Using Customer Reviews in Marketing: Getting Permissions Right

"Best carbonara outside of Rome!" — a guest writes it on Google, and you want it on your homepage. But that review legally belongs to the guest, not to you. Here's how restaurants can use customer reviews in marketing legally: get written permission, follow each platform's rules, respect GDPR, and disclose how your reviews are collected under EU law.

Social proof sells tables. A homepage that opens with real guests praising your food converts better than any adjective you could write about yourself — which is exactly why so many restaurant websites are plastered with screenshots of Google reviews. Most of those screenshots are technically copyright infringements. The good news: doing it legally is not hard, not expensive, and actually makes your marketing stronger, because permission-based reviews come with names, faces and stories you can use properly. This guide covers the full legal picture for restaurants, cafés and bars: who owns a review, how to get permission without awkwardness, what Google, Tripadvisor and Facebook allow, what EU law and GDPR require, and how to build a review wall on your website that converts — and holds up.

Who owns a review? The copyright fact most owners miss

Here's the sentence that surprises almost every restaurant owner: the guest who wrote the review owns it. Under copyright law in Finland, Sweden, Norway and across the EU, an original piece of writing — and a review is a piece of writing — belongs to its author from the moment it's created. Posting it on Google doesn't transfer ownership to Google, and it certainly doesn't transfer it to you.

What the guest does grant, by posting on a review platform, is a licence to that platform: Google's terms give Google the right to display the review on Google's services. That licence runs between the guest and Google. You are a third party. Copying the review onto your website, into a Facebook ad, or onto a printed flyer is a new use that needs its own permission.

Does anyone actually get sued over a copied restaurant review? Direct lawsuits are rare — but the risk isn't only a lawsuit. It's the platform complaint (Google and Tripadvisor both act on copyright reports), the angry guest who sees their words in your ad and posts about that, and the advertising-standards complaint if the review is used misleadingly. All of these are avoidable with a two-minute permission step.

"But it was posted publicly!" — why that isn't permission

The most common objection is also the most understandable: if someone shouts praise for your restaurant in a public square, surely you can quote them? Legally, no — and the analogy that actually fits is a different one. A guest posting a review is like a photographer taking a photo of your restaurant and posting it publicly. You still can't print that photo on your menus without asking. Public visibility and a licence to reuse are two completely different things.

There are three separate rights tangled up in every review you want to reuse:

1. Copyright — the reviewer's ownership of their words (covered above).
2. Personality and portrait rights — the right to control commercial use of your name and likeness. Using "Sofia Karlsson, Stockholm" next to a quote in a paid ad without consent can violate this even where copyright wouldn't be an issue.
3. Data protection (GDPR) — the reviewer's name, photo and any identifying details are personal data. Republishing them is "processing" that needs a lawful basis (see section 6).

The practical upshot: you need the reviewer's consent, and consent has to be specific and informed — consent to post on Google is not consent to appear in your Instagram ads. That's why the permission system in the next section asks for the use case explicitly.

Permission done right: the 4-level system

Not every use needs a lawyer-drafted contract. Match the formality to the risk with this four-level system:

Level 1 — Implied context (lowest risk)

A guest writes in your physical guestbook, on a feedback card that says "may we share your feedback?", or replies to your post-visit email that invites them to leave a public review. The context itself suggests sharing. Still worth a quick "mind if we feature this?" — but the risk of a dispute is minimal.

Level 2 — Direct message consent

Your workhorse. Reply to the review on Google or message the guest: "Thank you! We'd love to feature your review on our website — is that okay? We'd show it as '[First name] L.'" A clear "yes" in writing (keep the screenshot) covers website use. This handles 90% of cases and takes two minutes.

Level 3 — Written release

For paid advertising, print materials, or video testimonials, use a short written release. It doesn't need legalese — it needs five things: who, what (the exact review text), where you'll use it (website, social ads, print), for how long, and the right to withdraw. A simple email exchange where the guest confirms all five counts.

Level 4 — Full testimonial agreement

For influencer partnerships, professional photography of the guest, or broadcast use. This is the one to have a lawyer glance at — especially if money changes hands, because then disclosure duties kick in (see section 7).

A template for Level 2–3 that you can adapt:

"Hi [name]! Thank you for the lovely review. We'd love to feature your words ('[quote]') on our website's guest review section and occasionally on our social media, credited as '[First name] L.'. Is that okay with you? You can ask us to remove it anytime at [email]."

Most guests say yes — being featured feels good. The ask itself is also good hospitality: it tells the guest their opinion genuinely mattered. For systematic collection, build the ask into your review generation flow so permission arrives together with the review.

Platform rules: Google, Tripadvisor and Facebook

Even with the guest's permission, the platform where the review lives has a say — its terms of service govern what you can do with content from its site.

Two rows deserve emphasis. First, review schema markup: Google's structured-data guidelines are explicit — you may only mark up reviews your own site collected (e.g. through your own feedback form). Marking up reviews copied from Google or Tripadvisor won't earn you rich-result stars, and it can earn you a manual action. If you want those stars in search results, collect reviews on your own site with a proper form — then you own the permission chain too.

Second, incentives: Tripadvisor's enforcement is famously strict — hotels and restaurants caught offering discounts for positive reviews have been publicly named and shamed on the platform itself, which is a worse outcome than the reviews were ever worth. Google similarly prohibits any compensation for reviews. Ask; never pay.

EU law: what the Omnibus Directive requires

Since May 2022, the EU's Omnibus Directive (2019/2161) has set hard rules on consumer reviews that every Nordic restaurant with an online presence must follow. It's enforced nationally — by the Finnish Competition and Consumer Authority (KKV), Sweden's Konsumentverket (KO), and Norway's Forbrukertilsynet — and the fines follow the GDPR-style logic of hurting enough to matter.

Three duties matter for restaurants:

1. Disclose whether and how you verify reviews. If your website shows guest reviews, you must state whether you check that they come from real customers — and if so, how. A simple line works: "Reviews shown here are from verified guests who dined with us." If you don't verify, you must not imply that you do.
2. No fake reviews, ever. Posting fake reviews yourself, or paying anyone to post them, is now explicitly a banned unfair commercial practice across the EU. This covers both fake positives for yourself and fake negatives for competitors.
3. Disclose paid rankings and endorsements. If a review or ranking position was paid for, that must be clear to the reader.

The verification-disclosure rule is the one most restaurant websites currently break without realising it. A testimonial slider with no statement about where the quotes came from is, strictly speaking, non-compliant. The fix is one sentence in the right place — add it under your review section and in the fine print.

GDPR: names, photos and consent

A reviewer's name is personal data. Their photo is personal data. Republishing either on your website is "processing" under GDPR, and you need a lawful basis for it. In practice, that basis is consent — which brings us back to the permission ask, now with GDPR-grade requirements: consent must be freely given, specific, informed and unambiguous, and the guest must be able to withdraw it as easily as they gave it.

The practical rules that follow:

• Default to first name + last initial. "Sofia K." gives the quote credibility without exposing the guest. Use a full name only with explicit agreement.
• Photos need separate, explicit consent. Never lift a guest's profile photo from Google to illustrate their quote. Ask: "May we use your photo with the review?" Most will say yes; some won't — respect it instantly.
• Honour withdrawals fast. If a guest asks you to take down their review, do it promptly and confirm. Keep a simple log: review, guest contact, consent date, scope, withdrawal date if any. Our guide to using booking data for marketing the GDPR-safe way covers the same record-keeping mindset.
• Special care with children and vulnerable guests. Don't feature reviews that identify minors, even with a parent's casual okay in a comment thread — get it properly or skip it.

One reassuring note: stating your aggregate rating ("4.8 on Google from 312 reviews") processes no personal data at all. Aggregates are always safe; it's the individual quotes, names and faces that need the permission trail.

Paying for reviews: incentives, disclosure and the law

Let's settle the "free dessert for a five-star review" question definitively, because it comes up in every restaurant:

The influencer row deserves a word, since "invite a food blogger for a free tasting menu" is standard restaurant marketing. That's legal — but the resulting content must be recognisable as advertising (e.g. "paid partnership" labels), and you cannot script or buy the opinion. A disclosed, honest influencer review is fine; a paid five-star script is not. When in doubt, the EU rule of thumb: would a reasonable reader understand there's a commercial relationship? If not, disclose more clearly.

Where to place social proof on your website

Permission secured — now make the reviews work. Placement matters as much as the quotes themselves:

• Homepage hero, one killer quote. Not a slider of twelve — one strong, specific review ("The reindeer fillet was the best thing I've eaten in Helsinki this year — Sofia K.") beats a wall of "great food, nice staff". Rotate it quarterly so it stays fresh.
• A dedicated reviews section. Six to ten verified reviews with names, dates and the platforms they came from, plus your verification statement for Omnibus compliance. Link out to your Google and Tripadvisor profiles so visitors can verify.
• Contextual quotes on key pages. A review praising your private dining room belongs on the private-dining page; a quote about the kids' menu belongs on the family page. Match the proof to the decision.
• Booking and contact pages. Doubt peaks right before the commitment — a short testimonial next to the booking button is worth more than one buried on an "About" page.
• Keep them current. A review wall whose newest quote is from 2022 quietly tells visitors nobody's praised you since. Refresh twice a year; retire anything that no longer reflects the experience.

This is also where your website platform matters: review sections should be editable in minutes, not a developer ticket. With PowerfulWebsite, testimonial and review sections are built into every plan (from €59/mo up to the €239/mo Restaurant tier), so adding a newly-permissioned review takes less time than the permission ask did.

The cherry-picking trap: only showing 5-star reviews

Here's the temptation: your Google profile has 300 reviews averaging 4.6, including some thoughtful three-star critiques. Your website shows… eight five-star raves. Is that misleading? Under EU consumer law, it can be. Advertising must not mislead through omission — presenting a selection that gives a false impression of the overall picture is exactly the kind of practice the Unfair Commercial Practices Directive (which the Omnibus Directive updated) targets.

The safe approach is representative selection:

• Show a mix that roughly reflects your real distribution — if you're 4.6 stars, a 4-star review among the 5-stars actually increases trust.
• Never edit a review's text to remove criticism. Quote verbatim or don't quote.
• Link to the full review profiles so visitors can see everything — transparency is the antidote to cherry-picking accusations.
• If you show an aggregate ("4.8 on Google"), make sure it's current and matches the linked profile.

Counterintuitively, a visible 4-star review with a thoughtful owner response often converts better than a wall of unblemished praise — it proves the reviews are real, which is precisely what sceptical diners are checking for. Our Facebook recommendations guide and Tripadvisor guide cover platform-specific display options.

Keep a permission file: your paper trail

The unglamorous final step that makes everything above enforceable: a simple log. A spreadsheet is fine. One row per reused review:

• Review text (or link) and platform
• Reviewer's name and contact
• Date permission granted, and how (screenshot of message / email)
• Scope: where you're using it (website, Instagram, print)
• Attribution used ("Sofia K." / full name / anonymous)
• Withdrawal date, if it ever happens

Review it once a year: remove withdrawn consents, refresh stale quotes, check that aggregates are current. Store it with your other marketing records — if a guest ever disputes a use, this file ends the conversation in your favour in about thirty seconds. And if you ever sell the business, a clean permission file is a small but real asset: the buyer inherits social proof they can legally keep using.

Done right, permissions aren't bureaucracy — they're the difference between social proof you have to take down when someone complains and social proof that works for you for years. Ask, record, display, refresh. Your happiest guests are your best marketers; this is how you let them do the job properly.

Frequently asked questions