Foundations
Commerce reviews: five launch artefacts for ecommerce teams
A commerce reviews launch checklist for ecommerce teams, covering data roles, advertising evidence, review ingestion and the five artefacts to prepare.
What to take away
- Classify your data role first. The ICO's controllers and processors guidance decides whether you act as controller, processor or both, and that choice drives every contract you sign.
- Reviews reused in ads become claims under the CAP Code. The ASA's business advice states the evidence rule you have to meet.
- Treat ingestion and software as separate budget lines. The around £400-a-month software figure is illustrative, not a quoted supplier price; budget API ingestion separately by request and SKU.
- Produce five artefacts before launcha data role memo, a processor contract, a moderation policy, an ingestion test log and a claim evidence file.
Data roles decide the paperwork
Market entry starts with classification. The ICO's controllers and processors guidance explains that a processor acts on a controller's documented instructions.
Where you set the purpose of review collection, you are the controller. Where you hold reviewer emails and IP addresses only on a retailer's behalf, you are the processor.
Joint controllership is the middle case. If the retailer sets the purpose and your platform sets the means, both parties are controllers and the split belongs in writing.
Controller or processor?
Does your platform set the purpose of review collection?
You are a controller
You are a processor
Reviewer names, order numbers and uploaded photos count as personal data. Record what you collect, why you hold it and how long it stays. A processor contract is not optional when you host client UGC, and the clauses to check list covers liability, term and deletion.
Reviews in advertising
Once a review quote appears in an ad, it is an advertising claim. The ASA's advice for businesses sets out the evidence a marketer must hold for it.
Incentivised reviews carry the highest risk. Paying for a review and republishing it as independent praise is likely to mislead, even when the text is genuine.
Moderation policy matters here too. Publishing only the flattering reviews can mislead in the same way as inventing them.
The Digital Markets, Competition and Consumers Act 2024 gives the CMA direct enforcement powers over fake and misleading reviews. Treat that as a second regulator reading the same page.
Ingesting third-party reviews
The Google Places API is the usual route for third-party review data. Its Places API reference documents the endpoints and returned fields, and Google bills per request across its Essentials, Pro and Enterprise SKUs.
Illustrative only: 300 detail calls a day is roughly 9,000 calls a month. Check that against Google's current monthly free allowance per SKU before you price a commercial tier.
Publish only where the feed's terms allow, whether that is a Shopify theme block or a custom product page module. The duty to comply sits with the publisher, not the supplier that sold you the feed.
Ingesting third-party reviews
- Choose Google Places API endpoint
- Pilot review volume per location
- Price commercial tier on real volume
- Check display requirements before republishing
- Confirm publisher duty to comply
Assessing demand and market estimates
Size demand before you sign supplier contracts. Official series such as the ONS business e-commerce and ICT activity data use different definitions from a supplier's projection of its own market.
That gap matters at board level. The breakdown in commerce reviews market size in England: data and sources separates official statistics from estimates, which is where most business cases fall apart.
Review volume follows order volume more than marketing spend. Illustrative case: a retailer doing 20,000 orders a month might expect several hundred reviews, depending on prompt timing.
Entry routes and where liability sits
Data protection work
- In-house review widget
- Full controller duties
- Third-party platform
- Processor contract needed
- Marketplace listing
- Joint controllership risk
- Agency-managed UGC
- Controller and processor
Advertising exposure
- In-house review widget
- Direct CAP Code duty
- Third-party platform
- Shared with the platform
- Marketplace listing
- Marketplace terms apply
- Agency-managed UGC
- Agency and brand liable
Review supply
- In-house review widget
- Manual collection
- Third-party platform
- Platform API or feed
- Marketplace listing
- Marketplace reviews
- Agency-managed UGC
- Agency tooling
Use the table as a scoping tool, not a legal opinion. Each route changes which party answers a customer complaint.
A quick test: name the person who answers a complaint on each route. If nobody is named, the paperwork is not finished.
Minimum viable checklist
- Data role memo naming controller, processor or joint controllership.
- Signed processor contract with deletion, audit and term clauses.
- Moderation policy covering incentives, negative reviews and response times.
- Ingestion test log recording request volume and per-call cost.
- Advertising evidence file holding the proof behind every published claim.
For the definitions and scope these steps assume, read the England market guide for 2027, which maps rules, data and costs onto a launch calendar.
Common questions
Does UK GDPR apply if we trade only in England?
Yes. UK GDPR covers the whole United Kingdom, so an England-based team carries the same controller and processor duties as one in Wales or Scotland.
How much does review ingestion cost at scale?
A dependable total needs your call volume and the current rate for the relevant SKU. The around £400-a-month figure above is an illustration for review software, not an API ingestion price; no API rate is stated here.
Can we collect Google reviews without the API?
Scraping is not the supported route. The Places API reference documents the approved endpoints, and access sits behind Google's quotas and billing terms.
Do we need a written contract with a review platform?
Yes, where you process personal data for a retailer. The ICO guidance expects a written agreement that fixes the processor's instructions and limits.
