Can employees write reviews of your business? What Google, the FTC and the NLRB say

Short answer: yes, employees can write reviews of your business - and the law constrains you more than it constrains them. There are three separate rulebooks in play. The FTC’s Consumer Reviews and Testimonials Rule (effective October 2024) makes an undisclosed insider review a federal violation: a manager who reviews the business without disclosing the relationship breaks the rule directly, and the business breaks it when a manager asked staff or their relatives for reviews and the relationship never got disclosed. Civil penalties currently run to $53,088 per violation, a figure unchanged since January 2025. That is the same rule, and the same number, that decides whether offering a customer a discount for a review is legal. Google’s and Yelp’s conflict-of-interest policies ban employee reviews outright, positive or negative. And the NLRA protects much of what employees say publicly about their working conditions, which means firing someone over a critical review can buy you a federal labor charge.

So the practical question isn’t “can they?” It’s “which of the three rulebooks applies to the review in front of you” - because the right move is different under each one.

Rulebook 1: the FTC, for the positive ones

Since October 21, 2024, an insider review without a clear disclosure of the relationship has been a federal violation when a manager wrote it, and the business is on the hook when a manager asked staff or their relatives for reviews and either gave no instructions about disclosure or knew the undisclosed reviews were up and left them there. Even where the rule’s text doesn’t reach, an employee’s undisclosed praise is the kind of hidden “material connection” the FTC’s Endorsement Guides have treated as deceptive for years. The once-universal practice of asking staff to “help get our Google rating up” is now the kind of thing the FTC sends warning letters about: its first sweep under the rule went to ten companies in December 2025, and the practices it named included paying employees for five-star reviews from friends and family. Warning letters aren’t findings of violation, and as far as we can find the only money paid so far in a case carrying a rule count is $750,000, from TruHeight, a supplement seller whose website, the FTC alleged, carried several thousand five-star reviews written by its own employees and presented as customers. That is the direction of travel.

Here’s the trap: undisclosed employee reviews are also a gift to your competitors. Last year a gym we’ll call Bluff City Fitness in Memphis was sitting at 4.5 stars on 32 Google reviews. A competitor noticed that 11 reviewers shared last names or profile photos with people on the gym’s own “meet the team” page, flagged each one under Google’s conflict-of-interest policy with that evidence attached, and nine came down within a month. The rating fell to 4.3 - and the owner had no recourse, because the reviews really were policy violations. He’d built part of his rating on sand and a competitor noticed before he did.

Rulebook 2: the platforms

Google’s contributor policies treat reviews by current or former employees as a conflict of interest in both directions, and the policy text says so in those words: “current or former employment” is the first example it gives. That cuts two ways for you. Your employees’ 5-stars are removable if anyone assembles the evidence - but so is the revenge 1-star from someone you fired last month. If you can document the employment relationship (and you can - you signed their paychecks), flag it under conflict of interest with that documentation. These flags succeed far more often than generic “this review is fake” reports because the evidence is concrete.

Rulebook 3: the NLRB, for the negative ones

The instinct when an employee posts a critical review is to treat it as disloyalty and act accordingly. Be careful. Section 7 of the National Labor Relations Act protects concerted activity - employees acting together, or one employee speaking for coworkers, about wages, scheduling, safety, or working conditions. It covers non-supervisory staff at most private employers, union or not. A review that says “they schedule us for clopens and skip breaks” may well be protected speech even though it’s sitting on your Google profile, and the NLRB has repeatedly found discipline over public workplace complaints unlawful, going back to the Facebook-post cases of the mid-2010s. Fire the reviewer and you can convert a bad review into a bad review plus an unfair labor practice charge.

Two limits, so the rule doesn’t read as absolute. A purely personal gripe with no link to shared conditions isn’t concerted, and a review that trashes your product or your customers without tying it to a workplace dispute can lose protection as disloyalty. Deciding which side of that line a review sits on is exactly the call you shouldn’t make at 11 p.m. without counsel, which is the point.

The platform flag is still available to you - conflict of interest doesn’t care whether the review is protected speech, only whether the reviewer works there. Removal via Google’s policies and retaliation via HR are completely different acts with completely different legal exposure. Do the first. Don’t do the second without employment counsel.

What an enforceable policy actually says

Most handbook review policies fail because they’re written as blanket bans - “employees may not post reviews or negative commentary about the company” - and blanket bans sweep in NLRA-protected speech, which makes the whole clause legally shaky and practically unenforceable. The yardstick the Board uses is itself in play as of this update (October 2026): the 2023 Stericycle test, which presumes a rule unlawful if a reasonable employee could read it as restricting protected activity, still applies, but the Board’s new General Counsel has asked it to replace that test in pending cases, and since a third Republican member was seated in August 2026 the Board has had the votes to do it. Check before you rely on either version. A narrow rule survives under both, which is the point of writing one:

• Employees don’t post consumer reviews of the business on Google, Yelp, or similar platforms (this mirrors the platforms’ own rules, so it’s easy to defend).
• Anyone who has posted one is asked to delete it or add a disclosure of the relationship.
• Nobody - including managers - solicits reviews from staff, family of staff, or vendors.
• The policy says nothing about Glassdoor, Indeed, or commentary on working conditions. That speech is regulated by labor law, not by your handbook, and pretending otherwise just invalidates the parts of the policy you can enforce.

The part nobody tells you

The most common version of this problem isn’t malicious - it’s the loyal employee who 5-stars you unprompted because they’re proud of where they work. You can’t be punished for a review you never asked for and didn’t know about, but once you do know, leaving it up while citing your rating in marketing starts to look like adoption. The clean fix costs one slightly awkward conversation: thanks, genuinely - now please take it down or disclose.

And when a review on your profile mentions an employee - yours, former, or the reviewer themselves - your public response has its own tripwires; there’s a separate guide for reviews that name former employees, and replysmith.net keeps templates for employee-mention responses if you need wording that doesn’t create new liability. For the broader question of how to answer the critical ones, the negative review playbook applies here the same as anywhere - with one addition: never confirm or deny in public that a reviewer works for you. That’s a personnel record, and it’s nobody’s business but the flag form’s.

Your rating should be built entirely out of people you don’t pay. It’s worth less otherwise - and now it’s expensive, too.