Med Spa Reviews: What the FTC Rule Bans, What Google Bans, and What Your Reply Can Cost

The Federal Trade Commission's 2024 rule on consumer reviews does not ban review gating. The Commission wrote that out of the rule in plain words. In the final rule at 89 FR 68034, published 22 August 2024, the Commission stated: "although Sec. 465.4 does not cover 'review gating,' review gating can nonetheless violate section 5 of the FTC Act."

Most trade coverage of that rule tells med spa owners the opposite. That error points your attention at the wrong document. Gating is dealt with in the Endorsement Guides at 16 CFR 255.2, under a conditional test that asks what your filtering did to your public rating, not whether you filtered at all.

The practice is prohibited outright somewhere else. Google's Maps User Generated Content Policy lists, among the things merchants are not allowed to do, "Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers." So a med spa running a happy-patients-only feedback funnel is likely clean under the federal rule and squarely against the policy of the platform its local visibility depends on.

This post separates the two regimes, prints what each one says with its section numbers, and then covers the half of review management that has actually produced federal penalties: the reply you write underneath a bad review.

Every source on this page was read on 19 August 2026. We make med spa software, so we have an obvious interest in how clinics collect patient feedback and manage their client records. The regulations and platform policies below hold regardless of whose software you run them in.

What the FTC's 2024 review rule actually says

The rule is the Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, published at 89 FR 68034 on 22 August 2024, RIN 3084-AB76, effective 21 October 2024. It is codified at 16 CFR Part 465 under the authority of 15 U.S.C. 57a. The regulatory text itself begins at 89 FR 68077, which is why you will see both citations in circulation. The rule was present in full, with no stay or vacatur annotation, in the eCFR content snapshot dated 18 August 2026.

The table below maps every section of Part 465 as codified, with the detail in each that matters most to an aesthetics practice.

Read 465.1(d) first, because it quietly widens everything else. If a star rating with no text is a consumer review, then every provision about buying, soliciting or faking reviews applies to the star taps your front desk collects on an iPad, not only to written testimonials.

Read 465.3 second, because it is widely miscited. It is reserved. Any article telling you the FTC rule stops a competitor from recycling reviews across products or locations is describing a provision that was dropped before the rule was finalized. Conduct like that may still be reachable under section 5 of the FTC Act, but not under Part 465.

Read 465.7(b) third. It is narrower than the shorthand "you must publish every review". It applies to the review display on your own website, and it expressly permits withholding on criteria applied equally to all reviews without regard to sentiment, listing defamatory or obscene content, "The personal information or likeness of another individual", content that is "clearly false or misleading", reviews the seller "reasonably believes" are fake, and reviews "wholly unrelated" to the services offered. That carve-out for another individual's personal information turns out to be useful later in this post.

Gating sits in a different document, under a different test

The FTC's own definition of the practice, from footnote 319 of the final rule quoting the proposed rule at 88 FR 49379, is this: "Review gating occurs when a business asks past purchasers to provide feedback on a product and then invites only those who provide positive feedback to post online reviews on one or more websites." That is the standard med spa follow-up funnel, described precisely.

The Commission addressed it directly and put it outside the rule. It acknowledged that the provision "does not cover review gating, the mere solicitation of positive reviews, or incentivized reviews (except for those required to express a particular sentiment)." It also wrote that "Just because a business engages in review gating or otherwise expects reviews to be positive does not mean there is either an express or implied requirement that reviews need be positive to obtain an incentive."

Where gating does live is 16 CFR 255.2(e)(11), Example 11 of the Endorsement Guides. The example describes a marketer inviting only the pleased purchasers to post, and concludes that such a practice "may be an unfair or deceptive practice if it results in the posted reviews being substantially more positive than if the marketer had not engaged in the practice." Those are the operative words. It is a conditional effects test. The question is not whether you filtered, it is whether the filtering moved your public rating.

The same example gives the FTC's own safe path, and it answers the question most owners are actually asking: "If, in the alternative, the marketer had simply invited all recent purchasers to provide feedback on third-party websites, the solicitation would not have been unfair or deceptive, even if it had expressed its hope for positive reviews." You may ask everyone. You may say you hope for a good one.

The two documents carry different consequences

Part 465 is a trade regulation rule, so violations expose a business to civil penalties under 15 U.S.C. 45(m)(1)(A). The Endorsement Guides are not. 16 CFR 255.0(a) states that the Guides "represent administrative interpretations of laws enforced by the Federal Trade Commission for the guidance of the public" and "provide the basis for voluntary compliance with the law by advertisers and endorsers", with practices inconsistent with them potentially leading to corrective action under section 5 after investigation.

On the penalty number, the figure most articles print is stale. The FTC's own August 2024 preamble said "The maximum civil penalty is currently $51,744 per violation." The codified amount is now 16 CFR 1.98(d): "Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. 45(m)(1)(A) $53,088", with the section stating those amounts "apply only to penalties assessed after January 17, 2025" and carrying the source note 90 FR 5581, Jan. 17, 2025.

Three qualifiers travel with that number, and all three come from the FTC. It is a maximum, and courts "must take into account the statutory factors set forth in section 5(m)(1)(C) of the FTC Act and may impose much lower per-violation penalties". Courts "will also decide how to calculate the number of violations in a given case". And civil penalties require "actual knowledge or knowledge fairly implied on the basis of objective circumstances that such act is unfair or deceptive and is prohibited by such rule". Treat $53,088 as a ceiling attached to a statute, not as a price list.

Google prohibits the thing the FTC rule leaves alone

This is the inversion that makes the whole subject confusing, and it is the most useful thing on this page. The federal rule and the platform policy diverge on three of the five practices a med spa is most likely to run, and land in the same place on the other two. The table below sets them side by side, quoting each source.

Row two is the headline. A gating funnel is a platform problem long before it is a federal one. Row three has the same shape in reverse: a "$25 off your next treatment when you leave us a review" promotion, offered with no instruction about what to say, may sit outside 465.4 because nothing conditions it on sentiment, while Google's policy names discounts explicitly.

Row four is the sharpest divergence. The FTC will accept a disclosed insider review. Google's policy prohibits conflict-of-interest content whether or not it carries a disclosure. So a staff member who writes "I work at this clinic and I love it" has satisfied 465.5 and still written a review Google's policy treats as prohibited content.

Google's on-premises language deserves its own reading, because it is aimed at exactly the script most front desks use. The policy says merchants "should not require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included", and names two examples: "Merchants requesting that staff solicit a certain number of reviews" and "Merchants requesting that staff solicit reviews that include specific content, including content that identifies a staff member." Note the verbs. Asking is not what is named. Requiring and pressuring are. Staff review quotas and "please mention your injector by name" are both listed.

Google also publishes the method it sanctions. Its Tips to get more reviews page says: "Remind customers to leave reviews: To leave reviews, you can ask customers to visit a Google link or scan a QR code." Combine that with the FTC's generalized-solicitation carve-out and the compliant play is unglamorous and simple. One review link. Sent to every patient. No pre-screen, no incentive, no script about what to write.

What Google publishes about reviews and local ranking

Google's Tips to improve your local ranking page is Google's own primary source on this, and it is more modest than the agency pitch you have probably received. The summary sentence reads: "Local results are mainly based on relevance, distance, and popularity." The third subheading on the same page, and its body text, use the word "Prominence" instead. Google uses both words on one page, so treat neither as the canonical term.

Under that heading Google states that prominence "means how well-known a business is" and that the factor is "also based on info like how many websites link to your business and how many reviews you have. More reviews and positive ratings can help your business's local ranking." The verb is "can help". Review count is listed alongside link signals, not above them, and that page published no weighting when it was read on 19 August 2026. On the same page it states: "There's no way to request or pay for a better local ranking on Google. We do our best to keep the search algorithm details confidential."

Two consequences follow for how you plan. First, treat any pitch that promises a specific rank position, or that prices a ranking outcome, against Google's own sentence about paying for local ranking. Second, stop chasing an unbroken wall of five stars, because Google argues against it directly on its Tips to get more reviews page: "Value all reviews: Honest and balanced reviews can help potential customers decide. A mix of positive and negative feedback often feels more trustworthy. As best practice, reply to reviews and share your perspective."

That last instruction is where the risk moves. The same page tells you that "Your replies are public and help you build good relationships with customers." Public is the operative word, and for a healthcare practice it changes the entire calculation.

The reply is where the federal penalties have actually landed

In October 2020 the HHS Office for Civil Rights issued a Notice of Proposed Determination to U. Phillip Igbinadolor, D.M.D. & Associates, P.A., OCR Transaction Number 16-225168, over a single reply to a single Google review. The Basis for CMP section reads: "Number of individuals whose PHI was impermissibly disclosed in 2015 one (penalty of not less than $50,000). Total: $50,000." The violation cited was 45 C.F.R. 164.502(a).

The detail that matters most is who revealed what. OCR records that the reviewer "posted a negative review of UPI on UPI's Google page using a pseudonym, so as not to reveal his real name". The practice's public reply named him in full, and went on to disclose that he was a patient, his visit dates, that he had missed scheduled appointments, that he presented as an emergency patient with pain in the lower left quadrant, and that he had been referred for root canal treatment. The reply also included the line "Get a life." The review was anonymous. The reply is what identified the patient.

That penalty was not reduced, not suspended and not appealed. The Notice of Final Determination dated 1 June 2021 states that the civil money penalty "is final", that the practice "failed to file a timely request for a hearing", that it "has no right to appeal", and that payment of "the full and aggregate amount of $50,000" was due on receipt. The penalty tier was willful neglect not corrected. OCR had told the practice by phone in August 2016 that the reply should be removed promptly, and the notice records that it remained public four years later.

Four published OCR actions between 2019 and 2023 turn on replies to online reviews. The table below sets out what each one disclosed and what it cost.

The Elite Dental figure is the one most often quoted as the going rate for this mistake, and HHS's own language makes clear it is not one. Set it against Igbinadolor instead. Elite cooperated and paid $10,000 covering multiple patients. Igbinadolor refused to produce financials, ignored an administrative subpoena, left the reply up, and paid $50,000 for one. The variable that moved the number was conduct after the disclosure, not the disclosure itself.

Manasa carries the obligation operators least expect. The corrective action plan required the practice to issue breach notices to individuals whose protected health information was disclosed on any internet platform without a valid authorization, and to file a breach report with HHS, within 30 days. A review reply can therefore start a breach notification process, not just a payment.

OCR's own framing has been consistent across successive directors. Roger Severino in 2019: "Social media is not the place for providers to discuss a patient's care." On New Vision Dental in 2022: "Providers cannot disclose protected health information of their patients when responding to negative online reviews. This is a clear NO." Melanie Fontes Rainer in 2023: "OCR continues to receive complaints about health care providers disclosing their patients' protected health information on social media or on the internet in response to negative reviews. Simply put, this is not allowed."

One caveat you should carry. Every OCR review-response action located in this research is dental or psychiatric. We found no published OCR enforcement action against a med spa or an aesthetics practice arising from a review reply, searched 19 August 2026. OCR does reach aesthetics practices on other facts: Village Plastic Surgery in New Jersey paid $30,000 in a right-of-access matter, and New England Dermatology and Laser Center in Massachusetts paid $300,640 over improper disposal of PHI. OCR also resolves most complaints informally and without publication, so the absence of a published aesthetics review case proves nothing about your exposure.

Why denying that someone is a patient is also a disclosure

The general rule is 45 CFR 164.502(a): "A covered entity or business associate may not use or disclose protected health information, except as permitted or required by this subpart or by subpart C of part 160 of this subchapter." A public reply is not among the permitted disclosures listed at 164.502(a)(1). 45 CFR 160.103 defines Disclosure as "the release, transfer, provision of access to, or divulging in any manner of information outside the entity holding the information", which a Google reply plainly is.

Now the counter-intuitive part. 45 CFR 160.103 defines individually identifiable health information to include information that relates to "the provision of health care to an individual" and that "identifies the individual". The bare fact that a named person received care is therefore individually identifiable health information. That cuts both ways. "You were seen on the 3rd" is a disclosure. So is "We have no record of you as a patient." The denial confirms that you checked a patient record against a name, and it speaks to the provision of care to an identified individual.

The only reply that is safe on this axis is one that neither confirms nor denies that the reviewer was ever a patient, and that contains no clinical, scheduling, billing or insurance detail of any kind.

There is a tidy alignment here between the two halves of this post. 16 CFR 465.7(b) permits a business to withhold a review from its own website display on sentiment-neutral criteria applied equally, and one of the criteria the FTC lists is "The personal information or likeness of another individual". The instinct that protects a patient's privacy is also an FTC-sanctioned reason to keep a review off your own testimonial wall, provided you apply the same rule to every review regardless of star count.

Whether HIPAA reaches your med spa at all

Most content on this subject tells every med spa that HIPAA binds it. The definition does not say that. 45 CFR 160.103 defines a covered entity as "(1) A health plan. (2) A health care clearinghouse. (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter."

The covered transactions are enumerated in the same section and every one of them is insurance or claims oriented: health care claims or equivalent encounter information, eligibility, claim status, enrollment and disenrollment, payment and remittance advice, coordination of benefits, premium payments, referral certification and authorization, first report of injury, claims attachments, and health care electronic funds transfer and remittance advice. A purely cash-pay med spa that never transmits any of those electronically is a health care provider under 160.103, and may not meet the covered entity test.

Read that carefully in both directions. It means you should not assume HIPAA applies without checking your own transaction footprint, including anything a third party transmits on your behalf. It also means the opposite conclusion is unsafe. State medical confidentiality statutes, professional board rules for the physicians and nurses on your license, and section 5 of the FTC Act all sit behind HIPAA. None of those were researched for this post, and none of them disappear because you take cash. HIPAA may not reach you, and that does not make you free.

The practical position for an operator is the same either way. Write your review reply policy to the stricter standard, because the cost of the stricter standard is a slightly blander public reply, and the cost of guessing wrong is on the table above.

What to change in your review process this month

Start with the funnel. If your follow-up asks patients to rate their visit and then routes only the high scores to a Google link, that is the arrangement Google's policy describes as selectively soliciting positive reviews. Replace it with one link that goes to everybody, on the same schedule, with no score gate in front of it. That single change takes you from a platform policy breach to the practice the FTC's own Example 11 describes as not unfair or deceptive.

Then audit the four things that are easy to fix in an afternoon. Remove any offer of a discount, credit, product or service tied to leaving a review, because Google's policy names those categories directly. Remove staff review targets, because Google names them. Remove any script asking patients to name their injector, because Google names that too. And put a written instruction on file that any employee or relative who reviews the business must disclose their relationship clearly and conspicuously, because 465.5(c)(1)(ii)(B) makes that instruction a defense.

Then rewrite the reply template. One template, used for every review, positive or negative, that thanks the reviewer for the feedback, states that the practice takes concerns seriously, gives a phone number and a named person to call, and says nothing that confirms or denies a treatment relationship. Have one person own replies. The Igbinadolor record shows the cheapest correction available in that whole matter was deleting the reply, and it was never made.

What your software has to do

Whatever system you run, this is the requirements list that makes the above operationally possible rather than aspirational.

It has to send the review request to every completed appointment on the same rule, with no branching on a satisfaction score, so the "invite all recent purchasers" position is a property of the system rather than a promise from your front desk. It has to record who was asked and when, so you can show the invitation was unconditional. It has to keep clinical notes, treatment history and payment records out of any outward-facing surface, so nobody can paste a chart detail into a public reply from muscle memory. It has to let you restrict who can publish a public response. And it has to keep the follow-up messaging that drives repeat visits separate from the review request, so that the work you do to bring clients back is never confused with an incentive attached to a review.

If you are choosing or replacing a system, that list is worth putting to any vendor in writing, alongside the questions in our breakdown of what med spa software actually costs. Velarya's own client management tooling is built around keeping clinical and marketing surfaces separate, and you can see how it handles patient records in a demo.

Frequently asked questions

Is review gating illegal?

Not per se, and not under the FTC's 2024 rule. The Commission stated in the final rule at 89 FR 68034 that 16 CFR 465.4 "does not cover 'review gating'". Gating is instead judged under the Endorsement Guides at 16 CFR 255.2(e)(11), which says the practice "may be an unfair or deceptive practice if it results in the posted reviews being substantially more positive than if the marketer had not engaged in the practice." That is a conditional effects test. Separately, Google's Maps User Generated Content Policy, read 19 August 2026, lists selectively soliciting positive reviews among the things merchants are not allowed to do.

Can I ask all my patients for a Google review?

Yes, on both sources. 16 CFR 465.2(d)(1) excludes reviews "that resulted from a business making generalized solicitations to purchasers to post reviews or testimonials about their experiences". 16 CFR 255.2(e)(11) adds that inviting all recent purchasers "would not have been unfair or deceptive, even if it had expressed its hope for positive reviews". Google's policy states it allows merchants to solicit or encourage content representing a genuine experience, without offering incentives and without attempting to influence the rating or the contents of the review.

Can I offer a discount for a Google review?

The two regimes differ, so the answer depends on which one you are asking about. 16 CFR 465.4 reaches compensation or incentives conditioned "expressly or by implication" on a review expressing a particular sentiment, so an incentive with no sentiment condition falls outside that section. Google's policy is broader and lists, among prohibited merchant conduct, offering incentives "such as payment, discounts, free goods and/or services in exchange for posting any review". A discount-for-review promotion can therefore be outside the FTC rule and inside Google's prohibition at the same time.

Can my staff leave reviews for my med spa?

16 CFR 465.5 permits an officer or manager review that carries "a clear and conspicuous disclosure" of the material relationship to the business, and 465.5(c)(1) extends the solicitation rules to immediate relatives, which 465.1(i) defines as "a spouse, parent, child, or sibling". Google's policy is stricter and prohibits "Content that is based on a conflict of interest", a definition that includes "current or former employment, a contractual or consultory relationship, or other professional or personal affiliations". A properly disclosed employee review can satisfy the FTC and still fall inside Google's prohibited content policy.

Can I ask patients to leave a review at the front desk?

Google's published policy, read 19 August 2026, addresses requiring and pressuring rather than asking. It says merchants "should not require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included", and gives two examples: merchants requesting that staff solicit a certain number of reviews, and merchants requesting that staff solicit reviews containing specific content, "including content that identifies a staff member". So drop the staff quota and drop the request to name the provider. Google's own suggested method is to ask customers to visit a Google link or scan a QR code.

How should I respond to a negative med spa review?

Write a reply that neither confirms nor denies that the reviewer was a patient, and that contains no treatment, scheduling, billing or insurance detail. Under 45 CFR 160.103, information relating to "the provision of health care to an individual" that identifies the individual is protected health information, so confirming patient status is a disclosure and so is denying it. Thank the reviewer, state that concerns are taken seriously, and give a phone number and a named person to contact offline. Move the specifics to that call.

Does HIPAA apply to a cash-pay med spa?

Not automatically. 45 CFR 160.103 defines a covered entity to include "A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter", and the enumerated transactions are all insurance or claims oriented, such as claims, eligibility, remittance advice and coordination of benefits. A practice that never transmits any of those electronically may fall outside the covered entity definition. That is not permission to publish patient details. State confidentiality law, professional board rules and section 5 of the FTC Act still apply and were not examined here.

Do more Google reviews improve local ranking?

Google's own wording is permissive rather than causal. Its Tips to improve your local ranking page states that prominence is "also based on info like how many websites link to your business and how many reviews you have" and that "More reviews and positive ratings can help your business's local ranking." That page published no weighting when it was read on 19 August 2026, and states that Google keeps "the search algorithm details confidential". The same page states there is "no way to request or pay for a better local ranking on Google", which is worth remembering the next time an agency prices a rank position.