The legal side of review replies: what you can (and can't) say
GDPR, HIPAA, defamation, and platform policy — the legal guardrails around review replies for UK, US and EU businesses.
This is a plain-language overview, not legal advice. Consult a lawyer for anything you would sign your name to.
Confirming a person was a customer
For regulated industries — healthcare (HIPAA in the US), law, financial advice — publicly confirming that the reviewer was a client or patient is itself a disclosure. Reply in the neutral 'if you were seen at our practice' voice, never 'thank you for coming in on the 14th'.
Defamation and factual accuracy
You can call a claim inaccurate; you cannot call the reviewer a liar. UK, US and EU defamation law all treat the accusation of dishonesty as actionable. 'That is not what happened' is fine; 'you are lying' is not.
GDPR and the right to reply
Do not include personal data in a public reply that the reviewer did not include themselves. Their first name is fine if they used it; their surname or their email is not, even if you know it.
Platform policy
Google, Yelp, Trustpilot and Tripadvisor all prohibit incentives-for-removal (offering a refund contingent on the review being taken down). Resolve first, then ask separately — never in the same message.
References
- 1.Prohibited and restricted content — Google Business Profile Help
- 2.HIPAA and social media — U.S. Department of Health & Human Services
External sources open in a new tab. Policies and platform features change; check the source directly if you're relying on it for a decision.
About the author
The HappyReplies Team
Editorial team
We build HappyReplies and reply to Google reviews for local businesses every day. Everything on this page comes from what we've seen work — and what we've seen backfire — across cafes, salons, clinics, and studios.
Want to talk to us directly? Get in touch.