Testimonials and Online Reviews: What Businesses Need to Know

Testimonials and reviews are some of the most convincing content you can put on a website. A prospective customer would rather hear from someone who already hired you than read your own description of how good you are.

There are rules around them, though, and several of them changed recently. The FTC now has a rule aimed specifically at fake reviews and paid opinions, and New York expanded its main consumer-protection law in February 2026. If reviews and testimonials are part of how you market your business, it’s worth knowing what actually applies to you.

Here’s the whole thing in one paragraph. Use real testimonials from real people. Don’t edit them in a way that changes what the person meant or makes the result sound better than it was. Don’t offer someone anything in exchange for a positive review. Disclose it when the reviewer is an employee, a relative or someone you paid. And get written permission before you publish someone’s name, photo or personal details, especially if you’re in healthcare.

The rest of this article explains those points, covers what’s different for New York and New Jersey businesses, and links to the official rules so you can read them yourself. Healthcare and mental-health practices should also read our guide to patient testimonials and HIPAA. If you’re an NBT client preparing something for us to publish, use our testimonial submission and publishing protocol.

What’s on This Page

• What changed, and when
• What the federal rules require
• Can a testimonial be edited?
• Truthfulness and permission are two different things
• What New York businesses need to do
• What New Jersey businesses need to do
• A separate warning for healthcare and mental-health practices
• How this applies to different types of organizations
• Before you send a testimonial for publication
• Where to read the actual rules

What Changed, and When

There isn’t one single testimonial law. The requirements come from federal advertising law, state consumer-protection and privacy laws, and, if you’re licensed or work in healthcare, from HIPAA or your professional board. Here’s what’s changed, newest first.

• New York FAIR Business Practices Act, effective February 17, 2026. New York expanded General Business Law Section 349 beyond deceptive practices to also cover unfair and abusive practices. The original act was signed December 19, 2025, and a chapter amendment signed March 27, 2026 refined the final language. The new unfair and abusive provisions are enforceable by the Attorney General. They did not create equivalent private claims.
• Federal Consumer Reviews and Testimonials Rule, effective October 21, 2024. This is the big one for most businesses. The FTC rule directly prohibits fake reviews, paid sentiment, undisclosed insider reviews, review suppression, fake social-media influence, and review sites that pretend to be independent but are controlled by the business. Start with the FTC’s questions and answers on the Consumer Reviews and Testimonials Rule, then read the rule itself at 16 C.F.R. Part 465.
• Revised FTC Endorsement Guides, effective July 26, 2023. The updated FTC Endorsement Guides explain how existing truth-in-advertising law applies to testimonials, reviews, influencers and material relationships. The guides are not a separate penalty rule, but practices that conflict with them can lead to an FTC action when the conduct violates Section 5 of the FTC Act.
• New Jersey Consumer Fraud Act amendment, approved August 5, 2022. New Jersey added abusive commercial practices to the conduct its main consumer-protection statute covers. The law already covered deception, fraud, false promises, misrepresentations and certain material omissions. The enacted language is in P.L. 2022, Chapter 96.
• HIPAA and the HIPAA Privacy Rule. HIPAA isn’t new and it isn’t specifically a testimonial law, but it can require written authorization before a healthcare provider publishes identifiable patient information for marketing. Practices should read our separate guide to patient testimonials and HIPAA requirements.

What the Federal Rules Require

The short version: a testimonial has to come from a real person who actually had the experience being described. You can’t invent it, you can’t buy a review that has to be positive, and you can’t hide the fact that the reviewer works for you.

The FTC Consumer Reviews and Testimonials Rule prohibits or restricts several specific things:

• Fake reviews and testimonials. Don’t create, buy, sell or distribute reviews from people who don’t exist, people who didn’t have the experience described, or people whose experience is materially misrepresented. AI-generated reviews presented as real customer feedback fall squarely in here.
• Paying for a required opinion. You can’t make a payment, discount, free product or any other incentive depend on the review being positive. The condition doesn’t have to be stated outright. Asking someone to “tell everyone how much you loved us” in exchange for something can be a problem even if you never say the words “five stars.”
• Undisclosed insider reviews. Owners, officers and managers can’t write reviews without disclosing who they are. Businesses also have responsibilities when reviews come from employees, agents or relatives.
• Fake independence. You can’t run a review site and present it as an independent source when it covers a category that includes your own products or services.
• Review suppression. You can’t use unfounded legal threats, physical threats, intimidation or certain false public accusations to get a negative review taken down. You also can’t claim your displayed reviews represent all or most submissions if you’re filtering out the negative ones.
• Fake influence. You can’t buy or sell fake followers, views or other engagement numbers when you know they’ll be used to misrepresent commercial influence.

The FTC Endorsement Guides add context that catches a lot of people off guard. An endorsement has to reflect the person’s honest opinion or experience, and it can’t make a claim that would be deceptive if you made it directly.

Here’s the part that surprises business owners: a completely truthful testimonial can still make your advertising misleading. If you feature your single best result, you’re implying that’s what customers generally get. If you can’t back up that the result is typical, the FTC’s position is that you need to clearly explain what people can generally expect, and you need support for that explanation too. Adding “results may vary” in small type at the bottom doesn’t automatically fix a misleading overall impression.

Material connections have to be disclosed when a reader wouldn’t expect them and knowing about them would change how much weight they give the review. That covers payment, free or discounted services, employment, family or personal relationships, early access, referral arrangements and prize eligibility. The disclosure needs to be somewhere people will actually see it. Burying it on a profile page or behind a “more” link probably isn’t enough.

One more thing worth knowing: agencies, PR firms, review brokers and reputation-management companies can also be on the hook for deceptive endorsements they knew or should have known about. That’s why your website or marketing provider may ask you to confirm where a testimonial came from before publishing it. It isn’t bureaucracy for its own sake.

Can a Testimonial Be Edited?

Yes, within limits. You can clean it up. You can’t change what the person meant or make the result sound better than it was.

The FTC’s position is that an ad doesn’t always have to use the endorser’s exact words unless it presents them as an exact quote. What it can’t do is take the endorsement out of context or reword it in a way that distorts the person’s opinion.

Fixing a typo, cutting repetition or shortening a long submission is usually fine if the meaning survives. It gets risky when the edit changes the substance. Swapping “helped me manage” for “cured” is a different statement. So is turning a qualified opinion into an absolute one, removing a limitation that changes the meaning, or stitching two separate comments together into a stronger result than the customer actually reported.

Brackets and ellipses show that you added or removed text, but punctuation doesn’t rescue a misleading edit. If your changes go past basic cleanup, send the final version back to the person and get written approval before it goes live.

Keep three things together: the original submission, the edited version and the approval. If anyone ever questions it, you have a record of what you received, what you changed and what the person signed off on.

Truthfulness and Permission Are Two Different Things

This trips people up regularly. A testimonial can be completely accurate and still get published without the permission some law requires. They’re separate questions. Is this true, and are we allowed to use this person and this information this way?

The federal rules don’t require a signed release for every testimonial. Their focus is whether the advertising is genuine, disclosed and not deceptive.

A separate permission requirement can come from:

• State laws covering commercial use of a person’s name, image, likeness or voice
• HIPAA, when identifiable health information is involved
• Professional licensing rules on confidentiality and advertising
• A contract or confidentiality agreement you already signed
• The rights of a minor, which usually means a parent or guardian has to consent
• The specific platform or context where you’re publishing

Even when no law clearly demands a signed release, getting written permission is good practice any time you’re publishing someone’s name, photo, video, voice, employer, location or personal experience. The permission should spell out what you can publish and where it can appear. “They probably don’t mind” is not a record.

What New York Businesses Need to Do

What this means for your business: Keep the testimonial and the ad built around it truthful, don’t create a misleading overall impression, and get written consent before using a living person’s name, likeness, picture or voice in advertising. If you’re licensed, you also have to protect information you learned through the professional relationship and be able to back up your claims.

A few New York laws work together here.

Your advertising can’t mislead people. General Business Law Section 349 prohibits deceptive business practices and Section 350 prohibits false advertising. Applied to testimonials, that means the content, the editing, the photos, the placement, the disclosures and everything around them have to tell the truth as a whole. A sentence can be literally true and still contribute to a misleading ad if the context is stripped out.

The Attorney General now has broader authority. The 2026 FAIR Business Practices Act expanded Section 349 to cover unfair and abusive practices, not just deceptive ones. Unfair conduct is defined around substantial consumer injury that isn’t reasonably avoidable and isn’t outweighed by benefits. Abusive conduct includes materially interfering with someone’s understanding of a product or service term, or unreasonably taking advantage of someone’s lack of understanding or their reasonable reliance on you to act in their interest. Those new provisions are enforced by the Attorney General. The private right of action is still tied to deceptive acts.

Using someone’s identity in advertising generally requires written consent. Civil Rights Law Section 50 covers using a living person’s name, portrait, picture, likeness or voice for advertising or trade without prior written consent, and calls for a parent or guardian’s written consent for a minor. Section 51 lets that person seek an injunction and damages. Practically speaking: get the consent before you publish, and keep it with the approved testimonial.

Licensed professionals have more to deal with. Part 29 of the Board of Regents Rules treats false, fraudulent, deceptive or misleading professional advertising as unprofessional conduct. It also covers unsubstantiated claims, guarantees of professional services, and disclosing personally identifiable information you obtained in a professional capacity without consent. Your specific profession may add more, so check the rules for your license.

The takeaway isn’t just “false advertising is illegal.” Look at the finished page the way a stranger would. Is the testimonial real? Do the edits preserve what the person meant? Does the result sound typical when it isn’t? Is every connection disclosed? Does your written consent actually cover this person and this format?

What New Jersey Businesses Need to Do

What this means for your business: Don’t use a testimonial to make a false promise, misrepresent someone’s experience or hide something important. If you’re licensed, check your own board’s advertising and confidentiality rules before publishing client information.

The New Jersey Consumer Fraud Act, as amended in 2022, covers commercial practices that are unconscionable or abusive along with deception, fraud, false pretenses, false promises, misrepresentations, and knowingly concealing or omitting a material fact with the intent that others rely on it. It applies to the sale or advertising of merchandise, which under New Jersey law includes services, and to real estate.

In practice, that means no using selective quotes, edits, images or missing disclosures to leave customers with a materially false impression.

There’s one detail in the 2022 amendment worth flagging. In an action brought by the New Jersey Attorney General, a commercial practice that violates state or federal law is conclusively presumed to be an unlawful practice under the Consumer Fraud Act. In other words, breaking the FTC’s federal review rule can feed directly into a state case. Treat federal compliance as part of your New Jersey process, not a separate thing.

New Jersey doesn’t currently have its own testimonial statute equivalent to the federal rule. But licensed counselors, psychologists, social workers, physicians, dentists, attorneys, accountants, real-estate professionals and other regulated businesses may have additional advertising, recordkeeping and confidentiality requirements, and which ones apply depends on the license. Mental-health practices can start with the Professional Counselor Examiners Committee’s statutes and regulations, then confirm whether a different board actually governs the professional or the facility.

A Separate Warning for Healthcare and Mental-Health Practices

Healthcare and mental-health practices have everything in this article to consider, plus HIPAA, patient privacy and profession-specific confidentiality rules. A standard testimonial release or verbal permission may not be enough when identifiable health information is being used for marketing, and removing the patient’s name doesn’t necessarily make the information anonymous.

We cover those requirements separately in Can You Post Patient Testimonials? What HIPAA Actually Requires.

How This Applies to Different Types of Organizations

The core rules are the same across the board, but the minimum safe process changes depending on what you do and what you’re publishing. Find the one that matches your situation.

Ordinary Consumer Businesses

Federal truth-in-advertising rules, the FTC review rule and your state’s consumer-protection law all apply. Verify that the person and the experience are real, keep the original submission, avoid misleading edits, disclose material connections and document permission for how you’re using it.

Businesses Offering Review Incentives

The incentive can’t be conditioned on a positive review, directly or by implication, and it may need to be disclosed. Ask for honest feedback either way, disclose the incentive where required, and save the exact wording of your solicitation.

Influencer, Affiliate and Sponsored Campaigns

Material connections have to be clearly disclosed, and the underlying claims still need support. Give endorsers written disclosure and claim instructions, watch what actually gets published, and fix missing disclosures or unsupported claims quickly.

Owner, Employee and Family Reviews

Readers judge a review differently when they know the reviewer is connected to the business. Disclose the relationship, don’t present an insider as an independent customer, and don’t ask staff or relatives to post reviews without disclosing who they are.

Healthcare and Mental-Health Practices

FTC rules, HIPAA, state privacy law and professional obligations can all apply at once. Read our separate guide to patient testimonials, identifiable health information and HIPAA authorization before publishing a patient or client story.

Other Licensed Professionals

Your board may regulate advertising, confidentiality, guarantees, credentials, record retention and client solicitation. Check the rules for the board that actually governs you and your business before publishing.

Nonprofit Organizations

Nonprofit status doesn’t automatically remove privacy, state consumer-protection or professional obligations, and FTC jurisdiction can depend on your structure and commercial activity. Look at what you’re actually doing rather than assuming a blanket exemption.

Agencies, Website Managers and Marketing Providers

An intermediary can share responsibility for an endorsement it knew or should have known was deceptive. Require the client to confirm authenticity, accuracy, disclosures and permission. Don’t materially rewrite testimonials, and stop when the source or authorization is unclear.

Before You Send a Testimonial for Publication

Treat every testimonial as a small approval process instead of loose copy that gets pasted onto a page. Confirm that the person and experience are real, preserve the original submission, identify any material connections, obtain the required permission, and keep the approved final version with your records.

If you’re an NBT client sending us a testimonial, endorsement, review, case study or client story to publish, follow our Testimonial and Review Publishing Protocol. It explains what to verify, what records to keep and what we need from you before anything goes live.

Where to Read the Actual Rules

If testimonials are a meaningful part of your marketing, spend twenty minutes with the source material. Everything below links to an official government source.

Federal Trade Commission:

• FTC questions and answers on the Consumer Reviews and Testimonials Rule (start here)
• 16 C.F.R. Part 465, the Consumer Reviews and Testimonials Rule
• 16 C.F.R. Part 255, the FTC Endorsement Guides

New York:

• General Business Law Section 349, deceptive, unfair and abusive practices
• General Business Law Section 350, false advertising
• S8811, the FAIR Business Practices Act chapter amendment
• Civil Rights Law Section 50, use of a person’s identity in advertising
• Civil Rights Law Section 51, remedies
• Board of Regents Rules Part 29, unprofessional conduct

New Jersey:

• P.L. 2022, Chapter 96, Consumer Fraud Act amendment
• Professional Counselor Examiners Committee statutes and regulations

Your exact obligations depend on your state, your profession, your relationship with the person and what you’re publishing. If you rely heavily on testimonials, run review incentives, work with influencers or publish patient or client stories, build a review of these rules into your normal marketing process instead of waiting for a complaint.

Healthcare and mental-health practices should continue with our guide to patient testimonials and HIPAA. NBT clients preparing material for publication should use our testimonial submission protocol.

If you’re not sure whether the testimonials currently on your site meet these requirements, we can take a look and tell you what we’d change.

This article provides general information about advertising, testimonial and privacy requirements. It isn’t legal advice and doesn’t determine which laws apply to your organization or to something you’re planning to publish. If you handle regulated services, sensitive information or unusual endorsement arrangements, talk to an attorney or a qualified compliance professional.