Before publishing UK commerce reviews, check consent, editing and disclosure

What to take away

Do consumer rules cover reviews you publish?

Yes, whenever the review promotes something. A review that sells a product is a marketing communication, judged by the same rules as an advert.

A star rating built from cherry-picked quotes can be a misleading action under CPUT. Burying a run of complaints can be a misleading omission.

Consent and data protection for review collection

Collecting a review means processing personal data, so the UK GDPR and the Data Protection Act 2018 apply. Consent is the usual lawful basis for publishing a name or photo. For how that sits with the other lawful bases, read commerce reviews UK regulations in England.

Five checks before a review goes live:

If a complaint reaches the ICO, that record is your defence. Its published enforcement action includes fines for unlawful marketing and consent failures.

Editing, moderating and displaying reviews

Remove reviews holding personal data, hate speech, spam or defamatory claims. Do not remove one simply because it is negative. Publish the policy so regulators can test it.

If you edit for length, keep the meaning intact and mark it as edited. A five-star quote taken from a three-star review is a misleading action.

Show the whole rating distribution, or say how you filtered, and date every review.

Incentives, gifts and paid reviews

Paying for a review is not unlawful. Failing to say so is. A free product, a gift card or a prize draw entry is a material connection, and the CAP Code requires it to be obvious.

Employee reviews need the same disclosure. A staff member praising their own employer's product is writing marketing, whatever the platform calls it.

For how incentives interact with paid placements, see the commerce reviews advertising rules in England.

Example: consent and disclosure wording you can copy

Two short lines cover most cases:

I agree that [Business] may publish this review with my first name and city on its website, in emails and in paid social ads, and I can withdraw this at any time.

Review left after receiving a free sample. No payment was made and no wording was changed.

Platform terms when you syndicate reviews

Platform terms travel with the content. Google's Places API policies cover attribution, caching and alteration of user-generated content, and the Places API policies page sets those out.

Meta's ad rules apply when you pay to promote a post containing reviews. Ads must not carry false or misleading claims, and the reviews used must be genuine.

Contracts with review software and agencies

If the vendor collects reviews, it is a processor and you are the controller, so the lawful basis stays with you. Insist on audit rights, breach notification timescales and a clear exit. The clauses worth arguing about are covered in commerce reviews commercial contracts in England.

Enforcement: who can act, and what it costs

The Advertising Standards Authority sets out its range of sanctions, from adverse publicity to removal of the ad.

Prosecutions under CPUT stay rare, but the exposure is real.

Common questions

Do I need consent to publish a customer review?

Yes, if you publish anything identifying the reviewer, such as a name or photo. Ask for consent separately and record when it was given.

Can I edit a review before publishing it?

Fix typos and trim length, then mark the review as edited. You cannot change its meaning or turn a complaint into praise.

What are the penalties for fake reviews in England?

Trading standards can prosecute under CPUT 2008, with an unlimited fine and up to two years in prison. The ICO can fine for consent failures and the ASA can order an ad removed.

Do platform terms restrict reusing reviews in ads?

Yes. Google's Places API policies and Meta's ad rules both set conditions on attribution and alteration, so check both before you republish.