In short and in plain language
Do you show customer quotes on your website? Then you usually have to say if and how you check that they are real.
This note belongs right next to the quotes. If it is missing, that can break the law.
Small firms have simple ways. Link each quote to a real order. Or let the customer approve it in writing. Or show all reviews from your profile.
Name, town and photo are personal data. Get a consent you can prove. The customer may take it back.
We build the block with the note and the approval for you.
On the home page there is a box with three short sentences and five stars above them. It has been there since the last relaunch, and today nobody in the company could say where those sentences actually came from - an email, a phone call, or the pen of the agency that built the site. This is exactly the point where a harmless design element turned into a legal question. Anyone who makes consumer reviews accessible must, under Section 5b(3) of the German Act Against Unfair Competition (UWG), state whether and how they make sure the reviews come from people who actually received the service. This article shows three verification routes a small business can realistically take, which sentence has to sit next to the review block, what the customer release looks like - and when a testimonial block is better left off the page entirely. How reviews are managed on the third-party profile is covered in managing Google reviews actively; this piece is about your own site.
Key takeaways
- The duty applies to everyone who makes reviews accessible, not only to review platforms. Section 5b(3) UWG counts information on whether and how authenticity is ensured among the material information a consumer is owed.
- If that information is missing, it is material information withheld. Section 5a(1) UWG turns that into an unfair commercial practice as soon as the visitor needs the information for their decision.
- Claiming that the quotes come from real customers without having taken reasonable and proportionate steps to verify them falls under number 23b of the annex to Section 3(3) UWG - and there is no balancing of interests in the individual case there.
- Three verification routes are enough for a small business: an order reference in your own system, a signed release for each quote, or an unfiltered import from the business profile. What matters is not the technology but that the route is described and actually kept.
- The customer's name, town and photo are personal data. Consent under Article 6(1)(a) GDPR has to be demonstrable under Article 7(1) GDPR - and it can be withdrawn at any time.
What the law requires for testimonials
The rule entered the Act Against Unfair Competition when Germany transposed the European modernisation directive, and it consists of a single sentence. Section 5b(3) UWG provides: „Macht ein Unternehmer Bewertungen zugänglich, die Verbraucher im Hinblick auf Waren oder Dienstleistungen vorgenommen haben, so gelten als wesentlich Informationen darüber, ob und wie der Unternehmer sicherstellt, dass die veröffentlichten Bewertungen von solchen Verbrauchern stammen, die die Waren oder Dienstleistungen tatsächlich genutzt oder erworben haben." In English: where a trader makes accessible reviews that consumers have carried out with regard to goods or services, information on whether and how the trader ensures that the published reviews originate from consumers who have actually used or purchased those goods or services counts as material. Two words carry the whole weight: whether and how. The law does not prescribe a check. It prescribes that you say whether you check, and if so, by which route. A business that openly writes that it does not verify the origin has met the duty - it only loses the trust argument the block was built for in the first place.
The consequence sits one provision earlier. Material information must not be withheld: under Section 5a(1) UWG a trader acts unfairly if they mislead a consumer „indem er ihm eine wesentliche Information vorenthält" - by withholding material information that the consumer needs in the circumstances for an informed transactional decision and whose absence may lead them to a different decision. A review block with no statement of origin at all is exactly that case. The visitor reads the stars as a statement about real jobs, and that assumption is left uncorrected. That reviews carry so much weight is no accident - they belong to the trust signals on a website that decide the visit before the first sentence is read.
It gets sharper the moment the business expressly claims the reviews are genuine. The annex to Section 3(3) UWG lists practices that are always unlawful towards consumers - no balancing, no threshold. Number 23b covers the claim that reviews of a product or service come from consumers who have actually purchased or used it „ohne dass angemessene und verhältnismäßige Maßnahmen zur Überprüfung ergriffen wurden" - without reasonable and proportionate steps having been taken to verify it. The popular line that all reviews come from real customers is therefore no longer a figure of speech but a claim that has to be carried. Whoever writes it down has to walk the route behind it.
What triggers the duty
Making the reviews accessible is enough. It does not matter whether the business collected the quotes itself, took them from a platform or set them as a pull quote on a reference page. As soon as a consumer statement about goods or services sits on your own site, the duty to inform applies - even for three sentences in the footer area.
What the duty does not require
No statute prescribes a particular verification procedure, and none demands gap-free control. What is demanded is the disclosure. Reasonable and proportionate means exactly that: what a four-person business can manage is a different yardstick from what a platform with millions of entries can manage.
Where it becomes always unlawful
Number 23c of the annex names two things in one breath: submitting or commissioning fake reviews, and misrepresenting consumer reviews or endorsements. For your own site that means above all: no quotes you wrote yourself, none bought in, none ordered from friends and family.
Three verification routes a small business can take
The question in the consultation is almost always the same: how is a trade business with four people supposed to ensure that reviews are genuine? The answer is unspectacular. It needs no service, no interface and no certification body, but a decision in favour of one of three routes and the discipline to keep to it. All three can be set up in a morning, and all three can be described in a single sentence - which is convenient, because that sentence is exactly what has to sit next to the block afterwards.
Route 1: order reference
A quote only goes on the page if there is a matching job, invoice or appointment in your own system. The link is recorded internally and never published. This is the strongest route and the easiest one for businesses that write up every job anyway: the evidence is already sitting in the bookkeeping.
Route 2: signed release
The customer writes or confirms the text and releases it in writing - on paper, by email or through a form with a confirmation mail. The release carries a date, the exact wording and the scope of publication. It settles two things at once: the proof of origin and the data protection consent.
Route 3: unfiltered import
The reviews are taken from your own business profile, in full and unchanged - not just the friendly ones. The business then does not verify anything itself but points to the platform's procedure. That is permitted, but it has to say exactly that and must not be passed off as your own check.
The third route is the most convenient and at the same time the one where most mistakes happen. Anyone embedding reviews from their Google Business Profile while letting through only the four and five star entries misrepresents the overall picture. An excerpt is allowed if it is made transparent: the total number of reviews, the average and a link to the full list belong next to it. Without those three figures, a selection turns into a statement the underlying data does not support.
All three routes share the same quiet precondition: the profile the quotes come from has to genuinely belong to the business. Claimed, duplicated or never-confirmed entries make any statement of origin worthless, because nobody can say who writes there. How to secure your own entry is covered in verifying your business profile and protecting it against fakes. Only after that is it worth pulling reviews onto your own site.
| Verification route | Effort per quote | What it proves | Where it fits |
|---|---|---|---|
| Order reference in your own system | A few minutes, usually done already | The person demonstrably was a customer | Trades, practices, service firms with a job history |
| Signed release | One short form per quote | Origin and consent in a single step | Detailed references with name, town or photo |
| Unfiltered import from the profile | One-off setup, automatic afterwards | The platform's procedure, not your own check | Retail and hospitality with many reviews |
| A folder of quotes with no link to anything | Low | Nothing - the origin stays open | None of the three cases, better no block at all |
Pick the route first, then build the block
The notice at the block: wording, place, technique
The information has to sit where the reviews sit. A paragraph in the privacy policy does not meet the duty, and neither does a line in the footer: material information must not be provided in an unclear or hard-to-reach way, and a notice three screen heights away is both. What works is a line directly under the heading of the block or a short text immediately below it, in the same type size as the quotes themselves and no smaller.
The wording may be plain. It has to answer two questions: whether you check and how. What it must not be is an advertising line that claims more than the business does. „Verified reviews" as a seal over an unverified block is precisely the constellation that number 23b covers. A collapsible area that hides the notice is risky too if the block itself is visible immediately - the information belongs on the same level of visibility as the stars.
- The notice sits in the same section as the reviews, with no click and no scrolling in between.
- It names the route, not just the result: order reference, written release or import from the profile.
- It says openly when nothing is checked. That is allowed and still better than a claim with nothing behind it.
- It says whether a selection was made. If the page shows only part of the quotes, the selection criterion belongs with it.
- It is text, not an image and not a graphic - otherwise it does not exist for screen readers and search engines.
- It travels along with every relaunch. The block almost always survives the move, the notice often does not.
Technically this is a text element attached to the component, not to the individual page. If the review block sits on the home page, on three service pages and on the reference page, then the notice has to come along in all five places without anyone maintaining it five times. That is precisely where it fails in practice: the sentence gets added once on the home page and the copies on the sub-pages stay unchanged. Setting up reviews as a reusable component solves the problem once - the same logic used everywhere else in conversion optimisation.
Three formulations that hold up
Getting the release from the customer
As soon as a quote carries more than „a customer from the region", data protection joins the picture. First name, surname, town, company name, job title and above all a photo are personal data, and publishing them needs a legal basis. In this constellation that is in practice always consent under Article 6(1)(a) GDPR: the data subject has given consent „to the processing of his or her personal data for one or more specific purposes". Specific here means: for the publication of this text on this website, not for advertising in general.
The text itself
The wording belongs in the release, not just the permission. Anyone who shortens feedback, smooths it out or merges two sentences into one needs agreement to the published version. The simplest form is the finished sentence in the form, with a field for change requests next to it.
The details about the person
Each detail is released separately: full name or first name only, town yes or no, company yes or no. That costs three checkboxes in the form and saves the awkward question of why the surname suddenly appears on the home page.
A photo alongside
A picture of the person or of the finished job is a separate point with its own rules. Who took it, who is visible and what the image may be used for should be settled before it goes online - the details are in image rights on your website.
What matters is the proof. Article 7(1) GDPR requires: „Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." A verbal yes at the kitchen table is consent, but it is not proof. In practice a filed form, a confirmed email or a record with a time stamp and the wording is enough. Anyone maintaining a reference page creates one row per quote: date, person, text, scope of the release, where it appears on the site.
What belongs in a release
Consent is also not forever. Article 7(3) GDPR states: „The data subject shall have the right to withdraw his or her consent at any time." The withdrawal has to be as easy as giving consent, and it takes effect for the future. In practice that means a named address for such messages and a way to take a single quote off the site quickly - even when it sits in a component that is rendered on five pages. If a service provider processes the reviews technically, the question of the contract comes with it, which is described in data processing agreements your website needs.
When a block is better left off entirely
Not every page gets better with testimonials. Three sentences from six years ago, with no date and no link to a service, carry less than one good project description. A business with only two pieces of feedback is better off showing two detailed references with task, solution and result than a carousel block turning the same two sentences in circles. And anyone who can no longer reconstruct the origin has only one clean choice anyway: empty the block and rebuild it, rather than writing a notice above it that is not true.
There are also cases where the block does not belong on the page even with impeccable origin. In the medical professions, the advertising rules of the sector restrict third-party statements and letters of thanks far more tightly than competition law does - what applies there is set out in practice websites: what medical professions may show. Self-written or invented quotes are out of the question in any case: they fall under number 23c of the annex, and that route never pays off in any calculation. The damage is not confined to the legal position; it hits the credibility of every other statement on the page.
Star ratings deserve particular caution. Marking reviews up as structured data so that they appear as stars in search turns a design element into a statement in the results listing - with the same requirements for origin and completeness. Stars a company awards itself are not provided for there. What the markup can and cannot do is set out in rich snippets for local businesses.
| Starting position | Better with a block | Better without a block |
|---|---|---|
| Origin provable for every quote | Yes, with a notice naming the route | not included |
| Only two or three old quotes | not included | Two detailed references instead of a carousel |
| Origin can no longer be established | not included | Empty the block, rebuild it, claim nothing |
| Only the friendliest quotes selected | Yes, if selection, total and average sit next to it | Otherwise better complete or not at all |
| Sector with tight advertising rules | not included | A factual description instead of testimonials |
| Quotes with full names but no consent | not included | Fall back to first names or an anonymous form |
Who can act on it
Building it in, maintaining it and what goes wrong
In the structure of the page, a testimonial block is a component like any other: heading, notice line, list of quotes, and for each quote the text, the person and the date. The date is the part most often missing, and it is the most useful one. Feedback from 2019 reads differently from feedback from last month, and a visitor who sees the date does not have to guess. Naming the service the quote refers to wins twice over - the same mechanism as with qualifications and seals, described in the master craftsman title and seals on a trade website.
Maintenance is an appointment, not a feeling. Once a quarter go through the stock, remove outdated quotes, add new releases, and hold the notice against the actual process: is the sentence still true, or has the way of working long since changed? The check is worth most after a relaunch, because the block travels along while the notice likes to stay behind. For businesses that touch their site regularly anyway - for instance in web design for trade businesses - this is one point on an existing list and not new effort.
- Take stock: which quotes sit on which page today, and where does each one come from?
- Sort out everything whose origin cannot be evidenced. Four evidenced quotes beat twelve unclear ones.
- Decide on one of the three verification routes and write it down in one sentence.
- Attach that sentence as a notice to the component, not to the individual page, and check it on every rendering.
- File a release for each quote, with date, wording, scope and an address for withdrawal.
- Set a quarterly appointment: check stock, dates and the notice against the process as it is actually lived.
- If prices or service scopes appear in the quotes, cross-check the same figures on the page - which pairs with publishing prices on your website.
A customer testimonial is worth exactly as much as the sentence beside it explaining where it came from - everything else is decoration with legal consequences.
Sources and legal bases
Related Articles
Trust Signals: Why Confidence on Your Website Sells
Trust signals on your website: how customer voices, references, quality seals and clear contact details turn visitors into enquiries - against AI fake shops.
Legal Notice 2026: Check Your DDG Details Correctly
Section 5 DDG replaced Section 5 TMG: which details belong in your legal notice, who is obliged, how reachable it must be and what really applies to the W-IdNr.
Local delivery: an online shop with its own delivery area
Delivery area by postal code or radius, delivery windows, delivery fees by zone and correct notes on delivery restrictions: how local retailers deliver.