Website Reviews and Testimonials: ACM, Omnibus and GDPR Rules (2026)

When a business redesigns its website, a testimonials section is usually on the wish list. The rules around it are stricter than most people expect. Since 28 May 2022, EU consumer law bans fake reviews outright and requires a business that shows reviews to say how it checks they are genuine.

This article is for businesses in the Netherlands, and for Japanese businesses planning a site for Dutch or European customers. It sorts out what you can and cannot do with testimonials on your own site and with external reviews from Google, Trustpilot, Kiyoh and similar services. It checks the EU directive, Dutch civil code, ACM (the Dutch Authority for Consumers and Markets) guidance and the GDPR.

The directive, the statute text, and pages from ACM, KVK, the AP (Dutch data protection authority), Google, Trustpilot and Kiyoh were checked on 3 November 2026. This is general information, not legal advice. For your own case, ask a lawyer or ACM. The article contains no real or invented customer quotes.

Main official sources	What was checked
Directive (EU) 2019/2161 (the Omnibus Directive)	Disclosure of how reviews are verified; ban on fake reviews (Annex I, points 23b and 23c)
Dutch Civil Code Book 6, arts 193a to 193g and 194	"Product" includes services; review disclosure duty; banned practices; misleading claims between businesses
ACM guidance and its online consumer protection guide (May 2024 edition)	Duties and examples for reviews, testimonials and embedded reviews
KVK page on review rules (updated 3 March 2026)	What a review policy should say; removal reasons; fine level
AP page on consent, GDPR arts 7 and 17, Copyright Act art 21	Four consent conditions, proof, withdrawal, erasure, portraits
Google, Trustpilot and Kiyoh rules	Limits on asking, removal, structured data

What you will learn	Short answer
What is regulated	Fake reviews are banned; verification must be disclosed (chapters 1 and 2)
How to check reviewers	Match them to client records, among other methods (chapter 3)
How to disclose	Short, where the reviews appear (chapter 4)
Buying and selling fakes	Both sides are targeted; agencies can create shared liability (chapter 5)
Hiding low ratings	Selection and ordering count too (chapter 6)
Rewards and asking	Disclose rewards; do not ask only happy customers (chapter 7)
External review widgets	Embeds are covered; Google limits structured data (chapter 8)
Names and photos	Consent, proof, withdrawal, erasure (chapter 9)
Not losing enquiries	Make disclosure part of the trust (chapter 10)

1. Reviews and testimonials: what differs and what does not

A website can show many kinds of other people's opinions: star ratings, written reviews, thank-you emails, interviews, case studies, embedded widgets and social posts. For rules purposes, some are treated alike and some are not.

ACM's guidance says its review rules also apply when you show testimonials or influencer opinions. "These are testimonials, not reviews" is not a defence.

How wide ACM's scope is

Chapter 4 of ACM's online consumer protection guide (May 2024) covers reviews you publish yourself, influencer opinions and testimonials, reviews collected by another company for you, and reviews embedded from another website or app. Whoever collects them and wherever they come from, if they appear on your site, you carry the responsibility.

Four kinds compared

The table sorts what appears on a site by type. The grouping is ours; the rules are from the sources shown.

Type	Example	Main issue	Source
Own review section	Buyers post stars and text	Genuine? Disclosure of checks	ACM guide 4.1
Testimonials	You select client quotes	Genuine? Selection; consent	ACM guide 4.1, GDPR
Embedded external reviews	Google, Trustpilot, Kiyoh stars	Embeds are covered; shared duty	ACM guide 4.1
Case studies	Your own write-up of a project	Advertising; accuracy	Civil Code 6:193c, 6:194

A case study you write yourself can be treated as advertising rather than as a review. Even so, wrong facts or an invented client still make it misleading.

Do not call a case study a review

A case study is your own description. If you want it to read as a client's opinion, the words must be the client's and the client must have checked them. Presenting your own text as a client's voice misrepresents whose opinion it is. Separate headings help, for instance "Project write-ups by us" and "Words from clients".

The four questions

Figure 1 puts the above into the order of a pre-publication check. The chapters that follow take each question in turn.

The third question is the one most often missed. Having a check in place but not telling visitors about it does not satisfy ACM's guidance.

2. The legal map: directive, civil code, ACM and the GDPR

Review rules are not in one statute. An EU directive is the base, the Dutch Civil Code turns it into national duties, ACM explains how it applies, and the GDPR covers the personal data in names and photos. This chapter draws the map; later chapters go into detail.

First, the timeline in Figure 2, from adoption of the directive to ACM's latest moves.

This is not new law. More than four years after the start date, ACM is acting against sellers of fake reviews as well as the shops that use them.

What Directive (EU) 2019/2161 added

The full title is Directive (EU) 2019/2161 of the European Parliament and of the Council of 27 November 2019, amending Directives 93/13/EEC, 98/6/EC, 2005/29/EC and 2011/83/EU. It is commonly called the Omnibus or Modernisation Directive.

On reviews it did two things. It added paragraph 6 to Article 7 of the Unfair Commercial Practices Directive (2005/29/EC): where a trader gives access to consumer reviews, information about whether and how it ensures that published reviews come from consumers who actually used or bought the product is material information. And it added points 23b and 23c to Annex I, the list of practices that are unfair in all circumstances. Member states had to adopt and publish measures by 28 November 2021 and apply them from 28 May 2022.

How the Dutch Civil Code carries it

Book 6, articles 193a to 193j of the Dutch Civil Code (Burgerlijk Wetboek, BW) cover unfair commercial practices. Three provisions matter for reviews.

Provision	Content	Directive link
6:193e(3)	Information on whether and how a trader ensures published reviews come from consumers who used or bought the product is essential information	Art 7(6)
6:193g, point z	Claiming reviews come from real buyers or users without reasonable and proportionate steps to check	Annex I 23b
6:193g, point aa	Posting or commissioning false reviews or endorsements, or presenting reviews misleadingly	Annex I 23c

Article 193g lists practices that are misleading "onder alle omstandigheden" (in all circumstances). No weighing of other factors is needed: if the practice happens, it is unlawful. Article 193a defines "product" as goods or services, including digital services, so consulting and design work are covered.

When your customers are businesses

Articles 193 and following protect consumers. If your services go only to businesses, the consumer-specific disclosure duty may not apply as written. But Article 194(1) bans misleading statements aimed at other businesses, and lists misleading claims about "awards, testimonials or other opinions or statements issued by third parties" (point f).

So whether the buyer is a consumer or a business, you cannot show a voice that does not exist or an assessment that is untrue. This article centres on the consumer rules and recommends the same standard for business-only services. That is our reading.

ACM guidance and KVK

ACM explains these provisions in its online consumer protection guide (Leidraad Bescherming Online Consument). KVK, the Chamber of Commerce, summarises the rules for entrepreneurs. Chapters 3 to 7 below lean on both.

On penalties, ACM stated in August 2024 that it can impose fines of up to €900,000 per violation. KVK says the fine can be as high as €900,000 per violation, and that you pay a maximum of 10% of your annual turnover, even if you make the same mistake more than once (page updated 3 March 2026).

3. How to check that a reviewer is a real buyer

The law asks that, if you say reviews come from people who used or bought the product, you take reasonable and proportionate steps to check. The statute does not list what is enough. ACM's guidance gives the reasoning and examples.

This chapter starts from ACM's examples and turns them into steps a small business can take. The table below is our summary, not an ACM list of approved methods.

Measures ACM mentions

ACM asks traders to think in technical, organisational and legal terms. Its examples include a registration requirement before posting, automated detection of suspicious patterns, a complaints process for reviews, clear posting rules and effective enforcement.

These were written with platforms in mind, but the logic applies to small firms: limit who can write, spot what looks odd, and act when in doubt.

Checks a small firm can run

A business with a few dozen testimonials does not need a detection system. The table lists ways to tie each author to a real transaction.

Method	What it shows	Limit
Match against invoices or contracts	The person really was a client	Authorship needs a separate check
Invite only contracted clients	Non-clients cannot write	Invite links can be forwarded
Posting through a customer account	Only logged-in buyers write	Depends on how easy accounts are to create
A review platform's invitation tool	The platform may restrict to buyers	Check each platform's terms
Look for suspicious patterns	Bursts of posts, identical text	You need a response when you find one
A reporting channel	Third parties can flag doubts	It must be publicised

The easiest to adopt is matching to records. If the client's name, contract date and delivery date are on file, a testimonial can be checked against them and you can say "this person was a client".

Keep a record of the check

Without a record, "we took steps" is hard to show later. For each testimonial note when it arrived, from whom, for which project and how you checked. Decide where it is stored and for how long, since parts of it are personal data.

If you cannot verify it, do not publish it

A kind word from someone who never bought, or a friendly post found on social media, does not belong in a testimonials block. ACM's guide also says not to link reviews to a different product or business than the one the consumer meant.

4. How to disclose the method next to the reviews

Taking steps is not enough. ACM expects you to tell consumers that you take steps and what they are. If your presentation suggests "these are real buyers' voices", an explanation of how you know is not optional.

Put it where the reviews are, not buried in the terms. ACM's guide asks that the information be clear, understandable and available where the reviews are shown.

What to include

Combining ACM and KVK, a disclosure covers these items.

Item	What to say	Source
Scope	Only quotes from clients are shown	KVK
Method of checking	Matched to invoices; only contracted clients are asked	ACM, KVK
Origin	Collected by us, or from an outside service	ACM
Rewards	Whether any payment or freebie was given	ACM
Score calculation	Period and method for any average	ACM, KVK
Editing and removal	When you edit or leave something out	KVK

If there was no reward, say so ("no rewards were given"). It saves the reader wondering.

Placement and length

Two or three lines under the section heading, with a small link to the fuller policy, is enough. There is no need to put a long policy above the reviews.

Here is the shape of such a note. It is a template, not a client quote.

The words below come from clients who contracted with us. We match each one to our contract and invoice records, and we do not show voices from people who were not clients. We gave no rewards. We show every testimonial we have consent for from the last 12 months. Apart from typo fixes, we have not changed the text. Our policy is written further down this page.

Adapt the wording to what you really do. Describing a practice you do not follow is itself misleading.

If you show an average

State the period and the number of reviews. ACM expects you to make clear how a score is calculated. With only a handful of voices, showing the individual words is often more honest than an average.

5. Fake reviews and the ban on buying and selling them

Fake reviews sit at the top of the banned list. Article 193g(aa) BW prohibits posting false reviews or endorsements, or having others post them, as misleading in all circumstances. ACM says this covers likes, views and followers as well as reviews.

This chapter looks at what counts as fake and how far ACM is looking.

What counts as fake

The table lists situations that come up in practice.

Action	Allowed?	Why
Posting as a customer about your own business	No	False review (6:193g aa)
Inventing a person's quote	No	Same pattern as ACM's own example
Asking friends or family to write praise	Treat as no	Not real buyers' experience
Paying for reviews	No	Commissioning false reviews
Generating review-style text with AI	No	Not a real experience
Fixing a typo in a genuine client quote	Yes	Content unchanged
Showing a genuine quote on a different product's page	No	Linked to the wrong product

The rows on friends or family and on AI-generated text are not described directly in the guide; they are our application of the definition of a fake review.

The last row is easy to overlook. ACM's guide says reviews must not be tied to a product or business other than the one the consumer meant.

ACM's example: quotes from people who do not exist

ACM's guide describes a cosmetics company whose homepage carried quotes from satisfied consumers with four or five stars, which turned out not to be the experiences of real buyers. ACM calls this misleading and not allowed.

The lesson is that the look of a star rating plus a quote is treated as a promise of authenticity. A dummy quote left in "just for the design" has the same effect on a live site.

Sellers are now in scope too

On 22 August 2024 ACM announced action against businesses that sell fake reviews and the webshops that use them, and said it had started investigating sellers. That follows earlier action against sites that bought and used fake reviews.

Handing the job to an agency does not remove the risk. ACM's guide says that if a company you hire to collect and post reviews does not follow the rules, you can be jointly responsible when you did too little to prevent it.

Agree terms with suppliers

When collection or posting is outsourced, put these points in the contract or purchase order so you can explain your position later.

• Ask only clients who really bought
• Label any rewarded review as such
• Do not drop low ratings selectively
• Let you inspect the process and the records

This is our reading of ACM's shared-responsibility principle. There is no standard contract wording.

6. Hiding low ratings: selection and ordering

Wanting only the good reviews on your own site is natural. ACM draws a clear line: selection, ordering or overall presentation must not give consumers a false impression.

ACM's example is deleting only negative reviews while leaving positive ones. That is misleading because it departs from the real spread of opinion.

What you may and may not remove

KVK says that if you remove a negative review you should state the reason, and that you need not explain if you can prove the review is fake. It also says to edit a review only for a good reason, such as deleting a racist remark.

Situation	Judgment	Note
Discriminatory or threatening wording	May remove	Put the reason in your policy
Provably from a non-client	May remove	No need to explain a proven fake (KVK)
Provably factually wrong	May remove	State the reason and reply with a correction
Low rating but true	Keep	Reply instead
Showing only the last year	Allowed	State the period (ACM)
Hiding only low-star reviews	Not allowed	Misleading selection

To stay on the right side of the last row, base any exclusion on truth or wording, not on whether the rating is high or low.

Period and ordering

ACM wants you to make clear which reviews you show, for example only those from the past year. On ordering, its page sets no specific rule but says selection, order and overall presentation must not mislead.

You are free to choose the default order. A sensible approach is to state it and let visitors switch to sorting by rating, which lowers the risk of misleading anyone. That is our design suggestion.

Replying

Replying to a low rating usually reads better than deleting it. Kiyoh says businesses can reply publicly. Keep a reply calm, factual and short, and add a contact route if needed.

When you select testimonials

ACM's review page says not to show only the reactions that suit you ("toon niet alleen reacties die u goed uitkomen") and to show everything, positive and negative ("Laat alles zien: positief én negatief"). Section 4.1.1 of its guide adds that selection, order or overall presentation must not mislead.

So you cannot choose testimonials because they are highly rated. The following is our suggestion, not an ACM-approved method.

• Show every testimonial you have consent for
• If that is too many, narrow by a criterion that does not depend on the rating, such as "the last 12 months" or "the latest 10 by date", and write the criterion next to the quotes
• If some are left out, put the criteria in your policy (no consent, transaction cannot be confirmed, abusive wording)

The aim is to be able to explain that the rating was not what decided what you show.

Is it fine to pick case studies?

A case study you write is not a list of customer ratings, so choosing good projects is ordinary advertising. But if you call it "customer feedback" or present it as an overall satisfaction picture, it can mislead through selection. Use headings like "Project write-ups" and do not present them as an average. This is our reading.

7. Rewarded reviews and how you ask

Offering a discount or a freebie to get reviews is tempting. Here the rules are most specific, and ACM, Google and Trustpilot differ slightly.

In short, the law does not forbid giving a reward; hiding it is the problem. Platform terms, however, ban reviews in exchange for rewards altogether.

Law versus platform rules

Source	Rewarded reviews	Basis
ACM (law in practice)	Allowed if the reward is clearly disclosed	ACM guide 4.1.1
KVK	Allowed if clearly labelled, e.g. "sponsored"	KVK
Google	Not allowed; such reviews are removed	Contribution policy
Trustpilot	Not allowed	Guidelines for businesses

On your own site you could, in law, collect rewarded voices if you disclose them. But do not turn the same exchange into a Google or Trustpilot review. Treat each place separately.

Do not mix them into one average

ACM's guide says you must not give the impression that an average score consists only of unrewarded reviews when it does not. If you collect rewarded voices, show them apart from the others and say whether they feed any score.

Timing and whom you ask

ACM's guide suggests not asking right after ordering but waiting until people have had time to use the product. For a service, that means asking after the client has used the result.

Whom you ask matters even more. Trustpilot prohibits picking and choosing which customers you invite. Google also bans selectively soliciting positive reviews. Ask everyone on the same terms.

Requests to avoid

• Asking for five stars, or dictating the content
• Asking only the clients who were happy
• Pushing someone who left a low rating to withdraw it
• Offering a discount or refund in return for changing or removing a review

ACM's guide asks for restraint when approaching people with negative reviews, and lists rewards for changing a review as misleading. Trustpilot also bans pressure and threats about writing, editing or deleting.

An enforcement case

ACM's guide reports that it made a company stop misleading consumers after the company asked customers for a positive review and promised to refund half of the cost in return. The reviews had not come about fairly.

8. Showing Google, Trustpilot and Kiyoh on your site

Displaying outside reviews is a common way to borrow trust. ACM's guide says reviews embedded from another website fall under the same rules. Even if a service does the collecting, once you show it on your site, the responsibility is partly yours.

How the three differ

The table shows points that affect what a business can do, taken from each service's published material. The Kiyoh column is its own description and has not been independently verified.

Point	Google	Trustpilot	Kiyoh
Rewarded requests	Banned; reviews are removed	Banned	Check its terms
Asking only happy people	Banned	Banned	Invitations go to customers who ordered (its description)
Removal by the business	Rule-breaking reviews removed at Google's discretion	Reviews belong to the author; the business reports breaches	The business cannot remove negative reviews (its description)
Pressure	Rewards for withdrawing banned	Pressure to write, edit or delete banned	Check its terms
Score period	Check the service's help	Check the service's help	Last 12 months (its description)

Open each service's current terms before relying on this table. Rows saying "check" are where we have not confirmed the exact wording. What the table does show is that platform terms can be stricter than the legal minimum.

Filtering an embed

If a widget lets you filter which reviews appear, showing only the high-star ones moves towards the misleading selection ACM warns about. Decide in advance that embed settings will not hide low ratings.

Structured data limits (Google)

Showing outside reviews tempts people to mark them up for star snippets. Google's guidance says that if the reviewed entity controls the reviews about itself, pages with LocalBusiness or Organization markup are ineligible for the review star feature. That includes Google Business Profile or Facebook reviews placed on the business's own site through a widget.

Do not mark up your own ratings to get stars in search. Our article on Google Business Profile covers the local-search side.

Third-party scripts and the GDPR

Embedded widgets load from external servers and may send visitors' IP addresses elsewhere, the same issue as externally loaded fonts. Our articles on Google Fonts embeds and GA4 consent cover consent design and self-hosting.

Options include loading the widget only after consent or showing a static image. Choose in line with the consent design of the whole site.

9. Names and photos: GDPR, portraits and consent

A name, company, job title or photo makes a testimonial more convincing. It also publishes a client's personal data, and the GDPR applies in the Netherlands.

This chapter uses the AP's guidance and the GDPR text to set out the basics.

What is personal data

Names and photos are personal data. A company name alone usually does not identify an individual, but a sole trader whose business name is their own name can be identifiable. That is a case-by-case question.

What you show	Personal data?	Practical approach
Name and photo	Yes	Get consent in writing or by email
Name, company and role	Yes	Get consent
Company name only	Often not	Get consent if it is a person's name
Initials and sector	Can be	Easy to identify in a small market
Anonymous ("a client")	Not if not identifiable	Still check it is a real voice

Anonymity reduces the consent issue but not the need to confirm authenticity. Readers cannot check an anonymous voice, so records and disclosure matter more.

The AP's four consent conditions

The AP says valid consent must be freely given, unambiguous, informed and specific.

Condition	Meaning	Example for testimonials
Freely given	No disadvantage for refusing	Do not make it a condition of the work
Unambiguous	A clear affirmative act	No pre-ticked box
Informed	Who publishes what, and why	Say where, for how long, how to withdraw
Specific	Separate consent per purpose	Website, social media and ads are different purposes

The last row is often missed. Consent to appear on the website does not cover using the same words in an ad or a brochure.

The path from asking to withdrawal

Figure 3 shows the sequence from request to withdrawal.

The last step is the one most often left until later. Decide before you publish how you will erase the content on request.

Proof, withdrawal and erasure

Article 7 GDPR requires you to be able to demonstrate that consent was given and says it must be as easy to withdraw as to give. The AP adds that recording the consent alone is not enough; you must also be able to show on the basis of what information it was given.

If consent is withdrawn and no other ground supports the processing, Article 17(1)(b) requires erasure without undue delay. Published content can persist in search caches and social posts, so check places where it was copied as well as your own site.

Do not make consent a condition

Article 7(4) tells you to take utmost account of whether a service is made conditional on consent that is not needed for it. Offers like "a discount in exchange for your photo" are best avoided.

Portraits and photographs

Photos raise a portrait question separate from data protection. Article 21 of the Dutch Copyright Act (Auteurswet) does not allow publication of a portrait made without commission where the reasonable interest of the person portrayed opposes it. Portraits made on commission are dealt with by Article 20. In practice, the simplest course is to agree the scope of use in writing when the photo is taken.

10. Showing reviews without losing enquiries

Some worry that following the rules makes a site look stiff and costs enquiries. We have no data to show that either way. What follows is design reasoning.

Our conclusion: put the disclosure forward as a reason to trust, instead of hiding it. A single line explaining how you check shows the voices are real.

Patterns that work together with the rules

Pattern	Aim	Watch out for
One line under the section heading	Show how you check, reduce doubt	Do not paste long terms
State the number honestly	Small counts still read as honest	No average from very few reviews
Link to the outside review page	Visitors can check elsewhere	Do not choose only the flattering ones
Separate case studies from client words	Readers know what they are seeing	Do not present cases as an average
Enquiry route near the voices	Gives a next step after reading	No hard sell that harms credibility
Keep replies to low ratings	Shows how you respond	No emotional rebuttals

The table shows that the compliant way of presenting is also the considerate one.

When you have few voices

A new business is tempted to inflate the numbers. If you have two or three real client voices, show two or three. As ACM's example shows, invented voices destroy trust in a way that is hard to repair.

While voices are few, trust can come from elsewhere: who does the work, how a project runs, how costs are worked out and a public FAQ. Our article on the B2B enquiry flow covers building trust this way.

Distance between voice and enquiry

Placing client words near the service description, the cost reasoning and the contact form puts them in front of readers at the moment they decide. That is generally better than decorative placement at the top.

The Japanese rule on stealth marketing

Japan has, since 1 October 2023, regulated advertising that consumers cannot recognise as advertising (stealth marketing). The Consumer Affairs Agency lists social media posts and review posts among the online expressions covered.

The Japanese rule is chiefly about not hiding that something is advertising. EU and Dutch rules add a duty to disclose how you check that reviews are genuine. A business that reuses Japanese-site wording for Dutch customers may therefore fall short on the disclosure of checks.

11. Thinking by situation

Instead of invented clients, the table below gives situations. Find the closest row and use it as a starting point. It is general, not individual advice.

Situation	Check first	How to show
Just started, a few clients	Ask each for consent	State the count; lead with case studies
All clients are businesses	Authenticity and consent; misleading claims are unlawful between businesses too	Keep art 194 in mind and verify facts
Webshop using Kiyoh	Embed settings and the terms	Do not use filters that hide low ratings
Agency collects reviews for you	Their process and records	Put agreed terms in the contract
Japanese firm building for Dutch customers	Do not reuse Japanese text as is	Add the disclosure of checks; get consent again
Want a photo with the quote	Scope of consent and withdrawal contact	Separate consent per place of use
Want to post many past reviews	Source and whether a transaction exists	Do not post what you cannot match

The Japanese-firm row names a pitfall that arises when translating a site: translation alone is not enough; you also need the disclosure of checks and fresh consent.

12. Common pitfalls and what not to do

Even when you know the rules, daily routine can undo them. The table lists what to avoid and why.

Do not	Reason
Invent a person for a testimonial	Fake review; banned in all circumstances (6:193g)
Hide only low-star reviews	Misleading selection (ACM)
Offer a discount for a review and not say so	Hidden reward (ACM)
Ask only happy clients	Selective solicitation (Google, Trustpilot)
Press someone to withdraw a low rating	Pressure; also breaks platform rules
Show a name or photo without consent	GDPR and portrait issues
Leave it all to an agency	Shared responsibility possible (ACM)
Mark up outside stars in your own structured data	Google excludes them

The two easiest to miss are leaving it all to an agency and the structured data issue, since the problem arises in parts you did not write.

Common misunderstandings

• "It is embedded from another service, so it is not my responsibility" is wrong. ACM covers embedded reviews.
• "A testimonial is advertising, so I can edit it freely" is wrong. Changing a client's words so they say something untrue is misleading.
• "We are B2B, so the consumer rules do not matter" is wrong. Article 194 BW applies between businesses.

13. What to do next, and a checklist

The rules look long, but the order of work is simple.

Steps

1. List every review, testimonial, star rating and case study now on the site
2. Match each to an actual transaction and remove what you cannot match
3. For voices you keep, check consent and re-ask where it is missing
4. Find out whether any voice was rewarded and decide how to label it
5. Add a short statement of how you check, near the reviews
6. Write down your rules for removal and for replies
7. Review embed settings to be sure low ratings are not filtered out
8. Set a contact for withdrawal and a procedure for erasure

Checklist

• Every voice shown is from a real client
• There is a record of matching against transactions
• The checking method is disclosed where reviews appear
• Rewards, or their absence, are stated
• No review is removed because its rating is low
• The score calculation and period are stated
• Names and photos have recorded consent
• A withdrawal contact and erasure procedure exist
• Embedded reviews are not filtered to flattering ones
• Terms with any supplier are agreed

14. Summary

• Check reviews and testimonials with four questions: genuine, checked, disclosed, all shown
• Fake reviews are banned in all circumstances under the EU directive and Dutch law; sellers are now investigated by ACM too
• Checks can be as simple as matching records, but you must say what you do where the reviews appear
• Do not remove low ratings because they are low; remove only on grounds you can explain
• Never hide rewards, and do not trade rewards for Google or Trustpilot reviews
• Names and photos need freely given, recorded consent, with an easy way to withdraw and erase
• Embedded external reviews fall under the same rules

If you are building or redesigning a site and want the testimonial section, the disclosure wording and the consent flow designed together, our approach is described on the service page. If you are unsure what your case needs, get in touch with your situation. More articles are in the column.

Sources checked

EU and Dutch law

• Directive (EU) 2019/2161, EUR-Lex (the official publication): official source of the directive
• Directive (EU) 2019/2161, Article 3(4)(c) and Annex I 23b, 23c (text reproduced by lawplayer.com): title, the addition of Article 7(6), wording of 23b and 23c, application from 28 May 2022
• Burgerlijk Wetboek Boek 6, wetten.overheid.nl: 6:193a (definitions), 6:193e(3), 6:193g points z and aa, 6:194(1)(f)
• Auteurswet, wetten.overheid.nl: articles 20 and 21 (portraits)
• Art. 7 GDPR, Conditions for consent: proof, withdrawal, freely given
• Art. 17 GDPR, Right to erasure: erasure after withdrawal, exceptions

ACM, KVK, AP

• Reviews en beoordelingen gebruiken, ACM: genuine reviews, explaining checks, labelling rewards, negative reviews
• Leidraad Bescherming Online Consument (May 2024), ACM: chapter 4, embeds, suppliers, scores, examples, enforcement
• ACM: Strengere regels voor online verkopers: rules from 28 May 2022, announcement of 27 May 2022
• ACM: aanpak verkoop nepreviews: 22 August 2024, probe of sellers, fine ceiling
• Online sales: rules for reviews, KVK: review policy, removal reasons, fine level (updated 3 March 2026)
• Legal basis of consent, Autoriteit Persoonsgegevens: four conditions, proof, withdrawal

Google, Trustpilot, Kiyoh

• Prohibited and restricted content, Google Contribution Policy: fake engagement, rewarded reviews, selective solicitation
• Review snippet structured data, Google Search Central: reviews a business controls about itself, widgets, undisclosed incentives
• Guidelines for businesses, Trustpilot: selective invitations, incentives, pressure
• Reliable reviews, Kiyoh: customers who ordered, negative reviews, 12 months (its own description)

Japan

• Stealth marketing regulation, Consumer Affairs Agency (Japanese): 1 October 2023, includes review posts

All were checked on 3 November 2026. Laws, ACM's guidance and each service's terms change; check the current version before you publish. The Kiyoh items rest on its own description. We could not connect to EUR-Lex, so the directive text was checked in a reproduction (lawplayer.com); the Civil Code text was read on wetten.overheid.nl.

Related: Google Business Profile for ZZPers, Google Fonts embeds and the GDPR, B2B enquiry flow