Guide
Med spa reviews: what Google and the FTC allow
Ask every patient for a review in the same way, whatever their experience. Don't steer unhappy patients away from review sites, don't write or buy reviews, and don't reward reviews, especially positive ones. When you reply, never confirm that someone is a patient or mention their treatment.
Can you ask only happy patients for reviews?
No. Google's review policy prohibits selectively asking customers with positive experiences for reviews and discouraging negative ones, often called review gating. A survey that sends only five-star answers to Google is exactly that. The FTC's rule doesn't name gating specifically, but the FTC says asking only happy customers could violate the FTC Act, and the rule does prohibit suppressing negative reviews.
What does the FTC's review rule prohibit?
The FTC's Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465) took effect in October 2024. In plain terms, it prohibits:
- Fake reviews and testimonials, however they are produced, including AI: reviews by people who don't exist, who didn't use the service, or that misrepresent their experience.
- Buying reviews, or offering anything in exchange for a review that is conditioned, openly or implicitly, on it being positive or negative.
- Reviews or testimonials by the business's officers, managers, employees or agents without a clear disclosure of the relationship, and, in some circumstances, asking employees or relatives of staff for reviews.
- Review websites presented as independent when the business controls them.
- Suppressing negative reviews through threats, intimidation or false accusations.
- Buying or selling fake social media indicators, such as followers or views, to misrepresent influence.
The FTC can seek civil penalties for violations. The cap is adjusted for inflation each year: it was $53,088 per violation when the FTC warned ten companies about the rule in December 2025 (16 CFR 1.98). Read the rule itself and the FTC's questions and answers for the detail.
Can you offer a discount or gift for a review?
Not for Google reviews. Google prohibits reviews posted because the business offered an incentive, whatever the review says, and its Business Profile help calls discounts or free goods for reviews strictly prohibited. Under the FTC rule, an incentive tied to a particular sentiment is prohibited everywhere. The simplest compliant approach is no incentives at all.
Can staff or owners review the practice?
No. Google's policy prohibits reviews with a conflict of interest, including from current or former employees and contractors, and the FTC rule restricts undisclosed reviews by a business's officers, managers and employees. Ask staff to share the practice's review link or QR code with patients instead.
How do you reply to a review without a HIPAA problem?
Treat every reply as public. Even if the reviewer has shared their own details, the practice should not confirm that they are a patient, mention their treatment or discuss their visit. The HHS Office for Civil Rights has settled with practices over exactly this, including a Dallas dental practice in 2019 ($10,000) and a New Jersey psychiatric practice in 2023 ($30,000) that disclosed patient information in replies to online reviews.
What about testimonials on your own site?
Patient testimonials on your site or social channels generally need the patient's written HIPAA authorization, collected by the practice. If the patient received anything of value, disclose it. And a testimonial describes one experience: it does not prove a treatment works or that results are typical. See patient UGC consent and HIPAA basics.
A simple review process for a med spa
- Send the same review request after every visit, through your practice's own messaging and with the consent your systems require.
- Link straight to your Google review form. No screening question first.
- Handle complaints through a separate service-recovery path that has nothing to do with the review link.
- Reply to reviews with the HIPAA-safe pattern above.
- Report reviews that break the platform's rules through the platform. Never pressure a reviewer to remove a review.
Questions
Can we remove negative reviews?
Not because they are negative. You can report a review that breaks the platform's rules, such as spam or a conflict of interest, through the platform's own tools.
Is it review gating to ask 'How was your visit?' first?
If the answer decides who receives the review link, yes. If everyone receives the link whatever they answer, it isn't.
Do these rules apply outside Google?
The FTC rule applies to reviews and testimonials generally, wherever they appear. Each review platform also has its own policies.
Sources
- Google Maps user-contributed content policy: prohibited and restricted content
- FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465 (eCFR)
- FTC: Consumer Reviews and Testimonials Rule: Questions and Answers
- FTC: FTC warns 10 companies about possible violations of the agency's new consumer review rule (December 2025)
- Google Business Profile Help: Tips to get more reviews
- HHS: Dental practice pays $10,000 to settle social media disclosures of patients' PHI (2019)
- HHS: Manasa Health Center resolution agreement and corrective action plan (2023)