Is Your Sales Popup Legal? FTC and EU Rules for Social Proof in 2025

1. Why regulators suddenly care about popups

For years, social proof widgets lived in a grey area. They looked like harmless UI decoration, so nobody thought of them as advertising. That has changed. Regulators now treat an on-site notification exactly as they treat a claim in an ad: if it states or implies a fact to influence a purchase, it must be truthful and not misleading. A popup that says “14 people are viewing this right now” is making a factual claim about demand. A badge that says “Only 2 left” is making a factual claim about stock.

The shift matters because the penalties are real. Enforcement bodies have moved from warning letters to fines, and consumer-protection groups actively scan popular stores for manufactured urgency. The good news is that the rules are mostly common sense: show what is genuinely happening, and you are fine. The trouble only starts when the numbers are invented. If you already run honest notifications, this article will mostly reassure you. If you have been faking the data, it is a warning worth reading closely.

2. The FTC rule on fake reviews and testimonials

In the United States, the Federal Trade Commission finalised a rule targeting fake and deceptive reviews and testimonials, which took effect in 2024. It bans a set of practices that touch social proof directly: creating or buying fake reviews, presenting reviews from people who never used the product, suppressing genuine negative reviews, and misrepresenting that a review is independent when it is not. The rule allows for significant civil penalties per violation, and because a single fake-review campaign can involve thousands of individual instances, the theoretical exposure is large.

For social proof specifically, the practical reading is simple. If your popup surfaces reviews, star ratings, or testimonials, those must come from real customers who genuinely bought and used the product. You cannot cherry-pick only the five-star reviews into a widget while burying the one-star ones behind a filter designed to hide them. And a “verified buyer” label has to mean the buyer was actually verified. The FTC rule does not ban social proof — it bans lying with it.

3. What the EU says: the UCPD and dark patterns

In the European Union, the relevant framework is the Unfair Commercial Practices Directive (UCPD), reinforced by the Omnibus Directive and guidance on so-called dark patterns. The UCPD prohibits misleading actions and omissions that cause the average consumer to make a decision they would not otherwise have made. Manufactured scarcity, false countdowns, and fabricated activity feeds all fall squarely inside that definition when they are not backed by reality.

The EU has been especially vocal about “false urgency” and “false scarcity” as named dark patterns. A countdown timer that resets when it hits zero, a “low stock” warning that never changes no matter how many people buy, and a “20 people bought this in the last hour” banner generated by a random-number script are all treated as misleading practices. Because Proofly is an EU-based company, this framework is the one we design around first — and it is stricter than many merchants realise. When in doubt, assume the EU standard, because if you clear it you almost certainly clear the US one too.

4. Recent-purchase notifications: lawful versus unlawful

The single most common social proof widget is the recent-purchase notification — the small card that says “Sarah from Leeds just bought the Trail Runner 2.” This is completely legal when it reflects a real order. It becomes a problem the moment any part of it is fabricated: a fake name, a fake product, a fake location, or a fake timestamp. The dividing line is whether a regulator inspecting your order database would find the transaction the popup describes.

To stay on the safe side, a lawful recent-purchase notification should be tied to an actual order event, should not invent details that did not happen, and should not exaggerate frequency by replaying the same handful of sales on an endless loop to simulate a busier store than you have. Showing real orders with a modest delay is fine. Inventing orders is not. If your store is quiet, the honest move is to show fewer notifications or switch to a different proof type, not to manufacture traffic you do not have.

5. Countdown timers and stock counters

Countdown timers and low-stock counters are the highest-risk widgets because they are the easiest to fake and the most heavily scrutinised. The rule of thumb: the deadline or the stock number must be real. A sale that genuinely ends Friday at midnight can have a timer counting down to Friday at midnight. A product with genuinely three units left in the warehouse can say “Only 3 left.”

What gets stores in trouble is persistence and resets. A timer that restarts every time the visitor reloads the page, or that shows a different deadline to every visitor, is a textbook false-urgency pattern. A stock counter hard-coded to “Only 2 left” on a product you have thousands of is a false-scarcity pattern. Regulators have issued fines over exactly these behaviours. If you want urgency, tie it to a real event: a real end date, a real inventory level, a real shipping cut-off. Real urgency converts and is completely defensible.

6. A quick legality checklist

Before you publish any social proof widget, run it against these questions. Does every notification correspond to a real event you could point to in your database? Are names, locations, products, and timestamps accurate rather than invented? Do countdowns end at a genuine deadline and stay ended? Do stock numbers reflect actual inventory? Are the reviews you surface from real, verified customers, with the negative ones not deliberately hidden? Have you avoided implying an endorsement or partnership that does not exist?

If you can answer yes to all of those, your popups are almost certainly compliant in both the US and EU. If any answer is no, that is the widget to fix first. A single honest configuration change — switching off a fake counter, connecting a feed to real order data — usually resolves the risk entirely, and often improves trust at the same time, because savvy shoppers can smell a fake countdown from a mile away.

7. How honest social proof stays compliant

The reassuring part of all this regulation is that it only punishes deception. Everything a legitimate store wants to do is still allowed. You can show real recent purchases, real visitor counts, real review scores, real signup numbers, and real deadlines. Tools built for honest use make this the default. With Proofly, notifications are driven by genuine events on your site — a real order, a real form submission, a real visitor count — rather than by a random-number generator, so what your visitors see maps to what actually happened. You can easily set up recent-purchase notifications, live visitor counters, and review widgets that are both persuasive and defensible. If you want to add credibility the compliant way, you can start with a free Proofly account and connect it to your real data.

Compliance and conversion are not in tension here. The same authenticity that keeps you on the right side of the FTC and the UCPD is also what makes social proof believable. Shoppers trust proof that feels specific and real; they discount proof that feels generic and staged. Building on real events gives you both outcomes at once.

8. A note before you rely on this

This article is a general overview to help you spot risk, not legal advice for your specific situation. Rules differ by country, they are updated regularly, and how they apply depends on your exact wording, market, and product. If you operate at scale, sell in multiple jurisdictions, or are unsure whether a particular widget crosses a line, check with a qualified lawyer in the relevant market before you publish. The safest default in the meantime is also the simplest one: only show what is genuinely true, and you will rarely go wrong.