# Customer Reviews Are Marketing Claims Too

**Author:** John Morabito (Founder, /winston)
**Published:** September 20, 2026
**Reading time:** 11 minutes
**Canonical:** https://www.winstondigitalmarketing.com/playbooks/cannabis-ugc-and-review-compliance/

Reviews and customer photos are somebody else's words until you move them onto a surface you control. The moment a dispensary pulls a review onto a product page or reshares a customer's post, the claim inside it starts to look like a claim the business is making. Here is where that line sits, how to curate without rewriting people, what to do with a review that says cannabis cured something, and why review gating is a separate problem you also have.

## The short answer

Cannabis compliance work is almost entirely about first-party claims. Package copy, menu descriptions, the language on a category page, what the social account is allowed to post. The rules operators lose sleep over are the ones governing what the business says about its own products.

Customer content breaks that frame, because the words start out as somebody else's and end up on surfaces you control. A review on Google is a customer talking to the public through a platform you do not own. The same review, pulled onto your product page as a testimonial underneath a strain, is your business publishing a statement about that product. The sentence did not change. Who is standing behind it did.

That is the whole trap. A review or a reposted customer photo that makes a medical claim can be treated as the business making that claim once the business publishes or amplifies it. Adoption is a familiar idea in regulated advertising generally, where a statement you republish, endorse or amplify tends to get evaluated as though you had written it. Cannabis operators run into it more than most, because the single most common thing a satisfied customer writes is the one thing the business is least able to say.

This page is general information rather than legal advice. Cannabis advertising and promotion rules differ by state, they change often, and none of them are quoted here. Take the policy you build out of this to your counsel and your state regulator before you publish it, and let them tell you where your line actually sits.

Two neighboring topics are handled elsewhere and are deliberately not repeated here. Earning reviews, responding to them and managing sentiment is cannabis reputation management: https://www.winstondigitalmarketing.com/playbooks/cannabis-reputation-management/. Anything involving a paid partner, a commission or a gifted product is cannabis influencer marketing: https://www.winstondigitalmarketing.com/playbooks/cannabis-influencer-marketing/, where the disclosure obligations are different because the relationship is. This page is about unpaid content that customers wrote on their own, and what happens to it when you move it.

## Where the words sit changes what they are

The same sentence carries different weight on three different surfaces, and most operators treat all three as one thing.

| Where the words sit | What you control | How it tends to read |
| --- | --- | --- |
| A third-party platform: Google, Weedmaps, Leafly, Yelp | You can respond and you can flag. You cannot edit or remove. | The customer's statement. You did not solicit the wording and you cannot change it. |
| An unfiltered review feed on your own site | You chose to install the feed and you chose which platform it pulls from. | Ambiguous, and it depends on whether anything is being filtered. A widget quietly set to show four and five star reviews only is a curated block wearing an automatic one's clothes. |
| A hand-picked testimonial on a product or category page | Everything. You chose the review, the placement and the context around it. | Published content. Selection is an editorial act, and the claim inside a quote you chose is hard to describe as somebody else's. |

Exposure tracks control. The more say you have over which words appear, the more the words look like yours. So if you could not write the sentence in your own product copy, think hard before republishing it under your own logo, and think harder before putting it next to a buy button.

It also means the safest place for your best review is often exactly where the customer left it. A five star review on Google saying the product helped somebody sleep does more for you sitting on Google, where it feeds the map pack and gets read by the next shopper, than it does copied onto a product page where it becomes a claim you have to defend.

> **The widget nobody audited.** Review widgets and aggregators almost all ship with a minimum rating filter, and it is usually on. That single setting quietly converts an automatic feed into a curated selection, which changes how the block reads and, on most platforms, breaks the terms you agreed to when you connected the account. Open the settings on whatever is embedded on your site and write down what it is filtering. It takes five minutes and it is the fastest fix in this playbook.

## Reposting customer content is a publishing decision

A customer posts a photo of your product and tags you. Resharing it feels like a courtesy, and that is the framing that gets operators into trouble, because a reshare is a publication. Three things need checking before it goes anywhere.

- **The caption and any text in the image.** Whatever they wrote travels with the post, and the most common customer caption in this category is some version of what the product did for them. That is the exact claim your own marketing cannot make, so republishing it hands you the claim. Where the platform allows it, republish the image and write your own caption. Where it does not, meaning a straight reshare that carries their words intact, treat their words as your words and decide accordingly.
- **The person.** Get permission in writing rather than assuming a tag is consent. Confirm they are of legal age, which matters more here than in any other category and is the first thing a regulator or a platform will ask about. Check who else is identifiable in the frame. And keep the permission somewhere you can find it in a year, because the request that matters is always the one from eighteen months ago.
- **The audience.** Your own site is age-gated. Your social following is not, not in any way you can verify, and a reshare pushes somebody else's consumption imagery in front of whoever follows you. That is a different risk from the one the original poster took, and it is yours now. The platform-by-platform version of what passes and what gets pulled is in the cannabis social media rules: https://www.winstondigitalmarketing.com/playbooks/cannabis-brand-social-media-rules/

The same logic applies to every quieter form of amplification: pinning a review, quoting one in an email, putting one in a slide, screenshotting a comment into a story. Each one is a selection you made, which is what makes the claim yours, even though none of them feel like publishing at the time.

## Review gating and incentives are a separate problem you also have

Two practices get grouped with cannabis compliance and do not belong there. They are worth separating because they come from a different rule set, they apply to every industry, and a cannabis operator carries them on top of everything else rather than instead of it.

**Gating** is surveying customers first and sending only the happy ones to a public review link while the unhappy ones get an internal feedback form. The major platforms prohibit it in their terms, and beyond the terms it produces a rating that does not describe your customer base, which makes it useless as a management signal. It usually arrives by accident, switched on inside a loyalty tool or an SMS platform by somebody who thought they were being efficient. Ask everybody the same way, send everybody to the same link, and let the number be the number.

**Incentives** are discounts, loyalty points or entries in a draw in exchange for a review. Platform terms broadly prohibit paying for reviews, endorsement expectations call for a material connection between a reviewer and a business to be disclosed where one exists, and in cannabis there is a third layer, because state promotion and discount rules may restrict what you can give away and to whom. Three rule sets land on one tactic, and the tactic does not work well anyway. Consistent asking at the point of sale and in a follow-up message builds steadier velocity, and it does not leave a record linking a payment to a compliment.

A bakery has both problems too. Cannabis adds a second and third layer on top of them, which is why operators who audit only against state rules tend to miss both. Neither one lives there.

## Curating without putting words in somebody's mouth

Assume you have decided to publish reviews on your own site, which is a reasonable decision. Selection is fine. Editing is where it goes wrong, and it comes in a few recognizable shapes.

- **Trimming until the meaning moves.** Cutting a run-on or dropping a paragraph about parking is fine. Cutting the qualifier so the remaining half reads stronger than the customer meant is not, and an ellipsis does not make it acceptable. The test is whether the person who wrote it would recognize what you published as what they said.
- **The composite.** Assembling one glowing testimonial out of three reviews and attributing it to a single name is fabrication, even when every word in it was written by a real customer. If you want the effect, publish three short quotes.
- **The polish.** Fixing a typo is housekeeping. Rewriting a clumsy sentence so it reads better is authorship, and once you are the author the claim is yours without qualification.
- **The detached attribution.** A quote with no name, no source and no date reads as invented whether or not it is, and it is the format most likely to be challenged. Attribute the way the platform shows it, first name and last initial, and say where it came from.

Say what your selection rule is, in a line, somewhere people can see it. Something as simple as a note that you publish reviews as written and select for length and relevance does more for trust than another testimonial does, and it forces you to actually have a rule. The broader argument for showing your working on pages like this is in the cannabis content marketing playbook: https://www.winstondigitalmarketing.com/playbooks/cannabis-content-marketing/

## The review that makes a health claim

Every dispensary and every brand gets these, and they are usually the warmest reviews you receive. Somebody writes that your product helped them sleep, or eased pain, or did something a great deal more specific than that. Four moves, in order.

1. **Leave it where it is.** On a third-party platform you generally cannot remove it, and trying tends to look worse than the review. A review you did not solicit, edit or republish is the customer's statement.
2. **Do not amplify it.** Keep it off the product pages, out of the emails, off the pinned slot, and out of screenshots. That takes discipline, because the review is nice and the impulse to show it off is strong.
3. **Reply without repeating the claim.** Your reply is your words under your name. Thank them, keep it short, and say nothing at all about the condition. Do not confirm it, do not expand on it, and do not argue with it. Repeating the claim in order to agree with it converts a customer's sentence into a business statement in a single move, and it is the most common way this goes wrong.
4. **Escalate anything that is actually a safety report.** A review describing a bad reaction or an unexpected effect is a product complaint, and it should go through whatever process you use for those rather than sitting with whoever handles marketing. Write that process down before you need it.

The reply is first-party content, so it carries every obligation your product copy carries, and a responder working from a template written for a restaurant will cheerfully restate a medical claim in the first sentence. Brief whoever answers your reviews on that one point and you have removed most of the risk in this area.

## Write the policy down once

Almost all of this goes wrong by drift. Nobody decides to publish a medical claim. A widget gets installed, an SMS tool gets a new feature, a new hire starts answering reviews, somebody reshares a story on a Friday. One page of policy, given to everyone who touches customer content, prevents most of it. It needs to cover six things.

- Which review sources you publish on your own site, and whether anything is filtered.
- The selection rule, and the fact that reviews get published as written.
- What disqualifies a review from republication, with health and efficacy claims named explicitly.
- The reshare checklist: written permission, age confirmation, caption handling, who signs off.
- The reply standard, including the instruction never to restate a medical claim in a response.
- Where a safety report goes, and who owns it once it gets there.

Then take it to counsel and to your state regulator's guidance, and have them mark it up. A written policy that your lawyer has read is also the thing that helps most if anybody ever asks what your process was, because the question in that moment is usually whether one existed at all.

## What to do first

In order. The first two take an afternoon between them and remove most of the exposure.

1. Open every review widget and feed on your site and write down what each one is filtering. Turn off the minimum rating filters.
2. Read the reviews and customer quotes currently published on your own pages. Pull down anything making a health or efficacy claim, and anything you cannot source to a named platform review.
3. Check the composites. If a testimonial reads too well, find the original and confirm it is one person's words.
4. Audit how you ask for reviews, end to end, and remove any gating or incentive you find in the loyalty, SMS or email tooling.
5. Build the reshare consent process, in writing, with an actual place the permissions get stored.
6. Brief whoever replies to reviews on the one rule that matters: never repeat a health claim back.
7. Write the one-page policy and send it to counsel alongside your state regulator's current guidance.

## Hiring someone for this

Most agencies treat reviews as a volume problem, because in most categories it is one. Ask a prospective partner what they would do with a five star review that says your product cured somebody's insomnia, and listen for whether the first instinct is to feature it. Ask whether their review tooling filters by rating, and whether they know the answer without checking. Ask who writes the replies and what those people have been told about medical claims.

Our pricing is published rather than quoted after a call, and every engagement is a written scope with the number attached before you pay anything. It is on the pricing page: https://www.winstondigitalmarketing.com/pricing/. The done-for-you version sits inside our cannabis marketing service: https://www.winstondigitalmarketing.com/services/cannabis-marketing/, and if you want to see how your own pages read to a machine before talking to anybody, put the site through the free audit: https://www.winstondigitalmarketing.com/audit/. None of that is legal advice either, and it does not replace your counsel.

## Frequently asked questions

### Can a dispensary put customer reviews on its own website?

Yes, and the act of choosing which ones to put there is the part worth thinking about. A review on Google or Weedmaps is a customer speaking in public through a platform you do not own. The same review, selected by you and placed on a product page under a strain, is content you published. Nothing in the sentence changed, but the person standing behind it did. That is manageable: publish reviews that say what your marketing is already allowed to say, leave the ones making health or efficacy claims where they sit, attribute what you publish, and do not rewrite it. The rule of thumb that survives most policies is that if you could not write the sentence yourself in your own product copy, you should think hard before republishing it under your own logo. Confirm the specifics with counsel and your state regulator, because this is general information rather than legal advice.

### Is a review that makes a medical claim a problem for the business?

It depends almost entirely on where it lives and what you do with it. A customer writing on a third-party platform that your product helped them sleep is that customer's statement, and in most states the business is not treated as the author of reviews it did not solicit, edit, or republish. The exposure starts when the business adopts it: pulling that review onto a product page, quoting it in an email, pinning it, putting it in an ad, or resharing it to your own followers. Adoption is a familiar idea in regulated advertising generally, where a statement you republish, endorse or amplify tends to get evaluated as though you had said it. So the practical answer is that the review itself is usually not the problem, and promoting it usually is. Where your state's rules draw that line specifically is a question for counsel and your regulator.

### Can we repost a customer's photo of our product?

Treat a repost as publishing rather than as a courtesy, and three things need checking before it goes up. First, the caption and any text in the image, because those travel with the post and become part of what you published, and a customer caption about what the product did for them is exactly the kind of claim you would not write yourself. Second, the person, meaning you have their permission to use it, they are of legal age, and nobody else identifiable is in the frame without knowing. Third, the audience, because your account reaches a following that is not age-verified the way your own site is, and a reshare puts somebody else's consumption imagery in front of it. The safest version is to ask for permission in writing, republish the image without the original caption, and write your own caption that says only what you are allowed to say.

### What is review gating and why does it matter for a cannabis business?

Review gating is surveying customers first and routing only the happy ones to a public review link while the unhappy ones get a private feedback form. It is a problem independent of anything in cannabis law, because the major review platforms prohibit it in their terms and because it produces a rating that does not represent the customer base. The reason it deserves its own paragraph in a cannabis context is that operators in this category are usually thinking hard about state rules and not at all about platform terms, so gating tends to arrive quietly inside a loyalty or SMS tool that somebody switched on. Ask every customer the same way, send them all to the same link, and let the rating be whatever it is. The fix for a bad rating is volume and recency of real reviews, which is the work described in our cannabis reputation management playbook.

### Can we offer a discount for leaving a review?

This is where two separate rule sets land on the same tactic. Incentivized reviews run into platform terms, which broadly prohibit paying for reviews, and into endorsement expectations, which call for a material connection between a reviewer and a business to be disclosed when one exists. Those apply to every industry. On top of that, a cannabis operator has state promotion and discount rules that may restrict what you can give away and to whom, which is a second layer most categories do not carry. The combination is why incentives are rarely worth it here. Asking consistently at the point of sale and in a follow-up message gets you steadier review velocity than a discount does, and it does not leave a paper trail connecting payment to praise.

### Can we edit or shorten a review before publishing it on our site?

Trim for length, never for meaning, and say that you trimmed. Cutting a run-on sentence or dropping a paragraph about parking is fine. Cutting the qualifier out of a sentence so the remaining half reads stronger than the customer meant is editing somebody into a claim they did not make, and it is worse than publishing the original because now the words are demonstrably yours. The versions that go wrong most often are an ellipsis placed so the surviving fragment says something new, a composite built from several reviews and presented as one person, and a lightly rewritten quote that reads better than the original. Publish reviews as written, attributed the way the platform shows them, or do not publish them.

### How should we respond to a review that makes a health claim?

Respond without repeating the claim, because your reply is your words on a page carrying your name. Thank the customer, keep it short, say nothing about the condition they mentioned, and do not confirm, expand on, or argue with the medical content. A reply along the lines of thanks for taking the time to write this, we are glad you had a good visit, is enough, and it reads as gracious rather than evasive. What to avoid is the well-meant version that restates the claim in order to agree with it, which converts a customer's sentence into a business statement in one move. Leave the review up, leave it where it is, do not pin it, quote it, or pull it onto your site, and if the review contains something you believe is unsafe or is a genuine adverse event, escalate it internally the way you would any product complaint.

## Get the customer content off your risk register

We audit what your site is republishing, fix the review widgets and the asking process, and write the one-page policy your team can actually follow. Everything here is general information rather than legal advice, so your counsel and your state regulator still have the final word. Published pricing, written scope, no call required.

Service: https://www.winstondigitalmarketing.com/services/cannabis-marketing/
Audit: https://www.winstondigitalmarketing.com/audit/