The FTC Consumer Review Rule for Magento 2 Stores: Audit Your Reminders, Incentives and Moderation

In July 2026, the FTC finalized an order against supplement seller TruHeight with a $4 million judgment, partly suspended to $750,000 on payment. According to a DLA Piper analysis, the Consumer Review Rule was the only legal basis for the money. The review conduct at issue: employees posing as real users, and consumers offered a free product or discount in return for a five-star review.

A Magento 2 store sits in the middle of that conduct. It sends reminder emails, hands out coupons, and decides which submissions appear. Each is a setting, and each can be configured to fit the rule or not. The FTC’s staff guidance says a retailer that merely hosts reviews is not liable for fake ones it did not write or buy. Incentives, insider reviews, and suppression differ because they reflect the store’s own conduct.

This guide gives a seven-step audit of review reminders, incentives, and moderation, mapped to the settings in MageDelight’s Advanced Review Ratings & Reminders extension. It covers the US rule only. It is general information drawn from public FTC materials, not legal advice, and the author is not a lawyer. Have counsel review your final policy.

What the Rule Says, in Plain Terms

The rule is called 16 CFR Part 465. This rule became active on October 21, 2024. This rule allows courts to charge money penalties to people who intentionally break the law. The table summarizes each section and where a store is exposed.

Four facts shape the risk. The FTC has set the civil penalty at $53,088 for each violation, a number the FTC says can rise quickly. Next, the rule does not allow consumers to take action on their own, but state attorneys general can act under state laws, as Illinois did when it joined the FTC in a lawsuit in May 2026 against Premium Home Service. Then FTC staff said their responses do not provide any protection from action. Finally, the FTC sent warning letters to 10 companies in December 2025. According to DLA Piper, the companies that got the letters were property management companies, personal injury law firms, and an accounting firm. These companies were accused of giving money or other rewards for reviews. The letter asks the companies to respond within five business days.

Prerequisites

• Access to the extension configuration, the reminder rules, the Manage Reviews grid, and Marketing > Cart Price Rules.

• A spreadsheet to record each setting, its current value, the risk, and the fix.

• The wording of every email template that asks for reviews or carries a coupon.

• A named owner for review policy, plus access to counsel for the final sign-off.

• A list of any agencies, reputation vendors, or marketplaces that gather, import, or reprint your reviews.

The Seven-Step Audit

Step 1: Map Every Path a Review Takes

List each way a review reaches your storefront, because the rule applies to the store’s conduct at every point. For a store running the extension, the paths are:

• The product review form, open to everyone, registered customers only, or verified buyers only, depending on the Allow to Post Review setting.

• Automated reminder emails sent by reminder rules.

• Order experience and shipping experience ratings, each with their own reminder emails.

• Reviews created by an administrator on the Add New Review screen.

• Reviews migrated from the native Magento system or another platform.

• Reviews that are shared or imported from platforms and agencies.

• Reviews that are used in advertisements, landing pages, and email marketing campaigns.

Success looks like this: a page map that shows, for each path, who starts it, who can modify it, and where the reviews go.

The Settings Map

Use this table as the audit worksheet. It links each extension setting to the rule section it touches, a safe configuration, and a red flag.

Step 2: Audit the Reminders

Generalized solicitation is the area where the rule leaves the room, though FTC staff say the guidance is not a formal safe harbor. FTC staff say a shop that emails every buyer to ask for feedback is not responsible if an employee on that list leaves a review and the same answer holds when every recipient is offered a reward. The danger comes from who gets the email and what it says.

In MageDelight > Advanced Review > Manage Reminder Rules, check each rule for the following:

• Triggers are mechanical. Order status, delay in days, customer group, and store view should be the only filters. Priority conflicts between rules can create hidden exclusions, so read the order.

• No cherry-picking. The rule does not specifically ban asking happy customers, but FTC staff say that practice could go against the FTC Act. Do not create a rule or an integration that stops sending reminders to customers who have returned items, received refunds, given satisfaction scores, or have open complaints.

• Neutral wording.  FTC staff provide examples of implied sentiment, such as inviting customers to tell how much they loved a visit in return for a coupon. This is a problem. FTC staff ask for a review of the product, the delivery, or the order.

• Order and shipping reminders follow the same rules. The Order Review Reminder Days and Shipping reminder settings send emails too, and their review emails fall under the same rules.

Success looks like this: every enabled rule is documented, none filters on satisfaction, and each email asks for an honest review without hinting at a rating.

Step 3: Audit the Incentives

The rule does not ban review incentives. It bans conditioning them, expressly or by implication, on a particular sentiment. FTC staff add that an expectation of positive reviews is not itself a violation, but a business that offers an incentive should still disclose it, because failing to disclose could violate the FTC Act under the Endorsement Guides.

• Check the coupon trigger. The extension offers Send Promotional Coupons After with two options. Review Posted sends the coupon right after submission, before moderation. Review Approved sends it only after an admin approves, which the manual says helps prevent misuse. If your moderation ever rejects honest negative reviews, Review Approved ties the coupon to sentiment in practice. This is the audit’s analysis, not FTC text, but it is the most likely hidden coupling in a Magento setup.

• Check the coupon value. One cart price rule, one value, for every honest review. No tiers by star rating.

• Check the email copy. The extension includes a Product Review Promotional Coupons Email template. Read it for any language that hints a good review is expected.

• Disclose the incentive. The manual does not describe an incentive badge on rewarded reviews. Disclose in the reminder email and in the review policy text, or ask MageDelight about customization.

• Never pay to change or remove reviews.  The rule does not forbid it. The rule is clear: staff says that paying consumers to change or remove truthful negative reviews may violate the FTC Act. Contacting a customer to fix the problem is fine. Asking a customer to update a review is fine too.

Treat featured reviews as testimonials. Staff says that reviews that are given incentives are considered testimonials according to the rule, and any reviews that are shown in your marketing are also considered testimonials.

Success looks like this: one coupon, one value, a neutral email, a documented trigger, and a visible incentive disclosure.

Step 4: Audit the Moderation

Section 465.7(b) is the gatekeeping provision. It is violated when a business implies that the reviews it displays represent most or all of those submitted while withholding reviews based on rating or negativity. The regulation then lists criteria that do not count as suppression when applied equally to all reviews: confidential commercial information, defamatory, harassing, abusive, obscene or vulgar content, another person’s personal information or likeness, discriminatory content, content that is clearly false or misleading, reviews the seller reasonably believes are fake, and reviews wholly unrelated to what you sell. The FTC’s template warning letter says gatekeeping counts even when a third party handles your reviews.

Walk through these extension settings:

• Restricted Keywords. The list blocks or restricts any review containing a listed word. Keep it to profanity, slurs, personal data markers, spam, and competitor names. A list containing complaint vocabulary quietly filters negative reviews.

• Auto Approve Reviews. Either setting is workable. What matters is that you write down the approval criteria and apply them the same way to a 5-star and a 1-star review.

• Reported reviews. Quick Action on Report offers Moderated, Pending, or Rejected. Rejected removes a review automatically after one report, which lets a competitor or an angry seller delete a legitimate complaint. Choose Moderated or Pending so a person checks the review against your criteria. The default Moderation Criteria list (Off-topic, Inappropriate, Fake, Abusive) maps well to the rule if applied evenly.

• Policy Content. Publish the criteria in the review policy, and don't promise that every review will be posted unless it's true. I think FTC staff say a policy of excluding reviews that mention products or only discuss customer service is acceptable if the review policy treats positive reviews and negative reviews equally.

• Admin responses. Replying in public is okay. The extension can email the customer when an admin replies. Staff says not to make accusations you know aren't true and not to use physical threats or scare tactics. A legal warning must have a reason, behind it.

Then test the outcome, not the settings. In Manage Reviews, compare the share of 1 and 2-star reviews among all submissions with the share of reviews that are published. If there is a gap, such as 12% of reviews submitted versus 3% of reviews published, you must document an explanation. This threshold is illustrative and not a legal test.

FTC staff also note that sorting reviews by helpfulness is not suppression, and a default sort that puts five-star reviews first is not covered by the rule. Burying reviews could still be unfair or deceptive under Section 5. The extension’s search, sort, and rating filters help shoppers find lower ratings, so leave them on.

Step 5: Audit Insider and Admin-Created Reviews

The Add New Review screen allows an administrator to create or edit a review for a customer. This includes setting the display name, choosing a rating, adding the review text, and writing a response. Use this feature when a customer emails a review that needs to be added to the site. It is also the one feature that, misused, produces exactly what the rule bans.

• Never write reviews. Staff must not create reviews that misrepresent a customer’s experience. Only transcribe a real customer’s own words, and record the source.

• Limit who can use it. Restrict access through admin roles and review the list of users with access.

• Do not rewrite substance. Edit only to remove personal data or content that fits a published criterion, and log the change.

• Find insiders. The Manage Reviews grid shows customer email, verified purchase status, and order number, and the review metadata records IP address and user agent. Search for company email domains and for clusters from one address.

• Disclose insider reviews. If employees, officers, or relatives review, the disclosure must be clear, conspicuous, and unavoidable. Staff says a disclosure in the first line works, while one behind a hyperlink does not. Staff also warn that insider reviews that materially raise a star average can still be a disclosure problem.

• Understand the exemption. An employee who writes a review after receiving your generalized email to all purchasers does not put you in violation, even without disclosure.

If you moved from another review platform, the extension’s free migration is appropriate for genuine historical reviews. Do not use migration to bring in reviews you cannot trace to a real customer.

Step 6: Audit What You Show and Say

• Display. Make sure rating filters and sorting stay visible. Do not hide low ratings behind extra clicks.

• Claims. Look at the statements that say "all reviews are verified" or "unedited reviews”. Those statements must match what your moderation actually does.

• Marketing reuse. Staff says using reviews that aren't representative in marketing could be deceptive under the FTC Act, even though rule 465.7 does not cover this. Quote reviews that reflect the experience.

• Summaries. If you display AI-generated review summaries, such as those from MageDelight’s AI Review Summary extension, confirm that negative themes appear alongside positive ones. This is a deception-risk judgment, not an FTC rule requirement.

• Marketing audit.  A broader review of how reviews are used in ads and email fits well into a digital marketing audit.

Step 7: Document, Train and Re-Audit

• Write the policy. One page covering reminder timing, incentive terms, withholding criteria, insider disclosure, and who approves exceptions.

• Keep a settings log. Record each change to reminder rules, coupon triggers, keywords, and report actions, with date and reason.

• Control vendors. The rule can reach agencies, public relations firms, and reputation management companies. The rule should also require contract clauses that ban reviews, sentiment-conditioned incentives, and suppression.

• Train staff. Support teams and marketing teams should know that they must not write reviews or pressure customers to change them.

• Re-audit quarterly, and after every extension update or marketing campaign that touches reviews.

• Have a response plan. The FTC template letter requires written confirmation of steps within five business days. Who will gather that evidence? Please identify the person or team responsible.

Common Mistakes and Troubleshooting

• Coupon only after approval. Rejecting negative reviews ties the reward to praise. I think we should fix the moderation criteria or trigger the coupon when a Review Posted occurs for verified buyers.

• Keyword lists that grew organically. Someone writes the word "scam" after a spam wave, and negative reviews disappear. Check the list each quarter against the criteria.

• Auto-reject on report. One bad actor can erase legitimate reviews. Use Moderated or Pending.

• Reminders only for good orders. An integration that skips customers with returns looks like cherry-picking even if the intent was efficiency.

• Staff-written reviews "to seed" new products. This is the conduct behind the FTC’s cases. Use Verified Buyers only and let reminders do the work.

• Policy text that overpromises. A page claiming every review is published, while a keyword list blocks some, sets up the misrepresentation 465.7(b) addresses.

• Forgetting store views. Reminder rules and rating categories apply per store view. Audit each one.

Which Setup Fits Your Store

• No incentives, Verified Buyers only, manual approval: the lightest audit. Focus on written moderation criteria and the keyword list.

• Coupon for every review: the highest priority. Fix the trigger. Fix the wording. Disclose the incentive. Check whether featured reviews are being used in marketing.

• Agency or reputation vendor in the mix: audit the contract and the vendor’s review practices. The rule names these businesses as liable. You may become liable for the items you purchase.

• Reviews moved from another platform: first verify the source of a sample of those reviews, then leave the migrated set unchanged.

• Sales outside the US: this guide does not cover other regimes. Ask counsel about review rules in each market you serve.

• Sensitive products (health claims, children’s products): expect more scrutiny. TruHeight’s review issues arose alongside health claims about children.

I read that the extension costs $399 for Magento Open Source, $599 for Adobe Commerce, and $899 for Adobe Commerce Cloud for the year. After that year, the extension costs $259 each year for updates and support, as listed on the product page. The extension works with Magento versions 2.4.0 to 2.4.9. The extension also lists compatibility with Hyvä, B2B, GraphQL, and REST API. The user manual documents every setting named here, and MageDelight’s Magento support service can help implement the changes your audit recommends.

FAQ

Does the rule ban incentivized reviews?

No. FTC staff say incentives are allowed as long as there is no express or implied requirement that the review take a particular sentiment. Disclosure of the incentive is still advisable, because failing to disclose could violate the FTC Act.

Am I liable if a customer posts a fake review on my store?

Not for merely hosting it. FTC staff say a store that prompts reviews and aggregates ratings is covered by the hosting exemption and has no duty to investigate each review. You are exposed if you wrote or bought fake reviews, or bought ones you knew or should have known were fake.

Can I remove reviews?

Yes, under criteria applied equally to all reviews, such as vulgar, abusive, defamatory, or clearly false content; reviews you reasonably believe are fake; and reviews unrelated to what you sell. The risk is removing reviews because they are negative, especially if you imply the remaining reviews are all of them.

Can I ask only my happiest customers for reviews?

The rule doesn't ban this, but FTC staff say it might violate the FTC Act. A better approach is to send a notice to everyone eligible to buy.

What are the penalties and who enforces the rule?

If you want to know about violations, the FTC says that each violation can carry a penalty of up to $53,088. The FTC and the Justice Department enforce the rule. State attorneys general can also enforce the rule under state law. There is no right of action. Check the maximum before you rely on this figure.