Asking Clients for Reviews After the DMCC Act: What Regulated Firms Can and Cannot Do

Review collection was, for a long time, an area where the guidance was soft and the practice was loose. That changed on 6 April 2025, when the unfair commercial practices provisions of the Digital Markets, Competition and Consumers Act 2024 came into force.

Fake reviews are now a banned practice — one of 32 listed in Schedule 20 as inherently unfair, meaning the CMA does not need to demonstrate any effect on consumer decision-making to enforce. The CMA can impose penalties of up to 10% of global turnover, without first going to court.

For regulated professional firms, this sits on top of existing conduct obligations. The combination is not onerous, but it does rule out several things that were previously common.

What the Act prohibits

Three categories matter.

Fake reviews. Submitting, commissioning, or offering to submit a review that does not reflect a genuine experience. This covers reviews written by staff, by family, by suppliers, or bought from a service. It also covers commissioning someone else to do it.

Concealed incentivised reviews. Incentivised reviews are not banned outright. A review given in exchange for a discount, a gift, a prize draw entry, or any other benefit is permissible — provided the incentive is disclosed clearly. What is banned is the concealment.

Misleading presentation of review information. This is the provision most firms overlook. It covers giving positive reviews greater prominence than negative ones, suppressing or removing negative reviews while publishing positive ones, and presenting aggregate ratings in a way that misleads. Cherry-picking is caught. So is using stale feedback in a way that misrepresents current service.

There is also a duty on those who publish reviews to take reasonable and proportionate steps to prevent and remove banned review content. A firm running its own on-site testimonial system is a publisher for these purposes.

The CMA allowed a grace period to July 2025 for businesses to get compliance processes in place. That period has long passed.

What this means in practice

Most firms need to change relatively little. But the changes are specific.

Stop selecting. If your website displays testimonials, it should not display only the best ones while a Google profile carries a different picture. Displaying a curated selection is defensible where the selection method is transparent and not skewed — displaying five five-star quotes while quietly declining to mention the two-star average is not.

Stop incentivising quietly. If the firm offers anything at all in return for a review — even a charitable donation or a prize draw — it must be disclosed, and it should be apparent from the review itself or from the surrounding context.

Ask everyone. The safest and most defensible collection method is a consistent, universal request at a fixed point in the client journey. Every client, same trigger, same wording, no filtering by anticipated sentiment. This is both compliant and, in our experience, better for the firm: a profile with a 4.6 average and some substantive criticism reads as more credible to a professional buyer than a wall of unbroken five-star entries.

Do not screen before sending. Sending a satisfaction survey first and only inviting the happy respondents to leave a public review is review gating. It is a form of selective solicitation that produces misleading review information, and it is a poor position to defend.

Handle removal requests carefully. Asking a platform to remove a review because it is defamatory, breaches confidentiality, or comes from someone who was never a client is legitimate. Removing negative reviews from your own site because they are negative is not.

The professional conduct layer

Regulated firms have a second set of constraints that sit alongside consumer law.

Confidentiality. Responding to a negative review is where firms most commonly cause themselves a problem. A response that confirms the person was a client, describes the matter, or corrects their account of the facts may disclose confidential information — regardless of whether the client disclosed it first in their review. The client's own disclosure does not release the firm from its duty.

The workable response format is short, acknowledges the feedback, declines to discuss the matter publicly, and offers a private route. Nothing more.

Substantiation. Professional codes generally require that claims are accurate and can be evidenced. An aggregate rating displayed on a website should reflect the actual underlying data, from a real source, current as at a stated date.

Disparagement. ICAEW's Code of Ethics at R115.2 prohibits promotional material that disparages or discredits the practice or services of others — and ICAEW's guidance is explicit that this applies even where the statement is objectively and demonstrably true. A firm cannot say it provides a better service than a named competitor, however well evidenced. Comparative review claims need care for exactly this reason.

Client-specific outcome claims. Testimonials that describe results carry an implication about what other clients can expect. Where outcomes depend on facts, that implication needs qualifying.

A defensible process

For a firm of any size, the following is proportionate:

1. A written review policy. One page. States that the firm does not solicit or commission fake reviews, describes the collection method, states whether incentives are used and how they are disclosed, and sets out how negative reviews are handled. This document is what makes the "reasonable and proportionate steps" duty demonstrable.
2. A single collection trigger. File closure is usually the right moment. Automated, universal, identical wording.
3. No incentive, or a disclosed one. No incentive is simpler.
4. Display everything or display transparently. If the site pulls reviews from a platform, pull all of them with the real aggregate. If it uses selected testimonials, say how they were selected and link to the full source.
5. A response template for negative reviews that discloses nothing.
6. A periodic check of what is published, including anything a marketing supplier has added.
7. Supplier terms that prohibit review generation. If an agency or lead generation provider produces reviews on the firm's behalf, the firm carries the exposure. Commissioning is caught by the ban.

That last point deserves emphasis. Firms that outsource marketing sometimes discover that reviews have appeared without anyone at the firm deciding to obtain them. The firm's contract with its supplier should close that off explicitly.

Common questions

Can we ask clients to leave a Google review?
Yes. Asking is not incentivising. Ask consistently and without conditions.

Can we offer a charity donation for each review?
It is an incentive, so it must be disclosed clearly. Simpler not to.

Can we remove a review from our own website?
Where it is defamatory, breaches confidentiality, or is not from a genuine client, yes. Where it is simply unfavourable, removing it while retaining favourable ones risks producing misleading review information.

Does this apply to B2B firms?
The DMCC unfair commercial practices provisions are consumer-facing. A firm acting only for corporate clients has less direct exposure — but professional conduct obligations around accuracy and substantiation apply regardless of client type, and Google reviews are visible to consumers whatever the firm's client base.

Are LinkedIn recommendations caught?
A recommendation about an individual is a different thing from a consumer review of a service. But the same principles — genuine, not commissioned, not misleadingly presented — are the sensible standard to apply.

---

TIKF Group manages digital presence for regulated professional firms, including review processes designed around consumer law and professional conduct obligations. Request an audit.

This article describes publicly available regulatory requirements and is not legal advice. Firms should verify current obligations against the DMCC Act 2024, CMA guidance, and their own regulator's code.