The UK's fake reviews ban.

What changed in April 2025

The Digital Markets, Competition and Consumers Act 2024 (the DMCC Act) replaced the UK's old unfair trading rules. Section 225 bans unfair commercial practices, and Schedule 20 lists practices that are unfair in all circumstances: no further test of harm is needed. Paragraph 13 of Schedule 20 is the fake reviews ban. It came into force on 6 April 2025.

On the same day, the Competition and Markets Authority (CMA) got the power to enforce consumer law directly: it can investigate, decide a business broke the law, and fine it, without first going to court.

What's banned

Paragraph 13 bans four things:

• 13(1) Submitting or commissioning a fake consumer review, or a review that conceals that it was incentivised.
• 13(2) Publishing reviews, or information derived from them (such as star ratings), in a misleading way.
• 13(3) Publishing reviews without reasonable and proportionate steps to prevent and remove fake reviews, concealed incentivised reviews, and false or misleading review information.
• 13(4) Offering services to traders that do or facilitate any of the above.

Breaking paragraph 13 isn't a criminal offence. It's enforced through civil action and CMA fines.

What counts as a review

A consumer review is “a review of a product, a trader or any other matter relevant to a transactional decision”. The CMA calls it a broad concept, and says a review doesn't even have to be written by a consumer. A fake consumer review is one that purports to be, but isn't, based on a person's genuine experience.

• Incentives. “Commissioning” includes incentivising by any means: money, discounts, freebies, event invitations, or asking a member of staff to write one. Incentivised reviews are allowed only if the incentive is made prominently clear, not behind a “learn more” link, and the review still reflects a genuine experience. Generic requests for reviews that don't steer the sentiment are fine.
• AI. “Writing” a review includes creating it by any means. The CMA gives bot-generated reviews as an example of what's banned. Our reading is that an AI-written review not based on anyone's genuine experience is a fake review.
• Testimonials on your own site. The CMA's guidance doesn't use the word “testimonial”, but it does cover reviews a trader publishes “on their own website” and reviews provided to a trader “to include in their marketing materials”. Given how broad the definition is, our reading is that customer quotes on a homepage are likely to count.

If you publish reviews, you have duties

Paragraph 13(3) creates a positive duty for anyone who publishes reviews, including on their own website. The CMA's guidance (CMA208, April 2025) expects every publisher to have at least:

• a clear, plain-English policy on preventing and removing fake and concealed incentivised reviews;
• an assessment of the risks, with further proportionate steps to match them.

Beyond that, it describes systems to detect, investigate and remove problem reviews, and to correct ratings and review counts afterwards. Publishers shouldn't rely on their users to police reviews for them.

There's no exemption for small businesses: “Even a small trader publishing only reviews from their own customers” must take reasonable and proportionate measures where there's a risk. The CMA does say lighter measures can be reasonable when “there is likely to be direct proof of a purchase or genuine experience”.

If you show reviews from a platform on your own site, for example a rating widget, the CMA treats you as a publisher too, and you should check, on reasonable grounds, that the platform's own controls are adequate.

Cherry-picking counts

The Act says publishing reviews in a misleading way includes:

• leaving out or removing negative reviews while publishing positive ones;
• giving positive reviews more prominence than negative ones;
• leaving out the circumstances in which a review was written, such as that the person was paid for it.

The CMA's guidance adds encouraging only satisfied customers to leave reviews, and “selecting only favourable reviews to be presented” when they don't reflect what reviewers say overall. Not saying that a reviewer is an employee, shareholder or supplier may also be misleading, and so can old reviews after the product has materially changed.

Penalties

• Businesses: up to 10% of total turnover, including worldwide and group turnover, or £300,000 if that's higher. The CMA can also order businesses to put things right, compensate consumers and publish corrective statements.
• Individuals: a director who consents to or connives in a breach can be treated as an accessory. The CMA says it may apply a fixed penalty of up to £300,000 where someone has no turnover.
• Outside the UK: the rules reach practices directed at UK consumers by any means, wherever the business is based.

Enforcement so far

• July 2025: compliance sweep. After a three-month adjustment period, the CMA reviewed more than 100 businesses' websites and wrote to 54 that could be failing to comply. It later reported that 90% made changes.
• March 2026: first investigations. The CMA opened its first direct-enforcement investigations into reviews: Autotrader and Feefo (one-star reviews allegedly not published or counted), Dignity (staff allegedly asked to write positive reviews), Just Eat (a rating system allegedly inflating star ratings) and Pasta Evangelists (undisclosed discounts for five-star reviews). All five were still open when we checked, with no findings made.
• Amazon and Google. Both gave the CMA undertakings on fake reviews (Google in January 2025, Amazon in June 2025), under the law that applied before the DMCC Act.

We found no fines for fake reviews under the new rules up to November 2026.

Does it apply to B2B SaaS?

The DMCC Act protects consumers: individuals acting wholly or mainly outside their business. Reading the Act, a SaaS product marketed only to businesses may fall outside paragraph 13, but the CMA hasn't said so, and many SaaS products are bought by sole traders, freelancers and individuals too. Separate rules cover misleading business-to-business marketing (the Business Protection from Misleading Marketing Regulations 2008). If you sell to anyone in the UK who might be buying for themselves, the safe assumption is that the rules apply.

A practical checklist

1. Write a short, public, plain-English policy on how you collect, check and remove reviews.
2. Only publish reviews and testimonials you can tie to a genuine experience, ideally a real purchase.
3. Disclose incentives prominently, next to the review, and never make them depend on the sentiment.
4. Say when a reviewer works for you, owns part of you or supplies you.
5. Don't hide negative reviews or bury them beneath the positive ones.
6. Retire old reviews that no longer describe the product.
7. Check any review widgets you embed, and the platform behind them.
8. Check the whole site for quotes nobody can account for any more.

HasReceipts is built around the CMA's “direct proof of a purchase”: each testimonial is tied to a real payment through your billing, the customer approves the exact words, and your whole site is scanned for quotes that can't be backed. It doesn't make you compliant on its own, but it gives you the records to show where every quote came from.

This guide explains the rules in plain English. It isn't legal advice; for decisions about your business, talk to a lawyer in the relevant country.