Fake testimonials and AI-made reviews: the legal risk, and what to do instead

AI video and image tools can produce a convincing "happy customer" in minutes. A face, a voice, a script, a kitchen in the background. The tools do not ask whether that customer exists. The law does. This page explains what the FTC says about testimonials, where AI changes the picture and where it does not, and what a small business or agency can use instead.

This is information, not legal advice. The FTC pages behind it are named in the sources. If you run ads in another country, check that country's rules, and ask a lawyer about anything unusual.

The short rule

A testimonial is a claim that a real person used your product and had a real result. If the person does not exist, or never used the product, or the result never happened, the testimonial is false. Making it with AI does not change that. Making it with a camera and an actor does not change it either.

The medium is not what the FTC cares about. The experience is. So the useful question is never "was this made with AI?" It is "did a real customer really say this about a real experience?"

What the FTC rule says

The FTC published a plain-language question and answer page for its Consumer Reviews and Testimonials rule. In simple terms:

• Effective date. The rule took effect on 21 October 2024.
• Fake reviews. It prohibits reviews and testimonials that misrepresent that they come from a real person, or from someone who actually used the product, or that misstate the person's experience.
• Insider reviews. Reviews from owners, staff, relatives or paid partners need a clear disclosure of that connection.
• Suppression. You cannot use threats or intimidation to stop honest negative reviews, and you cannot misrepresent that the reviews on your site are all the reviews you received.
• Fake social media indicators. Buying followers, views or likes to look more popular is covered too.
• Penalties. Courts can impose civil penalties for knowing violations. The FTC page does not print a dollar figure, so none is quoted here. Ask a lawyer or check the FTC's current notice if the number matters to you.

The FTC also says its staff guidance is not a safe harbor. That means a Q and A answer is the agency's view, not a promise that you cannot be challenged. Treat it as a floor.

AI avatars: what is and is not allowed

The FTC page says the rule has no blanket ban on AI-generated avatars in marketing. It also says an avatar endorsement is prohibited when the underlying testimonial is fake. Those two statements fit together. The avatar is a delivery method. The words it speaks are the testimonial.

Three things follow from the FTC page and its wider endorsement guidance:

• A real customer's real words, read out by an avatar, are not automatically a problem. The customer must still have said them, still agree to this use, and the video must not mislead people about who is speaking.
• An invented person with invented results is a fake testimonial. Calling it "a character" does not fix it if viewers are led to believe a customer said it. A made-up member transformation falls here too; for gyms, see AI class promos for fitness studios and gyms.
• Using a celebrity's likeness without permission to suggest they endorse your product violates the rule. This includes AI look-alikes. For celebrity and brand questions beyond testimonials, read Can AI content include brand logos, celebrities or competitors.

It is not clear whether AI-written reviews are expressly covered by name. The rule talks about reviews that misrepresent their source or experience, and a review written by software for a customer who never wrote it fits that description on its face. Do not rely on a gap in the wording. Ask a lawyer if you are tempted.

The three-bucket test

When someone on your team proposes a customer-style video, sort it into one of three buckets before anything is made.

Bucket	What it is	My view
1. Real customer, real words	A customer wrote or recorded the words. You have their written permission to use them, name and date included.	Fine. Keep the consent on file.
2. Real words, avatar delivery	A real customer wrote the words, and you turn them into a read-out by an AI presenter or voice.	Possible if the customer agreed to this form, the words are not changed, and the video does not claim the presenter is the customer. Label it the way your own policy says. If in doubt, use the customer's own recording instead.
3. Invented person or experience	No such customer exists, or the result never happened.	Do not do it. This is what the rule is aimed at.

Bucket 2 is the grey one. The rule of thumb I use: would a viewer feel tricked if they learned how the video was made? If yes, go back to bucket 1.

Safe alternatives to fake testimonials

Most of the time, the reason people reach for a fake is that real ones are slow to collect. There are faster honest routes.

• Ask for a 30-second phone clip. Send customers a simple script of three questions: what was the problem, what did we do, what changed. Real clips beat polished fakes for trust.
• Quote written reviews with permission. Email the customer, ask if you may use their words and first name on your site, and keep the reply. Tools that automate review requests, and the rules around them, are covered in review management software.
• Write a short case study. Interview the customer, send them the draft, get written approval, and say whether the result is typical.
• Use an AI presenter as a presenter. An AI or stock spokesperson who explains your product is not a testimonial. Keep it clearly framed as a presenter or actor, and never give it a story about "I used this and my sales doubled."
• Show the work, not a person. Before and after photos with real consent, product demos, a walk-through of the process. For more on when real footage should stay real, see when not to use AI video.

If your goal is UGC-style ads (ads that look like a customer filmed them), the legal limit is the same. For the cost and rules side, see cheap UGC ads. For avatar tools in that space, Higgsfield versus Arcads and Creatify covers what each one does. Arcads and Creatify are AI services that make spokesperson-style video ads, and Higgsfield is a platform that gathers many AI image and video models in one place. None of them removes the testimonial question above.

Insiders, incentives and suppression

Fake AI customers are the new problem. The old ones still apply, and AI makes them easier to commit by accident.

• Incentives. The FTC's Q and A page says the rule bars buying reviews and bars rewards that require or imply a particular sentiment. "Leave us five stars for 10% off" is the example everyone gets wrong. You may thank people for an honest review. You may not pay for a good one.
• Staff and family. A review from an employee, owner, relative or paid partner needs a clear disclosure of the connection. If a team member writes "I love this" on your page, that is an insider review.
• Free product. If someone got the product free or was paid to talk about it, that connection must be made clear to viewers. This is the "material connection" idea in the endorsement guidance.
• Hiding bad reviews. Choosing to show only five-star reviews and calling them "all our reviews" is covered by the suppression part of the rule.
• Typical results. If a customer's result is not what most people get, the ad must make clear the results people can generally expect. A real testimonial can still be misleading if it is the best case.

The ad platform angle

Even if you were never contacted by a regulator, the ad platforms can act first. The sources list the official pages for two of them.

• Google Ads. Its policy on misrepresentation says manipulating media to deceive, defraud or mislead is not allowed. It bars implying backing from a brand or organisation you do not have, and it bars presenting improbable results as likely. It does not use AI-specific wording. Serious violations can lead to suspension without warning.
• Meta. Its ad standards ban deceptive practices and content that infringes third-party rights, and say ads must clearly represent the advertised brand. Meta also describes labelling for ads made or significantly edited with AI, and for photorealistic AI humans. The label is a transparency tool. It does not make a fake testimonial acceptable.

The tools have rules too. Higgsfield, a platform that gathers many AI image and video models, says in its terms that you must not represent its output as human-made. That is a tool rule on top of the legal one, and it is another reason not to dress an AI person up as a real customer.

For a broader tour of platform traps, see do you have to label AI content and the plain guide to using AI video in paid ads for clients.

Who is liable, the agency or the client?

There is no firm answer, because it depends on the facts and the law. In practice, both can be asked questions: the brand that runs the ad and the agency that made it. Do not assume a contract clause protects you from a regulator. What a clause can do is allocate cost between you and the client. For that, see what to put in your contract when you use AI tools and should you tell clients you used AI.

A staff policy you can copy

Paste this into your team handbook and edit it. It is a starting point, not legal text.

1. We never publish a testimonial from a person who does not exist, or who did not have the experience described.
2. Every testimonial on our site or in our ads has a file entry: customer name, date, the original source (email, form or recording), and their written permission to use it.
3. We do not change a customer's words in a way that changes their meaning. If we shorten them, the customer approves the short version.
4. We do not offer a reward that depends on a positive review. We may ask for honest feedback.
5. Staff, owners, relatives and paid partners disclose their connection when they post about us.
6. We do not delete honest negative reviews we control, and we do not describe a selection of reviews as all of them.
7. An AI presenter explains the product. It does not tell a personal story about using it.
8. No AI look-alike of a real public figure is used to suggest an endorsement.
9. Before any new customer-style format goes live, a named person signs off against this list.

The evidence file to keep

If someone ever asks "where did this testimonial come from?", you want an answer in two minutes, not two days. For each testimonial, keep:

• the customer's name and contact detail (stored privately);
• the date and the original message or recording;
• the written permission, including where it will be used;
• whether the result is typical, and what you said about that in the ad;
• any reward or free product given;
• the final published version and where it ran.

A shared folder or a simple table works. If you make lots of creative assets, it helps to keep this file next to your files, as in where to keep AI images, videos and prompts.

How I'd approach this

I would start with the three buckets and put a hard stop on bucket 3. If a customer-style video cannot be traced to a real person and a real experience, it does not run. That one rule removes most of the legal risk and most of the trust risk too, because customers can often tell.

Then I would make collecting real proof easy. One short form, one short script, one consent line. Real clips from five customers are worth more than fifty invented ones, and they cost almost nothing.

I would keep AI for the parts of marketing where it is plainly not a witness: product explainers, visuals, translations, short edits. And I would write the policy above down, because staff turnover is where good intentions break.

If you want this set up as a repeatable routine, with a request form, a consent log and an approval step before anything is published, that is the sort of workflow Blur Studio builds. For anything that looks like it could mislead people about who said what, ask a lawyer before you publish, not after.