Every guide to local marketing tells you the same thing: ask your happy customers for a review. It is good advice, and it has quietly become risky advice. Since April 2025 the UK rules on consumer reviews have been stricter than most small business owners realise, and in March 2026 the regulator stopped writing advisory letters and started opening investigations.
None of that makes asking for reviews a problem, and nothing here should stop you collecting them. But a handful of habits that are still routinely recommended — including one we have recommended ourselves — now fall foul of either the law or Google's own policies. This is a plain-English summary rather than legal advice, so if your business does anything unusual with reviews, take proper advice.
What changed, and when
The consumer protection parts of the Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025. Among other things, they added fake and misleading consumer reviews to the list of practices treated as unfair in all circumstances — so there is no argument about whether a particular consumer was misled. The practice itself is banned.
The Competition and Markets Authority published its fake reviews guidance, CMA208, alongside it, and allowed a three-month adjustment period through April, May and June 2025 in which it prioritised helping businesses comply over enforcing against them. It updated that guidance in September 2025 with more detail for sites that publish reviews.
The same Act let the CMA enforce consumer law directly, without going to court first, and fine a business up to £300,000 or 10 per cent of worldwide turnover, whichever is higher. More on what that realistically means for a five-person company below.
What is actually banned
The prohibitions are narrower and more specific than the headlines suggest. In plain terms, they cover:
- —Writing a review of your own business, or asking anyone else to — staff, family, a supplier, an agency — where it does not describe a genuine experience
- —Posting or commissioning a review that conceals the fact it was incentivised
- —Offering to write, sell or arrange fake reviews for someone else
- —Presenting reviews misleadingly: cherry-picking the positive ones, suppressing or delaying genuine negative ones, or showing a star rating the reviews do not support
- —Publishing consumer reviews without taking reasonable and proportionate steps to prevent and remove fake ones
Incentives are not banned. Concealing them is.
This is the distinction almost everyone gets wrong in one direction or the other. The Act does not outlaw incentivised reviews; it outlaws a review that hides the incentive. If a reader can plainly see the reviewer got something, the review is not a banned practice on that ground alone.
What counts as an incentive is broader than money: a discount, a free product, a voucher, a favour, or a prize draw where entry depends on leaving a review. Any of those has to be disclosed where someone reading the review will see it.
For Google reviews specifically, disclosure is not enough, because Google's own rules are stricter than the law. Google's prohibited content policy for Business Profiles bans offering incentives in exchange for reviews at all, and bans asking someone to change or take down a negative review in exchange for something. Breaching it usually costs you the reviews first and can end with the profile suspended.
So the practical rule is simple: attach nothing to a Google review request. Not a discount, not a prize draw, not a free delivery next time.
Review gating: the habit almost everyone still recommends
Review gating means surveying customers first and sending the review link only to the ones who say they were pleased. Software has been sold on that feature for years. It is explicitly against Google's policy: any process filtering who gets asked, whether by expected sentiment, job size or a member of staff's hunch, breaches the rules.
The legal position is less settled but points the same way. The CMA's guidance treats the suppression of genuine reviews as a problem, and gives limiting who is invited to review in order to avoid negative feedback as an example. Whether that catches a builder who simply remembers to ask the pleased customers is genuinely arguable, and there is no decided case to point at.
We would treat that as a reason to change the habit rather than test it. We have written ask every satisfied customer in this blog before; on reflection, ask every customer is both safer and better business. In our experience an average of 4.6, with a couple of measured criticisms and calm replies underneath, reads as more credible than an unbroken run of fives.
The reviews on your own website count too
This is the part that catches website owners off guard. The duty to take reasonable and proportionate steps applies to anyone publishing consumer reviews, not only to Trustpilot and the app stores. The CMA's updated guidance is aimed at sites that let people review products or services, and it is direct: genuine, relevant and lawful reviews should be published, genuine negative ones should not be edited, deleted or delayed, and the business being reviewed should not be able to block reviews it dislikes.
Whether a static testimonials page of hand-picked quotes makes you a publisher in that sense is unresolved, practitioners say. The misleading-presentation limb is clearer and does not depend on the question: five glowing quotes selected from a much more mixed picture, or a homepage rating the reviews do not support, is a problem however the page is categorised.
For a small business site that mostly means two things: attribute every testimonial to a real, identifiable person who agreed to it, and if you pull in a live feed of your Google reviews, show them as they come.
What the regulator has actually done
After the adjustment period ended, the CMA swept the websites of more than 100 businesses that publish reviews and wrote to 54 of them that appeared to fall short, asking what they were changing. That was the warning phase.
On 27 March 2026 it opened its first five investigations under the new rules, into Auto Trader, Feefo, Dignity, Just Eat and Pasta Evangelists. The allegations range from one-star reviews being kept out of a star rating, to staff being asked to write positive reviews, to customers being offered undisclosed discounts for five stars. No findings have been made against any of them, and the CMA expects to give an update in September 2026 — next month, which is why this is worth reading now.
Be realistic about where that leaves you. Those are large companies and review platforms, and a five-page site for a plumber in Bromley is not next in the queue. Your realistic exposure is smaller and more ordinary: a competitor or customer who complains, and — much the likelier of the two — Google quietly deleting a batch of reviews or suspending the profile, which happens faster than anything a regulator does and has no appeal worth the name. Fix this because the alternative loses you the reviews you worked for, not because you expect a penalty.
A review process that stays on the right side of all this
The compliant version is no harder than what you are doing now. It is mostly a matter of removing things:
- —Ask every customer, not a filtered subset, at the same point in every job
- —Send the short review link Google generates for you, the same way, to everyone
- —Attach nothing to the request — no discount, no prize draw, no free delivery next time
- —Never ask staff, family or suppliers to post a review of work they did not buy
- —Reply to every review, briefly to the good ones and calmly to the bad, and never offer anything in exchange for one being changed or removed
- —Show the reviews on your website as they are, with no filtering to five stars and no editing, and attribute each one to a real person who agreed to it
- —If visitors can post reviews on your site, publish a short policy on fake and incentivised reviews and follow it
How we handle this on the sites we build
For the detail, the CMA's fake reviews guidance CMA208 is free on GOV.UK, and Google's prohibited and restricted content policy covers the other half. Both are more reliable than the compliance emails that will arrive once the September update lands.
On the sites we build, reviews are either pulled from the source unfiltered or attributed to a named customer who agreed to it. We do not write testimonials for clients, and we do not put an average rating on a page the reviews do not support. It has changed what we recommend on the local SEO side, too: ask everyone, incentivise nothing.
If you have inherited a site with a testimonials page nobody can vouch for, or you are not sure whether your review requests would survive a look, we are happy to go through it with you and say plainly what we would change. Usually it is an afternoon's work rather than a project, and when that is the answer we would rather tell you.