A breach notice goes out on Tuesday. By Thursday the star rating on your Google Business Profile has dropped, and the new reviews do not read like ordinary complaints. Some come from customers whose data was in the breach. Some come from people who read a headline. Some come from people who never bought anything from you.
Those three groups are treated very differently by the platforms, and most of the damage a business does to itself in this phase comes from treating them as one. This post separates them, sets out what Google, Yelp and Trustpilot say they will and will not remove, covers the FTC rule on fake and suppressed reviews that now carries civil penalties, and ends with how to tell whether you are actually recovering. Every platform policy and rule below was read from the source page on November 14, 2026. Policies get revised, so check the live page before you act on a quote.
Why the reviews arrive in a wave
Yelp describes the pattern in its own words: “When a business becomes the subject of media attention, people may come to Yelp to express their opinion about it. Reviews that are written as a form of social commentary are not useful for people who rely on Yelp for accurate, first-hand descriptions of the experience at a business.”
Its response is mechanical. “When we notice an unusual spike in activity on a business page, we will display an Unusual Activity Alert and temporarily disable the posting of content. When activity returns to normal, our moderators remove the alert and clean up the page.” The support page adds the trigger condition: an influx of reviews “motivated by a recent news event rather than actual consumer experiences with the business,” with the alert “removed on a case-by-case basis when activity on the page has dramatically decreased or stopped.” Yelp says these alerts are published on business pages in the U.S. and Canada.
Trustpilot treats the same pattern as a flaggable category. Among the reasons a business can flag a review, its guidelines list “reviews written solely about topics that are trending in the news or on social media, rather than feedback on a genuine experience.”
Sources: Yelp Trust and Safety, Consumer Alerts, Yelp Support, What are Consumer Alerts?, Trustpilot Guidelines for Businesses, September 2026.
Sort the reviews before you touch the flag button
Affected customers. A review that says “my details were in the breach” describes a genuine experience, whatever you think of its tone. Google says it does “allow content that describes negative experiences in a respectful manner.” Flagging these reviews fails, and it leaves a record of a business trying to silence people it harmed.
News commentary from non-customers. A review that argues about the company in general terms, with no experience of the place or service, is where platform policy gives you a case. Google’s policy: “Only post content that is based on your experience or questions about experiences at a specific location. We don’t allow content which contains general, political, or social commentary or personal rants.” Yelp’s guidelines say “reviews aren’t the place for rants about political ideologies, a business’s employment practices, extraordinary circumstances, or other matters that don’t address the core of the consumer experience.”
Reviews with a real policy problem. Personal information is one. Trustpilot lets a business flag a review “if it contains another person’s personal information such as someone’s name, phone number, email address,” and Google says “Do not distribute or post personal information without consent.” Unsubstantiated claims are another: Google does not allow “Unsubstantiated allegations of unethical behavior or criminal wrongdoing.”
One caution on the middle group. Trustpilot warns that “a review may be genuine even if you don’t recognize the reviewer,” and that “Genuine experiences aren’t limited to purchases.” A person who received your breach notice is a customer for this purpose, even if their name is not in your sales system.
What each platform will and will not remove
Google. “You can report any review, but only those that violate Google policies are eligible for removal.” And: “Do not report a review just because you disagree with it or dislike it. Google doesn’t get involved in conflict between businesses and customers. Negative reviews can highlight areas for improvement and aren’t always a sign of poor service.” Evaluation “typically takes several days,” and if a flag is declined you get a one-time appeal covering up to 10 reviews. Google also warns that automated spam detection can wrongly remove legitimate reviews, and tells owners to contact support when that happens.
Yelp. Yelp’s Unusual Activity Alert is the platform’s own response to news-driven spikes: Yelp applies it when it notices one, and it comes off when Yelp’s moderators decide the activity has returned to normal. Its guidelines are also direct about solicitation: “Businesses should never ask customers to write reviews.” That is stricter than Google’s or the FTC’s position, so a review-request campaign that is fine on Google can be a violation on Yelp.
Trustpilot. “Not liking a star rating or disagreeing with a negative review is not a valid reason for flagging a review, and we don’t remove reviews just because a business thinks they are unfair or critical.” Flagged reviews stay public during the investigation, with one exception: “Flagged content remains visible online during the investigation, with the exception of reviews flagged as ‘harmful or illegal,’ which are hidden while we look into them.” Trustpilot’s recommended path for a review that does not breach its rules is to reply: “telling your side of the story, so that people reading reviews can decide how much weight to give to the review in question.”
Sources: Google Business Profile Help, Report inappropriate reviews, Prohibited and restricted content, Yelp Content Guidelines, Trustpilot Guidelines for Businesses, Trustpilot Help, How to flag service reviews.
How to reply: the reply is for the next reader
Most replies after a breach are read by someone who has not been affected yet: a prospect, a journalist, a partner’s procurement team. Write for them.
What the platforms and the FTC allow:
- You can reply publicly. The FTC’s staff guidance says: “Yes, you can respond publicly to the review, and yes, you should watch what you say.” The rule bars a false accusation about the reviewer made knowingly or with reckless disregard for the truth, and bars physical threats or intimidation to get a review changed or removed.
- Google’s mechanics. You must verify the business first. Google reviews replies against its content policies; replies “usually take up to 10 minutes to review, but sometimes a review can take up to 30 days.” The reviewer is notified, and “Customers can still change their review after reading your reply. If they change their review, the date on their review will change to show when the latest update was made.” The reply appears as your business, with no personal name shown.
- Trustpilot’s conditions. “Be sure to always keep your replies polite and professional, and don’t include things such as personal information, threats, or aggressive language, otherwise we will remove your replies.”
What belongs in the reply, in our judgement and consistent with the FTC’s breach guidance for businesses, which tells companies to avoid misleading statements, not to withhold details that help consumers protect themselves, and to tell people how they will be contacted in future so that breach-themed phishing is easier to spot:
- Acknowledge what the reader experienced, in one sentence, without defending the company.
- State what happened and what data was involved, in plain language, matching your notice exactly.
- State what you have done for affected people.
- State how you will contact them, and that you will never ask for payment details by text or email.
- Give a channel that is not the review thread. Never put the customer’s personal information in the reply.
An illustration, for a fictional regional dental group: “Thank you for writing, and we are sorry your information was involved. On November 3 we wrote to every affected patient: a billing vendor’s system was accessed, and names, addresses and appointment dates were included. Clinical records were not. We have arranged free credit monitoring for everyone affected. We will only contact you by letter or from the number printed on that letter, and we will never ask for card details by text or email. If you did not receive a letter, call the number on our website and we will check.” It is short, it matches a notice, and it gives a scammer nothing to copy.
Sources: FTC, Consumer Reviews and Testimonials Rule: Questions and Answers, Google Business Profile Help, Read and reply to reviews, FTC, Data Breach Response: A Guide for Business.
What not to do: the FTC rule now has teeth
The FTC’s Consumer Reviews and Testimonials Rule, 16 CFR Part 465, “went into effect on October 21, 2024,” and “authorizes courts to impose civil penalties for knowing violations.” The maximum civil penalty is $53,088 per violation, and the FTC’s September 15, 2026 Federal Register notice says its penalty amounts “will remain unchanged during 2026.” That figure is a ceiling: courts weigh statutory factors and can impose much less.
What the rule prohibits, read from the eCFR text:
- Fake reviews. Writing, creating or selling a consumer review that materially misrepresents, among other things, that the reviewer exists. Buying one the business “knew or should have known” was misrepresented. The FTC’s announcement includes AI-generated fake reviews.
- Paying for sentiment. Compensation or incentives conditioned on reviews “expressing a particular sentiment, whether positive or negative.” The staff Q&A is blunt that offering incentives for 5-star reviews with a disclosure attached still violates the rule.
- Undisclosed insider reviews. An officer’s or manager’s review needs “a clear and conspicuous disclosure of the officer’s or manager’s material relationship to the business.” Family members may write reviews if they clearly disclose the relationship.
- Suppression. Using “an unfounded or groundless legal threat, a physical threat, intimidation, or a public false accusation” to prevent a review or get one removed. A legal threat is allowed “if you have a legitimate basis for doing so.” Intimidation “is not limited to physical threats” and can include abusive communications and character assassination.
- Misleading displays. Claiming the reviews you display “represent most or all the reviews submitted” while suppressing them by rating or sentiment.
- Paying to remove truthful negative reviews. Not a violation of the rule itself, but the staff Q&A says it “may violate the FTC Act as an unfair or deceptive act or practice.”
Two more points that matter if you hire help. The staff Q&A says reputation management companies, review brokers and PR firms can be liable under the rule: “Yes.” And the rule “does not provide a private right of action,” meaning enforcement comes from the FTC. The staff guidance also states that it “doesn’t provide a safe harbor from potential liability,” so treat the Q&A as the agency’s reading, not a shield.
What is still allowed, per the same guidance: contacting customers who left negative reviews to resolve the issue, and asking satisfied customers to update their reviews. Trustpilot adds the limit: “you should never pressure them to do so.” Selective solicitation is a separate problem. Google prohibits “selectively solicit positive reviews,” Trustpilot prohibits directing happy customers to review and unhappy ones to contact you privately, and the FTC says cherry-picking solicitations “could violate the FTC Act.”
The platforms enforce on their own schedule and in their own way. Yelp displays a Compensated Activity Alert when it has evidence someone offered payment for reviews, generally removed after 90 days if the behavior stops, and a Questionable Legal Threats alert when a business “may be abusing the legal system to intimidate or silence a reviewer.” Trustpilot’s listed consequences of misuse include “placing a Consumer Warning on your profile and hiding your TrustScore,” and its help page adds “stopping your Trustpilot stars from appearing in search engine results.” Google says fake engagement “is not allowed and will be removed.”
Sources: 16 CFR Part 465 on the eCFR, FTC press release, August 2024, 16 CFR 1.98, Federal Register notice 2026-18853. This is general information, not legal advice; ask counsel before any review-related action.
How to measure recovery
We did not find a published benchmark for how many days a star rating takes to recover after a breach, and we are not going to invent one. What exists is organization-level data. IBM’s 2026 Cost of a Data Breach Report, covering 602 organizations, defines recovery to include that “Customer confidence and employee trust have been restored.” By that definition, 42% of organizations fully recovered, fewer than one in 20 did so in less than 50 days, and 19% needed over 150 days. IBM also attributes 63% of the average USD 4.99 million breach cost to detection, escalation and lost business (IBM, Cost of a Data Breach Report 2026). IBM’s own summary for most organizations: “the hard work of recovery can take months or even years.” Plan for months, not weeks.
A star average blends everything and lags. A tracking sheet that separates the signals works better. This is our suggested design, not a sourced standard:
- Post-notice rating, tracked separately. Compute the average of reviews posted after the notice date, weekly, apart from the all-time rating. The cumulative average moves slowly by construction.
- Weekly review volume against the pre-incident baseline. A volume spike with falling ratings is the wave. Volume returning to baseline with a stable rating is the first real sign of recovery.
- Breach-mention rate. The share of new reviews that mention the incident. When it trends toward zero, the story is aging out of customers’ own words.
- Reply coverage and time to reply. Percentage of reviews with a reply, and the median hours to reply. Fully in your control.
- Platform mechanics. On Trustpilot, “Only the most recent review is factored into your TrustScore, though all reviews will count towards your total number of reviews.” On Google, a changed review shows the date of the latest update. On Yelp, track whether an Unusual Activity Alert is still displayed. Each of these tells you where the number can move and where it cannot.
- Search results for your brand name. Whether the first page is dominated by breach coverage, and how fast owned and neutral pages are displacing it.
- Non-review signals. Support ticket volume, cancellation rate and renewal conversations. IBM’s definition of recovery is about customer confidence, and reviews are only one place it shows.
The sequence we use as the working default: reply to every legitimate review, flag only what breaches a stated policy and keep a log of each report and its outcome, ask real customers for real feedback through the channels each platform allows, and publish a dated, sourced account of the incident on your own site so there is something accurate for search to find. The first two steps are the Review Management work. The fourth sits with Crisis PR.
For the earlier stages, see the first 72 hours after a breach goes public and when a vendor’s breach lands on your brand. For the coordinated-attack variant, see review bombing recovery and our guide to Google review removal. If the people exposed include your executives, read what to do when your own license, email and address leak.
The 90-second audit shows how exposed your review profile is today, and the strategy call is free.