Binding law — in force AI-adjacent law
Do not publish AI-generated reviews or testimonials that misrepresent that the reviewer exists or used the product (16 CFR 465.2)
A business may not write, create or sell a consumer review, consumer testimonial or celebrity testimonial that materially misrepresents that the reviewer or testimonialist exists, used or had experience with the product, service or business, or what that experience was (16 CFR 465.2(a)), and may not purchase such a review or disseminate such a testimonial about itself when it knew or should have known of the misrepresentation (465.2(b)). The Commission states that AI-generated reviews are covered (89 FR 68034, n. 35). The rule text never mentions AI; it is encoded as AI-adjacent (owner decision D-19, D-11 pattern 1). Detect code that writes model-generated review or testimonial text into a review store or posts it with no real submitting customer.
Trust and provenance not reviewed by a lawyer · audit-grade · source verified 4 Oct 2026 · release 2026.10.05
- Lane
- Binding law — in force In force: applies since 21 Oct 2024
- Official source
- 16 CFR 465.2(a) · captured 4 Oct 2026 · anchor hash (SHA-256)
87c57e7a019f…· 9 more anchors in the data release - Verification
- Quoted text found word for word in the captured official document (4 Oct 2026). Source last verified 4 Oct 2026: checked against the captured official document; not in the weekly watcher's list; checked against the captured document.
- Data release
- Data release 2026.10.05, data as of 4 Oct 2026, schema 0.3.10.
- Legal review
- Not reviewed by a lawyer. TwinEthos derived this rule from the official text it cites: treat it as research to check against that text; it is not legal advice. No TwinEthos rule has been legally reviewed yet. Open questions for counsel on this rule: 1.
- Audit standard
- Audit-grade: meets all 10 checks of the TwinEthos audit standard that apply to it. The audit standard is TwinEthos's own quality bar for provenance, dates, applicability, detectors, fixtures, remediation and licences; it is not a legal review.
- Detectors
1 detector (code pattern), experimental: written from the rule's text and not yet measured for precision on real code, so treat a hit as a lead to verify.
Known limits:
- Generated reviews posted to third-party sites by a separate marketing tool
- Author ids invented by the generator
- Review-writing assistants that return a draft to the signed-in customer are compliant when only the customer's submit creates the review; check the submit handler. Synthetic reviews in test fixtures or demo seed data ne…
Who it applies to
- Duty falls on: organization
- Businesses (16 CFR 465.1(a)) that write, create or sell consumer reviews or testimonials, including with generative AI, or that purchase reviews or disseminate testimonials about themselves, where the review or testimonial materially misrepresents that the reviewer exists, used the product or had the experience described, for consumers in the United States. In force from 2024-10-21.
- Not covered:
- Paragraph (b) (purchasing or disseminating) does not apply to reviews or testimonials resulting from generalized solicitations to purchasers to post about their experiences, or to reviews that appear only because the business hosts consumer reviews (465.2(d)); paragraph (a) (writing or creating fake reviews) has no such exception
- Whether it applies depends on facts outside the code; a person has to decide.
The guard to add
Never publish model-written reviews or testimonials as a customer's; let a linked customer edit and submit any AI draft.
In review and testimonial features, model output is a draft returned to the signed-in customer (review_draft), and only that customer's submit action creates the review, with author_id and, where available, order_id or a verified-purchase flag. Remove any seeding, persona or marketing job that writes generated reviews or testimonials into the review store or posts them to third-party sites; AI summaries of real reviews are labelled as summaries, never shown as a review.
Where it goes: 1 application source code, 2 data models, 9 AI output handling, 14 user-facing text.
What this provision adds:
- Writing or creating a fake review is covered whoever posts it; purchasing reviews or disseminating testimonials is covered when the business knew or should have known of the misrepresentation.
Example (Python + OpenAI SDK), before:
text = client.chat.completions.create(model=M, messages=[{'role': 'user', 'content': f'Write a 5-star review of {p.name}'}]).choices[0].message.content
db.reviews.insert_one({'author': fake.name(), 'rating': 5, 'text': text})After:
draft = client.chat.completions.create(model=M, messages=help_me_write(customer_notes)).choices[0].message.content
return {'review_draft': draft} # the signed-in customer edits and submits it
def submit_review(user, order, text, rating):
db.reviews.insert_one({'author_id': user.id, 'order_id': order.id, 'verified_purchase': True, 'text': text, 'rating': rating})Control: AI-generated consumer reviews or testimonials are published as if written by real customers who used the product. The same guard addresses 1 item with binding law in 1 jurisdiction. Engineering guidance, not legal advice.
Rule id us-ftc-reviews-rule.no-ai-generated-fake-reviews-or-testimonials · review status: primary source derived