Customer testimonials and the law

27 Jan 2013
Alasdair Taylor

Testimonials are a good way to reassure potential customers that your business is genuine, and your products or services are well-regarded by existing customers. By way of example, you can see ours here.

There are however a couple of legal issues you should bear in mind if you’re thinking of collating and publishing testimonials on your website.

First, don’t make them up!

Ethics and evidential issues aside, inventing testimonials is likely to make you a criminal under the Consumer Protection from Unfair Trading Regulations 2008 (which cover marketing aimed at consumers) or the Business Protection from Misleading Marketing Regulations 2008 (which cover marketing aimed at businesses).

Second, get consent to publish testimonials.

While unsolicited praise is very gratifying for a business owner, you should almost always ask for consent to publish, because:

  • the text of a testimonial may be protected by copyright (as a literary work);
  • if you want to use a customer logo, this will also usually be protected by copyright; and
  • if you want to use a personal name, as indeed you should, then the testimonial will constitute “personal data” under the Data Protection Act 1998.

At the risk of over-legalising, you might want to think about formalise the licence to publish testimonials. A formal licence should cover:

  • the basic right to publish – what, where and how?
  • a right to alter testimonials – e.g. to reflect changes in company names; and
  • a right to request the removal of a testimonial by the person giving it, which might be necessary where a great early experience of a business turns sour.

Consent could, for example, be covered by your website T&Cs or included in a special testimonial submission form.

A suggested clause is set out below.

x.1 If you submit a testimonial to us using [this form / our testimonials form], then you agree that we may publish your testimonial, together with your name and any logo that you upload using the form, on this website[ and on any successor website that we may operate from time to time], on such page and in such position as we may determine in our sole discretion.

x.2 You further agree that we may edit the testimonial and publish edited or partial versions of the testimonial. However, we will never edit a testimonial in such a way as to create a misleading impression of your views. [You may terminate this licence by giving to us 30 days’ written notice of termination.] 


I work for a small law firm. At the conclusion of my cases, I request a Google review. My employer has taken many of my favorable reviews and reposted them to the firm website, but removed my name and replaced it with “my attorney,” thus making them generic to the firm (and thereby, the other lawyers in the firm to whom the reviews did not apply). Is this illegal?

If a user leaves a review under the general company webpage but discusses a specific product; Can we copy and paste that review to place under that specific product on the website?

My wife’s former company is using customer testimonials in advertisement that specifically reference my wife’s name and the service she provided.  She is no longer with the company.  How long are they allowed to use her name in their advertisement and is there anything she can do?

Assuming EU law applies here, there may be room to make an argument that this is not lawful under data protection law.  However, I think you would need to consult a lawyer to get a clear answer to this question – legality depends upon all the circumstances.

What if you give a testimonial for the great service provided by a doctor affiliated with a cetrain group practice then that doctor leaves that practice and the current practice  uses your testimonial, in his profile for their office that he is now affiliated with, but still has the name of the previous practice in your original teatimony?

I hope I asked my question correctly.

I am gathering testimonials from clients by way of a questionnaire.  We would like to use some of the comments in marketing material – should there be a consent box on the questionnaire that clients sign to show consent?

Maybe, but not necessarily. Whilst under IP law you will need a licence to use the testimonials, and in one sense that licence requires consent, you may not want to use consent as your basis for processing under the GDPR, as consent under the GDPR is inherently withdrawable. An alternative approach would be to use “legitimate interests” as your basis for processing hte personal data. The best approach here will depend upon all the circumstances. Sorry if this is not a very useful answer.

Hi there, a supplier of ours has provided terrible customer service on two occasions in the first 6 months of the contract and I have left negative reviews online for them. They offered to release us from our contract (which we want), but then said that they would only do it if we improve or remove our negative feedback online. Essentially blackmailing us into removing the bad reviews! What would be the legal standing on this please? Thanks

It may be that the poor customer service amounts to a breach of contract, in which case you may be able to exit without their agreement.  You should review the contract document – or ask a lawyer to do so – to determine whether there has been a relevant breach.

That is, very likely, and infringement of the copyright in the photograph, which absent any transfer or relevant employment relationship will be owned by the person who took the photograph.  There could also be other IP rights in play, for instance copyright or design rights protection the jewelry itself.

We’re looking at adding testimonials to our website. To make the testimonials more ‘personal’ we wanted to use stock photos of people to put next to a few testimonials. Is there anything wrong with using stock images of people rather than an actual image/photo of the person leaving the testimonial?

Thank you for your article. I was looking for accurate information about exactly this but I would like to make sure I have understood correctly. I am in the UK and I do put testimonials on my website and usually used just the person’s first intitial, last name and town or organisation. They are never put on the website without permission. I recently received marketing material from a major bank. The business name and address on the marketing material were correct, but, the person’s name to whom it was addressed was that of one of the people who wrote one of the testimonials on my website. Theirs was the only name of a testimonial author which was written as full First and Last name but their business name was also written with it so it was clear that they were not linked to my business in any other way. It has taken three weeks for the bank to tell me where they bought the data (they bought it from a very major credit check and marketing data company). So, I contacted the marketing data company who told me they use fuzzy logic to find additional information/data linked to a business to give their customer as much useful information as possible, but, the additional information/data they find is always in the public domain. They are going to look into how this name got onto the marketing data they sell about my business but immediately pointed out to me that the name was shown as the author of a testimonial on our website and that this immediately establishes a link, so I have changed the name in question on my website to first initial, last name and town. My question is, have I breached the Data Protection Act even though I had permission and the testimonial and name were put on my website in exactly the same format as was given to me by the customer? My second question is, has the data marketing company (or any other organisation they buy data from) done anything wrong if they lifted that name off my website and sold it? Is the person’s name in the public domain because it is on the website at all, (the content of which is copyrighted), or is it personal data as I believe I understood from your article? Many thanks.

I received testimonials from my corporate position. I am currently a new owner of my own business with the same services as my corporate job. Can I use the testimonials I received from my job for personal business if given permission by the testimonial provider or does that breach some sort of legal policy?


Thank You!


hi there I am doing interviews with previous happy customers to feature on home page – so we can reassure future customers on some of their barriers to purchase.

we intend to give a small payment to cover the cost of their time to do the interview, not so they will give us positive feedback- we will already have establised without payment that they are a happy customer. 

Is this ok? 


Hi there – we have a lot of positive reviews on our public Facebook page. Is the copyright / data protection any different for these? We can add the above clause to our website T&Cs (which is also on our Facebook page) but would this still cover Facebook reviews? We’d like to use the positive statements in marketing materials.

Thanks in advance.

The first thing to do is to check the Facebook T&Cs to see what they say about the ownership and licensing of this type of content.

Hi there – I work for a technology company who want to publish some customer quotes on their marketing material. The quotes are things customers have said to us, however, my company has decided not to credit the customer (or ask their permission) to avoid breaching copyright (if they said no etc.) – this seems a little dishonest to me, but also I am worried they are breaking the law. Are you able to clarify, please?

If the quotes are sufficiently original and substantial to attract copyright protection, then the way to avoid breaching copyright is to get permission. Use of copyright material without permission is a (crude) definition of copyright infringement.

If you include with the quotes information from which any individuals may be identified (eg individual names, sole trader company names) then there may also be privacy and/or data protection issues here.

I’m a professional speaker and after I speak at a conference or event I normally pull out my phone and record testimonials from some participants. I normally just record what they think about the presentation or me as a speaker. Should I ask them if they give me permission to use this testimonial in my marketing material and record that on the same video file (without publishing that part, of course)? Or just the fact that they are giving the testimonial straight to the camera be enough to prove they are consenting on the testimonial?

They are consenting to the testimonial, but not necessarily to any particualr use of the testimonial.  Accordingly, I suggest that you get a specific recorded permission here. NB If you are relying upon consent to comply with data protection rules here, such consent may be withdrawn later.

Good Afternoon. Please could you advise… Is it legal to post “Testimonials” from clients on a company website, when the individual who posted the “Testimonial” is no longer employed by that company? Many thanks.

I’d need a little more information here to give some guidance. Was the relevant employee authorised by the client to provide a testimonial at the time it was provided? In what specific manner and circumstances was the testimonial provided? Do any written T&Cs or other written agreement govern the use of the testimonial?  If so, what does the documentation say about usage? Has the client objected to use of the testimonial? Do you have reason to believe that it would?

We inherited a business 3 years ago which included all hard-copy testimonials that were used in the advertising and on the website.  My question is – as we no longer use these testimonials in our advertising, can we dispose of them (they do not contain personal details apart from first and last name) or do we have to keep them for a certain number of years?

Many thanks

Unless you have (or the business has) given a contactual commitment to keep the testimonials (which would, it’s fair to say, be very unusual) then it’s probably safe to dispose of them.

Hi, Our business used to make use of a consulting company and we gave them two glowing video reviews. We have since moved on and we see the consulting company is still using our reviews for marketing. The break-up was bad. We didn’t sign any content release forms – so I have kindly requesting removal of these testimonials from Facebook and their website. Their contract did not have a confidentiality clause in (for the consultant and our business) – I am expecting some argument in terms of use of the materials. Do I have any rights to have this removed from Facebook and their websites etc?

There are various types of legal argument that you might make here depending upon the details – eg under copyright law, contract law or data protection law. However, I don’t think the information here is sufficient to form a view on what might or might not work.

Assuming there is nothing in their contract (or in any other document agreed by the parties) that has an effect upon the use of the testimonials, and assuming that there was no unwritten agreement about the use of the testimonials, then we are probably dealing with an implied licence/consent of some kind, and indeed it may not be possible to decide whether such a licence/consent is revocable without consulting a judge. I doubt there is much in the way of case law to go on.

I left a testimonial on a site in July for a dog breeder, as my husband and I had a great experience with them and I wanted to share that on their website. Two days ago I was messaged on facebook by a person who was asking about my experience with a different breeder. That second breeder had copied and pasted my testimonial from the original website, who they have no affiliation with, but changed the name of the breeder to his own and the name of the dog. He kept my name as reference but when I called to complain about his use of my review when I had never worked with him, and the breed of the dog was completely different, he hung up. Then he texted me back saying he would have it down by tomorrow night, which hasn’t been done. The only thing they did was change my name to a made up name. I also saw this process happen. I’m appalled at this as it’s not very reputable to do as a dog breeder. Is there anything I can do to make the breeder responsible for his false testimonial? Who knows if any of his testimonials are true?

In theory there are several forms of legal claim you might look at here, most notably copyright infringement. In practice, however, a report to the relevant local Trading Standards office may be the most proportionate response.

If a customer sends an email to one of our staff members, thanking them for providing a great service etc, are we allowed to use that comment and their company name for a testimonial on our website without their express permission? And if we do this, what are the potential repercussions?

If the comment is substantial enough, this could be a breach of copyright. This sort of thing is most unlikely to go to court however. The bigger risk may be damage to customer relationships.

I want to create a tutorial video product of a known website on creating an online store.  This website offers the capacity to create a store but it’s complicated for newcomers and even if they belong to this site for a long time as a member it will be difficult – unless someone is there personally to guide them or with a video to guide them. This is where I come in. The problem I face is: can I legally use the name of the website and use the logo as a title header in my ebook and domain name describing my product without legal issues if I acknowledge the website in both my video and pdf ebook ?

Feel free to email me any legal info that will help.


A solicitor who I did work for kindly provided me with a testimonial for my new website. He has now left the firm he worked with and I received an email from that company demanding I take the testimonial down. I removed the company name from the testimonial but left the solicitor’s name. However the firm are still not happy with this and have threatened legal action if this is not taken down. It’s a short sentence saying that the solicitor was impressed with the service I provided. Nowhere does it mention the company name. Do I have to take it down?

I had a group of customers come to a free training session for a new program we are launching, at the end of session one, they were quite pleased and we asked to record video testimonials about what they learned. We got them all to sign simple one-sheet documents that says we are allowed to do whatever we want with these testimonials, but we did not express on that document any reference to “copyright” per se.

One of the customers later went on to work as a spokesperson for a competing company whose boss has issues with me. He called us up and told us that his boss is quite unhappy about his testimonial being on our website and in our promotional video, and the boss is quite adamant that we remove it.

Does he have any right for that?

I want to include a testimonial on my website that a friend left me reviewing a product.

The product is of a somewhat embarrassing nature and he has asked if he can submit the testimonial under a pseudonym. Does anyone know the legality of this?


We are about to film a video with a customer testimonial, and my manager asked if we will pay the customer? I am not sure if this is legally acceptable?

If a key opinion leader / major company in an industry [Company A] buys an expensive piece of capital equipment from company B it would be seen as an indirect form of endorsement of the product by other members of the same industrial community.

May company B publish that company A has become a user of their product without seeking the permission of comapny A?

The default position here under English law is that the publicising the purchase wouldn’t be prohibited, but depending upon the circumstances there could be specific issues. For example: if the fact of the purchase is confidential in some way, the publication could be a breach of confidence. Purchasing T&Cs also sometimes prohibit this sort of publication.

Hello, we have customers leaving testimonials on our website using a Facebook comments plug-in. So we have their Facebook profile information available. We would like to use some of the testimonials on our product package, which will be sold in retail shops/drug stores. Our product is a pain relief product. I understand that we should contact the customers and get written permition to use the testimonials on the package? Should we ask them to send us a signed letter by post or is an email confirmation enough?

There are a few different potential issues here, relating to: (i) copyright; (ii) data protection rights; and (iii) product regulation.

The copyright issue arises to the extent that the testimonials are sufficiently “original” and substantial to attract copyright protection. If they do have copyright protection, you need permission (a licence) to use them. In principle, an email permission should be fine, although the evidential value of a signed piece of paper may be  greater.  (Of course, the evidential strength of the permission only becomes relevant if you get into a dispute about whether permission was properly given.)

The primary data protection issue arises in relation to any use of any personal data (eg a name) as part of the testimonial. Generally, a clear consent should be adequate for the use of the personal data on product packaging. Again, the form of the consent (email vs paper) is an evidential question. NB there may also be an issue with the use of personal data to seek permission. Do you have a pre-existing consent to use the data for that purpose?

I’m not familiar with the relevant laws, but you should also check that there are no special rules affecting this type of product.  Eg medicines and medical devices are subject to special regulation concerning product packaging and marketing statements.

As always, the above approaches the questions from the perspective of English law – other issues may arise under other legal systems. I suggest you consider taking professional advice on this.

Do you have any advice for collecting video testimonials? We want to use an app called Boast, which enables our site visitors to leave a video review or using a mobile app. These videos can be displayed on the website, but we thought of editing a selection and having a youtube vide made from it. Can we use your suggested clause or do we need anything else in addition? Thanks

You are very welcome to use the suggested clause, although I would suggest altering it to be more specific about about exactly what it is you plan to do.

I would like to put customer testimonials on my website for nutraceuticals that I am marketing. But I have been told that I cannot do this by my website company. What are the rules around this and how can I legally do this?

As a company we have a number of customer testimonials with agreement for use in marketing purposes. We’ve since set up a division of the company with a specific trading name (ie “XYZ” a trading name of “Company Z”).

The testimonials have the company name in, but will appear on the website for the division.

Can I change the company name in the testimonial to the division name to avoid confusion when potential new customer reads them?

There probably isn’t an entirely clearly legal answer to this question, as the (copyright) licence for using testimonials isn’t usually written down. For this reason, you may want to take a pragmatica approach: if the changes won’t offend the providers of the testimonials in any way, then there is little risk in making the changes.

I’m currently a student and towards the end of my first tenancy with letting agency i emailed them with a few questions about vacating the property. At the end of the email I finished with a quick thank you sentence. I have just been informed by a friend that my comments along with my first name, initial of surname and the road I lived on have been published on their site under their reviews section. Where do I stand on this? It was a private comment in a personal email and they have not asked for my permission to publish anything by me. Any help would be greatly appreciated. Thanks!

If I were in this situation, and I wanted the testimonial removed, I would:

  • first, send a polite message requesting removal (not mentioning any specific legal basis);
  • if that didn’t work, send a polite reminder, pointing out that the publication may be an infringement of copyright (if there’s enough of it), breach of privacy and/or breach of data protection law; and
  • if that didn’t work, and I was really incensed about the testimonial, send letter explictly threatening legal action.

They might of course ignore any threats, as legal action would be wholly disproportionate.

No it isn’t, and I am unlikely to pursue it. But it all seems rather unjust and I just wanted to know your thoughts. Thanks for sharing them.

Hello, I received client testimonials that praised my work personally (specifying my name).

Since I have left the company, they have removed my name from the testimonials and inserted the name of the company in its place.

Can you confirm what, if any, recourse I have.

Hi, I contacted the company’s website host and they said I have to get a court order to have it removed. So I’ve decided to take legal action. Can you advise on the best way to word it briefly without writing down too much? Does that make sense?

… on commencing legal proceedings, you will need to consult a solicitor or equivalent. There are too many variables and risks to provide this kind of assistance in blog comments.

I started a business and was working with a particular web design company, but things didn’t work out; however she came up with a “deal” where she agreed to send us photos of her wearing our products in exchange for my testimonial giving her good feedback. I completed the testimonial on top of sending her a free item and donating money to her foundation but now she’s backed out of sending us photos as previously discussed. I requested my testimonial be removed due to that and she sent me a cease and desist letter. Does this mean she has to remove my testimonial? If not, what legal actions can I take to have it removed?

On the basis of the information you have given me I think the “deal” is probably enforceable (as a contract or variation of the existing web design contract).

It doesn’t necessarily follow that she must remove the testimonial: it depends upon whether the right to use the testimonial was intended to be conditional upon the provision of the photos. If it wasn’t, your remedy is probably in damages, which may well be negligible.

In any case, the usual way to try to enforce legal rights in these sort of circumstances is to: (i) politely request the required actions; (ii) threaten legal proceedings; and (iii) if the benefits clearly outweigh the costs, issue and pursue legal proceedings. I find it hard to believe that (iii) will be satisfied in this case.

If you are satisfied she does not have the right to publish the testimonial, another course would be to contact her hosting company and request that they arrange the removal of the testimonial.

Also: what is she asking you to cease doing in her letter?

Thanks for the fast response. The letter stated she would no longer communicate, respond or assist us in the future with any services. I’m not satisfied because she didn’t complete the deal she initially came up with. I just want my testimonial removed. What legal action can I threaten her with? 

To follow-up on my previous post that I just submitted, since you are saying that a product review or testimonial should have the author’s consent to use for other purposes like an email campaign. What is the differnce between that and a ecommerce site owner removing bad reviews. Is that a seperate issue?

… that copying and publishing are acts restricted by the law of copyright; deleting is not.

Just to be clear on what your saying. If a customer leaves a product review on our ecommerce site, and we want to use it in an email blast, we need to get their permission becuase it could be considered ‘copyrighted’? Doesn’t the fact that they put the product review in the public domain on our site entitle us to use it, or should I, as you suggested, put a terms and conditions page on our ecommerce site?

Yes, that is right. Putting the review on your website is not the same as putting it in the “public domain” for the purposes of copyright law. The safest course would be to get a proper licence as suggested. Of course, the chances of a complaint may in fact be rather low.

We have a customer who when the works were completed gave us a testimonal.  Unfortunatly he later failed to pay his bill, and despite repeated attempts to recover the debt we where forced to issue court proceedings against him.  He gave us the testimonal, however we didn’t get a legal agreement draw up in any form.  Can he demand we remove his testimonal and picture of his house from our website. The dispute is purely related to his failure to pay his debts?

The question is: did the terms of the licence to use the testimonial include a right for the customer to revoke the licence?

As the licence was not in written form, and there is no “standard industry practice” (that I am aware of) to follow, perhaps the only way to get an answer to this question is to ask a judge.  As litigation would be hugely disproportionate, I doubt there will ever be a clear answer to this question.

The best approach, as often, is to write down the terms of the licence, and get customers to expressly agree to those terms.

ps If I were you I would remove the testimontial: I wouldn’t want to give a difficult or unsatisfied customer more reasons to be unsatisfied, not least because of the risk of poor reviews being posted elsewhere on the internet.

If a person has left a positive comment on my site, and added his name, must I ask him before I use his comment and “first name plus last initial” for a testimonial?

I’ll assume that: (i) the comment was published on your site, and was intended to be published by the user, e.g. as a blog comment; and (ii) your website T&Cs don’t have anything to say about the legal basis on which comments are provided; and (iii) by “use … for a testimonial” you mean republication on your website on a special testimonials page.

If these assumptions are correct, I think the risk of this sort of reuse is very low, although without an express licence (see point (ii) above) you can never be entirely sure.

If assumption (i) is incorrect, and the comment was sent to you directly, the risk is somewhat greater. If this is the case, why not ask the person for permission to use the comment as a testimonial? That’s what I do (or should do … ) when SEQ gets unsolicited praise.

If you have an affiliate website that markets a product, can you use the testimonials from the company’s site about that product on your affiliate website? The testimonials are copied and not altered in any way. The product you are promoting is clearly identified in the testimonial.

You would need the permission of the copyright owner to reproduce each testimonial. In most cases the copyright owner will be the person who wrote the testimonial or the employer of that person. In some cases you might also (or alternatively) need the permission of the company in question, for example if that company has been granted an exclusive licence to publish the testimonial.

I produce a fundraising event in Texas and at the end of the event, attendants, winners and staff of the non-profit who were in attendance were asked, and exuberantly agreed to providing videotaped testimonials.  Their testimonials were produced unedited, unscripted and unrehearsed in a marketing clip featuring their name, title and their non-profit organization logo in background.  Their testimonial claimed a wonderful fun-filled evening, raising more money then expected, better turnout, etc.  Nonprofit now wants us to delete using video testimonial, quotations, etc.  What gives?

Add a new comment

Your email address will not be published. Required fields are marked *

SEQ Legal
Copyright © 2024 Docular Limited | All rights reserved