# The legal side of review replies: what you can (and can't) say

> GDPR, HIPAA, defamation, and platform policy — the legal guardrails around review replies for UK, US and EU businesses.

_Published 2026-07-22 · Updated 2026-07-22 · 11 min · By The HappyReplies Team_

Source: https://happyreplies.com/resources/review-reply-legal-guide

This is a plain-language overview, not legal advice. Consult a lawyer for anything you would sign your name to.

## Confirming a person was a customer

For regulated industries — healthcare (HIPAA in the US), law, financial advice — publicly confirming that the reviewer was a client or patient is itself a disclosure. Reply in the neutral 'if you were seen at our practice' voice, never 'thank you for coming in on the 14th'.

## Defamation and factual accuracy

You can call a claim inaccurate; you cannot call the reviewer a liar. UK, US and EU defamation law all treat the accusation of dishonesty as actionable. 'That is not what happened' is fine; 'you are lying' is not.

## GDPR and the right to reply

Do not include personal data in a public reply that the reviewer did not include themselves. Their first name is fine if they used it; their surname or their email is not, even if you know it.

## Platform policy

Google, Yelp, Trustpilot and Tripadvisor all prohibit incentives-for-removal (offering a refund contingent on the review being taken down). Resolve first, then ask separately — never in the same message.