Rules and ethics
Part of Before publishing UK commerce reviews, check consent, editing and disclosure
Commerce reviews advertising rules without the guesswork
A checklist on commerce reviews advertising rules in England, covering ASA and CAP code duties, ICO cookie consent for review widgets and CMA fake review powers.
What to take away
- A shopper in England sees a five-star badge and an influencer post making the same claim. Two sets of rules apply, run by two different bodies.
- The Advertising Standards Authority administers the CAP Code for non-broadcast ads; the ICO governs cookies and storage used by review widgets.
- The CMA has direct powers to tackle fake and misleading reviews under the Digital Markets, Competition and Consumers Act 2024, in force from 6 April 2025.
- Keep a written sign-off trailwho checked the claim, when, and against which rule. This is general guidance, and individual cases need a qualified adviser.
The advertising code that covers review claims
The CAP Code applies to marketing communications in England, including paid social posts, search ads and landing pages that quote or imply customer reviews.
Review claim checks
- Claims honest, not misleading, substantiated
- Headline rating backed by data
- Date of data collection recorded
- Testimonials genuine and permission logged
- Endorsements disclose commercial relationship
- Rating period stated clearly
Claims must be honest, not misleading and capable of substantiation. If a headline says "rated 4.9 by customers", you need the underlying data and the date it was collected.
About regulation - ASA | CAP sets out how the ASA and CAP system works for UK advertising, which is the starting point for review claims.
The CAP Code rules are 3.1, 3.7 and 3.45 to 3.48, covering misleading claims, substantiation and testimonials. The ASA has ruled, for example, that a 2017 Purplebricks "rated 4.7 out of 5" claim was misleading because the rating came from a self-selecting sample.
Testimonials and endorsements
Testimonials must be genuine and used with permission. Endorsements need clear disclosure of any commercial relationship, including gifted products and affiliate links.
Average ratings and dates
State the period a rating covers. A rating from 2023 shown in 2026 without a date can mislead, even if every individual review is real.
Cookies, storage and review widgets
Review widgets often set cookies or read device storage to load reviews or track a click. That falls under the privacy rules on storage and access technologies.
Cookie consent for widgets
- Identify cookies and storage set by widget
- Check if consent is legally needed
- Collect consent before non-essential storage
- Avoid pre-ticked boxes and accept-only banners
- Record what each widget stores and how long
Guidance on the use of storage and access technologies explains when consent is needed for cookies and similar technologies, which applies to review widgets too.
Consent must be freely given, specific and informed. A pre-ticked box is not consent. Record what each widget stores and for how long.
Storage strictly necessary to provide a service requested by the user does not need consent.
Fake and misleading reviews
The Digital Markets, Competition and Consumers Act 2024 gives the CMA direct enforcement powers against fake reviews and other unfair commercial practices, from 6 April 2025. The earlier Reforming competition and consumer policy - GOV.UK consultation is background only.
If you buy review services, ask how the supplier sources reviewers and whether incentives are disclosed. Undisclosed incentives are a common source of complaints.
Penalties and complaint routes
The CMA can fine up to 10% of global turnover or £300,000, whichever is higher, under the DMCC Act 2024. The ASA publishes upheld rulings. The ICO can fine up to £17.5 million or 4% of global turnover under UK GDPR, and up to £500,000 under PECR for cookie breaches.
A working checklist for England
Use this before any campaign goes live, and keep the evidence.
- Every rating claim has a date and a source dataset.
- Review text used in ads is verifiable and permission is logged.
- Review widgets have a documented cookie and storage purpose.
- A named person signs off the claim and the date.
- Supplier contracts require compliance with review and advertising rules.
If you are still building the basics, Commerce reviews UK regulations in England explains the wider legal backdrop before you write ad copy.
Common questions
Do the same rules apply across the UK?
Most advertising and consumer rules apply UK-wide, but some privacy guidance is set out separately for England, Scotland, Wales and Northern Ireland.
Are review widgets covered by cookie rules?
Yes, if they store or access information on a user's device. The ICO guidance covers cookies and similar tools used by review widgets.
Can I use customer reviews in paid ads?
Yes, if the reviews are genuine, the claim is substantiated and any commercial relationship is disclosed. Keep the date it was collected.
What happens if a review is fake?
The CMA can act under the DMCC Act 2024, and the ASA can act on misleading ads. The usual remedy is a takedown and a review process change.
For the full compliance picture, including updates planned for 2027, start with Commerce reviews: UK rules and compliance guide for 2027.
