Fake Review Rules: What UK Small Business Websites Need to Know in 2026

If there's a page on your website you've probably never thought about from a legal point of view, it's the one with your reviews or star ratings on it. Most of us collect testimonials as they come in, pick the nicest ones for the homepage, and that's about as much thought as we give it! 

The Competition and Markets Authority, the UK's consumer and competition watchdog, has spent the past year actively checking how businesses of all sizes handle reviews on their websites, and it's expecting to give an update on a handful of live investigations sometime this month.

In plain English: what's actually changed

A law called the Digital Markets, Competition and Consumers Act came into force last year, and it made a few specific things illegal that weren't clearly covered before:

• Faking or fabricating reviews, including writing them yourself or paying someone else to write them
• Hiding or suppressing genuine negative reviews so only the good ones show
• Publishing incentivised reviews (the kind where a customer gets a discount, freebie or entry into a prize draw for leaving feedback) without clearly saying the review was incentivised

None of this is new in spirit as consumer protection law has always frowned on misleading customers. What's changed is that the CMA now has direct powers to investigate and fine businesses itself, rather than having to go through the courts - and it's actually using these powers. It also applies to businesses of every size, not just the big review platforms and marketplaces you'd expect to be the target so you just need to make sure you're getting it right.

What the CMA has actually done so far

Earlier this year the CMA wrote to more than fifty companies that publish customer reviews, flagging concerns about their policies. The vast majority made changes off the back of that letter alone. Since then, the CMA has opened formal investigations into five businesses, looking specifically at how they handle negative reviews and whether incentivised reviews were properly disclosed. Updates on those investigations are expected this month.

To be clear, none of this means every small business with a five star badge on its homepage is at risk of a formal investigation. The businesses under the most scrutiny are ones with clear evidence of manipulation. But the questions being asked, about whether you have an actual review policy, whether it's visible to customers, and whether it would hold up if someone looked closely, are ones most small business owners have simply never had to answer before.

I think the businesses most exposed here aren't the ones doing anything dishonest on purpose. They're the ones who've just never written anything down, so if anyone did ask, they wouldn't have an answer ready. A short, honest policy covers most of what's actually being asked for, and it won't take you long to do.

If you've already got reviews on your site

Have a proper look at how they got there, rather than assuming everything's fine because nobody's complained.

• If you ever offer a discount, freebie or entry into a draw in exchange for a review, say so clearly next to the review itself, not buried in your terms and conditions
• Write down your process for collecting and moderating reviews, even if it's just a few lines, so you've got something to point to if anyone ever asks - maybe just add this into one of your ts and cs as a new section like 'reviews policy' 
• Don't only publish the glowing ones. A genuine three or four star review with a fair, professional reply from you tends to build more trust than a suspiciously perfect run of five stars
• Never write a review yourself, ask a friend or family member to post one pretending to be a customer, or pay for reviews without disclosure
• If you use a review app or plugin, check what it actually does with reviews that come in negative. Some default to filtering them out, which could land you in the same trouble as if you'd done it deliberately

If you're still planning your site

• Build your approach to reviews in from the start rather than working it out once customers start leaving them.
• Decide how you'll ask for reviews, and whether you'll ever offer anything in return for one, before you launch
• Write a short, plain-English review policy for your site. It doesn't need to be a legal document, just an explanation of how reviews are collected and that genuine feedback, good or bad, gets published
• Plan for how you'll respond to a review that isn't glowing. A calm, professional reply is far better for trust than no response, or a review that just disappears

A quick checklist

Do you have a written policy on how reviews are collected and moderated?

Is that policy visible on your website, not just something you could produce if asked?

If you ever offer anything in exchange for a review, is that clearly disclosed next to the review?

Do you publish genuine negative reviews alongside the positive ones?

Have you checked what your review app or plugin actually does with negative feedback by default?

Would your current review process survive someone asking you to explain it?

If you can tick most of those, you're in a reasonable position already. If you can't, it's a worthwhile hour of admin rather than an urgent crisis, but it's worth doing sooner rather than later given enforcement is only stepping up from here.