QR codes, kiosks, and review collection that stays compliant

Physical collection works, and Google says so directly. Its own review guidance tells businesses they can ask customers to visit a Google link or scan a QR code, and to print and display that code in the store. A code on the counter, the receipt, or the delivery bag removes almost all the friction between a satisfied customer and a review, and friction kills review flow more reliably than reluctance does.

The trouble is that most of the products sold for this are built around a feature that is against the rules.

What makes a QR code or kiosk noncompliant?

One thing, and it is almost always the same thing.

The satisfaction question. A screen appears asking "how was your visit" with a set of stars or a smiley scale. Tap a high rating and you go to Google. Tap a low one and you land on a private feedback form that goes to the manager.

That is review gating, and it is worth being precise about who bans it. Google bans it outright. Its Maps user generated content policy, under rating manipulation, says merchants may not discourage or prohibit negative reviews, or selectively solicit positive reviews from customers. The FTC does not name gating. Its 2024 rule, 16 CFR Part 465, bans the conduct around it: section 465.4 covers incentives conditioned expressly or by implication on a review expressing a particular sentiment, and section 465.7(b) covers displaying reviews as though they represent all or most of those submitted when they have been suppressed by rating. Say it that way, because "the FTC banned gating" is the version that gets your whole argument dismissed by the one person in the room who read the rule.

It also fails as strategy, for reasons that have nothing to do with enforcement, and gating is illegal and it also makes you rank worse covers the ranking arithmetic.

Vendors sell the feature as reputation protection and many owners have no idea it is a violation. If your review tool has a rating threshold in its settings, that threshold is the problem.

A compliant flow has no branch in it. Scan, land on the review form, write whatever you want. If you cannot draw the flow as a straight line, it is not compliant.

What do kiosk vendors get wrong about the policy?

The word. They read "require" and the policy says pressure.

Google's policy is unusually specific here. When soliciting reviews, merchants should not require or pressure users to leave ratings or write reviews while on the premises, and should not request that specific content be included. It then enumerates what that includes: merchants asking staff to solicit a certain number of reviews, and merchants asking staff to solicit reviews that mention specific content, including content identifying a staff member.

Three things fall out of that, and every one of them is standard practice somewhere:

• A staff held tablet at checkout is, on the face of the policy, pressure. A passively displayed code on a receipt, table tent or window decal is materially safer, because the customer chooses to engage with it while nobody is watching.
• Staff review quotas are named and banned. Not discouraged. Named.
• "Ask them to mention your hygienist by name" is banned. Every script that does this violates the same clause, and separately, a controlled test found review wording does not move map pack rankings anyway.

A kiosk that a customer picks up voluntarily in an empty lobby is a different object from a tablet a server hands over while standing there. The hardware is identical. The policy exposure is not.

Where should the code actually live?

Wherever the customer is already stopped and holding their own phone.

On the receipt or invoice footer. Prints automatically, costs nothing, reaches everyone. Weakest for response rate, best for coverage.

In the delivery or takeout bag. A small card on top of the order, opened at the moment of anticipation.

On the table tent or counter card. Works if the ask is attached to a moment. A code sitting on a table with no context gets ignored.

Handed over by a person, with a sentence. The strongest by a wide margin. The code is the mechanism, the human ask is what converts.

In a followup text or email. Not a physical code at all, and often the best option, because the customer taps rather than scans.

What does not work is a poster on a wall. Nobody walks over to a wall.

How do I decide where to put it, in numbers?

Run the arithmetic with your own volume. Be clear about what the rates below are: placeholders. There is no published benchmark for review card completion rates that discloses a sample and a method, so anyone quoting you one is quoting a vendor. Use these to build the model, then replace them with your own after thirty days.

Say you run 600 transactions a month.

Read the third row against the first. The receipt reaches twice as many people and produces less than half the reviews. Coverage is not the variable. The human sentence is.

Now price the gate on the same volume. Put a satisfaction screen in front of the handed card and you lose two groups: the customers who tap the low rating and never see Google, and the ones who abandon at the extra screen. Call it 1 in 20 instead of 1 in 12, so 15 reviews a month instead of 25. Over a year that is 120 reviews you did not collect, and a meaningful share of the ones you filtered out were four star reviews that make a profile look real.

Then count taps. Scan, land on the form, type. Two steps. Every screen you add between them costs completions, and an intermediate page that captures an email before it passes you through is the most expensive design decision on this list.

How to make it yours. Track reviews for thirty days with one placement live, then switch. Two months of data beats any benchmark, and it is the only completion rate that describes your customers.

What should the landing page do?

As little as possible, and then get out of the way.

The ideal is a direct link to the review form, one tap between the scan and the typing box. Use the link Google generates from your profile rather than a hand built URL. The generated one is built from your profile's Place ID and survives profile merges, rebrands and address changes. A hand built search or write-review URL breaks silently, and you find out months later when nothing has arrived. One quirk worth knowing before you start: the reviews QR code can only be generated on a computer browser, not on a phone.

If you must use an intermediate page, it may contain exactly two things: a thank you and a button. No rating question, no email capture, no survey, no offer.

Do not offer anything in exchange. Google bans incentives for reviews flatly, and 16 CFR 465.4 reaches any incentive conditioned expressly or by implication on a review expressing a particular sentiment. The same principle applies to your team: pay for asks made, never for reviews received.

Test it on a phone that is not signed into your business account. Most broken review flows are broken in a way the owner cannot see, because the page behaves differently when you are logged in as the business.

And check where the link points. If you have duplicate listings or an old profile, a good card can be feeding reviews to a listing that does you no good. Confirm it before you print a thousand cards, alongside the rest of what actually gets a business found on Google.

Do kiosks and codes create risk beyond gating?

Two real ones, and both are avoidable.

Device and network clustering. A dozen reviews written from the same tablet on the same network in the same hour can look like a pattern to a platform's filtering system. Google's policy names content exhibiting unusual volumes or patterns of review contributions as a violation in its own right. The reviews may be entirely genuine and still get suppressed. This is the main argument against a shared kiosk and in favour of the customer's own phone.

Reviews written on your premises under supervision. Even without a branch in the flow, a customer writing a review while an employee waits is not writing freely. Beyond the ethics, those reviews read as staged, and readers notice.

Yelp takes a stricter position than Google on soliciting reviews at all, so if Yelp matters in your category, account for it separately rather than pointing one code at both.

When something does go wrong and a wave of negative reviews arrives, the collection mechanism is not the fix. Handling a review bomb is a different process with a different clock on it.

Where does the hardware answer break down?

Two places.

When the code is doing work the operation should be doing. If your staff will not say the sentence, no placement rescues the number. The table above says the human ask outperforms passive coverage by a wide margin, and no card fixes a floor team that has not been asked to participate.

When your transaction volume is too low for the model. At 60 transactions a month, the difference between 1 in 12 and 1 in 60 is four reviews against one. Both are noise. A business at that volume should be asking by name, in person, one customer at a time, and skipping the printing entirely.

What to do this week

Scan your own code on a personal phone and screenshot every screen between the scan and the typing box. If any screen asks how the experience was, take the code out of service today.

Open your review tool's settings and look for a rating threshold or filter. If it exists, turn it off. If it cannot be turned off, change tools.

Count the taps. More than two and you are losing people who intended to help you.

Then move the ask to a person. Print the card, hand it over, say the sentence. The code is a convenience, not a strategy.

And plan the other half. Reviews arriving means responses going out, and review response is customer service rather than damage control when you treat it as part of the same system.

Want your review flow checked end to end?

Email me at eric@seod.com with a photo of your QR card, table tent, or kiosk screen, plus the link the code points at. I will scan it myself from a clean phone, tell you whether it gates, count the taps, and confirm the link lands on the right profile.

I will also tell you where I would physically put the code in your kind of business, which is usually not where it currently is. Takes me a few minutes and nothing follows it.

If you are also wondering whether posts are worth the effort alongside all this, Google Business Profile posts have a narrower effect than most people assume.

Otherwise keep reading the reviews and reputation library.