Ask genuine customers for an honest review through one consistent, optional process. Don't offer rewards, pick only happy customers or tell people what to write. Check the rules for your messages and industry too. And make it easy to say no.
We checked every rule in this guide in October 2026. Platforms and regulators update their pages. Recheck before you launch.
Which rules apply to Google reviews?
Three layers can apply at once: consumer law, Google's policy and, for some businesses, professional rules. A review process has to pass all of them.
Australian Consumer Law sets the legal floor. Google's policy sits on top and is stricter in places:
Decision | Australian Consumer Law | Google's policy |
|---|---|---|
Writing or buying reviews | Illegal if fake or misleading | Banned as fake engagement |
Staff or family reviews | Can mislead without disclosure | Banned as a conflict of interest |
Offering a reward | Conditions: any rating, disclosed | Banned for any review |
Hiding or editing criticism | Can mislead consumers | Discouraging negatives is banned |
Asking for a rating or a name | No specific ACCC rule | Banned: no requested content |
The ACCC's guidance on online reviews sets conditions for incentives. The reward has to apply whatever the rating. It also has to be clearly disclosed. Google bans incentives for Google reviews outright. Disclosure doesn't make one acceptable there.
Google's prohibited content policy rules out:
offering anything in exchange for a review, an edit or a removal
discouraging negative reviews or asking only happy customers
pressuring people to review while they're on your premises
asking for specific content, such as a suburb or a staff name
setting staff a review quota, or asking them to collect reviews that name them
posting reviews on a competitor's profile to undermine it
A customer can still mention a staff member on their own. That's their choice. A bonus tied to review counts looks a lot like the quota Google bans. Avoid it.
Google allows review links and QR codes. Its policy doesn't ban every business owned device either. Our recommendation is simpler. Let customers review on their own device, in their own time. That avoids pressure and privacy problems.
A real case of review filtering
In 2018, the Federal Court ordered Meriton to pay $3 million in penalties. Meriton had kept TripAdvisor's review invitations from guests it suspected would leave negative reviews. It did that by altering or withholding their email addresses. The ACCC's release on the Meriton case is dated 31 July 2018.
It's a TripAdvisor case, not a Google one. The lesson still applies: filtering who gets invited can mislead.
Penalties can be large. For relevant provisions, the corporate maximum for conduct from 28 March 2026 starts at $100 million. It can be higher: three times the benefit, if a court can work that out. If it can't, the alternative is 30% of adjusted turnover during the breach period.
Individuals face up to $2.5 million. These are the most a court can impose, not automatic fines for every misleading claim. The ACCC's fines and penalties page has the detail.
Who should you ask, and when?
Decide who's eligible before you write a single message. An eligible customer has:
a genuine experience at a defined point, such as a finished job
a contact channel you're allowed to use
no opt out on file
no earlier invitation inside your own contact limit
Never filter by sentiment. That means no happiness scores, staff hunches or likely ratings. A complaint or a refund request isn't a reason to skip someone either.
Happy customers get the Google link. Everyone else gets a private form.
Every eligible customer gets the same optional review link. Anyone can also contact the business privately.
Private feedback can still exist. It just can't act as a filter. Offer help to anyone who needs it, on its own merits.
A common mistake is sending the Google link only after a five star survey score. That's exactly the gate Google bans.
Ask at an objective moment that gives people enough experience to comment. That might be completed work, collected goods or the end of an engagement. No single delay suits an urgent repair, a long legal matter and a gym membership alike.
An open complaint isn't permission to silence feedback. And if someone asks you to stop contacting them, stop.
Create and test your review link
Our profile guide shows how to manage your Google Business Profile. To get the review link, open your Business Profile on a computer. Select Read reviews, then Get more reviews. Copy the link, or save the QR code image. Google's review link help notes that QR codes only come from a computer browser.
Before you print or send anything, check that:
the link opens the right business and branch
the printed QR code scans on a phone
a readable link sits beside every QR code
Customers need a Google Account to post. Google's tips for getting reviews say it needn't be Gmail. A QR code should never be a condition of checkout, service or a refund.
One optional reminder is our editorial limit, not a legal rule. Only send it where contact is still allowed. If your system can't tell who has already reviewed, say so in the message. Don't keep asking until a review appears.
How do you send requests responsibly?
Email and SMS requests carry their own legal checks:
Judge the whole message, including what it links to. A request that promotes your business is likely to be a commercial message. Treat these templates that way unless a qualified adviser says otherwise.
Keep a record of express consent where you have it. Inferred consent needs a provable, ongoing relationship. ACMA's guide to avoid sending spam says it doesn't cover messages sent just after a purchase.
Name the business behind the message, with accurate contact details. Then include an unsubscribe that works:
honoured within five working days
working for at least 30 days after you send
no fee, no login and no extra personal details
Suppression means removing someone from every future send. Do it straight away, not on day five.
Branded SMS from 1 July 2026
From 1 July 2026, texts that show your business name as the sender need a registered sender ID. The register covers branded sender names, the ones that appear instead of a number. Registration doesn't replace consent or the other rules.
People generally can't reply to a branded sender. ACMA's list of common spam mistakes says reply based unsubscribes that can't work break the law. So only use "Reply STOP" from a number that receives and processes replies. For one way texts, use a working unsubscribe link and test it. A common mistake is copying a two way script onto a branded sender.
Keep only the records the process needs, and limit supplier access. Plan retention and security too. Whether the Privacy Act covers you depends on the business. See who the Privacy Act covers.
Review requests by industry
Timing follows the experience, not a conversion target. The scripts to copy are in the next section.
Trades
Text from a working two way number once the job is finished and checked.
Professional services
Email at a natural milestone or when the matter ends.
Automotive
Text after the handover, from a registered branded sender.
Hospitality
Ask at the end of the visit, in person or on the receipt.
Retail and fitness
Email retail customers once the order has arrived. Text fitness members once they've used the membership for a while.
Health practices
Email an optional request that never prompts for clinical outcomes.
Review request scripts to copy
Every script below uses neutral wording: no "if you were happy", no five stars and no discount. Thanking someone for choosing you is fine. Each one is a starting point for review, not legal approval. Replace every bracket and test it first.
Trades SMS
Send this from a working two way number:
Hi [Name], this is [Business]. Thanks for choosing us for your recent job.
If you'd like to leave an honest Google review, use [link]. It's optional.
Questions: [contact]. Reply STOP to stop these messages.
Check that STOP replies are received and acted on. Don't add a rating or a staff name. Our guide to SEO for tradies covers the rest of local marketing for trades.
Professional services email
Email suits most professional firms:
Subject: Your experience with [Business]
Hi [Name], thank you for choosing [Business].
If you'd like to share your experience in an optional Google review, use [link].
For questions, contact [contact].
To stop these messages, use [unsubscribe link].
[Business identity and contact details]
Keep matter details out of the subject line and the body. Law firms have extra conduct rules. Our guide to law firm SEO and professional obligations covers them.
Automotive SMS
A dealership or workshop sending from its brand name needs a link based opt out:
Hi [Name], this is [Business].
You can leave an optional Google review about your experience here: [review link]
Questions: [contact]
To stop these messages, use [unsubscribe link].
Register the branded sender ID and test the unsubscribe link. Never swap in "Reply STOP" on a one way sender.
Four more scripts and a reminder
The same neutral pattern works for other industries, plus one optional reminder:
Hospitality, spoken or receipt: Thank you for visiting [Venue]. If you'd like to share your experience, our Google review link is [link]. It's entirely optional. You can also contact us at [contact] about your visit.
Retail email: Subject: Your experience with [Business]. Hi [Name], thank you for shopping with [Business]. If you'd like to leave an honest Google review, use [link]. It's optional. Contact [business contact] with any questions. To stop these messages, use [unsubscribe link]. [Business identity and contact details]
Fitness, two way SMS: Hi [Name], this is [Business]. You can share your experience in an optional Google review: [link]. Questions: [contact]. Reply STOP to stop these messages.
Health practice email: Subject: Optional feedback for [Practice]. Hi [Name], this is [Practice]. If you choose to share feedback publicly, our Google review link is [link]. A review is optional and public, so please consider your privacy. You can contact us privately at [contact]. To stop these messages, use [unsubscribe link]. [Practice identity and contact details]
Optional reminder, two way SMS: Hi [Name], this is [Business]. If you'd still like to share your experience, our optional Google review link is [link]. Please disregard this if you've already reviewed. Questions: [contact]. Reply STOP to stop these messages.
The health example depends on your professional, privacy and messaging review. It never prompts for clinical outcomes. A spoken or receipt request in hospitality is separate from any later email or SMS. That later message needs its own contact check.
Send the reminder once at most, and only from a working two way sender. For a one way sender, replace the last sentence with a tested unsubscribe link.
Long links and sender details can push an SMS into two parts. That can add cost.
What changes for health practitioners?
Health practices have an extra layer: the National Law on advertising regulated health services.
Ahpra's testimonial tool defines a clinical testimonial. It mentions the symptom, the diagnosis or treatment, or the outcome or practitioner's skill. Comments about customer service or communication style aren't testimonials. So not every comment about the front desk is a problem.
Equally, a glowing clinical review doesn't become safe advertising just because it's genuine. Control is the test. You're not responsible for reviews on a platform you don't control. Republish one on your website or social media, though. Then it's yours to answer for.
Even replying to a third party review may count as using a testimonial. Don't trim the clinical words and assume the rest is fine. Ahpra says editing reviews can mislead. Ask your practice's qualified reviewer before reusing anything. Some practices may prefer an internal feedback channel instead of public review requests.
Protect confidentiality in every public reply:
don't confirm that someone is a patient or client
don't reveal a diagnosis, an appointment, an invoice or a private conversation
never post records to rebut criticism
Time any request with care. Patients may be unwell or anxious. Never press anyone for a review. Our guide to SEO for medical practices covers the wider rules for health.
How should your team respond?
Reply where it helps, not to every review by rule. Here are five starting points:
Positive: "Thank you for taking the time to share feedback."
Mixed: "Thank you for your feedback. If you'd like to discuss it, please contact [role] at [contact]."
Service complaint: use the template below. Don't admit facts you haven't checked, and don't ask for removal.
Unrecognised reviewer: "We'd like to understand this feedback. Please contact [role] at [contact] so we can look into it privately." Don't announce that you have no record of them.
Sensitive or regulated information: escalate before replying. A private response may be better than a public one.
Thank you for sharing this feedback.
If you'd like us to look into it, please contact [responsible role] at [contact].
We'll consider the details privately.
Check the facts, confidentiality and any professional duties before you adapt it. Never make a remedy depend on changing the review.
A good reply does a few simple things:
thanks the person for taking the time
acknowledges the point without admitting facts you haven't checked
moves the detail to a private channel
names a role to contact, not a customer's details
reads like a person wrote it, not a pasted template
A name you don't recognise isn't proof of a fake review. People can post under a different public name. Treat the review on its content.
A common mistake is arguing the facts in public. Take the detail offline, and keep the public reply short.
Set house targets for the response itself. This one is an example, not a law or a Google promise:
Urgent threats, privacy exposures and serious allegations skip the queue. Google's review management help says owner replies are checked before they go live. That usually takes up to 10 minutes. It can take up to 30 days. So track approval, submission and public visibility as separate steps.
What if a review is fake, missing or disputed?
Work out what kind of problem you have before you act:
An ordinary negative review
Investigate the issue privately. Offer any fair remedy, with no review condition attached. Then reply factually, without private details, if a reply helps.
Never trade a refund, repair or discount for a deletion. Asking later doesn't fix that, because it can still read as a bargain.
A review that breaks the rules
Record the review link, the date, the policy category and your evidence. Report it from your Business Profile or Google's Reviews Management Tool, then check its status. If Google finds no breach, its guide to reporting inappropriate reviews allows one appeal.
Disagreeing with a review or disliking the score isn't a breach. No agency can promise that Google will remove a review.
Extortion
Extortion is different. Google describes a sudden burst of one and two star reviews. Then comes a demand for money, goods or services to remove them. Don't pay or engage. Gather the evidence straight away, then follow Google's steps to report review extortion.
A customer asking for a fair remedy isn't extortion. Don't label every refund request blackmail.
Missing reviews
Check you're looking at the right listing first. Then check for recent profile changes or merges, moderation delays and restrictions. Google's page on missing or delayed reviews says moderation can take a few days. Reviews removed for a policy breach won't come back.
Don't tell customers to repost or switch accounts to get around moderation. A missing review doesn't prove the customer ignored your request.
If you've broken the rules before
Fix it now. Stop the practice and turn off the affected automations. Keep an internal record, then correct the scripts and selection rules. Retrain the team, and get advice on any misleading material already out there.
Use Google's official reporting and support routes. Don't expect a clean slate or a set recovery time.
Choosing a review vendor
Check any review management vendor on:
message permissions and neutral selection
working opt outs and data handling
access controls, exports and an off switch
Ask what their removal service actually does, and on which policy grounds. A failed report isn't proof of fraud. But guarantees and fake review offers are serious warning signs.
How do you run and automate the process?
Write the policy down before you automate anything. It should say:
genuine experiences only, and always optional
no incentives, rating prompts or sentiment filters
no staff quotas and no pressure to post on site
approved messages only
confidential replies, with escalation for sensitive matters
Then give each part of the process an owner:
Role | Owns |
|---|---|
Business owner | The policy and suppliers |
Operations | The neutral completion event |
Messaging owner | Consent and suppression |
Profile owner | Links, reports and the listing |
Approved responder | Replies and escalations |
One person can hold several roles. After any change, review a sample of real messages and opt outs, not just the dashboard.
The contact checks pass or fail. They're never part of an average score. Build in a stop switch for when suppression or data sync fails.
Test before the first send
Use authorised test contacts to check the whole path:
the completion event and the consent flag
the right branch and sender details
the message preview and the review link
the opt out, and suppression in every connected system
duplicate controls
Don't submit test reviews. Check the fallback for customers who can't scan or don't want to sign in. A clean preview in your customer database (CRM) isn't enough on its own. Start with a small batch, check the result and expand once delivery and opt outs work.
What should you measure?
Count activity, public reviews and business results separately. Here's why raw counts mislead. Plumber A starts with 140 reviews and gets one a month. Plumber B starts with 60 and gets five a month.
A = 140 + t
B = 60 + 5t
Tie: 140 + t = 60 + 5t, so t = 20
Month 24: A = 164, B = 180
After 12 months, A has 152 and B has 120. Month 20 is a tie. Both sit on 160. B first gets ahead at month 21, with 165 against 161.
Chart data:
| Business A | Business B | |
|---|---|---|
| Month 0 | 140 | 60 |
| Month 12 | 152 | 120 |
| Month 20 | 160 | 160 |
| Month 24 | 164 | 180 |
SourceTeaching example, constant monthly additions
These are teaching numbers at constant rates, with no removals. The counts don't predict who ranks higher or who gets better enquiries.
Track delivery on its own line.
Say 100 jobs are completed in a month. Of those, 80 customers are eligible and 60 invitations are delivered. Delivery coverage is 75%. That's 60 divided by 80. Nine new public reviews appear in the same month:
Don't call 9 out of 60 a conversion rate. Some reviewers came without an invitation. Some reviews get removed, and names don't always match. There's no standard rate to aim for. There's no failure threshold either.
Each month, look at these side by side:
eligible contacts and delivery coverage
failed sends and opt outs
new public reviews and the rating trend
complaint themes
qualified enquiries
Compare like periods and locations. Note anything else that changed. Our ROI guide shows how to measure SEO business outcomes.
What reviews can and can't do for rankings
Reviews help in plainer ways first, whatever they do for local SEO. They give future customers evidence. They also show you what to fix.
Google's local ranking help names relevance, distance and prominence. It says more reviews and positive ratings can help local ranking. It publishes no review target. There's no recency weight or guaranteed lift either.
Our local SEO guide covers how reviews fit a local SEO plan. Our guide to what affects Maps visibility covers the ranking side.
Our free audit is a short, prioritised read on what to fix first.
Can you reuse reviews elsewhere?
Check each platform's rules before you reuse your process or your reviews. Ask where your customers actually research you. Then read that platform's current rules on requests and incentives. Permission on one platform isn't permission on another.
On your website, check permission and platform terms first. Then check attribution, context and freshness. Professional rules still apply. Don't imply a handful of quotes represents every review, or trim one so its meaning changes.
Google's review snippet guidelines also limit what reviews earn in search. Reviews a business controls about itself aren't eligible for review stars on LocalBusiness or Organization markup. That includes embedded third party widgets. Product pages with genuine product reviews still are.
Valid markup isn't the same as eligibility. Don't relabel a business as a product to chase stars. Our guide to schema markup covers the detail.
Bottom line Check permissions and presentation. A widget won't earn your business review stars.
What we recommend at Elev8d
Send every genuine customer the same optional request at the same point, with no reward. Test the link and the unsubscribe before the first real send. Keep private details out of every reply.
Don't get taken for a ride by anyone selling guaranteed removals. Google, not an agency, decides what breaks its policy.
Frequently asked questions
Can I offer a discount for a review?
No. Google bans incentives for any review, even disclosed ones. The ACCC's conditions don't change Google's rule.
Can staff or family review the business?
No. Google treats it as a conflict of interest. Under consumer law, it can mislead customers too.
Can I ask for a review in person?
Yes, as long as it's optional and there's no pressure. Let people review later on their own device.
Can I use a QR code?
Yes. Google provides one. Test it on a phone, and show a readable link beside it.
Can I remove a bad review?
You can't delete a review yourself. Report it for a policy breach, with evidence, then appeal once if needed. Disagreement isn't enough.
Why has a review disappeared?
Moderation, a profile merge or a policy removal are the usual suspects. The missing reviews checks above cover what to look at.
Does an existing customer relationship let me send SMS requests?
Not automatically. Inferred consent needs a provable, ongoing relationship. ACMA says it doesn't cover messages sent just after a purchase.
Do I need to reply to every review?
No. Reply where it helps. Some sensitive matters are better handled privately, with no public reply.
Can I buy Google reviews?
No. Bought reviews are fake engagement under Google's policy. Fake or misleading reviews are also illegal under Australian Consumer Law.
Next steps
Confirm the rules and an owner
Check which rules apply to your business. Name one person responsible for the process.
Replace your old scripts
Remove every reward, rating prompt and happy customer filter from your templates.
Test the link and the opt out
Create the review link and QR code. Then test them with your consent and unsubscribe flows.
Train the team, then start small
Brief the team and send a small permitted batch. Any failed consent, suppression or approval check stops sending until it's fixed.
