When you collect and publish customer reviews you process personal data. Under GDPR and similar laws you need a lawful basis, clear information about how data is used, data minimisation, security and a way to handle access, correction and deletion requests. Ask for explicit permission before publishing names or photos. This is general information, not legal advice.
- A review often contains personal data such as a name, email address, photo or details about a purchase, so privacy law can apply.
- You need a lawful basis for collecting and publishing reviews, and consent is one option but not always the only one (check with counsel).
- Be clear in a privacy notice about what you collect, why, who sees it and how long you keep it.
- Collect only what you need, for example a first name and rating, instead of full contact details on a public page.
- Get explicit permission before publishing a full name, photo, company or video, and record the date and wording.
- Prepare a process for access, correction and deletion requests, and respond within the time limits that apply to you.
- Check vendors and international transfers, and sign data processing terms where required.
- This article is general information and not legal advice, so confirm requirements with a qualified adviser.
What are the key GDPR requirements for reviews?
- Lawful basis under Article 6, such as consent or legitimate interests, must be identified before you process review data.
- Transparency obligations, including Article 12 and following, mean telling people clearly how you use their data.
- Data minimisation means collecting only the details you actually need for the review and its display.
- Security measures should protect reviewer data from loss, misuse and unauthorised access.
- Retention should be limited, so decide how long you keep reviews and reviewer details and remove them when no longer needed.
When do you need consent to publish a review?
- Publishing a full name, photo, company logo or video is a clear step that identifies a person, so ask for explicit permission.
- Consent under GDPR should be freely given, specific, informed and unambiguous, and it should be as easy to withdraw as to give.
- Record who agreed, when and to what wording, and store the record securely.
- Offer an anonymous or first-name-only display option for people who prefer it.
- Do not make permission to publish a condition of getting service, and review rules that apply to incentives separately.
How do you handle rights requests?
- People may ask to see their data under Article 15, correct it or ask for deletion under Article 17, depending on the circumstances.
- Set up a simple contact route, such as a privacy email address, and tell reviewers where it is.
- Log each request, confirm the person's identity, and respond within the time limits that apply to you, which is typically about one month under GDPR.
- Deleting a review from your site may also require removing it from backups, exports and third-party widgets over time.
- Keep a note of what you decided and why, in case a regulator asks.
What about vendors and international transfers?
- If a review tool processes data for you, it is usually a processor, and a data processing agreement is normally needed.
- Check where the vendor stores and accesses data and whether it uses sub-processors.
- Where data leaves the EU or UK, review the transfer mechanisms in place, such as standard contractual clauses.
- Ask vendors for security documentation and breach notification terms.
- Re-check these arrangements when you add integrations, such as widgets or automation tools.
How do US laws such as CCPA fit in?
- The California Consumer Privacy Act and similar state laws give residents rights to know, delete and opt out of certain uses of their data.
- Thresholds and definitions vary, so check whether your business is covered.
- Notices at collection and privacy policies must describe the categories of data you gather.
- Review rules for endorsements, such as FTC guidance, apply separately from privacy law.
- Seek advice if you serve customers in several regions.
What does a practical compliance checklist look like?
Step-by-step: how to do this with ProofBeer
Map every place where reviewer data is collected, stored and published.
Decide the lawful basis for each activity and record it, with legal advice if needed.
Update your privacy notice to explain review collection, display, retention and rights.
Add a consent checkbox for publishing name, photo or company, with a link to the notice.
Minimise the form so it collects only what you need, and offer first-name-only display.
Set up a contact route and a log for access, correction and deletion requests.
Review vendors, sub-processors and data transfers, and sign data processing terms.
Schedule an annual review of your process and train staff who handle reviews.
Common mistakes to avoid
Metrics to track
Share of published reviews with a recorded consent or documented basis.
Number of rights requests received and average response time.
Number of data fields collected per review.
Vendors with signed data processing terms.
Date of the last privacy review.
Quick checklist
Examples and templates
'I agree that my first name and review may be shown on this website. I can withdraw this at any time by emailing privacy at the address in the notice.'
'We have received your request and confirmed your identity. We have removed your review from our website and will remove it from our backups in the normal cycle.'
'Reviews and permission records are kept for three years unless the reviewer asks us to remove them earlier.'
- Use plain language in notices and consent text
- Keep consent records separate from marketing lists
- Ask a lawyer to review your wording once a year
How ProofBeer Helps You Grow
Capture consent for publishing identifying details when feedback is submitted, so you hold a record.
Let you display reviews with first name only or an anonymous label if the reviewer prefers.
Keep reviews and testimonials in a single dashboard, which helps you find and remove content when someone asks.
Frequently Asked Questions
Does GDPR apply to customer reviews?
It can. A review often contains personal data such as a name, email address or photo, and processing it can fall under GDPR if you serve people in the EU or UK. Check your situation with a qualified adviser.
Do I need consent to publish a review?
Not always, because a lawful basis other than consent may exist, but explicit permission is a safe practice for names, photos, logos and videos. Record the date and wording, and make withdrawal easy.
How long can I keep reviews?
There is no single period. Decide a retention period you can justify, document it and delete or anonymise data when it is no longer needed. Keep identifiable data for as short a time as practical.
What should I do when someone asks to delete their review?
Verify their identity, check whether a legal reason requires you to keep it, and remove it from your site, exports and widgets where appropriate. Reply within the time limit and log what you did.
Are review vendors responsible for compliance?
Responsibility is shared. A vendor is often a processor and must protect the data, but you remain responsible for having a lawful basis and a clear notice. Sign data processing terms and check security details.
Is this article legal advice?
No. It is general information about privacy and reviews. Laws differ by country and change over time, so consult a qualified lawyer or data protection professional for decisions about your own business.
Conclusion
Reviews build trust, and good privacy practice protects it. Collect only what you need, explain how you use it, record permissions and be ready to correct or delete on request. When in doubt,
take advice for your region.
- GDPR text - Articles 6, 7, 12, 15, 17
- California Consumer Privacy Act guidance
- EDPB and ICO guidance
