Review software controls UK retailers need for CMA online reviews guidance

What to take away

What the CMA's online reviews guidance actually requires of UK retailers

The Competition and Markets Authority (CMA) has been the UK's main consumer enforcement body for online reviews since it took on the role under the Consumer Rights Act 2015. Its online reviews guidance sits within the wider consumer protection collection for businesses, covering unfair commercial practices.

If you sell through a website, marketplace or app, that guidance applies to how you collect, display and act on reviews.

The core duty is not to mislead. That means no fake reviews, no suppressing genuine negative reviews, no cherry-picking only five-star content, and no presenting reviews as independent when they are not. The CMA has taken action against businesses that pay for reviews or edit them to change their meaning.

For an ecommerce manager, the practical output is a documented process: how reviews arrive, who checks them, what gets rejected and why.

A second requirement is transparency about ranking. If your site sorts reviews by "most helpful" or "most recent", the logic should be clear to the shopper. Hidden ranking that pushes negative reviews down is a misleading practice.

Review software can expose the sort order and keep a record of it, which is useful if the CMA asks how your display works.

The CMA also expects you to act on reviews that reveal a product or service problem. If a pattern of complaints appears, ignoring it can itself be misleading if you keep marketing the product as fault-free.

The guidance does not demand a specific tool, but it does demand evidence that you monitor and respond. That is where updated commerce reviews UK regulations matter for English retailers building a defensible file.

Finally, the CMA works with other regulators. The ASA handles advertising claims, the ICO handles data protection, and Trading Standards can act locally. A single review policy should satisfy all of them, not just one.

Consumer protection guidance for businesses - GOV.UK is the practical starting point because it gathers the CMA's consumer protection guidance in one place.

How the DMCC Act 2024 changes duties on fake and incentivised reviews

The Digital Markets, Competition and Consumers Act 2024 put fake reviews and hidden incentives on a statutory footing. The Act gives the CMA direct enforcement powers, including the ability to decide that a commercial practice is unfair and to impose penalties without going to court first.

For review compliance, the key provisions target reviews that are fake, reviews that are incentivised without disclosure, and reviews that are presented in a misleading way.

The Act also covers the submission of fake reviews and the commissioning of them. That means a retailer cannot simply blame a third-party agency if it bought reviews. The duty sits with the business whose products or services are reviewed. If your review software allows anonymous submission with no verification, you are carrying risk under the DMCC Act 2024.

Incentives are not banned outright. What is banned is hiding them. If you offer a discount, entry into a prize draw or loyalty points in exchange for a review, the review must be labelled as incentivised. The shopper needs to know before they weigh the review.

An incentive disclosure log records what was offered, to whom, and when, which is the evidence the CMA would expect to see.

Fake reviews include reviews written by the business, its staff or its agents, and reviews generated by bots. They also include reviews that are genuine in origin but edited to change their meaning. A review moderation queue should flag edits and keep the original text.

The Act's consumer protection provisions apply across the UK, so a Scottish or Welsh retailer faces the same duties as one in London.

Enforcement is not only about fines. The CMA can accept undertakings, publish information about a business, and seek redress for consumers. Reputation damage from a CMA investigation can outlast any penalty. That is why the DMCC Act 2024 has pushed review compliance from a marketing preference to a board-level concern for many UK retailers.

ASA CAP rules on testimonials and endorsements in review marketing

The Advertising Standards Authority (ASA) enforces the CAP Code, which covers non-broadcast advertising including testimonials and endorsements. If you use a customer review in an ad, on a landing page or in an email, the CAP Code treats it as a testimonial.

That means it must be genuine, it must be representative, and it must not be misleading by omission or exaggeration.

A common problem is the selected testimonial. Picking one glowing review from hundreds of mixed ones and presenting it as typical can breach the CAP Code. The ASA has ruled against advertisers who used testimonials that did not reflect the general experience of customers.

Review software can help by showing the overall rating alongside any highlighted quote, so the context is not lost.

Endorsements from influencers or affiliates are covered too. If a person is paid or otherwise rewarded for a review, the commercial relationship must be disclosed. The ASA's guidance on testimonials and endorsements sets out how to make that disclosure clear.

A label like "incentivised review" or "paid partnership" is usually enough if it is prominent and not buried.

The CAP Code also applies to review marketing on social media. A screenshot of a review posted to Instagram or TikTok is still an ad if it promotes a product. The same rules apply. For UK retailers, the safe approach is to treat every review used in marketing as a claim that needs substantiation.

Reviews and social media endorsements: guidance for businesses and brands - GOV.UK covers the same ground for brands running campaigns.

ASA rulings are published and searchable, which means a breach can surface in a competitor's due diligence or a journalist's story. The cost of a ruling is rarely financial; it is the loss of trust. A review moderation queue that records why a review was approved for marketing use gives you a defence if a complaint is made.

ICO expectations for reviewer data under UK GDPR and the Data Protection Act 2018

Reviewer data is personal data. A review usually includes a name, a location, a purchase history or a device identifier, and sometimes an email address. Under UK GDPR and the Data Protection Act 2018, you need a lawful basis to process it.

The ICO's lawful basis guidance explains the options, and for most review platforms the practical choice is legitimate interests or consent.

Legitimate interests can work for collecting and displaying reviews, but you must complete a legitimate interests assessment. That means weighing your interest in showing reviews against the reviewer's rights. If you use reviews for marketing, profiling or sharing with third parties, consent is often the safer basis. The ICO expects you to document the basis you chose and why.

Retention is the next issue. You should not keep reviewer data indefinitely. A retention schedule that deletes or anonymises reviews after a set period reduces risk. Review software should support that schedule without manual intervention.

If a reviewer asks for deletion, you need a process to remove the review and any associated personal data, while keeping an anonymised record for compliance.

Access requests are common. A reviewer can ask what data you hold about them, and you must respond within one month. If your review software cannot export a single reviewer's data, you will struggle. The same applies to correction requests: if a reviewer says their review was edited, you need to show the original and the change history.

International transfers matter too. Many review platforms host data outside the UK. If personal data leaves the UK, you need a transfer mechanism, such as the UK International Data Transfer Agreement or an adequacy finding. Check where your review software stores data before you sign. The ICO can fine, but more often it requires changes and publishes its findings.

Moderation queues: designing review software workflows that evidence compliance

A moderation queue is the operational heart of review compliance. It is the list of reviews waiting for a decision: publish, reject, edit or escalate. The design of that queue determines whether you can evidence compliance or just claim it.

The CMA and ASA do not require a specific queue, but they do expect decisions to be consistent, recorded and reviewable.

Start with clear rejection reasons. Common ones include profanity, personal data about a third party, competitor spam, off-topic content and suspected fake reviews. Each reason should map to a policy clause. When a reviewer challenges a rejection, you can point to the clause and the decision record. Review software that forces a reason code creates a clean audit trail.

Next, separate automated and human decisions. Automated filters can catch spam and profanity, but they should not silently delete genuine negative reviews. A human should review anything that is rejected for authenticity or policy reasons.

The queue should show who decided, when, and what they saw. That record is what you show the CMA if it asks how you handle reviews.

Escalation paths matter for legal risk. A review that alleges a safety issue, a data breach or a criminal act should not be handled by a junior moderator alone. It should escalate to a named compliance lead.

The queue should support that routing and keep the escalation timestamp. This is also where you link to your commerce reviews disclosure policy, so moderators know what must be disclosed.

Reporting is the final piece. A monthly report showing volume, rejection rates by reason, average time to decision and appeals gives management a view of risk. If rejection rates spike for one product, that is a signal. If time to decision grows, reviewers may go elsewhere.

The queue is not just a compliance tool; it is a customer service metric.

Verified-buyer checks and incentive logs as audit-ready controls

Verified-buyer checks confirm that a reviewer actually bought the product or service. The strongest check matches the reviewer to an order ID, email address or account. Weaker checks rely on a confirmation email or a unique link.

Under the DMCC Act 2024, verification is not mandatory for every review, but it is the simplest way to show that a review is not fake.

A verified-buyer badge is only as good as the check behind it. If your software marks reviews as verified without matching them to a transaction, the badge is misleading. The CMA has acted against misleading trust signals. Review software should log the verification method and the matched order reference, not just the badge status.

Incentive logs record every reward offered for a review. That includes discounts, loyalty points, prize draws and free products. The log should capture the offer, the date, the reviewer, the product and whether the review was labelled as incentivised.

If the CMA asks how you disclosed incentives, the log is your answer. It also helps you avoid double-counting incentives across campaigns.

Both controls need to be auditable. That means immutable timestamps, user-level access controls and export in a readable format. A spreadsheet maintained by one person is not audit-ready. Review software with role-based permissions and an audit log is. The ICO also expects access controls for personal data, so the same feature serves two regulators.

Finally, link the controls to your policy. A verified-buyer check means nothing if your policy does not say what happens when verification fails. An incentive log means nothing if no one reviews it. Assign ownership: a named person should review the log monthly and sign off. That sign-off is the evidence that the control is live, not just configured.

Choosing customer review software for a UK compliance file

Choosing customer review software in the UK is now a compliance decision as much as a marketing one. The platform must support the CMA's online reviews guidance, the DMCC Act 2024 duties, the ASA CAP Code and ICO expectations. That means features, not just promises.

Ask for a demonstration of the moderation queue, the verification method and the incentive log, not a slide deck.

Use a checklist to compare vendors. The items below cover the controls that a UK compliance file should evidence.

A table helps compare vendors on the features that matter most.

Price matters, but the cost of a CMA investigation is higher. UK review software ranges from low-cost plug-ins to enterprise platforms. The plug-in may lack audit exports and role-based permissions. The enterprise platform may be overkill for a small retailer.

Match the tool to your risk: if you sell regulated products or run frequent incentivised campaigns, you need the stronger controls.

Implementation is where compliance fails. A platform can be compliant and still be used badly. Train moderators on the policy, set the escalation routes, and test the audit export before you go live. Run a mock access request and a mock CMA enquiry. If you cannot answer both within a day, fix the gap before launch.

Finally, review the contract for data protection terms. You need a data processing agreement, clarity on sub-processors and a breach notification clause. The ICO expects you to manage your processors, not just your own systems. For a step-by-step selection process, see commerce reviews software selection. The right platform will make the compliance file easy to assemble, not harder.

Common questions