When Online Reviews Become Weapons — Practical Observations on the Standards for Online Review Activities

On June 8, 2026, the Cyberspace Administration of China and the State Administration for Market Regulation jointly issued the Standards for Online Review Activities (the “Standards”). The Standards respond to a pressing issue that has plagued numerous brand enterprises in recent years—the phenomenon whereby “third-party reviews” have degenerated from a consumer reference into a weapon for commercial attacks. As practising lawyers who have long handled corporate negative publicity, commercial reputation crises, and unfair competition disputes, the authors draw on observations from recently handled cases to offer a practical analysis of the institutional significance, regulatory highlights, and application challenges of the Standards.

I. From “Recommendation Reference” to “Grey-Zone Weapon”: The Practical Background Behind the Standards

The rise of online reviews was originally an antidote to information asymmetry in the consumer market. By conducting tests, comparatively analysing data, and citing professional testing results, review entities provide a reference for consumer decision-making—an information-intermediary function worthy of recognition. In recent years, however, some review activities have departed from objectivity and neutrality, carrying out targeted commercial attacks under the guise of reviews. These range from crude to sophisticated. The cruder forms are not difficult to identify: the “exaggerated promotion, review without testing, and integration of commerce and testing” singled out in official circulars, as well as practices commonly seen in reality, such as failing to test according to standard methods, conducting testing processes in an arbitrary and non-compliant manner, commissioning unqualified institutions to issue reports, and even directly fabricating data or forging and tampering with testing reports. The essence of such conduct is the manufacture of false information, which falls within the existing regulatory frameworks governing false advertising, commercial defamation, and even the forgery of certification documents; the determination of facts is relatively clear, and identification and investigation are relatively straightforward.

What is truly thorny in practice—and more deserving of vigilance—is a category of attack that is more technically sophisticated, more covert, and more harmful. Its common characteristic is this: the testing was indeed conducted, the institution is genuinely qualified, the data truly exists, and indeed every step appears to have a standard to rely upon; yet through carefully orchestrated arrangements at the levels of method selection, sample submission, result disclosure, and conceptual interpretation, truthful data is made to tell a distorted story. With respect to such conduct, the label “false” may be difficult to apply directly, and regulators and the courts have long been able to see the problem clearly but unable to reach it.

In multiple cases the authors have recently handled, they have observed that such attacks follow a few highly recognisable patterns:

First, the sample black box. The stages of product selection, sample purchase, sample submission, and liaison with the testing institution in commissioned testing are entirely under the unilateral control of the reviewing party, with no possibility of external oversight. Products of the same brand can perfectly well be divided into multiple samples for submission and tested multiple times, with the reviewing party ultimately adopting only the one result in which the target brand was “detected,” while adopting only the “not detected” results for other brands. Such selection leaves no trace whatsoever in the published report, and the picture of “multiple brands compared side by side, with only one detected” may already have been predetermined at the sample-submission stage. As to whether a long-term cooperative relationship—or even deeper arrangements of interest—exists between the reviewing party and certain testing institutions, this is often difficult to verify in individual cases; yet even without making any such presumption, the unilateral control over the sample-submission chain is itself sufficient to undermine the credibility of any horizontal comparison. The most direct way to test such manipulation is to commission separate testing of similar market-available products under the same standard and the same method. In practice, brand owners have already discovered, through comparative submission for testing, that other brands “not detected” in the original review were likewise “detected” under equivalent conditions, whereupon the picture of only one brand being detected collapsed.

Second, selective disclosure. For example, a reviewing party may simultaneously hold testing reports issued under multiple different standards—some showing “detected” and others showing “not detected”—yet publicly release only the one unfavourable to the target brand. Viewed in isolation, the published report is entirely truthful in its data; yet placed within the complete evidentiary picture, this manner of disclosure amounts to cherry-picking the overall facts. A more covert variant is “pseudo-transparent disclosure”: the reviewing party attaches a QR code in the article for downloading the full report, creating an impression of “everything is public and can withstand scrutiny,” but what truly shapes public perception is often the title, conclusions, and emotive expressions in the body of the article; very few readers will download the full report, and even fewer can comprehend the professional details within. Formally complete disclosure thus becomes a cover for substantive cherry-picking.

Third, citation beyond permitted use and the conflation of validity. For example, the declaration page of an inspection and testing report usually sets out explicit usage restrictions. For instance, the report declaration of a certain testing institution states: “Without the written consent of the testing institution, the commissioning party or any third party shall not use this report or its testing results for improper promotion”; and “Data and results in the report that are not marked with the China Metrology Accreditation (CMA) mark have no social certification effect and are for the internal use of the commissioning party only.” The reviewing party disregards these restrictions and uses results that, by their own declaration, are “for internal use only” in public-facing commercial communications that in effect disparage a specific brand. This can hardly be said not to constitute the improper promotion that the declaration prohibits. The supposed endorsement by authoritative testing does not hold up under the issuing institution’s own rules.

In fields involving specialised knowledge, this conflation of validity is even more misleading and harmful. Taking CMA accreditation as an example, “an institution holds CMA accreditation” does not mean “every report issued by that institution has certification effect,” because the granularity of CMA accreditation is not the testing institution as a whole, but rather the testing objects, items/parameters, and standard methods. The Accreditation Certificate issued by the accreditation authority comes with a schedule of capabilities, which itemises the testing items the institution is authorised to conduct and the specific standard methods on which they are based; only for “item + method” combinations falling within the scope of the schedule can the institution issue reports bearing the CMA mark and having social certification effect. Therefore, two reports issued by the same institution for similar samples under different standards (different methods) may well differ entirely in validity precisely because of the different testing standards adopted: one has social certification effect, while the other, according to its declaration, is for internal reference only. Yet whether a report bears the CMA mark and the differences in its legal implications are virtually incomprehensible to ordinary consumers. Reviewing parties exploit precisely this cognitive gap, presenting reports of unequal validity side by side as if they were equally authoritative. In practice, there has even arisen an inverted situation: the report used in the body of the review to support the “detected” conclusion and create online-reputation impact is precisely the one that, according to its declaration, has no social certification effect and is for internal use only, while the other report, which bears the CMA mark and concludes “not detected,” is relegated to a QR code in an appendix.

Fourth, conceptual substitution. For example, conflating the limit of quantification of a testing method (i.e., the lowest concentration that the instrument can accurately quantify, which is an indicator of method sensitivity) with the statutory maximum residue limit (i.e., the maximum permissible residue level prescribed by regulation), and then deriving the conclusions that “detection equals exceeding the standard” and “detection equals harm.” In fact, situations in which detected values are far below statutory limits are extremely common in food and consumer product testing; “detection” in itself does not constitute proof of any illegality or safety problem.

Fifth, the game of standard selection. The same testing item often has multiple testing standards and methods, whose sensitivity (limit of quantification) may differ by several times or even by orders of magnitude. The reviewing party tests similar products of different brands using different standards and methods of different sensitivity, and then places the results side by side in the same comparison table, creating the visual impact that, among multiple brands, only one brand is detected. The truth may simply be that the methods adopted for the other brands have a higher limit of quantification. “Not detected” only means below the lower limit of quantification of that method, and absolutely does not mean “nonexistent.”

The various techniques described above are distributed across every link of the review chain—method selection, sample submission, result disclosure, conceptual interpretation, and report citation—but they share one common feature: each data point, viewed in isolation, can withstand verification, and each report appears to genuinely exist, yet the selection of samples, the selection and arrangement of data, and the manner of citation and interpretation of reports together constitute a misleading overall narrative. This is precisely the typical scenario in which Article 12 of the Anti-Unfair Competition Law, as revised in 2025, places “misleading information” alongside “false information” within the regulation of commercial defamation.

What must be confronted even more squarely is that behind some review conduct there has already formed a grey industry chain of “using reviews to force negotiations, and using smears to sustain business”: first publishing or previewing negative reviews to create reputational pressure, and then demanding money or property from brand owners under such pretexts as “commercial cooperation” or “deletion fees”; or accepting commissions from competitors to carry out targeted topic selection and targeted attacks. The former may touch upon the crime of extortion under Article 274 of the Criminal Law, while the latter operates on the borderline between commercial defamation under the Anti-Unfair Competition Law and the crime of damaging commercial reputation or product reputation under Article 221 of the Criminal Law.

II. The Core Provisions of the Standards: A Targeted Regulatory Design

Reading through the twelve articles of the Standards, one can clearly discern the correspondence between them and the practical pain points described above.

(1) Article 4: Ending the Game of Standard Selection

Article 4 requires that where testing involves items such as product function and performance, it shall be commissioned to an institution holding statutory inspection and testing accreditation to be conducted in accordance with relevant standards and technical specifications; the basis of the test shall be expressly stated; testing samples and data records shall be retained; and the traceability of results shall be ensured. Where national standards or industry standards already exist, they shall be adopted as a priority; where it is genuinely necessary to adopt other standards or non-standard methods, the similarities and differences between them and the national or industry standards shall be explained, and non-standard methods must also undergo prior method validation. Particularly noteworthy is the special provision on food testing: the reviewing party shall possess the corresponding qualifications, shall not use non-standard methods, and shall not review items for which no national standard inspection method exists. This provision directly closes off the room for deliberately manufacturing a “detected” result through obscure standards or ultra-high-sensitivity methods. At the same time, the requirements to retain testing samples and all data records and to ensure the traceability of results also make the practice of “submitting multiple samples of the same brand and adopting one selectively” subject to reconstruction and verification, opening up the “sample black box” through complete records of samples and data.

(2) Article 6: Targeting Selective Disclosure and Conflation of Validity

Article 6 provides that one shall not make horizontal or vertical comparisons of similar products using different standards or methods; shall not quote inspection and testing reports issued by testing institutions out of context; shall not elevate a reviewed sample by disparaging other products; and shall not make false or untrue descriptions of products or maliciously defame them. By prohibiting the use of testing reports “out of context,” the Standards for the first time expressly designate, at the normative level, the selective disclosure and one-sided interpretation of testing results as a violation. This directly echoes the regulation of “misleading information” under Article 12 of the Anti-Unfair Competition Law and provides an important reference for the determination of cases of the “truthful data but misleading narrative” type. It should also be pointed out that “taking out of context” should not be understood merely as plucking isolated words or phrases from a report: disregarding the usage restrictions stated in the report declaration, or citing testing data while stripping away the validity context of the accreditation mark, likewise constitutes a fragmented use of the content of an inspection and testing report and should fall within the regulatory reach of this article.

(3) Articles 3, 5, and 8: Cutting Through the Fog of Interests and Qualifications

Reviewed samples must be ordinary commodities purchasable on the market with traceable sources, and where commissions, sponsorships, or relationships of interest are accepted or exist, a prominent notice must be given (Article 3); where no testing has been conducted and evaluation is based solely on subjective impressions, a prominent indication of “personal experience only” or “subjective impressions, for reference only” must be given (Article 5); and reviewing entities must verify the accreditation of testing institutions and the authenticity of testing reports, shall not commission unqualified institutions, and shall not display or cite false reports (Article 8). In light of the practical observations set out above, the verification obligation under Article 8 should reasonably extend to the accreditation mark and the declaration clauses of the report itself. To publicly disseminate a report that is not marked with the CMA mark, that according to its declaration is for the internal use of the commissioning party only, and that without the consent of the testing institution may not be used for promotion can hardly be said to fulfil the obligations of verification and compliant use. The three articles together constitute a constraint on the “integration of commerce and testing” and on false authoritative endorsement.

(4) Articles 9, 10, and 12: A Closed Loop of Liability

The obligation to proactively delete already-published false or untrue information (Article 9), the platform’s responsibility for managing review-information content and handling complaints (Article 10), and the connecting provision that cases suspected of constituting crimes shall be transferred to judicial authorities for handling (Article 12) embed the Standards within a complete chain of liability spanning administrative investigation and criminal prosecution.

III. Connection with the Existing System of Legal Liability

The Standards are themselves normative documents; although they do not directly create new legal liabilities, they provide concrete behavioural guidance for the application of existing laws.

At the civil and administrative levels, Article 12 of the Anti-Unfair Competition Law, revised in 2025 and effective October 15 of the same year, is the core basis. This revision contains two key changes: first, it removes the limitation that the actor must have a direct competitive relationship with the attacked party, enabling brand owners to assert commercial defamation directly against self-media and review institutions; second, it expressly lists the instigation of others to fabricate and disseminate false information as an act of unfair competition, enabling a direct strike against the masterminds behind the scenes. At the same time, what Article 12 of the Anti-Unfair Competition Law prohibits includes not only false information but also misleading information, and the conduct enumerated in Article 6 of the Standards—such as “comparison under different standards” and “taking testing reports out of context”—provides precisely a ready frame of reference for determining “misleading information.” These provisions can be expected to be invoked frequently in future enforcement and judicial practice.

At the criminal level, restraint and precision must still be maintained. The crime of damaging commercial reputation or product reputation under Article 221 of the Criminal Law takes “fabricating and spreading false facts” as a constitutive element, and whether cases in which the data itself is truthful and only the narrative is misleading can constitute a crime is subject to considerable controversy. In a certain medicinal liquor incident in 2018, a local public security organ took compulsory measures across provinces against a doctor who had published a critical article, only for the matter to end with the facts being unclear and the evidence insufficient. The lesson for enterprises is this: once criminal measures are used to suppress legitimate criticism, it is the enterprise’s own credibility that suffers. On the other hand, if a reviewing party demands money or property from an enterprise before or after publishing negative content, the case becomes one of extortion; and if the reviewing party makes a business of this for profit, it may be suspected of illegal business operations. In such cases a criminal report is fully justified.

IV. The Way Forward for Enterprises

Drawing on practical experience, the authors recommend that brand enterprises, when encountering suspected malicious review attacks, grasp the following key points:

First, secure the evidence. At the earliest opportunity, notarise the review content, the dissemination chain, and the interaction data, or preserve them through trusted timestamps or blockchain-based evidence preservation; retrieve all testing reports held by your own side and compare them with the reports cited by the reviewing party, identifying asymmetries in standard selection and data presentation. The completeness of the evidence directly determines the success or failure of all subsequent legal actions.

Second, give equal weight to technical rebuttal and legal action. Commission professional technical opinions on the application of testing standards, method sensitivity, and the meaning of limit values, dismantling the erroneous narrative of “detection equals harm” at its source rather than descending into emotional confrontation. At the same time, the declaration page of each report cited by the reviewing party should be examined item by item: whether the use of the report has obtained the written consent of the testing institution, whether it bears the accreditation (CMA) mark, and whether it states restrictions such as “for the internal use of the commissioning party only.” Where necessary, contact the testing institution that issued the report to verify it, and urge the institution to state its position, under the report’s terms of use, on the report being cited in breach of those terms—this is often the most direct way to dismantle the other party’s “authoritative endorsement.” In addition, one may commission a qualified institution to conduct comparative testing of the similar products involved in the review under the same standard and the same method, to test whether the original comparative conclusions can be reproduced; where the results contradict the picture presented in the review, this in itself is the most powerful rebuttal evidence. In particular, where the report the other party relies on for its core conclusion is the one lacking certification effect, while the report reaching the opposite conclusion bears the CMA mark, this contrast in validity should become the central thread of the response.

Third, make good use of the dual track of platforms and regulators. Article 10 of the Standards clarifies the platform’s obligation to handle complaints, and Article 11 establishes a mechanism for referring leads and sharing information between the cyberspace administration and market regulation authorities. Platform complaints and administrative reports should be pursued in parallel, citing specific provisions of the Standards to improve the efficiency and precision of handling.

Fourth, assess all three tracks and exercise restraint on the criminal one. Evaluate civil litigation, administrative reporting, and criminal reporting separately: for commercial defamation, the civil and administrative paths are more prudent and controllable in most situations; the criminal path should be reserved for cases involving extortion of money or property, paid deletion of articles, or the fabrication and dissemination of false facts causing major damage to an enterprise’s commercial reputation.

Fifth, beware the trap of paying to make trouble go away. In practice, intermediaries often suggest that enterprises pay for “cooperation” in exchange for deletion or revision of articles. This path may not only trap an enterprise in a vicious cycle of repeated extortion, but payments to the parties concerned may also give rise to compliance risks such as commercial bribery, and should be firmly avoided.

Sixth, build routine compliance capacity. Manage product testing archives systematically and maintain a regular public-opinion monitoring mechanism, so that when a crisis arrives you have the reports in hand and the standards in mind, and can respond within the critical window before online opinion ferments.

V. Limitations and Outlook

It should be objectively recognised that, as a normative document, the Standards sit low in the hierarchy of norms and do not themselves prescribe penalties; the punishment of violations must still rest on higher-level laws such as the Anti-Unfair Competition Law and the Criminal Law. The rules themselves still leave gaps: for example, Article 8 requires reviewing entities to verify the accreditation of testing institutions and the authenticity of testing reports, yet it does not expressly provide that the reports cited in a review must have social certification effect. As to whether data that is “truthful as a report but, according to its declaration, lacking social certification effect and for the internal use of the commissioning party only” may be used in public reviews, at present one can only resort to interpretive gap-filling through the “out-of-context” clause of Article 6 and the principle of “objectivity, fairness, comprehensiveness, and accuracy” in Article 2, awaiting clarification through subsequent law-enforcement practice or rule revision. In addition, the determination of “misleadingness” in individual cases still depends heavily on evidence and professional argumentation; and the timeliness of handling cross-platform, matrix-style dissemination is not resolved merely by the issuance of the Standards. All of this awaits clarification through future enforcement cases and judicial decisions.

In any event, the issuance of the Standards marks the regulators’ formal response to the problem of “review degeneration.” For the review industry, it is a watershed between unregulated growth and standardised operation; for brand enterprises, it is a new tool in the rights-protection toolkit that is worth putting to good use. The value of reviews lies in truthfulness and comprehensiveness, and truthfulness has never been merely “every data point is correct.” One-sided truth may be the most sophisticated form of misdirection.

(This article represents only the personal views of the authors and does not constitute legal advice on any specific matter. The circumstances of cases referred to herein have all been anonymised and generalised.)

Special Statement:

Beijing Dacheng Law Offices, LLP (Shanghai) strictly observes its obligation to protect client information. The client project content referred to in this article is drawn entirely from publicly available information or has been obtained with client consent. The content and views of the full text are for reference only, do not represent any position of Beijing Dacheng Law Offices, LLP (Shanghai), and shall not be construed as the issuance of legal opinions or advice in any form. To reprint or cite any content of this article, please communicate authorisation matters via private message, and indicate the source at the beginning of the article upon reprinting. Without authorisation, no content of such articles may be reprinted or used.