It is a common problem businesses face:  You are going about your day, providing great customer service, when you notice a bad review pops up on Yelp (or Google+, or Amazon, or any of the infinite places people post things online).

 — (Note that I am discussing general rules, and this article is not to be construed as legal advice; for that, you need to retain a lawyer) —

For reasons I will explain below (and to avoid having to pay lawyers), often the best thing is to try to get the person who posted the review to change or remove it, or to convince the web site to voluntarily remove the post.  If you can’t convince either one, then you will want to look at your legal options.
What if what they are saying is true?
When somebody posts a bad review or something else critical of you, your first hurdle is the First Amendment.  Defamation law (slander for spoken words, libel for written words) can be complex, but there is at least one hard and fast rule in the United States:  Truth is an absolute defense.  No matter how embarrassing you may find a review saying that there was a roach in the sandwich you served a customer, if there was in fact a roach, you have no case.  There are some narrow exceptions, so if you have questions, and particularly if you have some agreement with the other party that limits what they can say (such as a non-disparagement clause or a non-disclosure clause), you should definitely see a lawyer.
The rules relating to defamation do vary in other countries, so it may be possible to sue over truthful statements in those courts.  However, note that there is a U.S. law, the SPEECH Act, that prohibits enforcing foreign defamation judgments in the U.S. unless the foreign courts provided the same free speech protections as a U.S. court would have provided.  So while there is a route to sue over damaging but truthful speech, it is a very narrow, expensive, and likely fruitless route (definitely financially fruitless if the person doing the defamation lives, with all of their assets, in the United States).
What if they are lying?
In California, libel and slander require a false, defamatory publication that is unprivileged and has a natural tendency to injure or that causes special damage.  There are some complexities, but if the posting seems likely to meet those requirements, it is a good idea to retain a lawyer and learn your options.
There are two problems that permeate a lot of online defamation issues.  First, a lot of online defamation is done anonymously, so it is not easy to track down who posted it.  A lot of internet service providers keep access logs, and a lawyer can file suit against a “John Doe” and subpoena those records — but in this case, delay is not your friend.  Access logs can get very big, and it is a common practice for service providers to delete those logs after they reach a certain age.
The second problem is less specific to online posting, but does seem to occur more often in that context:  Even if you find out who posted it and you are able to get a court judgment against them, you may not be able to collect.  In addition to local defendants who just do not have the assets to pay a judgment, online defamation often involves international disputes.  For example, if a person in Turkey posts a defamatory statement about your eBay business online, you may be able to get a huge judgment against them, but good luck collecting.
A good lawyer can help you figure out if it makes financial sense to pursue claims.  A tech-savvy lawyer can help you identify the party who posted the defamatory review and do an asset search on that party.  Based on those results, your lawyer can help you decide whether it makes sense to pay the fees involved in suing the posting party.
Why don’t I just sue Yelp (or another service provider)?  A Tale of Two Defamers:
In 1996, Congress passed the Communications Decency Act.  While portions of that act were held unconstitutional, section 230 survived.  Section 230(c)(1) provides as follows:  “No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.”  Because of the Supremacy Clause to the Constitution, Section 230 preempts state laws, including those on defamation.  While there have been numerous Section 230 cases, many lawyers still seem to be unaware of the broad immunity this federal law provides.  For both plaintiffs and defendants, ignoring Section 230 is a terrible mistake.
Section 230 was intended to promote the growth of the internet and internet companies.  Without it, for example, Facebook would have to police every one of the billions of posts users have made.  The result of Section 230 is that republication of the very same defamatory statement is actionable in one context, but not actionable in another.  Consider, for example, the following review:
John Doe:  “I recently visited Jim’s House of Pancakes, Waffles and Bananas.  I couldn’t believe it when Jim himself walked out to serve my food.  He has syphilis, and had his hands all over my food!  Then, when I bit into my pancake, I chipped my tooth on a rock.  Then, when I paid with a credit card, he fraudulently charged my card an extra $100.  Avoid this store!”
Assuming that Jim is healthy and didn’t manhandle the food, no rock was ever in the pancake, and there was no credit card fraud, this meets the definition of slander just about everywhere.  Indeed, the statement itself is slander per se, and under any circumstance the person who posted the review can be sued.  But what if that person cannot be found, is overseas and beyond the reach of United States courts, or has no money to pay a judgment?  The obvious answer would seem to be to go after the publisher of the review — but for that, the critical question is where the review was published.
Imagine that John Doe submitted the review to a printed-on-paper newspaper and to Yelp, and the review was published in both places.  Section 230 does not apply to the newspaper, and under the right circumstances, the newspaper can be held liable for the falsehoods in John Doe’s review.
Yelp, however, as an “interactive computer service”, enjoys the protection of Section 230.  Applying the language of that statute is pretty easy:  “No provider or user of an interactive computer service [i.e. Yelp, which provides an interactive computer service] shall be treated as the publisher [even though it published the statement just like a newspaper did, it cannot be legally treated as the publisher] or speaker of any information [i.e. the information in the review] provided by another information content provider [in this case, John Doe would be the information content provider].”
So there it is.  The same review published by different information providers, even reaching the same audience, yields vastly different results.
Note that Section 230 is not a blank check for information providers.  If they created the review themselves, for example, they have no immunity.  Federal criminal law is not preempted, copyright law is exempt (although the DMCA does provide an exemption if they quality), and there are other exceptions.  So service providers still have to worry about certain aspects of what their customers post, but truth is generally not one of those aspects.  That said, Section 230 is a United States law, and does not apply in other nations, so service providers still need to be aware of the extraterritorial risks of not retracting false reviews.
So what do I do?  Those reviews are really hurting my business.
 
In probably the worst legal marketing strategy ever, my standard approach is to talk potential clients through how to approach service providers and get them to voluntarily remove false reviews.  Just like people would not go to a lawyer or doctor who has been repeatedly sued for malpractice, consumers will stop relying on sites that are filled with fake and false reviews or information.  So in most cases, the service provider’s interests are the same as the victim’s:  Keeping false information off of their site improves both the provider’s business and the victim’s business.  In a case where the client has a good shot at resolving the matter without incurring legal fees and without prejudicing their position, a good lawyer will provide the client with that information.
There are some sites that refuse to take down any bad information, even if they know it is false.  If the victim has no luck convincing the provider to take down bad information, or is dealing with a provider that has a policy against taking down any information, true or false, there are strategies that can be employed.  But at that point, it becomes difficult to make progress without a tech-savvy lawyer.  For example, because the person who posted the information is not immunized by Section 230, it is possible to sue the posting party as an anonymous defendant and then use a subpoena to get logs and other user information from the service provider that can be used to identify the posting party.  Once we have the actual identity of the posting party, it is possible to sue them and get them to take the review down themselves.
Even in cases where the posting party cannot be identified by name or is identified but lives in another country, there are strategies that can be employed to attempt to get the review taken down.  Section 230 is broad, but with a good lawyer all hope is not (always) lost — although the options and strategies depend strongly on the facts of the individual case.
The bottom line is that if you talk with a lawyer about online defamation and they aren’t immediately familiar with Section 230, you probably want to reconsider your choice of lawyer.