This question arrives at our intake in two forms. Founders ask "is this allowed?" Counsel asks the better question: "what is our exposure if we do it badly?" This article answers the second, because the first is easy: paying a professional to research, draft, and propose a Wikipedia article is legal in every major jurisdiction. The law, the platform, and the plaintiffs' bar all converge on a single variable — whether the payment was hidden.
Read this as a memo, not a sales page. We sell Wikipedia page creation and have an obvious interest in the conclusion — which is why every load-bearing claim below carries a source and a date.
Key takeaways
- Paying for Wikipedia help is legal everywhere. Undisclosed paying creates exposure on three layers at once.
- Layer 1 (platform): the Wikimedia Terms of Use make paid-contribution disclosure binding. Enforcement: account blocks, mass deletions, public investigations that name brands.
- Layer 2 (regulator): the FTC's Consumer Reviews and Testimonials Rule (effective October 21, 2024) carries civil penalties up to $53,088 per violation as of 2025; the first warning letters went to 10 companies in December 2025. State AGs and EU/UK regimes reach the same conduct.
- Layer 3 (litigation and PR): invoices to undisclosed editors are discoverable documents. Portland Communications is the current cautionary tale.
- The fix is mechanical: on-wiki disclosure, named accounts, three contract clauses in the vendor agreement.
The short answer: paying is legal; hiding it is where every risk lives
There is no law against commissioning a Wikipedia article, and no enforcement action we are aware of — by the FTC, a state attorney general, or an EU consumer authority — against a company for openly paying a disclosed editor who worked through Wikipedia's public channels. The entire documented risk record sits on one side of one line: payment concealed from the platform and the public.
The line is worth stating precisely, because vendors blur it in both directions — some imply the whole category is forbidden, others sell "discreet" work as if secrecy were the service. The record says otherwise. Concealment is simultaneously a breach of a contract you accepted, a fact pattern regulators treat as deceptive practice, and a document trail that reads badly in front of a judge, a journalist, or your own board.
The Three-Layer Exposure Model
We assess every engagement against the Three-Layer Exposure Model. Undisclosed paid editing is not one risk; it is three independent risks, each with its own enforcer and trigger — and a single discovery event can fire all three.
| Layer | Enforcer | Instrument | Trigger |
|---|---|---|---|
| 1. Platform | Wikipedia community + Wikimedia Foundation | Terms of Use (contract) | On-wiki forensics: sockpuppet investigations, pattern analysis |
| 2. Regulator | FTC, state AGs, EU authorities, UK CMA | Deceptive-practice statutes and rules | Complaints, sweeps, press coverage |
| 3. Litigation / PR | Opposing counsel, journalists | Discovery, leaks, investigative reporting | Any lawsuit or investigation that reaches your marketing spend |
The model's practical use: a vendor pitch that addresses only Layer 1 ("we know how to avoid detection") proposes to convert a platform problem into a regulator and litigation problem. Detection-avoidance is not risk management; it is risk relocation onto the two layers with subpoena power.
Layer 1: the Wikimedia Terms of Use — a contract, not a suggestion
Since a June 2014 amendment, the Wikimedia Terms of Use have required every compensated contributor to disclose "employer, client, and affiliation with respect to any contribution for which [they] receive, or expect to receive, compensation." This is not community etiquette. It is a condition of the contract every editor accepts by using the site, and undisclosed paid editing breaches it regardless of whether the edits were accurate or neutral.
Enforcement is the part buyers underestimate. It does not look like a quiet account closure:
- Blocks at scale. The Wiki-PR investigation banned more than 250 sockpuppet accounts in 2013, followed by a Foundation cease-and-desist, as documented in Wikipedia's own article on conflict-of-interest editing.
- Mass deletions. The 2015 Orangemoody investigation blocked 381 accounts and deleted roughly 210 articles — including pages of clients who had no idea their vendor operated covertly.
- Public case files that name names. Sockpuppet investigations are published, permanent, indexable pages. For many companies this artifact — a search result tying the brand to a manipulation case — costs more than any fine on Layer 2.
The deeper history of how these rules formed is its own article: a short history of paid Wikipedia editing. The operational summary: the platform layer has a written rule, a forensics capability, and a publication habit.
Layer 2, United States: the FTC and the state AGs
US law does not name Wikipedia. It names deception. Two federal instruments and one state precedent define the exposure.
Section 5 and the Endorsement Guides. The FTC Act's prohibition on deceptive acts has long been applied, through the Endorsement Guides, to paid promotion presented as independent opinion: material connections must be disclosed. An encyclopedia article a company secretly paid for, presented as the work of neutral volunteers, fits the template the Guides were built on — paid content wearing independent clothing.
The Consumer Reviews and Testimonials Rule. Effective October 21, 2024, the Rule (16 CFR Part 465) attached civil penalties to fake-review conduct — up to $53,088 per violation as of the 2025 inflation adjustment, indexed annually (Alston & Bird analysis). The Rule targets consumer reviews and testimonials rather than encyclopedia entries by name; counsel should not read that as a safe harbor. It marks enforcement priority for the broader category — paid content misrepresented as independent — and the agency moved quickly: in December 2025 the FTC sent its first warning-letter wave under the Rule to 10 companies.
State attorneys general. The controlling precedent for "we hired a firm, the firm faked it" is New York's Operation Clean Turf (2013): a year-long sting ending in agreements with 19 companies and penalties exceeding $350,000 for writing fake online reviews. Two details matter. The legal theory was general deceptive-practices law — the same theory reaches undisclosed Wikipedia editing. And the respondents included businesses that commissioned the work, not only the shops that performed it.
Layer 2, EU and UK: undisclosed advertising regimes
European law reaches undisclosed Wikipedia editing more directly than US law does.
EU. The Unfair Commercial Practices Directive's Annex I — the blacklist of practices banned in all circumstances — includes using editorial content to promote a product where the trader paid for the promotion without making that clear. A paid encyclopedia article with no disclosure maps onto that wording with little interpretive effort. The 2019 Omnibus Directive added fake-review prohibitions and hardened penalties: for widespread infringements, member states must provide fines of at least 4% of the trader's annual turnover in the affected states, or at least €2 million where turnover is unavailable (as of June 2026). Enforcement runs through national consumer-protection authorities.
UK. The Digital Markets, Competition and Consumers Act 2024 sharpened the old regime: from April 2025 the CMA can determine breaches itself — no court needed — and fine up to 10% of global turnover (as of June 2026). The banned-practices list explicitly covers commissioning fake reviews, and the prohibition on misleading omissions covers paid promotion presented as independent content. The advertising codes add a parallel rule: marketing must be obviously identifiable as marketing.
The pattern across both regimes: the law does not care that Wikipedia is an encyclopedia rather than a review site. It cares that money changed hands and the audience was not told.
Layer 3: discoverability — the Portland Communications lesson
The third layer is the one no vendor mentions: everything about an undisclosed engagement is a document. The contract, the invoices, the "please don't mention us on-wiki" email — all discoverable in litigation, and leakable always.
The current cautionary tale is Portland Communications. In April 2025, the firm and its parent Omnicom were sued by migrant workers from the 2022 FIFA World Cup over alleged sportswashing. In January 2026, the Bureau of Investigative Journalism reported that Portland had edited Wikipedia for clients since at least 2016 through subcontractors — including edits downplaying human-rights criticism connected to that same World Cup. Both facts are now compiled, with citations, in Wikipedia's permanent article on conflict-of-interest editing. Portland says the editing was not endorsed by the firm and current staff do not engage in it — which illustrates the point rather than blunting it: once the work surfaces, the dispute over who authorized it plays out in public, attached to the client matters it touched, while litigation is pending.
For counsel the takeaway is structural. An undisclosed engagement is a liability with no expiration date: the edits are timestamped forever, the paper trail sits in two companies' files, and the trigger — a lawsuit, an acquisition's due diligence, a journalist with a tip — is outside your control.
The jurisdiction map
| Regime | What is prohibited | Penalty ceiling | Enforcement example |
|---|---|---|---|
| Wikimedia Terms of Use (contract) | Compensated contributions without disclosing employer, client, affiliation | Account blocks, mass deletions, public investigation pages | Wiki-PR: 250+ accounts banned (2013); Orangemoody: 381 accounts, ~210 articles deleted (2015) |
| US federal — FTC Act §5, Endorsement Guides, Reviews Rule (16 CFR 465) | Deceptive practices; undisclosed material connections; fake reviews | $53,088 per violation under the Rule (as of 2025, indexed annually) | First warning-letter wave: 10 companies, December 2025 |
| US states — deceptive-practices statutes (e.g., NY GBL §§349–350) | Astroturfing; paid content presented as independent | Varies; negotiated penalties | Operation Clean Turf: 19 companies, $350,000+ (2013) |
| EU — UCPD Annex I + Omnibus Directive | Paid editorial promotion without disclosure; fake reviews | At least 4% of annual turnover or €2M, widespread infringements (as of June 2026) | National authorities; coordinated EU sweeps |
| UK — DMCC Act 2024 | Misleading omissions; commissioning fake reviews; unidentifiable marketing | Up to 10% of global turnover, CMA direct fining (from April 2025) | Regime in force April 2025; CMA guidance published |
The compliant way to pay
The compliant structure is documented, public, and — the part that surprises buyers — not commercially painful. Three mechanical components on the platform side:
- User-page disclosure. The editor's Wikipedia user page names the employer (the agency), the client (you), and the affected articles. Permanent and public.
- Talk-page declaration. The article's talk page carries a connected-contributor notice naming the paid relationship.
- Channeled edits. New articles go through Articles for Creation review; changes go through talk-page edit requests that an independent editor accepts or rejects. The paid party proposes; the community disposes.
The full mechanics — templates included, plus the five failure patterns that get pages deleted — are in our guide to Wikipedia's COI policy.
The same structure resolves the regulator layer, because every regime above prohibits concealed paid promotion. Disclosure through public channels removes the misrepresentation element: the payment is stated on the page itself, in its history, and on the editor's profile. One residual duty stays on your side — your own marketing must not present the article as spontaneous third-party recognition, and quoting it in ads still follows ordinary endorsement rules.
A page produced this way also tends to survive, because independent editors reviewed it before it went live. Our published terms — a 93% success rate to date, an 80% refund after three defense attempts, 90-day monitoring — are possible because of disclosure, not despite it; the conditions are on the guarantees page.
Contractual hygiene: three clauses your vendor agreement needs
If you take one section to your template library, take this one. The Portland pattern — work routed through subcontractors the client never saw — is a contracting failure before it is anything else. Three clauses close it:
- Warranty of disclosure. The vendor warrants that every contribution under the agreement complies with the Wikimedia Terms of Use paid-contribution provisions — user-page, talk-page, and edit-summary disclosure — and that no work runs through undisclosed channels. Breach is material.
- Named accounts. The vendor identifies in writing, before work begins, every account that will touch your matters — subcontractors' included — and updates the list before any new account is used. Unlisted accounts are unauthorized work.
- Indemnity for undisclosed editing. The vendor indemnifies you for losses arising from any failure of clauses 1–2: regulatory penalties, remediation costs, reasonable fees. A vendor doing disclosed work carries near-zero exposure under this clause and should not resist it. Resistance is diagnostic.
Our own client terms implement the same logic in both directions; the current text is public at offer agreement.
Download: PDFthe vendor scorecard (PDF) — seven publicly-checkable signals for screening any Wikipedia vendor, with the red-flag checklist on page two.
FAQ for counsel
Can we be fined for what an agency did without telling us? The risk is real and rises with constructive knowledge. Operation Clean Turf's respondents included businesses that commissioned the fake reviews, not only the firms that wrote them. "We didn't ask how the sausage was made" weakens with every invoice line that says "Wikipedia." The mitigation is a paper trail running the other way: a vendor agreement with the three clauses above documents that you contracted for compliant work.
The article about us is wrong. Is that defamation, and can we pay someone to fix it quietly? Separate the two questions. Accuracy disputes have a fast, free, on-wiki remedial path — a sourced talk-page request, escalating to the relevant noticeboards — and it works precisely where you can show a source. Defamation litigation is slow against pseudonymous authors and largely foreclosed against the Wikimedia Foundation in the US under platform-immunity doctrine. And "fix it quietly" converts a content dispute you might win into a conduct violation you will own — the worst available trade.
We bought a page years ago and suspect it was undisclosed. Now what? Remediate before discovery does it for you: establish which accounts performed the work, then bring the situation compliant through a disclosed engagement — retroactive talk-page disclosure, content re-reviewed against sources. Expect scrutiny; it is still cheaper, on every layer, than opposing counsel finding it first.
Where this leaves you
The legal question has a clean answer. Paying is lawful; concealment is the conduct that breaches the platform contract, triggers deceptive-practice regimes on two continents, and seeds a discoverable file. Every documented casualty in this market bought secrecy, not Wikipedia work.
Scope this the way you would scope any regulated vendor engagement: bring your counsel, ask for named accounts, put the three clauses in the agreement. Contact us for a compliance-first scoping call — we will walk your counsel through the disclosure mechanics, our account names, and the contract terms before anyone discusses content.
This is general information, not legal advice. Penalty figures and regime descriptions are stated as of June 2026; verify current figures with counsel in your jurisdiction.