What the FTC and Your State Dental Board Actually Require for Patient Testimonials and Before-After Photos

The Federal Trade Commission's Endorsement Guides (16 CFR Part 255) apply to any business using customer testimonials—including orthodontic practices. The core principle: testimonials cannot create false impressions about typical results.

This is educational content, not legal advice. Verify current rules with your compliance counsel.

The "Typical Results" Requirement

If your testimonial features an exceptional outcome, the FTC requires clear disclosure that results aren't typical. Vague disclaimers like "results may vary" are no longer sufficient under current enforcement guidance. You must either:

• Only feature testimonials representing outcomes most patients actually achieve
• Clearly disclose what the typical patient can expect (with specifics)
• Have documentation supporting any implied performance claims

Material Connections Must Be Disclosed

If a patient received any incentive for their testimonial—discount on treatment, free retainers, gift cards—this must be disclosed. The disclosure must be clear and conspicuous, not buried in fine print. This applies equally to written testimonials, video reviews, and social media posts you share.

Substantiation Requirements

Claims in testimonials require substantiation. If a patient says "my treatment finished three months early," you should have records supporting that this outcome is achievable. Practices cannot hide behind "the patient said it" if the claim is misleading.

State dental board advertising regulations vary significantly—what's permitted in Texas may violate California rules. However, most boards share common requirements for before-after imagery in orthodontic marketing.

Important: Rules vary by state. Always verify current requirements with your specific state dental board.

Common State Board Requirements

Based on typical state dental board regulations, most jurisdictions require:

• Written patient consent specifically authorizing use in advertising (not just general treatment consent)
• Accurate representation—photos must be of actual patients treated by your practice
• No misleading alterations—digital enhancement beyond basic lighting/color correction is typically prohibited
• Consistent photography conditions—same lighting, angle, and equipment for before and after

State-Specific Variations

Some states impose additional requirements. Examples we've encountered include mandatory treatment timeframe disclosure, requirements that photos be accompanied by specific disclaimer language, and restrictions on using photos in certain media types. A practice marketing across state lines faces the strictest applicable standard.

Enforcement Reality

Dental boards investigate complaints—often filed by competitors. Violations can result in formal discipline, required corrective advertising, and in serious cases, license implications. We've seen practices receive board inquiries over before-after posts that seemed obviously compliant to the practice owner.

HIPAA's Privacy Rule (45 CFR §164.508) requires specific written authorization before using protected health information for marketing purposes. Your general treatment consent form almost certainly doesn't cover this.

What Requires HIPAA Marketing Authorization

Before-after photos are protected health information when they could identify a patient—which includes most facial photographs, even partial views. Using these images in:

• Website galleries
• Social media posts
• Print advertising
• Google Business Profile photos
• Email marketing

All require valid HIPAA marketing authorization separate from your treatment consent.

Authorization Form Requirements

A compliant HIPAA marketing authorization must include specific elements: description of the information to be used, who will use it, the purpose, expiration date or event, and the patient's right to revoke. Generic "I consent to use my photos" language fails HIPAA requirements.

The Dual Consent Reality

Orthodontic practices need both HIPAA authorization is separate from and additional to and state-dental-board-compliant advertising consent. These serve different purposes under different regulatory frameworks. Many practices mistakenly believe one form covers everything—it doesn't. We recommend working with a healthcare compliance attorney to develop forms that satisfy both requirements simultaneously.

Compliance requirements directly impact orthodontic SEO strategy—particularly around structured data, review management, and content that search engines can trust.

Review Schema and Aggregate Ratings

Google's structured data guidelines require review schema to accurately reflect actual reviews. If you're selectively displaying only five-star testimonials, your aggregate rating in schema must still reflect your true distribution. Manipulated review schema can trigger manual penalties.

Before-After Galleries and Image SEO

Properly consented before-after images become valuable SEO assets. Compliant galleries can:

• Rank in Google Images for treatment-specific searches
• Support case study content with visual proof
• Build the trust signals Google evaluates for healthcare YMYL pages

However, using non-compliant images creates liability that outweighs any SEO benefit. If you need to remove images later due to consent issues, you lose that SEO equity anyway.

E-E-A-T and Authentic Testimonials

Google's quality rater guidelines emphasize Experience, Expertise, Authoritativeness, and Trustworthiness. Authentic, compliant testimonials demonstrate all four. Manufactured or incentivized reviews that don't disclose material connections can trigger both FTC issues and quality rater downgrades. The compliant path and the effective SEO path are the same path.

For comprehensive SEO strategy that respects these requirements, see our guide to SEO for orthodontists that respects patient privacy.

Compliance becomes manageable with proper systems. Practices that struggle typically lack organized consent tracking rather than facing genuinely complex situations.

Essential Documentation Elements

Your consent management system should track:

• Consent scope—what specific uses did the patient authorize?
• Consent date and version—which form did they sign?
• Expiration or revocation—is authorization still valid?
• Specific assets covered—which photos, which testimonial?
• Where content is published—can you remove it if authorization is revoked?

Practical Workflow Integration

The most sustainable approach integrates consent conversations into your existing patient touchpoints. Many practices find the debond appointment—when patients are happiest with results—is the natural moment for this conversation. Present it as celebrating their outcome, not administrative paperwork.

Revocation Procedures

Patients can revoke marketing authorization at any time. Your system needs a clear process: how do they notify you, who removes content, what's the timeline? Document this procedure and train staff. We've seen practices scramble when they can't identify all locations where a photo appears.

Annual Compliance Audits

Review your published content annually against your consent records. Verify every testimonial and photo has valid, current authorization. This audit protects against drift—content accumulating over years with documentation gaps.

Understanding enforcement realities helps practices calibrate appropriate compliance investment. Neither paranoia nor dismissiveness serves you well.

Dental Board Complaints

Most dental board advertising investigations begin with complaints—frequently from competing practices. The board reviews your marketing against state regulations, requests documentation, and determines whether violations occurred. Outcomes range from informal guidance to formal discipline appearing in your license record.

FTC Enforcement Priorities

The FTC prioritizes cases with significant consumer harm or widespread deception. Individual orthodontic practices rarely face direct FTC action for testimonial issues. However, FTC enforcement against healthcare providers in aggregate creates precedent your state board may reference. The greater practical risk is state-level enforcement using FTC guidelines as the standard.

The Patient Complaint Scenario

A patient who feels their image was used improperly can file HIPAA complaints with HHS Office for Civil Rights, dental board complaints, and potentially pursue civil claims. We've seen situations where a patient's circumstances changed—new job, divorce, relocation—and they wanted images removed that were posted years earlier with valid consent. Having revocation procedures prevents this from escalating.

The Practical Risk Calculus

Compliance investment is modest compared to potential consequences: legal fees responding to investigations, corrective advertising requirements, reputation damage from public discipline, and the distraction from actually running your practice. Most compliant practices report the systems become routine within a few months.