The Law on Website Reviews in Ireland Explained

A kitchen fitting business outside Drogheda went live with a new site, and the "What our customers say" section carried four five-star quotes. Warm, specific, believable. A first name, a townland, a job done well. Not one of them came from a customer. They were placeholder copy, written by whoever built the page so the owner could see what the section would look like once it was filled in properly. It never was filled in properly. Those four invented quotes sold kitchens for the best part of three years.

I am describing a pattern rather than one incident, because we see it often enough that it has stopped surprising anyone here. Demo content ships. Nobody circles back. The fiction quietly becomes the sales pitch.

What the owner did not know is the thing that matters most about that page. Under Irish law it is not a design detail, and it has not been one since 2022.

What the Consumer Rights Act 2022 did to your testimonials page

The Consumer Rights Act 2022 amended the older Consumer Protection Act 2007 and added two new entries to the list of commercial practices that are banned in all circumstances. You can read both in the text of the Act on the Irish Statute Book.

The first, sitting at section 55(1)(za), prohibits "stating that reviews of a product are submitted by consumers who have actually used or purchased the product without taking reasonable and proportionate steps to check that the reviews originate from such consumers".

Alongside it, paragraph (zb) prohibits "submitting or commissioning a person to submit false reviews or endorsements by consumers, or misrepresenting reviews or social endorsements by consumers, in order to promote products".

Read those twice, because the wording is broader than most owners assume. The second one does not require money to change hands. It does not require a review farm in another jurisdiction. A quote you wrote yourself, a quote your web designer invented as filler, a five-star write-up from your brother-in-law who has never bought anything from you: all of it is an endorsement by a consumer that is not, in fact, from a consumer.

"Banned in all circumstances" is the part that bites. There is no threshold, no defence that nobody was actually harmed, and no allowance for the fact that the service really is excellent. The practice itself is the breach.

The clause almost nobody has read

There is a second provision, and I would put money on your web designer never having mentioned it. The same Act inserted a new subsection 43(3B) into the 2007 Act, which says that where a trader gives access to consumer reviews of products, "information in relation to whether and how the trader ensures that the published reviews originate from consumers who have actually used or purchased the products shall be treated as material information".

Material information has a specific meaning in Irish consumer law. Leave it out and you are exposed to a misleading omission, which is its own separate breach.

So the obligation is not only that your reviews must be real. If you publish reviews at all, you are expected to tell people how you know they are real. Most Irish business websites carry a testimonials block and not one word explaining where those quotes came from. That is a gap you can close in about ten minutes with a single sentence, and almost nobody has closed it.

Verification is not a feature of the review. It is a record of where the review came from.

Three ways an honest business trips over this

None of the owners I have in mind set out to deceive anybody. That is what makes this worth writing about.

The quotes nobody wrote

Placeholder testimonials are the most common by a distance. Close behind them: quotes composed by the owner from the general sentiment of happy customers, quotes written by a member of staff, quotes lifted from a private WhatsApp message and then tidied up so much they became something the customer never said. The tidying is where it turns. Correcting a typo is fine. Rewriting the sentence and attributing it to a customer is misrepresenting a consumer review.

The verification badge you cannot stand over

"Verified customer." "Verified purchase." "Real reviews from real clients." Those phrases carry a legal obligation the moment you publish them, because section 55(1)(za) attaches to the claim, not the review. Make the claim, and you need reasonable and proportionate steps behind it. An invoice number, an order reference, a booking confirmation, a dated email from the address that placed the job. Something you could hand to an investigator.

If you cannot produce that trail, take the badge off. The review can stay. It is the claim attached to it that you cannot back up.

Publishing the good ones and quietly dropping the rest

This is the one that catches careful, decent operators. You collect fifteen pieces of feedback, twelve are glowing, three are middling, and the page ends up carrying the twelve. Selective publication in order to promote products is capable of misrepresenting reviews, and the same logic runs through the platforms. Google's own contributed content policy for Maps tells merchants not to "discourage or prohibit negative reviews, or selectively solicit positive reviews from customers", and separately bars merchants from offering "incentives, such as payment, discounts, free goods and/or services, in exchange for posting any review". The discount-for-a-review card in the delivery bag is a policy breach, not a clever growth tactic.

This is not a small-business problem invented by regulators with nothing better to do. When the European Commission coordinated a screening of 223 major review-carrying websites across 26 member states plus Iceland and Norway, published in January 2022, authorities could not confirm that roughly two-thirds of them were doing enough to ensure reviews came from genuine purchasers. Around a hundred of the sites gave consumers no information at all about how reviews were collected and handled. Those figures cover large platforms rather than local traders, and the sample was deliberately weighted towards the big players, so do not read it as a national average. Read it as a signal about which way the enforcement wind was already blowing four years ago.

What actually happens if you get this wrong

Time for some honesty about risk, because scaring you with a maximum penalty would be the cheap move.

Breaches of the prohibited practices list are criminal offences prosecuted under the Consumer Protection Act 2007, and the penalty scale in section 79 runs from a District Court fine and a possible short prison term at the summary end up to a fine not exceeding €60,000 and up to eighteen months on a first conviction on indictment. The Competition and Consumer Protection Commission enforces it.

Now the reality check. The CCPC's public enforcement effort has been aimed at large traders and platforms, not at a five-person kitchen fitting outfit with an unwatched testimonials page. Realistically, a prosecution landing on a small Irish business over four invented quotes is unlikely, and I am not going to pretend otherwise.

Your practical exposure is different, and closer. A competitor screenshots the page and complains. Or a customer recognises their own words in a testimonial they never gave. Somebody notices that the same four quotes appear, verbatim, on eleven other websites built from the same template, which is exactly what happens with agency placeholder copy. None of that involves a court. All of it involves the one asset a local trader cannot rebuild in a hurry, which is being believed. The call you do not want is the one where a customer asks, politely, who "Marie" actually is.

The stars you are chasing will not come from your own page

There is a technical point here worth more than the legal one to most owners.

A common reason businesses build out a testimonials page with review markup is to get the gold stars showing under their listing in Google results. It does not work, and it has not for years. Google's own structured data documentation for review snippets states plainly that "if the entity that's being reviewed controls the reviews about itself, their pages that use LocalBusiness or any other type of Organization structured data are ineligible for star review feature".

You control your own testimonials page. That is the whole point of it. So marking those quotes up as review data earns you nothing in search results, and if the quotes are invented you have taken on a legal exposure in exchange for a search benefit that was never available.

Stars in the local pack come from your Google Business Profile, where the reviews are written and held by other people. Reviews on your own site do a completely different job, which is converting somebody who is already looking at your page and deciding whether to ring you. Both are worth having, and putting your best reviews to work on your own site is still one of the highest-return changes a small site can make. Just do it for the right reason.

Two different jobs: reviews held by a platform, and reviews working on your own page.

Making a testimonials page you can stand over, in four steps

This takes an afternoon, once.

Audit. Open every page that carries a customer quote, including the home page slider and the footer, and list every quote you cannot immediately match to a real person.
Trace. For each surviving quote, find the invoice, booking, order number or original email and note the reference somewhere you can find again in two years.
Disclose. Add one plain sentence near the reviews explaining how you verify them, for example: "Every review on this page was left by a customer we have invoiced, and we hold the original message on file."
Deploy. Remove anything that failed steps one and two, push the change to production the same day, and diarise a review of the page every six months.

Step four is where this goes wrong for most small firms, and not because they are lazy. If every content change means emailing an agency and waiting three days for a quote at €75 to €150 an hour, a page that is merely legally awkward never gets to the top of the list. That is the actual mechanism by which bad testimonials survive for years. Being able to open your own site, delete four paragraphs and push the change before lunch is worth more than any plugin, and it is the reason we bundle full WordPress access, hosting, backups and support into one price of €60 a year with nothing held back. Control of your own content is not a luxury feature. On this particular page, it is a compliance control.

While you are in there, the same principle applies to the prices you display and whether you have to honour them. Same law, same commission, same afternoon.

Where a review platform genuinely beats doing it yourself

If you are running an online shop with a few hundred orders a month, hand-managing this is the wrong answer. A dedicated review platform that emails an invitation to verified purchasers after delivery does the verification work automatically, keeps an audit trail you did not have to build, and gives you a defensible answer to the "how do you know these are real" question without anyone touching a spreadsheet. For that business, the subscription is money well spent.

A trade business, a clinic, a consultancy or a shop doing a handful of jobs a week does not need any of it. You already know every customer by name. The trail is your invoices. What you need is not software, it is ten minutes of honesty and a sentence on the page.

The upshot

The law here is not asking you to be modest. It is asking you to be able to prove that the nice things on your website were said by the people you say said them.

Most Irish businesses will pass that test on the substance and fail it on the paperwork, because the quotes are real but nothing on the page says so, and because somewhere in the footer sits a line of demo copy that nobody has looked at since launch day. Go and look at the page. If you can trace every quote and a visitor can see how you check them, you are done. Where you cannot, you now know which four paragraphs to delete before the end of the week.

Frequently Asked Questions

Can I write a testimonial myself based on what a customer told me on the phone?

No, not if you present it as the customer's own words. Verbal praise is real feedback, but writing it up yourself and attributing it as a review turns it into an endorsement the consumer did not give, which section 55(1)(zb) of the Consumer Protection Act 2007 treats as a prohibited practice. The safe version is to ask the customer to send you a sentence by email or text, then publish what they actually wrote and keep the message on file.

Do I have to publish negative reviews on my own website?

You are not obliged to run a public review board on your own site. What you cannot do is present a curated selection as though it represents the full picture, or claim you publish all feedback when you do not. If your page says "our reviews" and carries only the best twelve of fifteen, that is where the risk sits. A clear, honest line such as "a selection of recent customer feedback" is a great deal safer than an implied claim you cannot support.

Can I offer a discount to customers who leave a review?

You should not, and this goes beyond Irish consumer law. Google's contributed content policy prohibits merchants from offering payment, discounts or free goods in exchange for posting a review, and enforcement can mean removed reviews or restrictions on your Business Profile. Asking a happy customer to leave an honest review is fine and always has been. Attaching a reward to it is not.

What exactly should I write on my reviews page to comply?

One sentence, in plain English, saying how you know the reviews are genuine. Something like: "All reviews on this page were left by customers who booked and paid for work with us. We hold the original emails and can verify each one on request." That addresses the material information point in section 43(3B). If you also display a "verified" badge, make sure you can actually produce the evidence for every review carrying it.

Will removing fake testimonials hurt my Google rankings?

Almost certainly not, and it may help. Reviews you host and control on your own site are ineligible for star review snippets in search results under Google's structured data policy, so you are not losing a ranking feature you had. Genuine reviews on your Google Business Profile drive local visibility. Invented quotes on your own site were never doing that work in the first place.

Does any of this apply to business-to-business sales?

Irish consumer protection law is aimed at trader-to-consumer dealings, so a testimonials page selling exclusively to other businesses sits outside most of it. Two cautions. Many small firms sell to both, and the moment a consumer could be reading the page it is in scope. Separately, a fabricated endorsement used to win B2B work carries its own commercial and reputational problems that no statute needs to spell out.

The Law on Website Reviews Reaches Your Own Testimonials Page