Fake = Illegal

This is not legal or professional advice. I am not a lawyer. The sources I cite may be incomplete, my interpretation of them may be wrong, and the law changes. Do your own research and hire a qualified attorney before you act on any of this.

Fake reviews, paid actors posing as organic customers, countdown clocks that reset, "14 people are viewing this right now" banners showing a number nobody's tracking. None of these sit in a gray area waiting for a law to catch up. Each one is already covered by a specific federal rule or a documented FTC enforcement position, with real penalty numbers attached. This is a map of which rule covers which tactic, and what actually clears the bar.

Fake reviews

As of October 21, 2024, a federal rule, 16 CFR Part 465, directly bans writing, buying, selling, or disseminating a review or testimonial that materially misrepresents that the reviewer exists, that they actually used the product, or that the review reflects their real experience. It also separately bans buying reviews, positive or negative, disclosing an insider's (employee, executive) connection is required if they post one, deceptively suppressing negative reviews, and buying fake social proof like followers or likes.

Two narrow exceptions exist: a general request to real customers to leave a review isn't "buying" one, and a platform that just hosts reviews without fabricating them isn't liable for what users post.

Penalty: up to $53,088 per violation for a knowing violation, this is a binding rule, not general guidance, and it comes with its own explicit civil-penalty schedule.

Fake endorsements: paid creators posing as organic customers

This is a different violation from fake reviews, and it's worth keeping separate because the fix is different too. The FTC's Endorsement Guides (16 CFR Part 255, current version effective July 2023) require disclosure whenever a "material connection" exists between the creator and the brand, payment, free product, affiliate commission, employment, and that connection isn't something the audience already expects. A film star doing a commercial doesn't need a disclosure; everyone assumes celebrities get paid. A UGC-style video formatted to look like an unprompted, unpaid customer testimonial absolutely does, because the entire format is built on the audience not expecting a paid relationship.

The disclosure has to be clear, conspicuous, and hard to miss, a mention buried in a bio link doesn't count. If the creator never actually used the product and is reciting a script, that's not just a disclosure problem anymore, it's also a fake-testimonial problem under the reviews rule above. A lot of the worst version of this tactic, paid, scripted, no material connection disclosed, product never touched, violates both rules at once.

AI-generated customers and UGC

This isn't a fifth tactic. It's the first two tactics with a new production method, and neither rule that already covers them cares how the fake got made.

The reviews rule doesn't check who or what wrote the review, it checks whether a real person had the experience described. A model-generated "customer" testimonial attributed to someone who doesn't exist is the same violation as the fake reviews section above, whether a copywriter wrote it, an actor read it, or an AI tool generated it from a prompt. The rule also reaches procuring a fake review from someone else, a freelancer, a review farm, an AI platform, so commissioning the fabrication out doesn't create distance between the business and the violation. The business that published it is the one who committed it.

An AI avatar built to look like an unpaid, organic customer posting UGC-style content is a virtual endorser under the endorsement guides, and the FTC has treated that disclosure requirement as medium-neutral since the 2023 update: a computer-generated persona still needs its material connection to the brand disclosed, same as a human paid creator. This version is harder to avoid than the human one. There's no version of a brand-built AI persona that doesn't have a connection to disclose.

On December 22, 2025, the FTC drew this exact line itself, in a single day, on a single vote. It reopened and set aside its own 2024 consent order against Rytr, an AI writing tool whose testimonial-generator feature let subscribers mass-produce reviews, because the original complaint never showed any of those generated reviews were actually published anywhere as real. The theory was pure capability liability, no proof of resulting deception, and the remedy, banning the feature outright, went further than a new policy directive telling agencies not to over-burden AI tool-builders. The agency's own statement drew the line explicitly: it would keep holding accountable "actors that use AI to violate the law," just "not the case here with Rytr." The same day, it sent ten warning letters to companies under the reviews rule itself over concrete conduct, including paying employees for 5-star reviews from friends and family. Building a tool that could generate a fake review isn't automatically a violation without proof someone used it to deceive a consumer. Directing AI, or a vendor, to actually produce and publish fake customer content is exactly as enforced as it was the day before.

New York added a narrower, AI-specific layer on top of both rules. A law signed in December 2025 and in effect since June 9, 2026 requires conspicuous disclosure in any ad containing a "synthetic performer," AI or computer-generated content depicting a human who isn't recognizable as any identifiable real person. It's broader than customer impersonation specifically, it covers any fully synthetic performer in an ad, but an AI-generated "customer" sits squarely inside the definition. Penalty: $1,000 for a first violation, $5,000 for each one after.

Fake countdown clocks

There's no standalone "countdown timer rule." This runs through the FTC's general deception authority under Section 5, and the agency has been explicit about where the line sits since a 2022 staff report, “Bringing Dark Patterns to Light,” specifically named a countdown clock "that just goes away or resets" as a deceptive urgency tactic. The standard is straightforward: a timer implies a real deadline. If the deadline isn't real, that's a material misrepresentation, because urgency claims demonstrably affect purchase decisions, which is exactly what makes them material.

A timer tied to an actual, enforced expiration, the offer genuinely ends and the price genuinely changes, is fine. A timer that resets on refresh, shows a different countdown to different visitors with no real deadline behind either one, or hits zero and quietly reappears, is the textbook violation.

Fake "people are buying or viewing this" tickers

Same authority as the countdown clock, the 2022 dark patterns report separately names fabricated activity messages, claims that other people are buying, viewing, or almost missing out on something, as a distinct deceptive pattern when the numbers aren't real. A ticker pulling from actual order data is a factual statement. A ticker running on a randomized script designed to simulate activity that isn't happening is a false statement of fact about product popularity and demand, which is exactly the kind of material claim Section 5 exists to police.

What actually clears the bar

Real reviews from people who used the product, insider relationships disclosed, negative reviews left up. Paid creators labeled as paid, in the post itself, not just their bio. An AI-generated persona or testimonial labeled as AI-generated, not passed off as a real customer. A countdown timer tied to a deadline that's actually enforced on the backend. An activity ticker that reads real order or session data instead of a randomizer. None of this costs more to build than the fake version. It's a data-source problem, not a budget problem.

The penalty ladder

Fake and insider reviews carry the sharpest exposure: a binding rule with an explicit $53,088-per-violation ceiling for knowing violations. Undisclosed paid endorsements run through the Endorsement Guides and general Section 5 authority, real, enforceable, but without that same rule-specific penalty schedule attached, since the FTC's own ability to collect money directly on a first-time Section 5 violation (as opposed to a rule violation) has been more limited since a 2021 Supreme Court ruling. Fake countdown clocks and fake activity tickers sit in that same general Section 5 category. None of that makes the second tier "probably fine." It means the FTC isn't always the one who shows up first, state consumer protection laws often fill that exact gap, some with their own penalties and a private right of action the federal framework doesn't have. New York's synthetic performer law is that exact gap already filled: a narrow, AI-specific penalty, $1,000 for a first violation and $5,000 after, sitting on top of the federal rules rather than replacing them.

Sources

Reviews and endorsements

• FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465 (effective Oct. 21, 2024)
• FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR Part 255 (effective July 26, 2023) — Federal Register

AI-generated content

• FTC Reopens and Sets Aside Rytr Final Order in Response to the Trump Administration's AI Action Plan (Dec. 22, 2025)
• FTC Releases Warning Letters for Fake Consumer Reviews and AI — DLA Piper
• FTC Issues Final Rule Targeting Fake Consumer Reviews and Testimonials, Including Those Generated by AI and Online Bots — National Law Review
• Influencer Marketing Under the Microscope — Arnold & Porter
• Governor Hochul Announces First-in-the-Nation Law Requiring Disclosure When Advertisements Include AI-Generated Synthetic Performers
• New York Enacts 'Synthetic Performer' Disclosure Law for Advertisements — Cooley

Urgency and scarcity

• FTC Staff Report: Bringing Dark Patterns to Light (September 2022)

This is not legal or professional advice. I am not a lawyer. The sources I cite may be incomplete, my interpretation of them may be wrong, and the law changes. Do your own research and hire a qualified attorney before you act on any of this.