GDPR-compliant review requests: Rules for businesses in 2026

Asking customers for a review by email is legally considered advertising and involves processing personal data. Under Section 7(2) of the German Unfair Competition Act (UWG), email advertising without prior consent is generally an unreasonable nuisance that competitors and trade associations can challenge with costly warning letters. Review marketing can usually be run in compliance with the law when it relies on valid consent or on the narrow existing-customer exception in Section 7(3) UWG, combined with data minimisation, transparency and a data processing agreement for any tools involved. This guide explains the key rules for 2026 in plain language, but it does not replace legal advice in individual cases.

Why review marketing touches data protection and competition law

Review marketing sits at the intersection of two legal frameworks. On one side is the GDPR: anyone who stores email addresses, names or order numbers and uses them for review requests is processing personal data and needs a legal basis for that. On the other side is competition law: an email asking for a review serves to promote the business and is therefore treated as advertising under the German Unfair Competition Act.

On top of that come the rules of the review platforms. Google, Trusted Shops and ProvenExpert all prohibit bought or covertly rewarded reviews and can suspend profiles or remove entries. These rules are not laws, but in practice they often take effect just as quickly.

The risk is real: advertising violations can lead to costly cease-and-desist letters from competitors, trade associations or consumer organisations, and data protection violations can result in fines and complaints to supervisory authorities. A single email campaign sent without checks can therefore breach several sets of rules at once.

The basic rules in detail

Consent: the cleanest basis for review requests

Valid consent is the safest foundation for email review requests. It must be given actively, for example through a separate checkbox that is not ticked in advance. Clauses hidden in terms and conditions or a blanket agreement to promotional messages are generally not sufficient, because consent has to be purpose-specific.

In practice this looks like the following:

• The checkbox states the purpose concretely, for example: "I would like to receive an email asking me for a review after my purchase."
• The consent is documented so it can be proven in a dispute.
• The double opt-in procedure, in which the sign-up is verified by clicking a confirmation link, has become established practice and is considered strong evidence.
• Consent can be withdrawn at any time; after a withdrawal, no further request may be sent.

Important: consent for a newsletter does not automatically cover review requests as well. Because of purpose limitation under Article 5 GDPR, each use should be captured separately.

The existing-customer exception in Section 7(3) UWG

For existing customers there is an exception that has to be interpreted narrowly in practice. Section 7(3) UWG allows email advertising without consent only if all of the following conditions are met cumulatively:

1. The business obtained the email address in connection with the sale of goods or services.
2. The email advertises the business's own similar goods or services.
3. At the time the address was collected, the customer was clearly informed of the right to object at any time.
4. Every advertising email contains the objection notice again.
5. The customer has not objected to the use.

Whether a pure request for a review already counts as advertising for your own similar goods or services is not assessed fully uniformly in practice. Anyone relying on the exception should therefore meet all conditions completely and document this. If the objection notice is missing at checkout or in a single email, the exception regularly falls away.

An internal suppression list, often called a Robinson list, helps: anyone who has objected is flagged and receives no further advertising emails. This list itself may only be used for the purpose of honouring the objection.

Data minimisation and purpose limitation under Article 5 GDPR

A review request usually needs only a few data points: a name, an email address and a reference such as an order number. Anything beyond that should not be collected or stored.

Purpose limitation means that addresses collected for a purchase may not simply be reused for arbitrary other purposes. The same applies in reverse: once the purpose no longer applies, the data must be deleted rather than kept for later. A defined deletion concept with clear deadlines is therefore part of compliance, not just tidiness.

Transparency: information duties under Article 13 GDPR

Information must be provided at the point of collection, for example at checkout or on the sign-up form. For review requests, the privacy policy should cover at least the following points:

• The purpose of processing, meaning the sending of review requests
• The legal basis, for example consent or the existing-customer exception
• Recipients or service providers used
• The storage period or the criteria defining it
• Data subject rights such as access, rectification, erasure, objection and the right to complain to a supervisory authority

Transparency starts earlier than many assume: the notice about the right to object under Section 7(3) UWG belongs at the point where the address is collected.

Processors: integrating tools correctly

Using a review tool usually means handing customer data to a provider that processes it on your behalf. That is generally processing under Article 28 GDPR, which requires a contract, often called a data processing agreement or DPA.

Before the first data sync it is worth checking: is a DPA in place? Where is the data stored? Which sub-processors are used? What does the deletion concept look like? Uploading a customer list without a DPA is an unnecessary risk.

What you should avoid

Bought reviews. Purchased reviews are legally problematic because they can mislead consumers about authenticity, and they also violate the policies of Google and other platforms. Besides removal of the entries, businesses risk profile suspensions and competition-law warnings.

Covert incentives. Promising discounts, vouchers or rewards for a review should only happen where the platform allows it and the reward is disclosed. Incentives that apply only to positive reviews are especially risky because they create a distorted picture. Covert rewards can be classified as a misleading commercial practice.

Unchecked customer lists. Old spreadsheets, trade fair contacts or bought address data can almost never be used cleanly for advertising in practice. Without documented consent or the conditions of Section 7(3) UWG, no email should be sent. If a list cannot be traced back completely, it is better left unused.

Suppressing critical reviews. Hiding negative feedback is not an option; what is legitimate is reporting unlawful entries. Our guide on reporting and removing Google reviews explains how that works step by step.

Practical checklist: sending review requests in compliance with the law

1. Decide the legal route: obtain consent or check the conditions of Section 7(3) UWG case by case, and briefly document the decision.
2. Design consent cleanly: separate, unticked checkbox, concrete purpose, consider double opt-in, store the proof.
3. Apply the existing-customer exception correctly: use only addresses from a sales context, include the objection notice at collection and in every email, maintain a suppression list.
4. Minimise data: process only the name, email address and order reference, with no further attributes or enrichment.
5. Update the privacy policy: describe the purpose, legal basis, recipients, storage period and data subject rights in full.
6. Sign a DPA: conclude a contract under Article 28 GDPR with every review tool and check storage locations and sub-processors.
7. Define deletion deadlines: delete addresses after the request has been sent or the purpose achieved; keep objections only in a suppression list.
8. No fake reviews: rule out bought reviews and covert incentives entirely.
9. Brief the team: no ad-hoc sends from sales or Outlook lists without approval.
10. Respond properly in the worst case: mind deadlines after a warning letter and do not sign a cease-and-desist declaration without legal review.

Structured requests instead of ad-hoc campaigns

Most risks arise not from bad intent but from disorganised processes: loose spreadsheets, spontaneous sends, missing documentation. The remedy is a fixed workflow: requests only go out from a defined process with a documented legal basis, and any mailing service you use is covered by a data processing agreement. A review link on a receipt or invoice works without any customer data at all; the guide to the Google review link shows how to create it. RateGate then brings incoming reviews from Google, Trusted Shops and ProvenExpert together in one shared inbox. An overview is available on the RateGate features page; how RateGate itself handles data is described in the privacy policy. One thing remains important: even the best tool does not remove a business's own duties such as consent, notices and an up-to-date privacy policy.

Frequently asked questions

Is a review request by email legally advertising?

In most cases yes. An email asking customers for a review serves to promote the business and is classified as advertising under competition law. That is why the rules of Section 7 UWG apply. Treating the request as advertising from the outset puts you on the safe side.

May I ask existing customers for a review without consent?

Only if all conditions of Section 7(3) UWG are met: the address comes from a sales context, the right to object was pointed out at collection and in every email, and the customer has not objected. It should also be documented when which address was collected for what. When in doubt, consent is the safer route.

What belongs in the privacy policy regarding reviews?

The purpose, meaning the sending of review requests, the legal basis, any service providers used as recipients, the storage period and data subject rights should all be described. The right to object and the right to complain to a supervisory authority belong there too. The information must be available at the point of data collection.

Do I need a data processing agreement for a review tool?

In most cases yes. As soon as a provider processes personal data of your customers on your behalf, for example to send requests, that constitutes processing under Article 28 GDPR. No customer list should be uploaded without that contract.

May customers be rewarded for a review?

Only with caution. An openly disclosed reward can be permissible if the platform allows it. Covert incentives or rewards that apply to positive reviews only are problematic both legally and under platform rules. When in doubt, it is safer to skip incentives entirely and instead ask politely and make it easy.

How long may customer addresses be stored for review requests?

Only as long as necessary for the purpose. After the request has been sent or the purpose no longer applies, the data should be deleted. Data of customers who objected may only be kept in a suppression list to prevent future emails.

Conclusion

GDPR-compliant review marketing is achievable when businesses take three things seriously: a clear basis for sending, meaning consent or the narrow existing-customer exception, transparent information for data subjects, and clean contracts with the tools they use. Bought reviews, covert incentives and unchecked address lists have no place in a serious process. Companies that organise requests properly instead of sending them spontaneously reduce their warning-letter risk noticeably and build customer trust at the same time. This article describes established practice, but it cannot replace advice from a specialist lawyer in an individual case.

This article is not legal advice.