$53,088 and $10,000: two AI review traps

The demo looks clean. A review request texts every patient after the visit, an AI drafts a reply to each new Google review within minutes, and the new location's star rating is climbing. You ask whether any of it needs disclosure or a legal look, and the answer comes back fast: "They're real patients writing real reviews. The AI only helps us respond, so there's nothing to disclose." It is a comfortable answer, and it is half right. The half it leaves out carries a statutory maximum of $53,088 per knowing violation at the Federal Trade Commission, and a $10,000 federal settlement that started with a dental practice's replies to Yelp reviews.

What the myth gets right

Start with the part that holds up, because a myth-buster that denies it loses credibility. The FTC's Consumer Review Rule (16 CFR Part 465), announced on 14 August 2024 and in force since October 2024, does not require a practice to label outreach or replies as AI-drafted. The FTC's own question-and-answer guidance says the rule contains no blanket prohibition on AI-generated content in marketing, although such use "could also be deceptive in violation of the FTC Act" (FTC, Consumer Reviews and Testimonials Rule: Questions and Answers, accessed September 2026). The same guidance says the rule does not prohibit offering incentives for reviews, as long as there is no express or implied requirement that the review express a particular sentiment.

So a text message that an AI wrote, asking a patient how the visit went, is not the problem. We found no provision in the rule, and none in the HHS materials we reviewed, that requires a disclosure label on outbound review requests or replies. Nothing here is legal advice, and state dental board advertising rules vary, so confirm with counsel before you rely on that.

So what for you: the lack of a labelling rule is real, and it is why the myth survives. It answers a question almost nobody is asking, which is whether the tool needs a disclaimer, and skips the two questions that carry the penalties.

Where the FTC line actually sits: who wrote the review, and who was asked

The rule's prohibitions are about the review itself. It bans reviews that misrepresent that they come from someone who does not exist or who had no real experience of the service, and the FTC states this covers AI-generated fake reviews. It bans conditioning an incentive on positive or negative sentiment. It requires disclosure when officers, managers, or employees write reviews, and it bans suppressing negative reviews through false legal threats, intimidation, or groundless accusations (FTC press release, 14 August 2024). The FTC seeks civil penalties from knowing violators, with a maximum of $53,088 per violation, a figure that carried into 2026 with no inflation adjustment (FTC, December 2025; Federal Register, 7 July 2026).

That penalty is not a theory. On 22 December 2025 the FTC sent warning letters to ten companies over fake reviews and incentives for five-star reviews, saying that when companies game the review system they "distort the marketplace and harm consumers" (FTC Business Blog, December 2025). No dental practice is named in that post, but the warning went to businesses the size of yours.

Here is how it applies to an automated workflow. Suppose a tool offers to "help patients write their review" by generating a draft from a star rating, and the patient posts it without reading it closely. If the text describes an experience the patient never said they had, you are close to the conduct the rule describes. As an illustration of scale only, not a forecast: 20 such reviews across three locations would carry a theoretical statutory maximum of $1,061,760 (20 x $53,088). The maximum is a ceiling, not a prediction, but it shows how quickly a per-violation penalty scales across locations.

The second trap is gating. Many review platforms route a patient who gives four or five stars to Google and sends everyone else to a private feedback form. The FTC's guidance says the rule does not explicitly prohibit asking only for reviews from customers you think are happy, but warns that the practice "could violate the FTC Act" (FTC, Questions and Answers, accessed September 2026). Google is blunter. Its Maps contributor policy prohibits merchants from offering incentives for reviews and from discouraging negative reviews or selectively soliciting positive ones (Google Maps policy, accessed September 2026). A practice that filters by sentiment risks a regulator's attention and a wave of removed reviews at the same time.

So what for you: ask your vendor two questions in writing. Does the tool ever draft or edit review text that gets posted under a patient's name, and does it route patients to a public page based on a satisfaction score? A yes to either is the feature to switch off, not the feature to disclose.

The trap nobody mentions: the AI reply that knows too much

The FTC is the smaller risk for most dental practices. The bigger one sits in the reply box. An AI reply tool reads the review, and often the practice management record, then writes something warm and specific. Specific is the problem. HHS's Office for Civil Rights announced a $10,000 settlement with Elite Dental Associates on 3 October 2019 after the practice disclosed a patient's last name, health condition details, treatment plan, insurance information, and cost information while replying to Yelp reviews (HHS OCR, October 2019, via HIPAA Journal). OCR's director at the time said: "Social media is not the place for providers to discuss a patient's care."

It has not stopped. On 5 June 2023 OCR announced a $30,000 settlement with Manasa Health Center, a New Jersey psychiatry provider that posted replies to negative Google reviews containing diagnoses and mental health conditions of four patients. The corrective action plan required revised privacy policies, workforce training, and breach notices to the affected individuals (HHS OCR, June 2023, via TechTarget). Both cases involved a human typing the reply. A tool that drafts forty of them a week, pulling context from the chart to sound personal, multiplies the number of chances to get one wrong.

Design the reply tool the other way round. A template that thanks the reviewer, invites them to call the office, and never mentions treatment, visit dates, or whether the reviewer is a patient leaves the model nothing to disclose. The safe version is also less personal, and that trade is worth making. Sign your business associate agreement with the vendor as well, but remember it governs how the vendor handles data, not what your reply says in public.

So what for you: nobody should let an AI publish a review reply without a human reading it first, and the reply tool should not have read access to treatment records at all.

Why this gets harder with a third site

A single office can be supervised by one person who reads every reply. Add locations and the review workflow usually gets configured once, at the center, and pushed everywhere. One setting then decides the gating behavior, the reply tone, and the chart access for every site. A mistake at the configuration level is repeated at scale, and the practice with more locations is also the practice with more review volume, which means more replies nobody is reading. Reviews are also a growth asset: a consistent, credible rating across sites is part of how a growing independent holds its own against a group with a marketing department. That is the reason to protect it with a rule set, not to avoid automation.

So what for you: write the review workflow down once, with named owners per site, before the tool is switched on at the next location. Decide who approves replies, what they may never say, and who can change the settings.

The call

The evidence points toward using AI in your review process, within limits that fit on a single page. Let it draft review requests and reply templates. Never let it write or polish the text of a review that goes up under a patient's name. Send the same request to every patient, not only to those who scored the visit highly. Keep incentives off the table, because Google prohibits them outright and the FTC bars any tie to sentiment. Keep every reply generic and have a human read it before it posts. Frankly, if a vendor cannot show you, in the product, that its tool can do those things by default, the tool is not ready for patient-facing work in a dental practice.

For an independent read on which of your current tools carry this kind of exposure, the AI Opportunity and Growth Assessment checks patient communications and reputation workflows as part of the audit. You can also book a free 20-minute discovery call to walk through your current review setup.

See also: why "AI marketing is priced for DSOs" does not hold up, and how the same FTC penalty applies to AI marketing in audiology.

Related: $39, not $249: the dental AI marketing myth · 0 AI malpractice cases. Insurers move first · AI marketing questions for OT and SLT practices