Compliance
Is asking customers for Google reviews allowed?
Yes. Google’s own documentation tells businesses to ask, and names scanning a code as a way to do it.[1]
Not legal advice. Check your licensing board and your own counsel.
Healthcare
Asking is not the HIPAA risk. Replying is.
Inviting a patient to review you discloses nothing. They write it themselves, in their own account. Every published enforcement action here was about what the practice wrote back.
- New Vision Dental, December 2022. $23,000. Yelp replies named patients who had posted under pseudonyms, and referenced visits and insurance.[7]
- Elite Dental Associates, October 2019. $10,000. Patient information disclosed in a reply to a Yelp review.[8]
Even confirming that a named person is a patient is a disclosure. TovTap never posts or replies for you.
More on the two settlements, and whether you can reply at all
In December 2022 the HHS Office for Civil Rights announced a settlement with New Vision Dental, which paid $23,000 and adopted a corrective action plan. The investigation concerned the practice’s responses to reviews on its Yelp page, including responses using patients’ full names where the reviewers had posted under pseudonyms, and responses including details about visits and insurance.[7]
In October 2019 Elite Dental Associates of Dallas paid $10,000 to settle an OCR investigation into the disclosure of patient information in responses to a Yelp review.[8]
The pattern in both is identical: the practice tried to defend itself in public and disclosed information doing it. Nothing requires you to stay silent, though. The FTC’s guidance says that if someone posts a negative review, “Yes, you can respond publicly to the review, and yes, you should watch what you say.”[6] The templates below do both at once.
Dentists, lawyers and financial advisors
Dentists. The American Dental Association’s Principles of Ethics and Code of Professional Conduct provides that “Although any dentist may advertise, no dentist shall advertise or solicit patients in any form of communication in a manner that is false or misleading in any material respect.”[9] The standard is truthfulness. A review from a real patient, in their own words, with nothing offered in exchange and no filter on who gets asked, is the version hardest to call misleading. Your state board may add requirements and this page makes no claim about any state’s rules.
Lawyers. Attorney advertising and solicitation rules are set state by state and vary meaningfully. We make no claim about any jurisdiction. Check your state bar’s advertising rules and any required disclaimers first.
Investment advisers. The SEC’s Marketing Rule permits testimonials and endorsements rather than banning them, but conditions them on disclosure made clearly and prominently “That the testimonial was given by a current client or investor” and “That cash or non-cash compensation was provided for the testimonial or endorsement, if applicable.”[10] Pay for a review and you inherit a disclosure obligation. Not paying keeps it simple, and it is what Google requires anyway.
Practical
Safe replies you can copy
Print these. Give them to whoever handles your reviews. This is the control that would have prevented both settlements above.
Three replies you can use as writtenPositive, negative, and the one that gets practices fined
Replace the bracketed placeholders with your contact details and change nothing else.
Reply to a positive review
Someone left you a good review and you want to thank them.
Thank you for the kind words. Our team really appreciates you taking the time to share this. If we can help with anything, please call our office at [PHONE].
Why it is safe: It thanks the reviewer without confirming that they are or ever were a patient, and without naming a treatment, a visit date, or a provider.
Reply to a negative review
Someone left a critical review and you want to make it right.
Thank you for the feedback. We take every concern seriously and would like the opportunity to address this with you directly. Please contact our office manager at [PHONE] or [EMAIL] so we can discuss it privately.
Why it is safe: It moves the conversation offline, which is the whole point. It does not confirm the person is a patient and does not reference records, billing, or insurance.
Reply to a review you believe is inaccurate
The review is wrong, unfair, or possibly not even from a customer. This is the one that gets practices fined.
We appreciate all feedback and use it to improve. As a matter of policy, we do not discuss any individual's specific situation in a public forum. Please contact us at [PHONE] and we will look into your concerns.
Why it is safe: Correcting the record in public is exactly the instinct that led to both dental enforcement actions cited above. This reply defends your reputation by showing restraint, and it discloses nothing.
The do and do not list for replies
Do
- Keep every reply generic enough that it would read the same way to a stranger.
- Thank the person, invite them to continue offline, stop there.
- Have one named person handle all replies, using an approved template.
- Use the same restrained template when the review is unfair or false.
Do not
- Do not confirm or deny that the reviewer is or ever was a patient. Confirming the relationship is itself a disclosure.
- Do not use a real name if they posted under a handle.
- Do not mention treatment, diagnosis, dates of service, insurance or billing.
- Do not correct the record from the chart, however wrong the review is.
- Do not ask staff to post reviews, hit a review quota, or name a team member. Google prohibits all three.
If you want the detail
The rules, in their own words
Two separate rulebooks apply. Google decides whether you may ask. The FTC decides what counts as a fake or suppressed review. Conflating them is where most advice on this goes wrong.
What Google's policy actually says
“Remind customers to leave reviews: To leave reviews, you can ask customers to visit a Google link or scan a QR code.”
The same page draws the line at rewards: “Offering incentives, like free or discounted goods or services, in exchange for customers to post reviews, change reviews, or remove negative reviews is considered fake & misleading content and is strictly prohibited.”[1]
Google’s Maps content policy is where the clearest prohibition on gating lives. Under Rating Manipulation, merchants may not “Discourage or prohibit negative reviews, or selectively solicit positive reviews from customers,” and when soliciting reviews merchants “should not require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included.”[2] Setting a stand out is fine. Standing over someone until they tap it is not.
“We do allow merchants to: Solicit or encourage the posting of content that does represent a genuine experience, without offering incentives to do so or attempting to influence the rating or the contents of the review.”
What the FTC rule covers, and what it does not
The FTC’s Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024.[3] It targets fake and false reviews, reviews bought with incentives, undisclosed insider reviews, company-controlled review sites, review suppression, and fake indicators of social media influence.
On incentives it is narrower than most summaries claim. Section 465.4 bars providing “compensation or other incentives in exchange for, or conditioned expressly or by implication on, the writing or creation of consumer reviews expressing a particular sentiment, whether positive or negative.”[4] The FTC’s guidance confirms the rule “does not prohibit giving incentives for reviews, as long as there isn’t an express or implied requirement that the reviews have to express a particular sentiment,” while warning that failing to disclose an incentive can violate the FTC Act separately.[6] Its example of crossing the line: “Tell us how much you loved your visit to John’s Steakhouse and get a $5 coupon.”[6] For Google reviews the nuance is academic, because Google bans incentives outright with no sentiment condition. Never attach a reward.[1]
On suppression, section 465.7 covers two things: using unfounded legal threats, physical threats, intimidation or knowingly false public accusations to stop or remove a review, and materially misrepresenting that the reviews displayed on a site you control represent most or all of those submitted when negative ones are withheld.[5]
The internet gets this wrong: as written, section 465.7 does not by itself make it unlawful to ask only your happy customers. Gating is squarely a Google policy violation,[2] and it becomes an FTC problem specifically when a business publishes a curated review feed with the negatives filtered out.[5] Not gating keeps you clear of both.
What TovTap does not do
- No gating. The Google button renders first, for everyone, before any rating is chosen. The private feedback box is identical at one star and at five.
- No incentives. You cannot configure a discount, freebie or entry in exchange for a review, because Google prohibits it.
- No pre-written review text. A neutral starter prompt at most, never a sentence to paste, never steered toward praise.
- No filtering or editing. TovTap does not post, reply to, edit or remove reviews. Your listing stays yours.
- No pressure. The stand sits on the counter. Nothing pops up, nothing chases anyone by text or email.
At the counter
Questions we actually get asked
Is asking customers for Google reviews against Google's rules?
No. Google's own Business Profile help page tells businesses to remind customers to leave reviews, and it names visiting a Google link or scanning a code as ways to ask. What Google prohibits is offering incentives, discouraging negative reviews, and selectively soliciting positive ones. TovTap does none of those.
Can the FTC penalize a small business for asking customers for reviews?
The FTC rule that took effect on October 21, 2024 targets fake and false reviews, reviews bought with incentives tied to a particular sentiment, undisclosed insider reviews, company-controlled review sites, and review suppression. A card on your counter that anyone can tap, with no reward attached and no filtering, is none of those things.
Can dentists ask patients for Google reviews without violating HIPAA?
Asking is not where practices get into trouble. Replying is. Inviting a patient to leave a review discloses nothing about that patient, because the patient chooses what to write in their own account. The published HHS Office for Civil Rights enforcement actions against dental practices in this area were about what the practice wrote back in public, including using a patient's full name where the reviewer had used a pseudonym and referencing visit and insurance details. TovTap never posts or replies on your behalf.
Is offering a private feedback option the same as review gating?
No. Review gating means showing the Google option to happy customers and hiding it from unhappy ones. TovTap shows the Google review button to everyone, first, before any rating is chosen, and the private feedback box then appears identically whether someone tapped one star or five stars. Both options are open to every single person who taps.
Do professional licensing boards allow asking for reviews?
Rules vary by profession and by state, so check your board and your own counsel. For dentists, the American Dental Association's published standard for advertising and solicitation is truthfulness: no dentist may advertise or solicit patients in a manner that is false or misleading in any material respect. Unincentivized, ungated reviews written by real patients are the easiest version of this to defend.
What if asking for reviews gets us a negative review?
It might, and that is the point of not gating. You are not powerless, though. The FTC's own published guidance confirms that you can respond publicly to a negative review, as long as you watch what you say, and that nothing in the rule stops you from contacting a customer to resolve the problem they reported.
Receipts
Sources
- [1] Google, Tips to get more reviews (Business Profile Help)
- [2] Google, Prohibited and restricted content (Maps user generated content policy)
- [3] Federal Register, Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465
- [4] 16 CFR 465.4, Buying Positive or Negative Consumer Reviews
- [5] 16 CFR 465.7, Review Suppression
- [6] FTC, The Consumer Reviews and Testimonials Rule: Questions and Answers
- [7] HHS Office for Civil Rights, settlement with New Vision Dental (December 2022)
- [8] HHS Office for Civil Rights, settlement with Elite Dental Associates (October 2019)
- [9] American Dental Association, Principles of Ethics and Code of Professional Conduct (PDF)
- [10] SEC, Investment Advisers Act Rule 206(4)-1 (the Marketing Rule), 17 CFR 275.206(4)-1
What we left out, on purpose
No per-violation penalty figure, because those amounts are adjusted annually and we could not confirm a current number against a primary source. No specific state dental board or state bar rule, because those vary by jurisdiction and we have not verified yours. No claim that the FTC rule bans review gating outright, because as written it does not say that. Google’s policy is the authority on gating.
TovTap is an independent company, not affiliated with, endorsed by or certified by Google, the FTC, the ADA or the SEC. TovTap does not claim to be HIPAA compliant and is not your business associate. Nothing here is legal advice. Consult your licensing board and your own counsel.
See what your customer sees
The whole flow, including the private feedback option that everybody gets.
