Permission to use testimonials: US, UK and EU rules in plain English

Do you need permission to use a testimonial?

Get it, and get it in writing. Three kinds of rules point the same way:

• Advertising rules. In the UK, the Advertising Standards Authority's guidance on the advertising code says marketing must not use a testimonial without the person's permission, and that you should hold evidence that it is genuine, with their contact details. Source: ASA, testimonials and endorsements
• Data protection. A customer's name, photo and job title are personal data. In the UK and EU you need a lawful basis to publish them, and when that basis is consent you must be able to show the person agreed. Source: GDPR, Articles 6(1)(a) and 7(1)
• Name and likeness laws. In the US, several states protect a person's name and picture from commercial use. California requires prior consent to use someone's name, photograph or likeness in advertising, and New York requires written consent to use a living person's name, portrait or picture for advertising or trade. Source: California Civil Code section 3344; New York Civil Rights Law sections 50 and 51

A thank-you email is not permission. "Great job, thanks!" tells you the customer is happy; it does not say you may publish it, or show their name next to it.

Getting testimonial consent in writing

Written permission can be a signed release, a reply to an email that asked a clear question, or an online form with its own publish question. Whichever you use:

• Ask separately, with nothing ticked in advance. Silence, pre-ticked boxes or doing nothing are not consent. Source: GDPR, Recital 32; ICO
• Say what you will publish, where, and with which details.
• Keep the record: who agreed, when, how, and the wording they saw. Source: ICO, recording consent
• Tell them how to take it back. Source: GDPR, Article 7(3)

Need the wording? Copy the testimonial release form template, or ask with one of the testimonial request emails, which tell customers they decide whether you may quote them.

Names, photos and other details

Ask about each detail on its own. A customer may be glad to be quoted by first name, but not with a photo or their employer.

• Show only what they agreed to. If they said no to a photo, don't take one from their social media profile.
• A job title and company make a quote more convincing, and also make the person easy to identify, so ask for those too.
• If they change their mind about a detail, remove it everywhere it shows, not only on the page they mention.
• If the customer is under 18, ask a parent or guardian as well.

Editing a testimonial

The FTC's Endorsement Guides allow an endorsement in other words than the endorser's own, but not presented out of context or reworded so as to distort their opinion or experience. Source: FTC, 16 CFR 255.1(b)

• Shorten, don't rewrite. Cut repetition and keep their words.
• Mark cuts with "…" so readers can see words were left out.
• Fix obvious typos only, and never merge quotes from different people.
• If a quote claims a result ("it halved our admin time"), the FTC treats it like a claim you make yourself, so you need evidence for it. Source: FTC, 16 CFR 255.2

When a customer withdraws permission

Under the GDPR a person can withdraw consent at any time, withdrawing must be as easy as agreeing, and it does not make your earlier use unlawful. Source: GDPR, Article 7(3) After a withdrawal, stop using the testimonial: take it off your website and out of anything new. You may keep a note that they withdrew, so it is not used again by mistake, if you tell people you keep such records. Source: ICO

Printed brochures already handed out cannot be recalled, which is a good reason to say in the release how long printed material stays in use.

FTC rules on endorsements and fake reviews

In the US, two sets of Federal Trade Commission rules apply to testimonials.

The Endorsement Guides (16 CFR Part 255, revised in 2023)

• An endorsement must reflect the honest opinions, findings, beliefs or experience of the endorser. (255.1(a))
• If an ad implies the person used the product, they must have been a real user of it when they gave the endorsement. (255.1(c))
• Connections the audience would not expect, such as payment, free products, discounts or a prize draw entry, must be disclosed clearly and conspicuously. (255.5)
• Advertisers should not suppress, edit or arrange customer reviews in a way that distorts what customers think of a product. (255.2)

Source: FTC, 16 CFR Part 255

The rule on consumer reviews and testimonials (16 CFR Part 465, in force since 21 October 2024)

• Fake reviews and testimonials: ones that claim to come from someone who does not exist (including fake reviews generated by AI), from someone with no real experience of the business, or that misrepresent the person's experience. (465.2)
• Buying reviews: offering money or other rewards on the condition that the review says something positive, or negative. (465.4)
• Insider reviews: testimonials by the business's own managers or staff without saying so. (465.5)
• Suppressing reviews: unfounded legal threats, intimidation or false accusations to stop or remove negative reviews. (465.7)

The FTC can ask a court for civil penalties against businesses that knowingly break this rule. Source: FTC, 16 CFR Part 465

For a testimonial page this means: real customers' own words, no fake testimonials, no paying for praise, and no presenting a selection as if it were every review you received.

UK and EU rules

United Kingdom

• Fake reviews. Since 6 April 2025, the Digital Markets, Competition and Consumers Act 2024 bans fake consumer reviews and concealed incentivised reviews outright, and businesses that publish consumer reviews must take reasonable and proportionate steps to prevent and remove them. The Competition and Markets Authority (CMA) explains this in its fake reviews guidance, and it can now fine businesses up to 10% of their global turnover for breaking consumer law. Source: DMCC Act 2024, Schedule 20; CMA, fake reviews guidance (CMA208)
• The advertising code. Testimonials must be genuine and reflect what the person said, used with their permission, and backed by evidence you keep. Source: ASA
• Data protection. The ICO's consent guidance under the UK GDPR: a clear opt-in, records of consent, and an easy way to withdraw. Source: ICO

European Union

• The GDPR. Consent must be freely given, specific, informed and unambiguous (Article 4(11)); you must be able to show the person consented (Article 7(1)); and they can withdraw at any time (Article 7(3)). Source: Regulation (EU) 2016/679
• Fake reviews. Since 28 May 2022, EU countries ban in all circumstances submitting or commissioning false consumer reviews or endorsements, or misrepresenting reviews, to promote products, and claiming that reviews come from real customers without reasonable and proportionate steps to check. Source: Directive (EU) 2019/2161, adding points 23b and 23c to Annex I of Directive 2005/29/EC

How TrustClap keeps permission on record

• Every collection page asks separately whether the answers may be published, with neither answer chosen in advance.
• Customers choose name, job title, company and photo one by one.
• The choice is stored with its date and the version of the wording the customer saw. Private feedback can never be published.
• Each customer gets a personal link to withdraw their testimonial or hide their details; withdrawn testimonials leave your widgets and wall within a minute.
• Quotes can be shortened, never silently rewritten, and imported testimonials show where they came from.
• Walls say "Selected testimonials shared with permission." and show no overall star score.

Sources

Checked on 1 November 2026. Rules change, so follow the links for the current text.

1. Federal Trade Commission, Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR Part 255 (revised 2023).
2. Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465 (in force since 21 October 2024).
3. California Civil Code section 3344.
4. New York Civil Rights Law section 50 and section 51.
5. Digital Markets, Competition and Consumers Act 2024, Schedule 20.
6. Competition and Markets Authority, Fake reviews guidance (CMA208), April 2025.
7. Advertising Standards Authority, Testimonials and endorsements.
8. Information Commissioner's Office, What is valid consent? and How should we obtain, record and manage consent?
9. Regulation (EU) 2016/679 (the GDPR), Articles 4(11), 6(1)(a) and 7, and Recital 32.
10. Directive (EU) 2019/2161, amending the Unfair Commercial Practices Directive 2005/29/EC.