Skip to content
Law & data protection

Customer Testimonials: Proving They Are Genuine

Reviews on your own website: what Section 5b(3) UWG requires, three practical ways to verify them and what the customer release has to cover.

14 min read KundenstimmenUWGTrust-SignaleRechtssicherheit

In short and in plain language

Do you show customer quotes on your website? Then you usually have to say if and how you check that they are real.

This note belongs right next to the quotes. If it is missing, that can break the law.

Small firms have simple ways. Link each quote to a real order. Or let the customer approve it in writing. Or show all reviews from your profile.

Name, town and photo are personal data. Get a consent you can prove. The customer may take it back.

We build the block with the note and the approval for you.

On the home page there is a box with three short sentences and five stars above them. It has been there since the last relaunch, and today nobody in the company could say where those sentences actually came from - an email, a phone call, or the pen of the agency that built the site. This is exactly the point where a harmless design element turned into a legal question. Anyone who makes consumer reviews accessible must, under Section 5b(3) of the German Act Against Unfair Competition (UWG), state whether and how they make sure the reviews come from people who actually received the service. This article shows three verification routes a small business can realistically take, which sentence has to sit next to the review block, what the customer release looks like - and when a testimonial block is better left off the page entirely. How reviews are managed on the third-party profile is covered in managing Google reviews actively; this piece is about your own site.

Key takeaways

  • The duty applies to everyone who makes reviews accessible, not only to review platforms. Section 5b(3) UWG counts information on whether and how authenticity is ensured among the material information a consumer is owed.
  • If that information is missing, it is material information withheld. Section 5a(1) UWG turns that into an unfair commercial practice as soon as the visitor needs the information for their decision.
  • Claiming that the quotes come from real customers without having taken reasonable and proportionate steps to verify them falls under number 23b of the annex to Section 3(3) UWG - and there is no balancing of interests in the individual case there.
  • Three verification routes are enough for a small business: an order reference in your own system, a signed release for each quote, or an unfiltered import from the business profile. What matters is not the technology but that the route is described and actually kept.
  • The customer's name, town and photo are personal data. Consent under Article 6(1)(a) GDPR has to be demonstrable under Article 7(1) GDPR - and it can be withdrawn at any time.

What the law requires for testimonials

The rule entered the Act Against Unfair Competition when Germany transposed the European modernisation directive, and it consists of a single sentence. Section 5b(3) UWG provides: „Macht ein Unternehmer Bewertungen zugänglich, die Verbraucher im Hinblick auf Waren oder Dienstleistungen vorgenommen haben, so gelten als wesentlich Informationen darüber, ob und wie der Unternehmer sicherstellt, dass die veröffentlichten Bewertungen von solchen Verbrauchern stammen, die die Waren oder Dienstleistungen tatsächlich genutzt oder erworben haben." In English: where a trader makes accessible reviews that consumers have carried out with regard to goods or services, information on whether and how the trader ensures that the published reviews originate from consumers who have actually used or purchased those goods or services counts as material. Two words carry the whole weight: whether and how. The law does not prescribe a check. It prescribes that you say whether you check, and if so, by which route. A business that openly writes that it does not verify the origin has met the duty - it only loses the trust argument the block was built for in the first place.

The consequence sits one provision earlier. Material information must not be withheld: under Section 5a(1) UWG a trader acts unfairly if they mislead a consumer „indem er ihm eine wesentliche Information vorenthält" - by withholding material information that the consumer needs in the circumstances for an informed transactional decision and whose absence may lead them to a different decision. A review block with no statement of origin at all is exactly that case. The visitor reads the stars as a statement about real jobs, and that assumption is left uncorrected. That reviews carry so much weight is no accident - they belong to the trust signals on a website that decide the visit before the first sentence is read.

It gets sharper the moment the business expressly claims the reviews are genuine. The annex to Section 3(3) UWG lists practices that are always unlawful towards consumers - no balancing, no threshold. Number 23b covers the claim that reviews of a product or service come from consumers who have actually purchased or used it „ohne dass angemessene und verhältnismäßige Maßnahmen zur Überprüfung ergriffen wurden" - without reasonable and proportionate steps having been taken to verify it. The popular line that all reviews come from real customers is therefore no longer a figure of speech but a claim that has to be carried. Whoever writes it down has to walk the route behind it.

What triggers the duty

Making the reviews accessible is enough. It does not matter whether the business collected the quotes itself, took them from a platform or set them as a pull quote on a reference page. As soon as a consumer statement about goods or services sits on your own site, the duty to inform applies - even for three sentences in the footer area.

What the duty does not require

No statute prescribes a particular verification procedure, and none demands gap-free control. What is demanded is the disclosure. Reasonable and proportionate means exactly that: what a four-person business can manage is a different yardstick from what a platform with millions of entries can manage.

Where it becomes always unlawful

Number 23c of the annex names two things in one breath: submitting or commissioning fake reviews, and misrepresenting consumer reviews or endorsements. For your own site that means above all: no quotes you wrote yourself, none bought in, none ordered from friends and family.

Three verification routes a small business can take

The question in the consultation is almost always the same: how is a trade business with four people supposed to ensure that reviews are genuine? The answer is unspectacular. It needs no service, no interface and no certification body, but a decision in favour of one of three routes and the discipline to keep to it. All three can be set up in a morning, and all three can be described in a single sentence - which is convenient, because that sentence is exactly what has to sit next to the block afterwards.

Route 1: order reference

A quote only goes on the page if there is a matching job, invoice or appointment in your own system. The link is recorded internally and never published. This is the strongest route and the easiest one for businesses that write up every job anyway: the evidence is already sitting in the bookkeeping.

Route 2: signed release

The customer writes or confirms the text and releases it in writing - on paper, by email or through a form with a confirmation mail. The release carries a date, the exact wording and the scope of publication. It settles two things at once: the proof of origin and the data protection consent.

Route 3: unfiltered import

The reviews are taken from your own business profile, in full and unchanged - not just the friendly ones. The business then does not verify anything itself but points to the platform's procedure. That is permitted, but it has to say exactly that and must not be passed off as your own check.

The third route is the most convenient and at the same time the one where most mistakes happen. Anyone embedding reviews from their Google Business Profile while letting through only the four and five star entries misrepresents the overall picture. An excerpt is allowed if it is made transparent: the total number of reviews, the average and a link to the full list belong next to it. Without those three figures, a selection turns into a statement the underlying data does not support.

All three routes share the same quiet precondition: the profile the quotes come from has to genuinely belong to the business. Claimed, duplicated or never-confirmed entries make any statement of origin worthless, because nobody can say who writes there. How to secure your own entry is covered in verifying your business profile and protecting it against fakes. Only after that is it worth pulling reviews onto your own site.

Verification routeEffort per quoteWhat it provesWhere it fits
Order reference in your own systemA few minutes, usually done alreadyThe person demonstrably was a customerTrades, practices, service firms with a job history
Signed releaseOne short form per quoteOrigin and consent in a single stepDetailed references with name, town or photo
Unfiltered import from the profileOne-off setup, automatic afterwardsThe platform's procedure, not your own checkRetail and hospitality with many reviews
A folder of quotes with no link to anythingLowNothing - the origin stays openNone of the three cases, better no block at all

Pick the route first, then build the block

Before the next page draft, decide which of the three routes the business can realistically keep up, and write it down in one sentence. That sentence later becomes the mandatory notice, the briefing for the design and the answer to any enquiry - three jobs out of one decision. Do it the other way round and you end up with a finished block for which a justification has to be found afterwards.

The notice at the block: wording, place, technique

The information has to sit where the reviews sit. A paragraph in the privacy policy does not meet the duty, and neither does a line in the footer: material information must not be provided in an unclear or hard-to-reach way, and a notice three screen heights away is both. What works is a line directly under the heading of the block or a short text immediately below it, in the same type size as the quotes themselves and no smaller.

The wording may be plain. It has to answer two questions: whether you check and how. What it must not be is an advertising line that claims more than the business does. „Verified reviews" as a seal over an unverified block is precisely the constellation that number 23b covers. A collapsible area that hides the notice is risky too if the block itself is visible immediately - the information belongs on the same level of visibility as the stars.

  • The notice sits in the same section as the reviews, with no click and no scrolling in between.
  • It names the route, not just the result: order reference, written release or import from the profile.
  • It says openly when nothing is checked. That is allowed and still better than a claim with nothing behind it.
  • It says whether a selection was made. If the page shows only part of the quotes, the selection criterion belongs with it.
  • It is text, not an image and not a graphic - otherwise it does not exist for screen readers and search engines.
  • It travels along with every relaunch. The block almost always survives the move, the notice often does not.

Technically this is a text element attached to the component, not to the individual page. If the review block sits on the home page, on three service pages and on the reference page, then the notice has to come along in all five places without anyone maintaining it five times. That is precisely where it fails in practice: the sentence gets added once on the home page and the copies on the sub-pages stay unchanged. Setting up reviews as a reusable component solves the problem once - the same logic used everywhere else in conversion optimisation.

Three formulations that hold up

With an order reference: „We only publish feedback from customers for whom our system holds a completed job." With a release: „Every piece of feedback shown here was sent to us by the person named and released for publication in writing." With an import: „These reviews are taken unchanged from our business profile. We do not carry out our own check on the authors." On a reference page the same sentence sits once at the top and covers all the examples below it.

Getting the release from the customer

As soon as a quote carries more than „a customer from the region", data protection joins the picture. First name, surname, town, company name, job title and above all a photo are personal data, and publishing them needs a legal basis. In this constellation that is in practice always consent under Article 6(1)(a) GDPR: the data subject has given consent „to the processing of his or her personal data for one or more specific purposes". Specific here means: for the publication of this text on this website, not for advertising in general.

The text itself

The wording belongs in the release, not just the permission. Anyone who shortens feedback, smooths it out or merges two sentences into one needs agreement to the published version. The simplest form is the finished sentence in the form, with a field for change requests next to it.

The details about the person

Each detail is released separately: full name or first name only, town yes or no, company yes or no. That costs three checkboxes in the form and saves the awkward question of why the surname suddenly appears on the home page.

A photo alongside

A picture of the person or of the finished job is a separate point with its own rules. Who took it, who is visible and what the image may be used for should be settled before it goes online - the details are in image rights on your website.

What matters is the proof. Article 7(1) GDPR requires: „Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." A verbal yes at the kitchen table is consent, but it is not proof. In practice a filed form, a confirmed email or a record with a time stamp and the wording is enough. Anyone maintaining a reference page creates one row per quote: date, person, text, scope of the release, where it appears on the site.

What belongs in a release

Who is releasing (name, address or email), which wording is published, which details about the person appear, whether a photo is included, on which website and to what extent it is published, from when the release applies, and the note on withdrawal at any time with the address it goes to. Seven points on half a page - the form does not need to be longer, and it should not be shorter.

Consent is also not forever. Article 7(3) GDPR states: „The data subject shall have the right to withdraw his or her consent at any time." The withdrawal has to be as easy as giving consent, and it takes effect for the future. In practice that means a named address for such messages and a way to take a single quote off the site quickly - even when it sits in a component that is rendered on five pages. If a service provider processes the reviews technically, the question of the contract comes with it, which is described in data processing agreements your website needs.

When a block is better left off entirely

Not every page gets better with testimonials. Three sentences from six years ago, with no date and no link to a service, carry less than one good project description. A business with only two pieces of feedback is better off showing two detailed references with task, solution and result than a carousel block turning the same two sentences in circles. And anyone who can no longer reconstruct the origin has only one clean choice anyway: empty the block and rebuild it, rather than writing a notice above it that is not true.

There are also cases where the block does not belong on the page even with impeccable origin. In the medical professions, the advertising rules of the sector restrict third-party statements and letters of thanks far more tightly than competition law does - what applies there is set out in practice websites: what medical professions may show. Self-written or invented quotes are out of the question in any case: they fall under number 23c of the annex, and that route never pays off in any calculation. The damage is not confined to the legal position; it hits the credibility of every other statement on the page.

Star ratings deserve particular caution. Marking reviews up as structured data so that they appear as stars in search turns a design element into a statement in the results listing - with the same requirements for origin and completeness. Stars a company awards itself are not provided for there. What the markup can and cannot do is set out in rich snippets for local businesses.

Starting positionBetter with a blockBetter without a block
Origin provable for every quoteYes, with a notice naming the routenot included
Only two or three old quotesnot included Two detailed references instead of a carousel
Origin can no longer be establishednot included Empty the block, rebuild it, claim nothing
Only the friendliest quotes selectedYes, if selection, total and average sit next to itOtherwise better complete or not at all
Sector with tight advertising rulesnot included A factual description instead of testimonials
Quotes with full names but no consentnot included Fall back to first names or an anonymous form

Who can act on it

Claims for removal and injunctive relief are available under Section 8(3) UWG to, among others, „jedem Mitbewerber, der Waren oder Dienstleistungen in nicht unerheblichem Maße und nicht nur gelegentlich vertreibt oder nachfragt" - any competitor who distributes or purchases goods or services to a not insignificant extent and not merely occasionally - as well as to registered trade and consumer associations and to the chambers. The fifty thousand euro fine range in Section 19(2) UWG applies only to a widespread infringement within a coordinated enforcement action and in practice does not reach small businesses - a warning letter does. How to deal with a single inaccurate review is described in removing a negative Google review.

Building it in, maintaining it and what goes wrong

In the structure of the page, a testimonial block is a component like any other: heading, notice line, list of quotes, and for each quote the text, the person and the date. The date is the part most often missing, and it is the most useful one. Feedback from 2019 reads differently from feedback from last month, and a visitor who sees the date does not have to guess. Naming the service the quote refers to wins twice over - the same mechanism as with qualifications and seals, described in the master craftsman title and seals on a trade website.

Maintenance is an appointment, not a feeling. Once a quarter go through the stock, remove outdated quotes, add new releases, and hold the notice against the actual process: is the sentence still true, or has the way of working long since changed? The check is worth most after a relaunch, because the block travels along while the notice likes to stay behind. For businesses that touch their site regularly anyway - for instance in web design for trade businesses - this is one point on an existing list and not new effort.

  1. Take stock: which quotes sit on which page today, and where does each one come from?
  2. Sort out everything whose origin cannot be evidenced. Four evidenced quotes beat twelve unclear ones.
  3. Decide on one of the three verification routes and write it down in one sentence.
  4. Attach that sentence as a notice to the component, not to the individual page, and check it on every rendering.
  5. File a release for each quote, with date, wording, scope and an address for withdrawal.
  6. Set a quarterly appointment: check stock, dates and the notice against the process as it is actually lived.
  7. If prices or service scopes appear in the quotes, cross-check the same figures on the page - which pairs with publishing prices on your website.

A customer testimonial is worth exactly as much as the sentence beside it explaining where it came from - everything else is decoration with legal consequences.

Internetagentur Hildesheim

Sources and legal bases

This article is based on the official text of the German Act Against Unfair Competition in the version published on gesetze-im-internet.de (Sections 3, 5a, 5b, 8 and 19 and the annex to Section 3(3)) and on the consolidated text of the General Data Protection Regulation (Articles 6 and 7). It does not replace legal advice in an individual case; it prepares the conversation.

Related Articles

Web design & conversion

Trust Signals: Why Confidence on Your Website Sells

Trust signals on your website: how customer voices, references, quality seals and clear contact details turn visitors into enquiries - against AI fake shops.

12 min read
Law & data protection

Legal Notice 2026: Check Your DDG Details Correctly

Section 5 DDG replaced Section 5 TMG: which details belong in your legal notice, who is obliged, how reachable it must be and what really applies to the W-IdNr.

19 min read
Online shop & digitalisation

Local delivery: an online shop with its own delivery area

Delivery area by postal code or radius, delivery windows, delivery fees by zone and correct notes on delivery restrictions: how local retailers deliver.

17 min read