How CMA scrutiny of online reviews affects UK local SEO agencies

What to take away

• Local SEO services now sit inside the CMA's consumer enforcement perimeter, so review work for clients is regulated marketing, not a side task.
• The Digital Markets, Competition and Consumers Act 2024 bans fake reviews and makes hosting or facilitating them a breach, with fines up to 10 per cent of turnover.
• The Consumer Protection from Unfair Trading Regulations 2008 still apply to misleading review claims, and the CMA can act under both regimes.
• Agencies need written review policies, platform due diligence and a route for reporting problems to the CMA.
• Client contracts should say who owns review data and who is liable for a misleading claim.

What CMA scrutiny of online reviews means for UK local SEO agencies

The Competition and Markets Authority is the UK's consumer and competition regulator. It has taken a close interest in online reviews since its 2015 call for information on review platforms and its later work on fake and incentivised reviews. For an agency selling local SEO services, that interest changes the risk profile of routine work.

Buying reviews, writing them, offering discounts for positive ones or suppressing negative ones are no longer just platform policy breaches. They can be unfair commercial practices under UK law. The CMA can investigate without waiting for a platform to act.

A local SEO agency typically touches reviews in four ways: soliciting them, responding to them, reporting them and displaying them. Each of those is a marketing act. Each can create liability for the agency and the client.

That matters because the CMA's powers are broad. It can obtain undertakings, bring court proceedings and, under the DMCC Act 2024, decide cases itself and impose penalties. The regulator has said it will prioritise practices that cause widespread consumer harm, which includes fake reviews in local search.

For a small agency in Manchester or Leeds, the practical question is not whether the CMA will knock on the door. It is whether the client's review workflow would survive a complaint from a competitor. If the answer is no, the workflow needs changing.

Review work also interacts with data protection. Review text and reviewer names are personal data. Any agency storing, exporting or republishing them needs a lawful basis and a retention rule. The ICO's UK GDPR guidance applies alongside consumer law. Our guide to local SEO data protection duties covers the records you should keep.

One more shift: the CMA expects businesses to be able to show how they vet reviews. A policy that exists only in a slide deck is not evidence. Written procedures, training notes and platform settings are.

Fake reviews and the Digital Markets, Competition and Consumers Act 2024

The Digital Markets, Competition and Consumers Act 2024 gives the CMA a direct enforcement route for unfair commercial practices, including fake reviews. It received Royal Assent in 2024 and its consumer provisions are being commenced in stages.

The fake review provisions target a defined set of conduct. They cover submitting a fake review, commissioning one, and incentivising a review without disclosing the incentive. They also cover publishing review information in a misleading way, such as showing only five star ratings while hiding a large volume of negative ones.

Critically for agencies, the rules reach businesses that host or facilitate reviews, not just the businesses that write them. A directory, a marketplace or a review widget that knowingly carries fake reviews can be in scope. So can an agency that arranges them.

Penalties are the headline change. The CMA can impose fines of up to 10 per cent of global turnover, or up to £300,000 if turnover cannot be calculated. It can also accept undertakings and publish its decisions. That is a different world from the old route of going to court for an enforcement order.

The CMA can also act against traders who fail to take down fake reviews after being told about them. That creates a due diligence duty for platforms and for agencies managing profiles on them.

Read the primary text if you advise clients on this. The Digital Markets, Competition and Consumers Act 2024 sets out the unfair commercial practices regime and the fake review provisions in one place. The CMA's own pages explain how it uses those powers.

For local SEO work, the practical implications are specific. A Google Business Profile with a burst of five star reviews from accounts with no history is a red flag. So is a review gating setup that only asks happy customers. So is a competitor-suppression tactic that reports genuine negative reviews as spam without grounds.

None of those are new tricks. What is new is that the regulator can now fine the agency and the client without a court fight. The Competition and Markets Authority publishes its consumer enforcement work, so clients can check the record themselves.

Unfair commercial practices under the CPRs 2008

The Consumer Protection from Unfair Trading Regulations 2008 predate the DMCC Act and remain in force. They prohibit unfair commercial practices, including misleading actions and misleading omissions, and they list 31 practices that are banned outright.

The banned list includes falsely claiming that reviews are genuine, and using editorial content in the media to promote a product where the trader has paid for it. Those two entries cover most review misconduct an agency might encounter.

A misleading action under the CPRs includes giving false information or deceiving the average consumer. A misleading omission includes hiding material information the consumer needs to make an informed decision. A profile that hides a paid placement or a review incentive can breach either.

The The Consumer Protection from Unfair Trading Regulations 2008 are the underpinning rules for honest review claims. They apply to sole traders, limited companies and agencies alike. There is no small business exemption.

The CPRs also give enforcers a route to act on aggressive practices, such as pressuring a customer to remove a negative review. That is rarer in local SEO, but it happens.

When the DMCC Act provisions fully replace parts of the CPRs, the core principles survive. Honest, clear and non-misleading review claims remain the standard. The enforcement mechanism is what changes.

If you write review copy for clients, test it against both regimes. A claim like "rated the best in Birmingham" needs evidence. A claim like "over 200 verified reviews" needs a definition of verified. The ASA's CAP Code applies to ads, and the CMA applies to the underlying practice.

Review management rules for agencies and their clients

A workable review policy has to cover solicitation, moderation, response and removal. It also has to say who is responsible when something goes wrong. Here is a structure that satisfies both the CMA regime and normal client expectations.

1. Agree in writing who owns the review workflow, the agency or the client. Name the person who signs off review requests.
2. Document how reviews are solicited: which customers, which channels, what wording, whether any incentive is offered and how that incentive is disclosed.
3. Set a moderation rule that applies to positive and negative reviews alike. No gating, no filtering by sentiment.
4. Record how responses are written and who approves them. Responses must not mislead or imply a review is fake without evidence.
5. Define the removal process: what gets reported, to whom, with what evidence, and what happens if the platform refuses.
6. Keep an audit trail for at least the period your client's sector requires, and longer if a complaint is live.

A checklist helps clients see the gaps. Use this one in onboarding.

• Written review policy signed by the client
• Named review owner at the agency and at the client
• Solicitation wording checked against the CAP Code
• Incentive disclosure wording agreed
• Moderation rule that does not filter by star rating
• Response templates that avoid misleading claims
• Removal and escalation process documented
• Review data retention and deletion rule in place

Worked example. A dental practice in Bristol asks its agency to run a review campaign. The agency sets up a post appointment email asking for a review, with no incentive. It also sets up a widget that shows only four and five star reviews on the practice website. That widget is a misleading omission under the CPRs because it hides material information. The fix is simple: show a rating summary that includes the full distribution, or state clearly that only recent positive reviews are displayed. The agency should also record the decision and the date.

A second example concerns a home improvements firm in Glasgow. A competitor leaves three negative reviews from accounts created the same week. The agency reports them to Google with evidence of the pattern. That is legitimate. If the agency instead reports every negative review as fake, it risks acting unfairly and could itself be the subject of a complaint.

Agency contracts should include a review clause. It should say what the agency will and will not do, what the client must approve, and how disputes are handled. It should also say that the client remains responsible for the accuracy of claims about its own business.

If a client insists on buying reviews, the agency should decline in writing. That instruction is evidence of good practice if the CMA later investigates. It also protects the agency's own reputation, which is the asset that wins the next pitch. Our piece on local SEO agency reviews explains how buyers check that record.

Reporting review problems to the CMA

The CMA accepts reports about businesses that may be breaching consumer law. It does not resolve individual disputes or award compensation. It uses reports to decide where to investigate.

Before reporting, gather evidence. Screenshots with dates, URLs, account names where visible, and a note of what rule you believe is broken. The CMA is more likely to act on a pattern than on a single review.

Reports can be made through the CMA's online form on GOV.UK. The regulator also runs a cartel and competition reporting route, but review issues belong in the consumer enforcement channel. The Consumer protection guidance for businesses - GOV.UK collection explains how the CMA approaches cases and what businesses should do.

Agencies should not report on a client's behalf without written authority. They should also avoid public accusations of fakery unless they can support them. Defamation risk is real, and platform terms often penalise false reports.

For competitors, there is a legitimate route. If a rival is buying reviews, document it and report it. The CMA has said it will act on practices that distort local competition. The same conduct can also be raised with the platform.

For agencies, the more common need is a paper trail. If a client asks for something the agency refuses, the refusal should be in writing. If a platform ignores a valid removal request, the request and the response should be logged. That record protects the agency and helps the CMA if it ever asks.

Reporting is not a substitute for fixing your own process. The CMA's first question to any business is what its own policy says. If the policy is thin, the report will not save you.

Due diligence on review platforms and suppliers

Agencies increasingly buy review tools, widgets and reputation services. Each supplier is part of the chain the CMA can examine. Due diligence is now a client expectation, not a nicety.

Ask suppliers how they source reviews, whether they use incentivised panels, and how they handle negative feedback. Ask for their data processing terms and their retention policy. If they cannot answer, do not use them.

Platform choice matters too. Google Business Profile is the dominant surface for local search in the UK, and its review policies are enforced by Google, not the CMA. But a platform's own rules are not a defence against consumer law. If a platform allows a practice, that does not make it lawful.

When comparing suppliers, look at the evidence they publish. Our guide to local SEO reviews sets out the paperwork to request, including review provenance and moderation records.

Subprocessors matter. If a review widget sends reviewer data outside the UK, the agency may need a transfer mechanism. UK GDPR and the Data Protection Act 2018 apply. The ICO can act independently of the CMA.

Finally, check the supplier's own reviews. A reputation tool with a fake review problem is a liability in your stack. The same scrutiny clients apply to you applies to the tools you recommend.

Documenting review policy for clients

Documentation is what separates a defensible agency from a lucky one. The CMA's guidance expects businesses to be able to show how they meet their obligations. A short, clear policy beats a long, vague one.

A client review policy should state the purpose, the scope, the roles, the solicitation rules, the moderation rules, the response rules and the removal rules. It should name the laws it reflects, including the DMCC Act 2024 and the CPRs 2008.

Keep it current. The DMCC Act's consumer provisions are being commenced in stages, so the policy should note the commencement position and be reviewed when the regime changes. A dated version history is enough.

Train the people who touch reviews. A single account manager who offers a voucher for a five star review can undo a year of good practice. Training records are evidence.

Review the policy annually and after any incident. If a complaint is made, log it, investigate it and record the outcome. That record is what an enforcer will ask for first.

Agencies that treat review policy as a selling point will win work. Buyers are increasingly alert to review risk, and a documented process is a differentiator. Our overview of local SEO rules and ethics explains how that shift is changing agency selection.

Common questions

Does the CMA fine individual agencies for fake reviews? Yes, the DMCC Act 2024 allows the CMA to impose penalties directly, including fines of up to 10 per cent of turnover or £300,000, on businesses that breach the unfair commercial practices rules.

Do the CPRs 2008 still apply now the DMCC Act is in force? Yes, the Consumer Protection from Unfair Trading Regulations 2008 remain in force while the DMCC Act provisions are commenced in stages. Both regimes can apply to the same conduct.

Can an agency be liable for a client's fake reviews? Yes, if the agency commissions, facilitates or knowingly benefits from them. The CMA looks at the practice, not just the business named on the profile.

How do we report a competitor buying reviews? Gather dated evidence and report it to the CMA through its consumer enforcement route. Do not make public accusations you cannot support.

What is the minimum review policy a client needs? A written policy covering solicitation, moderation, response and removal, with a named owner and a retention rule. It should be dated and reviewed at least annually.

Does UK GDPR apply to review data? Yes. Reviewer names and review text are personal data, so you need a lawful basis, a retention rule and a way to handle deletion requests.