth getting right: the rule doesn't ban every incentive. It bans buying the verdict. "Leave us a review and get 10% off" is a different animal from "leave us a five-star review and get 10% off" — and hinting at the expected sentiment counts too.
• Undisclosed insider reviews — an officer or manager reviewing their own business without clearly disclosing the relationship, or soliciting reviews from employees or their relatives without telling them to disclose the connection.
• Threatening or intimidating a reviewer — using an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation to get a review prevented or removed. The angry cease-and-desist letter over a review you simply don't like is squarely the conduct this reaches.
• Misrepresenting the reviews you display — if you show reviews on your own site, you cannot materially misrepresent that they represent most or all reviews submitted when you've been withholding ones based on their rating or negative sentiment.
• Fake independent review sites — running a site or entity you own or control while passing it off as an independent source of reviews or opinions about your own category.
• Fake indicators of influence — buying or selling bot-generated or fake-account followers, likes, or views to misrepresent your influence for a commercial purpose.

In other words: the temptation to quietly clean up your rating is far more likely to bring the FTC to your door than the bad review ever was.

A word on disclosure, because it's commonly misattributed. The reviews rule above is about buying sentiment and faking reviews; it does not itself contain a disclosure mandate for incentivized reviews. The requirement that a reviewer disclose a material connection to the business — a payment, a free product, a discount, an employment relationship — comes from the FTC's Endorsement Guides and the general prohibition on deceptive acts in the FTC Act. The practical upshot is the same, and it's the safe practice: if you gave someone anything of value and they review you, that connection needs to be clear and conspicuous to a reader.

What you can actually do about a bad review

1. Respond publicly — briefly, calmly, and without confirming private details

A short, professional public response ("We're sorry to hear this — please contact us directly so we can make it right") does more for your reputation than an argument in the comments. Never confirm, in a public response, that someone was a customer, what service they received, or any health, financial, or personal detail — even to defend yourself.

For healthcare providers this is not a courtesy, it's a legal boundary. Protected health information disclosed in a public reply to a review is a disclosure under the HIPAA Privacy Rule like any other, and the fact that the patient went public first does not waive it or give you permission to respond in kind. The U.S. Department of Health and Human Services' Office for Civil Rights has brought enforcement actions against practices that revealed patient information while answering online reviews. Even confirming that someone is a patient can be the violation. If you need to say more than a generic line, take it to a private message or a phone call.

2. Flag reviews that violate the platform's own rules

Google, Yelp, Facebook, and most other platforms have their own content policies — reviews that aren't based on a genuine experience, that contain hate speech or threats, that are posted by a competitor, or that are plainly fake. Reporting a review through the platform's flagging tool is free, doesn't require a lawyer, and is the fastest path to removal when it works. It won't work for a review that's simply negative but genuine. Platforms will not remove an honest, if harsh, opinion, and pushing on them harder won't change that.

3. Ask for reviews — and think hard before filtering who you ask

You're free to ask customers to leave a review. What you can't do is condition anything on the review being positive. "Review gating" — using a tool that routes happy customers to a public review site and quietly diverts unhappy ones to a private feedback form — sits in a genuinely gray area rather than being flatly banned by the reviews rule. It becomes a clear problem when it's paired with a misrepresentation: displaying the surviving reviews on your own site as if they were most or all of the feedback you received. It can also draw ordinary deception scrutiny under the FTC Act on its own facts.

Because the line here is fuzzy and fact-dependent, the durable advice is the boring advice: ask everyone the same way, don't screen by sentiment, and don't describe a filtered set of reviews as though nothing was left out. If you're running a review-collection tool, look closely at what it actually does before you turn it on — the exposure is yours, not the vendor's.

4. Save a defamation claim for a provable factual falsehood

If a review states something specific and false — that you never showed up, that a payment was never refunded when it was, that a service was performed when it wasn't — and you can show real harm, a defamation claim may be available. Defamation is state law, and the elements, the deadline to sue, and what counts as protected opinion vary by state.

Go in with clear eyes. Many states have anti-SLAPP laws designed to knock out lawsuits that look aimed at silencing public criticism, and where they apply a losing motion can leave you paying the reviewer's attorney's fees on top of your own. There's a reputational dimension too — suing a customer over a review is itself newsworthy in a way the review wasn't. And remember the FTC rule above: a legal threat you can't back up is its own violation. Whether an anti-SLAPP law would apply, and how strong the claim really is, depends heavily on your state and the specific facts. That's a conversation with a local attorney, not a DIY letter.

What to do when a bad review lands

1. Don't respond in anger. Wait, then write a short, calm, generic reply. Disclose nothing about the person.
2. Check whether it violates the platform's policy (fake, off-topic, competitor-posted, threatening) and flag it if so.
3. Check your own contracts and forms for any non-disparagement or review-penalty language and remove it now, not after someone notices.
4. Resist any offer to "fix" your rating through purchased reviews, reviews bought for a particular sentiment, undisclosed insider reviews, or bot followers — these create federal exposure worse than the original review.
5. Don't send a threat you can't back up. A groundless legal threat aimed at removing a review is itself a violation of the FTC's reviews rule.
6. Keep asking customers for honest feedback, the same way for everyone, without screening by sentiment.
7. If a review states a specific, false, damaging fact, talk to a local attorney about whether a defamation claim is realistic in your state, including the anti-SLAPP risk.

None of this requires a dramatic response. The businesses that get into legal trouble over reviews are almost never the ones who got a bad review — they're the ones who tried too hard to make it disappear.

Where to check

• The FTC's business guidance on reviews, endorsements, and the Consumer Review Fairness Act — ftc.gov/business-guidance
• The full text of the FTC's reviews rule, 16 C.F.R. Part 465 — ecfr.gov
• HHS Office for Civil Rights guidance for HIPAA-covered providers — hhs.gov/hipaa
• Free help thinking through your policies: the SBA and its resource partners, including SCORE and your state's Small Business Development Center — sba.gov/local-assistance

This is general business and legal information, not legal, tax, or financial advice, and using it does not create an attorney-client relationship. Defamation and anti-SLAPP rules are state law and differ; talk to a qualified attorney in your state about your situation.