Client reviews used to be the safest marketing asset a law firm had. Post the five stars, embed the widget, move on. That era is over. Since January 1, 2026, Alabama’s overhauled Rules 7.1–7.3 have joined California’s SB 37 in putting testimonials under direct regulatory scrutiny, and the FTC’s Consumer Reviews and Testimonials Rule now carries federal civil penalties for anything that looks manipulated, incentivized, or misleading. A five-star badge that took your marketing team an afternoon to set up can now trigger a bar complaint or a federal inquiry if the underlying process wasn’t built correctly.

This isn’t a reason to stop collecting reviews. It’s a reason to treat them like the regulated content they’ve quietly become. Firms that get ahead of this will keep using reviews as a trust signal. Firms that don’t will find out the hard way what a 72-hour takedown order looks like.

1. Reviews Are Now Regulated Advertising, Not Just Social Proof

Testimonials have always technically fallen under attorney advertising rules, but enforcement was loose. That’s changed. Regulators are now treating a published review the same way they treat a billboard: it has to be true, verifiable, and non-misleading, full stop.

• Alabama’s amended Rule 7.2 requires that testimonials come from someone with actual, verifiable experience with the lawyer — no aggregated, edited, or composite quotes.
• California’s SB 37 gives the State Bar authority to demand an ad come down within 72 hours of a flagged violation, with penalties from $5,000 to $100,000 per violation.
• The FTC’s Reviews and Testimonials Rule (effective October 2024) makes fake, incentivized, or undisclosed-relationship reviews a federal matter, independent of state bar discipline.

2. Know What Actually Makes a Testimonial Compliant

Most firms aren’t publishing fake reviews. The risk is subtler: reviews that create an “unjustified expectation” about outcomes, or that lack the disclaimers regulators now expect as standard.

• Never pay, discount, or otherwise compensate a client for a review — direct or implied.
• Pair result-oriented testimonials with a clear disclaimer that outcomes depend on the facts of each case.
• Avoid curating only the most dramatic outcomes; a pattern of cherry-picked “wins” can itself be read as misleading.
• Disclose any existing relationship between the reviewer and the firm beyond the attorney-client relationship itself.

3. Build the Documentation Trail Before You Publish, Not After

If a regulator or the FTC challenges a review, the burden is on the firm to prove it’s real. That means the paperwork has to exist before the review ever goes live, not get reconstructed under a 72-hour deadline.

• Keep signed consent on file for every published testimonial, including what was said and when.
• Log where each review originated (Google, a client survey, a direct request) and whether anything of value was exchanged.
• Audit your review widgets and third-party platforms quarterly — a compliant intake process doesn’t help if an old, non-compliant review is still live on your homepage.

4. Where Firms Still Get Burned

The most common violations Inherent sees aren’t intentional fraud — they’re marketing habits that predate the new rules and never got updated.

Firms that treat this as a compliance project instead of a marketing afterthought come out ahead: reviews still convert, but they’re defensible if a regulator asks questions.

The Inherent Approach

Inherent builds review and testimonial programs that hold up under both bar scrutiny and FTC rules, pairing compliant collection processes with the documentation to back them up. If your firm’s reviews strategy hasn’t been updated since these rules took effect, talk to Inherent about a compliance audit.