Fake testimonials: unverified reviews on your site

The rule

Three provisions carry this check, and all three came into the Unfair Commercial Practices Directive through the Omnibus Directive, Directive (EU) 2019/2161. Member States had to apply their national versions from 28 May 2022.

Penalties are national. Article 13 of the UCPD, as replaced by the Omnibus Directive, requires penalties that are “effective, proportionate and dissuasive”. For widespread infringements dealt with through the cross-border enforcement regulation (Regulation (EU) 2017/2394, Art. 21), Member States must allow fines of at least 4% of the trader’s annual turnover in the Member States concerned, or at least EUR 2 million where turnover information is not available. The two Italian decisions below show how much lower an ordinary national fine can be.

The directive also leaves room for hosts. The Commission’s guidance says the first part of point 23c, submitting or commissioning false reviews, does not apply to platforms that host and give access to reviews without being involved in posting them. The second part, misrepresenting reviews, is aimed at traders including platforms, for example by showing only positive reviews or obtaining the withdrawal of negative ones. Hosts also carry the information duty in Article 7(6) and point 23b.

What PeekWell checks and how

EU-11 reads the reviews and testimonials a visitor can see on a public page, and asks two questions about them. Does the page say whether and how they were checked? Do any of them look possibly fabricated?

The first question is answered by code. The scan finds the testimonial and review blocks, then looks for a statement about how reviews are verified or collected on the pages it visited. A page with reviews and no such statement is recorded as observed that way.

The second is a different kind of answer. The scan runs the review text through a classifier that looks for signs of machine-written text, and it checks for duplicate wording across reviews and for photos that match stock images. What comes back is a flag with a confidence level. It is reported as “AI-flagged as possibly fabricated” and the severity is written as high if confirmed. The scan never states that a review is fake, because it cannot know. A classifier can misjudge, and a real customer may have used a writing tool or reused a profile picture.

The scan has limits, and the report says so. It sees the public pages it visited and nothing behind a sign-in. It does not contact reviewers, compare reviews with order records, or log in to a review platform to see what was moderated. It does not read your contracts or your agency’s briefs. It cannot see reviews that are never sent to the browser. A Passed means the expected behaviour was observed on the pages scanned. It does not say the site complies.

The same method runs for UK-13 and US-01, which state those jurisdictions’ own rules.

Why it matters for a company

Two Italian decisions show how enforcement has reached both ends of the market.

In March 2026 the AGCM fined Trustpilot Group Plc, Trustpilot A/S and Trustpilot S.r.l. EUR 4 million. Its press release says the platform had not run adequate checks that reviews were genuine, even where Trustpilot marked them as verified, and that its paid collection tools let businesses select which customers were invited to review. It cites Articles 20, 21, 22 and 23(1)(bb-ter) of the Consumer Code, and says the conduct included dark-pattern interface techniques. A review host was therefore held to what it told consumers about verification, which is close to the ground Article 7(6) and point 23b cover.

In June 2024 the AGCM fined Teahupoo S.r.l. EUR 16,000. The company sold followers, likes and comments through its website, and the authority found these did not come from real users or real consumer experience. It applied Articles 20 and 23, letter bb-quater, of the Consumer Code and ordered the practice stopped. That was a seller of the false signals, not a store displaying them. The decision matters here because the Commission’s guidance treats buying such signals as within point 23c.

Three practical consequences follow. A page that calls its reviews genuine is judged against what it did to check them. Saying “verified” without a process is itself the problem in point 23b. And a decision can rest on the way reviews were collected or presented, as the Trustpilot decision did, not only on whether a given review was invented.

Smaller companies and larger companies

The rule has no size threshold. Size enters in two places: what counts as reasonable and proportionate steps, and how the problem arises.

In a small company the page usually carries a handful of testimonials in a theme block. Some were written by the owner from memory of what customers said, some came from a freelancer who was asked for social proof, and a few star ratings are typed in by hand. Nothing on the page says how any of it was collected. The Commission’s guidance expects less machinery from a small trader than from a large platform, but the claim has to be honest: a quote attributed to a customer who does not exist is false whatever the size of the business. The Teahupoo decision shows a business with turnover of EUR 539,916 within an authority’s reach.

In a larger company the reviews come from several systems. A review vendor feeds product pages, a marketing team commissions creator content, an agency runs a seeding programme with free products, and an average rating is built from inputs nobody has listed. The risk is less one invented quote than a process that selects, as the Trustpilot decision describes, or a rating built on undisclosed criteria.

How to fix it

These steps are practical, not legal advice, and they follow the examples in the Commission’s guidance.

1. List every place reviews and testimonials appear. Home page, product pages, landing pages, app store badges and ad creative. Note the source of each: your own customers, a review service, an agency or the team.
2. Remove or relabel anything you cannot trace. A quote you cannot tie to a real customer comes off the page. Content written by staff or an agency should not be presented as a customer review.
3. Say how reviews are collected and checked. Put a short note where the reviews are shown, not on a page three clicks away. Say whether only buyers can review, how that is checked, whether all reviews are published or some are held back, and how the average is calculated.
4. Check reviewers where you can. Match reviews to orders or booking numbers, ask reviewers to register, and write clear rules against undisclosed sponsored reviews. Your review vendor may already offer these settings.
5. Show the negative ones as well. Do not delete negative reviews because of their rating. Remove them only on rules you apply equally, such as abuse or content unrelated to the product.
6. Brief your agencies in writing. Contracts and briefs should say that fake or paid-for reviews are not to be commissioned, and that incentives must be disclosed.
7. Re-scan. Run a scan again. The note about how reviews are checked should now be found, and any flagged item should be gone or explained.