Outlook
What the changing commerce reviews outlook means for retail teams
How data law, platform rules and regulator action are reshaping commerce reviews in England, plus a decision table for owned, licensed and earned supply.
What to take away
- Consumer law changed first. The Digital Markets, Competition and Consumers Act 2024 regime has been live since 6 April 2025. The CMA can now decide that fake or misleading reviews break the law, with fines up to 10% of global turnover.
- Data law changed across the UK. The Data (Use and Access) Act 2025 covers reviewer names, photos and order links.
- Platform rules move fastestGoogle Business Profile bans fake engagement, and AI summaries on Google, Amazon and Trustpilot make source quality the limiting factor.
- Keep the paper trail in the contractwithdrawal window, export rights and audit trail.
- Diary dated checkpoints, starting with 6 April 2027, rather than waiting for a news cycle.
What changed in review rules in 2025 and 2026
Three layers now bite on the same review text.
What changed in review rules
| Layer | Change | Effect on your review page |
|---|---|---|
| Consumer law | DMCC Act 2024 consumer regime live from 6 April 2025 | The CMA decides breaches itself and can fine up to 10% of worldwide turnover |
| Data law | Data (Use and Access) Act 2025, UK-wide | Name, photo and order link are personal data with purpose and retention duties |
| Platform rules | Google Business Profile prohibited content covers fake engagement | Gating and incentivised reviews risk removal or account action |
| Advertising | CAP Code rule 2.1 requires ads to be identifiable | A review quote in paid creative is ad content |
Enforcement has teeth. The CMA acted on fake reviews before, taking undertakings in 2016 from Total SEO & Marketing Ltd, a firm that wrote them for clients. It can now act without going to court.
On the data side, the ICO's decision notices show the reasoning pattern: what was collected, what the person was told, how long it was kept. Its £12.7m penalty on TikTok in April 2023 turned on consent, the same question review capture raises.
The three supply routes and the clause each one needs
The three supply routes
Scaling speed
- Owned
- Slow, defensible
- Licensed
- Fast, contract-dependent
- Earned
- High reach, low control
Clause to check before signing
- Owned
- Purpose wording per field, retention schedule
- Licensed
- Withdrawal window, export rights, audit trail
- Earned
- Disclosure duties, removal on request
Which review supply route to choose
High-consideration, long cycle?
Owned collection with post-purchase prompts
Check volume, risk and team size
Whichever route carries the volume, the contract decides what you can prove later. The clause list in commerce reviews commercial contracts covers withdrawal window, export rights and audit trail wording.
Example: a 12-month review data plan
Illustrative example, not a benchmark: a shop with 500 orders a month and a 3% review rate collects about 15 new reviews a month, or 180 a year.
- Write one consent line per purpose: display, syndication, paid creative.
- Set retention at 24 months for published reviews and 12 months for reviewer email.
- Test withdrawal end to end and time it. Aim to clear the site and any syndicated feed within 30 days.
- Record 6 April 2027 as the annual rules check, plus a quarterly platform policy read.
- Reopen each supplier contract 90 days before renewal.
What AI summaries and triage actually do
Google Maps and Search publish AI review summaries. Amazon labels AI-written review highlights. Trustpilot summarises reviews with AI. Each summary inherits the contradictions in its source set, so cleaning the set beats adding volume.
Automated triage flags profanity, personal data and competitor mentions before a human reads them. It cannot judge whether a claim is substantiated, so keep a person on that decision.
Generated reviews are banned. Amazon's community guidelines require reviews to reflect a genuine experience, and Amazon has said AI-written reviews breach them. Google's Business Profile prohibited content covers fake engagement. The commerce reviews AI applications in England guide shows where moderation hours move once triage is switched on.
Consent wording, retention and withdrawal
Sample consent wording for a post-purchase email:
We will publish your review, your first name and any photos on this product page and in our emails for 24 months. You can withdraw at any time by replying to this email.
Then check four things:
- One written purpose per field: name, photo, order link.
- A retention period24 months for published display data, 12 months for reviewer email.
- A withdrawal window in days, not "promptly"30 days for the site and any syndicated feed.
- One named owner who runs a deletion test each quarter.
What to watch: dated checkpoints for 2027
Dated checkpoints for 2027
| Checkpoint | Date | What to check |
|---|---|---|
| Consumer law | 6 April 2027, then each 6 April | CMA enforcement decisions and guidance updates |
| Contracts | 90 days before each renewal | Withdrawal window, export rights, audit trail |
| Platform policy | First working day of January, April, July and October 2027 | Google Business Profile help centre, Amazon review policy |
| Data law | Quarterly, after each ICO update | Purpose and retention reasoning in new notices |
Buying behaviour is shifting with enforcement. The commerce reviews market outlook in England tracks how tighter rules change what retailers pay for and where they cut tools.
Common questions
Does the Data (Use and Access) Act 2025 apply across the UK?
Yes. Data protection is reserved, so the Act covers England, Scotland, Wales and Northern Ireland alike.
Can we use AI to reply to reviews?
Yes, for drafting replies and grouping themes. No, for generating the review itself. A fabricated review presented as a customer view breaks platform policy and advertising rules.
How long may we keep review data?
There is no single statutory period. Set one, document it and test that deletion runs. Two years for published display data and 12 months for reviewer email is a defensible starting point.
Do we need fresh consent to reuse an old review in paid ads?
Usually yes. Paid creative is a different purpose from the product page, so a consent given in 2023 may not cover it.
In this guide
- Seven data sources and regulators to watch for commerce reviews 2027 trendsSeven data sources and regulators to watch for commerce reviews 2027 trends, with inclusion criteria, a glossary and questions retail teams should ask first.
- Commerce reviews: AI use cases and safeguardsHow retail teams can use AI for commerce reviews, from moderation and reply drafting to advertising checks, human oversight and children's data safeguards.
- An outlook on how tighter review enforcement is reshaping the commerce reviews marketCMA fines, vendor results and platform rules are reshaping commerce reviews. Here are the trends, forecasts and named providers UK retailers should track.
- When to review your commerce reviews skills forecastA practical guide to timing your commerce reviews skills forecast, covering recent UK change, team capability triggers and a checklist for compliant review work.
- Commerce reviews: managing growth and programme risks in the UKCommerce reviews can support growth, but weak disclosure, data handling and platform changes create risks. Learn how UK teams can set controls and prepare.
