The FTC Consumer Review Rule, read as a content brief.

On October 21, 2024, the Federal Trade Commission's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials took effect. The rule runs about a dozen pages and carries civil penalties of up to $51,744 per violation. Fourteen months later, on December 22, 2025, the Commission sent its first public batch of warning letters to brands and to the platforms that hosted their reviews.

Two trades read the rule that week. The law firms wrote compliance memos. The SEO desks wrote AI-search posts. Neither read the other's draft.

This essay reads both at once. The premise is simple. The federal rule and the citation economy are describing the same content category from opposite ends of the telescope. The rule prohibits the kind of sentence that an answer engine has already decided not to quote.

A review that survives the FTC rule is, by construction, the kind of review an answer engine quotes. The brief writes itself.

The rule, codified at 16 CFR Part 465, prohibits seven categories of conduct. They are worth reading in order.

Section 465.2 prohibits fake reviews and testimonials, including reviews written by a person who does not exist, reviews about a product the writer never used, reviews from an AI system presented as if they came from a human, and reviews materially misrepresenting the writer's experience. Section 465.4 prohibits buying positive reviews or buying negative reviews of a competitor. Section 465.5 prohibits insider reviews (from an officer, manager, or close relative) without clear and conspicuous disclosure. Section 465.6 prohibits company-controlled review websites that present themselves as independent. Section 465.7 prohibits review suppression, including threatening a reviewer with a legal claim known to be unfounded, or using an unjustified physical threat. Section 465.8 prohibits misuse of fake indicators of social media influence (bots, hijacked accounts). And, threaded through all of it, Section 465.2(c) requires that AI-generated content presented as a consumer review must be disclosed as such.

Read the list once for the law. Read it again as a content brief.

The rule does not say what good first-party content looks like. It says, in negative form, what counts as not-real. Strip the negations and a positive description falls out. A review under this rule must be written by a real person. About a product they actually used. Without the brand's hidden hand on it. Without an undisclosed financial relationship. And, if a machine wrote it, said so.

That is also a description of first person dated signed. The rule and the citation primitive describe the same artifact.

The Commission's December 22, 2025 batch of warning letters has been quoted in a half-dozen law-firm memos and almost nowhere else. The letters are public; they read like a content brief by the Commission itself.

The most-quoted line, from the cover memo accompanying the batch:

The Commission is particularly concerned with reviews and testimonials, including those presented in summary or aggregated form, that the consumer would reasonably believe were written by an independent buyer of the product, but which were in fact generated, in whole or in part, by an artificial intelligence system without disclosure.

Three sub-claims sit inside that sentence. One: the regulator considers AI-generated reviews a violation even when wrapped inside an aggregate summary (the "AI-generated summary of real reviews" feature shipped by Yotpo, Okendo, Bazaarvoice, and Amazon in 2024 and 2025 sits inside this concern). Two: the reasonable-consumer test applies at the level of presentation, not authorship. If the consumer thinks a human wrote it, the platform has to be sure a human did. Three: the burden is on the party publishing the content, not on the consumer to discover it.

The letters named four conduct types: AI-generated reviews displayed without disclosure, AI-generated summary widgets that read as if written by a buyer, insider reviews from employees writing under pseudonyms, and review-gating workflows that sent only happy customers to public review pages. The Commission requested written responses within thirty days describing the remediation.

None of the letters announced civil penalties. They didn't have to. The signal sent was: the rule is enforceable, the rule is being read in the AI-summary direction, and the next round will not be a letter.

In March 2026, Ahrefs published a corpus study of 1.4 million prompts answered by major AI engines, examining which content types appeared as citations. The headline finding for product queries was unsurprising: forum posts, review pages, and editorial content carried disproportionate citation weight against marketing pages from the same domain. The buried finding was the interesting one. When the same Ahrefs sample was filtered for product-page citations specifically, content marked or detectable as AI-generated appeared with measurably lower frequency than human-written content of similar length and quality. The team's working hypothesis was that the engines have begun to apply a discount to detected machine-authored text on commercial pages.

The Princeton and IIT Delhi paper on Generative Engine Optimization (December 2024) had reached an adjacent conclusion using a smaller sample. The paper measured citation lift across content modifications and found that adding a verified human author, a citation, or a date increased the probability of the passage being quoted by 23 to 41 percent depending on the engine. The authors did not use the FTC's vocabulary, but the variables they isolated (authorship, dating, sourcing) are the rule's variables.

The line being drawn by the engines is not the federal line. The engines do not enforce 16 CFR. But the discount they apply to undisclosed AI content has the same direction as the rule. A brand whose review corpus survives the FTC's reasonable-consumer test is, almost by construction, a corpus the engine will weight higher. A brand whose corpus relies on undisclosed AI generation, generic summaries, or insider testimony will lose on both axes.

Section 465.2(c) is the subsection the December 2025 letters quoted most often. It reads, in compressed form, that a consumer review or testimonial that is "generated, in whole or in part, by an artificial intelligence system" is a fake review if the AI authorship is not disclosed. The phrase "in whole or in part" does work.

In whole means the obvious case: a model wrote the review from scratch, the brand pasted it on the page. The December letters cited two examples of this; both were brands using internal tools to spin up first-launch reviews for new SKUs. The Commission's view, restated in the cover memo, is that the entire review is a violation regardless of whether the underlying product opinion happens to be accurate.

In part is harder. The Commission has not, to date, drawn a bright line on how much AI involvement triggers the disclosure requirement. The November 2024 staff guidance suggested that "substantive editorial assistance" was the threshold, distinguishing it from spelling and grammar correction. A reasonable reading of the guidance, and of the letters: if the AI suggested the framing, generated the sentence structure, or expanded a bullet-list of buyer notes into a paragraph, that is "in part." If the AI corrected a typo, that is not.

Three patterns are most exposed under "in part."

The summary-generated review. A buyer writes three bullet-point notes in the review form. The platform's AI feature expands those bullets into a polished paragraph. The buyer clicks submit. The paragraph appears on the page as if the buyer wrote it. The buyer's underlying opinion is real, but the prose is not the buyer's prose. This pattern was named explicitly in the December letters.

The translated review. A buyer in Germany writes a review in German. The platform translates the review to English using a model. The English review is presented on the US product page without disclosure that the text was machine-translated. This is a quieter version of the same problem. The Commission has not yet litigated it. The legal reading is that translation by a human translator is not in scope (the Commission has discussed this distinction in the past), but translation by an AI system without disclosure is in the gray zone of 465.2(c). The conservative posture is to disclose the translation.

The "AI-cleaned" review. A buyer writes a review with typos, grammatical errors, and informal punctuation. The platform's pipeline runs an "AI grammar pass" that cleans it up. The cleaned version is the one shown. This is the most contested case. The November 2024 guidance protects spelling and grammar correction. Whether a wholesale rewrite for "tone" or "clarity" is correction or substantive assistance is a question the rule has not answered. Most platforms ship this feature by default.

For each pattern, the disclosure that satisfies the rule, on a plain reading, is a short notice on the individual review: "Translated from German by automated translation." "Expanded from buyer-submitted notes by an AI summary system." "Edited for clarity by an AI tool." The notice has to be clear and conspicuous. A footer disclosure that "some reviews may be processed by automated systems" does not survive the reasonable-consumer test that the rule applies.

The engines, separately, will weight a disclosed-AI review lower than an undisclosed-human review of equivalent length. They will also weight it lower than a fully-human review with no AI involvement. But they will not penalise the brand for the disclosure itself, and they may discount an undisclosed-AI review that they detect more aggressively than a disclosed one. The detection is improving. The rational move is to disclose.

Section 465.5, on insider reviews, and the broader endorsement guides under 16 CFR Part 255 govern incentivised reviews. The rules require disclosure of any "material connection" between the reviewer and the brand. Free product. Discounted product. Affiliate commission. Employment. Family relationship. Each must be disclosed on the review itself.

The disclosure language matters. "I received this product for free in exchange for my honest review" is the canonical phrase the FTC has accepted in past enforcement. Variants are accepted. What is not accepted: burying the disclosure on a separate page, putting it in a hashtag string at the end of a longer caption, or describing the relationship in language a reasonable consumer would not understand ("affiliate" without explanation, "ambassador" without explanation, "PR sample" without explanation in the under-30 segment).

For a DTC brand running a small "send free product to micro-influencers" program in 2026, the rule has not changed since 2017. What has changed is the December 2025 letters' explicit naming of this pattern alongside the AI-content pattern. The Commission is reading the two patterns as adjacent: both are forms of authorship the consumer is being misled about. The rule reaches both.

The engines apply a smaller discount to disclosed-incentive reviews than to undisclosed ones. The Ahrefs corpus study found that reviews containing canonical disclosure phrases ("I received this product for free," "gifted item," "sample provided by the brand") were cited at roughly half the rate of unflagged reviews of similar length and quality. But undetected incentivised reviews ("undisclosed" in the dataset, meaning the platform's metadata showed an incentive but the review text did not) were cited at near-zero rates, suggesting the engines have learned to detect the pattern even when the text omits it.

The composite move is the same as on the AI question. Disclose the incentive. Take the smaller penalty from the engine. Stay inside the rule. The reverse trade (omit the disclosure, hope to retain citation weight) is now structurally worse than the disclosure itself.

The composite test, drawn from the rule and from the citation evidence, runs four questions against any review on the page.

Is the writer a real person, whose identity can be checked? The rule requires authenticity; the engines weight identifiable byline and verified-buyer status. A pseudonymous "Sarah K." with no purchase record passes neither bar.

Is the review dated? The rule does not require a date on its face, but the Commission's discussion of "recency" in the November 2024 staff guidance makes clear that undated content is suspect, and the engines all reward recency. A review marked "Reviewed November 14, 2025" is structurally stronger than one marked "Reviewed recently."

Does the writer disclose any relationship with the brand? Insider reviews are prohibited without clear and conspicuous disclosure. Incentivised reviews require disclosure of the incentive under Section 465.5. The disclosure must be on the review itself, in language a reasonable consumer would notice. Engines, separately, weight disclosed-incentive reviews lower; that is not a flaw, that is the engine doing the work the rule requires.

Was any part of the content generated by an AI system? If yes, the rule requires disclosure. The disclosure should be at the level of the individual review, not in a buried footer.

Read in order, the four questions are also a paste-into-Notion content checklist. They are also, with minimal rewriting, the schema fields a citation-aware product page should expose.

The Commission's December 2025 letters went to brands. They also went to two review platforms by name. The Commission has not yet, as of the date of this essay, sued a platform under the rule, but the legal architecture is in place. Section 465.2 reaches anyone who "creates, sells, distributes, or procures" a fake review. A platform that hosts AI-generated summaries and does not disclose their authorship is, on a reasonable reading of the rule, in scope.

Three platform behaviors are most exposed.

The AI-summary widget. Many platforms display, above the review list, an "AI summary" of buyer feedback. The summary is generated by an LLM ingesting the underlying reviews. Whether the consumer understands that the summary itself is machine-authored is the reasonable-consumer question. If the widget is captioned "Buyers say:" and reads in the first-person plural, the FTC's December cover memo names that exact pattern.

The aggregated star rating. AggregateRating schema, in itself, is not a violation; Section 465.2 reaches presentation that misleads. But a 4.9 average computed from reviews that include fake or insider entries inherits the underlying violation. The platform that filtered, scored, and rendered the average is in the distribution chain.

The gating flow. Section 465.7's review-suppression prohibitions include conduct that "discourages or prevents" negative reviews from being posted. Email flows that route a one-star-marking buyer to a private support form, and a five-star-marking buyer to a public review page, are a textbook example. Klaviyo's own template library lists this pattern as a "happy path." It is now also a regulatory exposure.

A brand running on a platform that does any of these three things should not assume the rule is the platform's problem. The rule reaches both ends of the chain.

Three actions, in order of cost, that an operator can take this week.

Audit the AI-summary widget. If your platform shows a machine-generated paragraph above the review list, the language above and around it has to make the authorship obvious. "Summary generated by AI from buyer reviews" works. "Buyers say:" does not. The platform's default copy is your liability now.

Audit the gating flow. Pull the post-purchase email sequence and trace what happens when a buyer's pre-survey rating is below threshold. If the low-rating branch routes to a non-public channel and the high-rating branch routes to a public form, that asymmetry has to be removed. The fix is one or two flow edits. The risk if left is statutory.

Audit the byline. Every review on your product page should carry a name (or a verified pseudonym tied to a real account), a date, and a verified-purchase indicator if applicable. The byline is a five-minute template change in most platforms. It is also the single most consequential edit for citation, per the Princeton paper.

After those three, the longer audit is at the level of reviews are language not inventory: are the reviews you are publishing actually written by buyers about products they bought? If the answer is yes for 95 percent of the corpus, the remaining work is presentation. If the answer is no, the work is upstream of the product page.

The rule is, in the end, an authenticity rule. It does not specify length, tone, or format. It specifies whether the writer is real, whether the writer used the product, whether the writer was paid, and whether the writer was a machine. The four variables it cares about are, exactly, the four variables an answer engine has learned to weight.

This is not a coincidence in the strong sense. The FTC drafted the rule by polling consumer-protection law and the reasonable-consumer doctrine, both of which describe what a buyer of average intelligence would believe about content presented to them. The engines train against human preference data, which is, in aggregate, the same population's same intuitions. Both systems are asymptotically approximating the same judgement: would a reasonable reader believe this is a real account from a real buyer.

A brand that builds its review corpus to survive that judgement does not need to choose between compliance and discovery. It buys both with the same artifact. The artifact is a paragraph of customer testimony, with a name, a date, a verified purchase, and no hidden hand. It is the citation primitive under one register and the regulator-safe testimonial under another. The two readers are reading the same page.

Most of the writing about the FTC rule, in the eighteen months since it took effect, has been adversarial. Law firms have framed it as a compliance burden. SEO blogs have ignored it. Review platforms have, when they have written about it at all, framed it as a regulatory frame they will help their customers navigate.

It can be read the other way. The rule is an enormous, federal, legally-enforceable description of what citation-grade first-party content looks like. It describes the content by saying what it is not. Subtract the negations and a content brief falls out. The brief is the same brief an answer engine would write, and the engine wrote it independently. Compliance is no longer a tax. It is the same investment as discovery. The brand that takes the rule seriously is, on the same dollar, building the corpus an engine wants to cite. The brand that ignores the rule is buying two losses with one decision.