Privacy considerations for customer reviews

A customer review can contain personal information about the reviewer and other people. Before publication, assess what will be displayed, the source, the lawful basis and the information given to the customer. Permission to receive feedback does not automatically settle every later promotional use.

Avoid exposing confidential matter details, third party names or sensitive information when responding publicly. Check separate rights in photographs and the terms of any review platform. Keep the review accurate and do not invent customers, outcomes or endorsements to make the page more persuasive.

Separate collection from republication

Identify where the review came from and what the person understood would happen to it. A private thank-you email, a response to a service survey and a review on a public platform are different starting points. Before moving the text to a website or advertisement, assess personal information, confidentiality, copyright and platform terms. Public visibility alone does not establish unrestricted permission to reuse a person's words, photograph or case details in every channel.

Write down the proposed presentation: full name or initials, photograph, business role, quotation and surrounding description. The context can disclose more than the quotation itself. A review beside a specialist legal service may reveal a private matter even if the person only praised general communication. Remove unnecessary case detail and consider whether a less identifying presentation achieves the same commercial purpose without creating that disclosure.

Obtain and preserve the relevant evidence

Where permission is needed, make the request specific about the text and intended channels. Do not ask a client to approve an undefined testimonial for all possible future purposes. Keep the approved wording, date and any limits together with the original source. If a reviewer later changes role or the business wants to use the quotation in a new campaign, check whether the earlier agreement and privacy assessment still fit.

The IPO guidance explains that using another person's protected material requires an appropriate right or permission. ^[1] A platform's embedding feature may offer a different arrangement from copying its content into a permanent image. Check that method separately. Avoid downloading a profile photograph simply because it appeared beside the review; the image may have a different rights holder and its reuse may create additional privacy issues.

Keep editing and presentation honest

Shortening a review should preserve its meaning. Do not remove qualifying words that turn a mixed experience into an unqualified endorsement. Label illustrative examples as examples and never attach a fabricated customer identity to them. The CMA's reviews guidance addresses fake and concealed incentivised reviews and responsibilities when publishing consumer reviews. ^[2] Consider those requirements alongside privacy rather than treating a permission email as approval of misleading presentation.

Keep a record of incentives and moderation decisions where relevant. If the business invites feedback, the invitation should not pressure clients to disclose sensitive information or imply that future service depends on praise. Review the overall impression created by selected quotations, star ratings and headings. An accurate sentence can still become misleading when presented as evidence of an outcome the client did not claim.

Plan corrections and removal across channels

Maintain an inventory of where each testimonial appears: service pages, advertising artwork, social posts and third-party campaign systems. This makes it possible to respond meaningfully to a correction or privacy objection. Removing the website quotation does not update a scheduled advertisement or an image already supplied to an agency. Record the applicable assessment and action rather than promising that every independent third-party copy can always be erased immediately.

Use Privacy notices for UK small businesses for the relevant privacy explanation and Marketing consent and customer preferences when the review request is part of a wider marketing workflow. Keep client confidentiality review separate from copy approval. In professional services, even confirming that someone was a client may need careful consideration, particularly if the surrounding topic is sensitive or the original engagement terms restrict publicity.

For Business privacy notice review, provide the original review, proposed edited version and intended publication locations. Identify names, images and confidential facts requiring a decision. The useful result is an approved scope of use with a practical record and correction process. Give marketing staff access to the approved quotation rather than the full confidential client file so routine reuse does not expose unrelated information.

Check a testimonial before a new campaign

A customer may have agreed to a short website quotation several years ago. Before placing the same quotation in a paid campaign, check the original evidence and whether the proposed use changes its context, audience or identifying details. Confirm that an old job title, business relationship or performance statement remains accurate.

Keep the approved wording with the campaign asset, including any agreed attribution limits. If a designer shortens the quote, review whether the meaning has changed rather than approving it solely for layout. Establish a way to locate all versions if the customer later raises a concern. A central record is especially useful when agencies and sales teams create their own presentation materials.

Illustrative scenario

A client thanks a business in an email that describes a private dispute. The marketing team wants to publish the whole message. It instead reviews the intended use, obtains appropriate permission where needed and removes unnecessary confidential details. The final quotation must still reflect what the client actually said.

Preparation checklist

• Identify the review source and intended publication channels.
• Check names, images and sensitive matter details.
• Record the permission or other assessment relied on.
• Keep a process for corrections, objections and future reuse.