A year after the UK banned fake reviews, the first CMA cases are about ordinary business habits

Five investigations, and not one is about an invented customer

On 26 March 2026 the Competition and Markets Authority opened enforcement cases against five companies over online reviews, and announced them the following day ^[1]. Autotrader is being examined over whether a number of one star reviews, which had been moderated by Feefo, were not published on its platform and were not counted towards its star ratings, “therefore denying consumers a fully rounded picture of other customers’ experiences” ^[9]. Dignity is being examined over whether it asked staff to write positive reviews about its crematoria services ^[10]. Just Eat is being examined over whether its ratings system inflated the star ratings of certain restaurants and grocers ^[11]. Pasta Evangelists is being examined over whether customers were offered discounts on future orders in exchange for leaving five star reviews, without that being disclosed ^[12].

The pattern is worth sitting with. Not one of these cases is about a business inventing a customer who never existed. They are about real reviews that did not get shown, reviews written by people with an interest in the business, a rating that did not match what people wrote, and an incentive that was not declared. Sarah Cardell, the CMA’s chief executive, said fake reviews “strike at the heart of consumer trust” ^[1].

These are large companies, and it would be easy for a small practice to read the announcement and move on. That would be a mistake, because the rules in question have no size threshold. They apply to any trader, and the CMA has said in terms that a small trader publishing only reviews from their own customers is still required to put reasonable and proportionate measures in place ^[5].

The five investigations were also not the CMA’s first move. It reviewed more than a hundred websites, concluded that more than half of the businesses it looked at, fifty four in total, could be failing to comply with its guidance, and wrote an advisory letter to every one of them ^[2]. Ninety per cent of the businesses it contacted then took action to improve their policies ^[7]. The investigations came after that, for the cases where the CMA wanted more than a letter.

What the law actually bans

The rules come from the Digital Markets, Competition and Consumers Act 2024, whose consumer provisions came into force on 6 April 2025 ^[4]. Schedule 20 of the Act lists commercial practices that are unfair in all circumstances, which is the category where a practice counts as unfair regardless of its effect in any particular case. One of those listed practices concerns consumer reviews ^[3].

The Act bans submitting, or commissioning another person to submit or write, “a fake consumer review” or “a consumer review that conceals the fact it has been incentivised” ^[3]. It bans publishing consumer reviews, or consumer review information, in a misleading way ^[3]. It bans publishing either “without taking such reasonable and proportionate steps as are necessary to prevent and remove from publication” banned material ^[3]. And it bans offering services to other traders for the doing of any of those things ^[3].

The definitions carry more weight than the headline. A fake consumer review is one that “purports to be, but is not, based on a person’s genuine experience” ^[3]. That is a wider test than most business owners assume. A review written by a member of staff who was never a customer falls inside it. So does one written by the owner’s brother in law, however sincerely meant. Consumer review information is defined as information derived from or influenced by consumer reviews ^[3], which puts the star rating on a profile page under the same rules as the words underneath it.

The enforcement machinery changed at the same time. The CMA no longer has to go to court to act on consumer law. Traders who do not comply can be fined up to 10 per cent of their worldwide turnover ^[4], and the CMA has been able to impose those penalties directly since April 2025 ^[7]. Breaching an undertaking carries up to 5 per cent of global turnover, and failing to provide information or concealing evidence up to 1 per cent ^[1]. In its first year of direct consumer enforcement the CMA opened fourteen investigations, issued 157 advisory and warning letters, and imposed £4.7 million in fines across its consumer work as a whole ^[7].

When the regime began the CMA said it would target “behaviour that is particularly harmful to consumers and represents clear infringements of the law” during its first twelve months, and that fines in that opening period were likely to be lower than in the years that follow ^[6]. That period has now passed.

Where the line falls between encouraging a review and buying one

Asking is allowed, and it is worth saying so plainly, because a good deal of nervous advice since April 2025 has implied otherwise. The CMA’s guidance accepts that a trader may encourage reviews by emailing customers generally to ask whether they wish to provide one, so long as the trader is not predetermining the content or the sentiment of what comes back ^[5].

Paying is where it becomes awkward, because the law and the platform do not agree. Under the Act an incentivised review is not unlawful in itself. The CMA’s position is that traders “are free to do this but to comply with the law they must” tell consumers that the review has been incentivised, and the review must still reflect the reviewer’s genuine experience ^[5]. Usually, the guidance adds, the reviewer will need at least to label the review prominently as incentivised, “namely, as an advert” ^[5].

Google does not allow it at all. Its policy for content on Maps and Business Profiles says businesses must not offer “payment, discounts, free of cost goods and/or services” in exchange for posting a review, revising one, or removing a negative one ^[13]. Its own advice page for owners is blunter still, saying that offering incentives in exchange for reviews “is considered fake engagement and is strictly prohibited” ^[14].

The advertising rules add a third layer for anything that counts as a marketing communication. The CAP Code requires that marketing communications must not contain fake consumer reviews, and must make clear where consumer reviews have been incentivised ^[15]. CAP’s own advice warns that “directly and explicitly incentivising consumers to leave positive reviews or testimonials is likely to be considered problematic” ^[15].

The practical consequence is that the legal question is the wrong place to start. A prize draw for reviewers might well be defensible in law with careful disclosure, and it would still put a Google Business Profile at risk, and the profile is usually where the customers actually are. At my own clinic the instruction to staff is the shortest version of this rule: nothing is offered in return for a review, ever, to anybody.

Review gating, and why it is the trap most businesses do not see

Review gating is the practice of asking a customer how their experience was before deciding where to send them, so that the satisfied ones are routed to a public review page and the dissatisfied ones are routed to a private feedback form. It is often sold as good practice, on the reasoning that a complaint is better handled privately. The sorting step is the problem.

The CMA treats it as part of a wider category of publishing reviews in a misleading way, which it describes as suppressing genuine negative or positive reviews, selectively promoting positive or negative ones, or omitting information about how reviews were written ^[5]. Its guidance warns specifically against “encouraging just those who are satisfied to leave reviews” ^[5]. It also warns against making “an offer of dispute resolution contingent on a consumer not leaving a negative review” ^[5], which is what a refund offered in exchange for silence amounts to, however politely it is phrased.

Google says the same thing in a single line. Merchants should not “discourage or prohibit negative reviews, or selectively solicit positive reviews from customers” ^[13]. The same policy says merchants must not “require or pressure users to leave ratings or write reviews while on the premises, nor should they request that specific content be included” ^[13]. That last sentence is worth reading twice by anyone who keeps a tablet at reception with the review page already open and a member of staff standing beside it.

The Autotrader case is a reminder that the gate does not have to sit at the point of asking. It can sit at the point of publishing. The CMA’s concern there is one star reviews that were moderated out and then also excluded from the star rating ^[9]. A business that gathers reviews on its own website and publishes only the good ones is doing a smaller version of the same thing, and the smaller version is not carved out anywhere in the guidance.

The duty most small businesses do not know they have

A business that publishes reviews is a publisher for the purposes of the Act. That includes a website with a testimonials page. The CMA says a publisher must have a clear policy on the prevention and removal of banned reviews, must assess the risk of such material appearing and take further proactive steps where those are reasonable and proportionate, and must regularly assess whether its own prevention and removal processes are working ^[5].

There is no exemption for being small or busy. The guidance states that publishers “cannot avoid implementing effective prevention and removal steps solely due to the (lack of) resources and capabilities available to them” ^[5]. What proportionate means will differ between a marketplace and a dental practice, but the floor is not zero.

For a small business showing customer feedback on its own site, the guidance points towards a short published policy that prohibits fake reviews and sets out how incentivised reviews are handled, clear rules applied consistently about who may submit a review, and a record of what was done when something looked wrong ^[5].

The advertising rules ask for something more specific again, and this is the part most often missed. CAP rule 3.47 requires a marketer to hold documentary evidence that a testimonial used in a marketing communication is genuine, and to hold contact details for the person or organisation that gave it ^[16]. Rule 3.48 requires the testimonial to relate to the product advertised, rule 3.49 requires that claims within it do not mislead, and rule 3.50 forbids featuring a testimonial without permission ^[16]. A quotation lifted from a Google review and pasted onto a home page has to satisfy all four of those.

What a clinic has to think about that a plumber does not

A regulated healthcare business carries two further constraints, and they pull in opposite directions.

The first is that patient feedback is evidence a regulator looks at directly. The Care Quality Commission uses people’s experience as an evidence category in its assessments, defined as a person’s needs, expectations, lived experience and satisfaction with their care, support and treatment, and it gathers that material from feedback sent to it, from interviews with people and local organisations, from survey results, and from community and voluntary groups and providers ^[18]. Patient feedback is therefore not only a marketing asset for a clinic, it is an input to how the clinic is assessed.

The second is that a clinic cannot answer a review the way a restaurant can. Confirming that the reviewer was a patient, or correcting their account of what happened in the room, discloses confidential information about an identifiable person. The reply that is safe professionally is one that says nothing about the individual, acknowledges the concern in general terms and offers a private route to resolve it. That is a professional judgement rather than a consumer law one, and it is why the reply templates written for hospitality do not transfer to healthcare.

There is a third constraint on what a review may be made to do. CAP’s advice is explicit that “testimonials alone do not constitute substantiation so marketers should not rely on testimonials as support for any direct or implied claims” ^[17]. For a clinic that means a glowing review describing an outcome cannot be used on a treatment page as evidence that the treatment produces that outcome. The evidence has to exist independently of the review, and section 12 of the CAP Code applies its own rules to medicines, medical devices and health related products ^[17].

The process I set up at my own clinic is deliberately dull. Clients are given a Google review link and a QR code after their treatment. Staff are instructed never to offer anything in return for a review, and never to decide who gets asked on the basis of how the appointment appeared to go. Everybody who finishes a treatment receives the same ask, and what they write is then out of our hands. It is a worse tactic than gating and a much better system, because there is nothing in it that has to be explained away later.

What this means for a local business

If you run a clinic, a practice, a firm or a trade business in the UK, the work here is small and mostly one off. The six things below are what the guidance and the platform policies actually require, rather than what reputation software tends to sell.

1. Ask everybody, in the same way, at the same point in the journey. A single ask sent to every customer is defensible. A sorting step before the ask is the practice both the CMA and Google name explicitly ^{[5] [13]}.
2. Offer nothing in return. Not a discount, not entry to a prize draw, not a free add on. Disclosure can make an incentive lawful, and it will not make it acceptable on Google ^{[5] [13]}.
3. Write the policy down. One page saying fake reviews are not accepted, how an incentivised review would be handled, and who may submit one. Absent policies on fake reviews, and unclear or inaccessible policies on incentivised reviews, were among the issues the CMA identified in its website sweep ^[2].
4. Stop diverting unhappy customers away from the review page. Handle complaints properly and separately, and never make a resolution conditional on a review not being left ^[5].
5. Audit the testimonials already on the website. Keep evidence that each is genuine and contact details for the person who gave it, and remove any that carry a claim the business cannot substantiate on its own ^{[16] [17]}.
6. If staff, family or suppliers have reviewed the business, deal with it now rather than when somebody asks. A review from a person who was not a customer meets the Act’s definition of a fake review whatever it says ^[3].

None of this will move a ranking, and it is not offered as a way to. The reason to do it is that the downside is now asymmetric. Online reviews potentially influence an estimated £23 billion of UK consumer spending a year, and 89 per cent of consumers use reviews when researching products or services ^[8]. On one side sits a regulator that can impose a penalty of up to 10 per cent of worldwide turnover ^[4] and no longer needs a court to do it ^[7]. On the other sits a platform that, under commitments given to that regulator, can attach a prominent warning to a business profile where its review score appears, switch off its ability to receive new reviews, and delete all of its reviews for six months or more in repeated cases ^[8].

What remains uncertain

The largest unknown is where proportionality lands for a small trader. The guidance uses the words reasonable and proportionate throughout, and says explicitly that a shortage of resources is not by itself an answer ^[5], but what a five person clinic has to do to satisfy that test has not been tested by any decided case. The five cases opened in March 2026 all involve sizeable companies, and each of them remains an open investigation ^[1].

The second is how far the rules on consumer review information reach. Just Eat is being examined over a ratings system that allegedly inflated the star ratings shown for certain merchants ^[11]. It is not obvious from the published guidance how much of that reasoning applies to a small business that displays an average it has worked out itself, or that shows a rating drawn from one platform while a lower one sits on another.

The third is the gap between the law and the platforms, which nobody has closed. On incentives the law permits, with disclosure, what Google prohibits outright ^{[5] [13]}. A business that followed the CMA’s guidance to the letter and labelled an incentivised review as an advert could still find its reviews removed. The CMA has secured commitments from Google on detecting fake reviews and on sanctioning the businesses that use them ^[8], but the two rulebooks have not been reconciled, and only one of them is enforced automatically and without appeal.

The fourth is capacity. Fourteen investigations in a year, across the whole of consumer protection, is not a rate that reaches the average local business ^[7]. The realistic exposure for most small firms is not a CMA case. It is a competitor reporting a profile to Google, a customer noticing that their one star review never appeared, or an advisory letter arriving because a website turned up in the next compliance sweep ^[2].