The Glowing Review Isn't a Licence to Publish: A UK Testimonial Consent Walkthrough

A client forwards a WhatsApp message: 'Honestly, the best copywriter we've worked with. Saved us weeks.' They want it on the homepage, in the pitch deck, maybe on a trade show banner. By Friday. Lovely. Except nobody has asked the customer whether they meant it for public use, or whether they want their name attached, or whether they'd like the quote to disappear in six months when they move jobs.

That's the moment to slow down. Not because testimonials are dangerous, but because a quote without permission is a liability dressed as social proof. This is editorial guidance, not legal advice — for anything thorny, especially data protection or sector rules, get a solicitor's eye.

First, separate the compliment from the consent

Customer feedback arrives in many shapes: a WhatsApp, a Trustpilot review, a sentence in an email thread, a case study interview. The compliment is free. The right to publish it is not automatic. A public review on a third-party platform is not the same as permission to lift the words into your client's brochure. And a private message is definitely not a licence to publish.

So before anyone opens Canva, run a simple check.

The five-point permission check

1. What was agreed? Not 'they seem happy' but the actual scope. Written quote only? Name and job title? Company logo? Photo? Use in paid ads? The difference between a website testimonial and a LinkedIn ad campaign matters.

2. Who said it? Get the exact name, role, company and the email or message it came from. If the quote came via a sales team, ask for the original thread. Chinese whispers make bad captions.

3. Where will it appear? Website, pitch deck, trade press, paid social, a conference slide — each is a different audience and a different lifespan. If the plan might expand later, say so now rather than coming back for a second ask.

4. How long does it stay live? 'Until we redesign the site' is not an answer. Agree a review date or a time limit. A quote given in 2026 for a launch may not be appropriate in 2029.

5. How is permission recorded? A screenshot is better than nothing. A short email or signed note is better still. Keep it with the client file, not in someone's inbox.

The withdrawal right nobody mentions

People change jobs. Companies get acquired. A customer who was delighted in March may be less delighted in November. UK GDPR gives individuals rights over their personal data, and while consent is only one lawful basis, if you're relying on consent it should be as easy to withdraw as it was to give. Practical version: make sure there is a route to say 'please take that down', and act on it promptly.

For B2B quotes, the company may also have a say if you're using their name or logo. Don't assume a happy individual speaks for legal.

When the quote is perfect and the paperwork isn't

This is the common pushback: 'But they said it in an email. That's consent.' It might be. It might also be a private compliment. The safe answer is not to kill the quote; it's to get the missing bit in writing.

Try: 'Lovely quote — before we put it on the homepage, can you confirm the customer is happy for us to use their name and company, and that they're okay with it staying up until we next review the site? A one-line reply is fine.'

If the client wants it live today: 'We can publish an anonymised version now and add the name once we have the OK.' That keeps momentum without borrowing trouble.

If the client says the customer will never mind: 'Probably right. But if they do mind, we're the ones who published it.' Keep it light, keep it firm.

A plain-English consent note template

Use this as a starting point, adapt it to the client, and keep a copy. It is not a legal document.

Hi [Name],

Thanks again for the kind words about [project/service]. We'd like to use your feedback in [specific places: website testimonial / pitch deck / case study] as a quote.

The proposed wording is: '[quote]'

We'd like to credit you as [name, job title, company]. If you'd prefer to be anonymous, that's fine — just say.

We plan to keep it live until [date/review point]. You can ask us to remove it at any time by replying to this email.

Please reply to confirm you're happy with the above. If you'd like any changes, tell us and we'll adjust.

That's deliberately plain. It names the quote, the places, the credit and the exit. It also gives the customer a chance to say 'actually, not my company name'.

Record it, then set a diary note

Save the confirmation where the next person can find it. Add a review date to the content calendar. If the testimonial sits on a page that nobody owns, it will outlive its usefulness and possibly its permission.

The pre-publication glance

Before it goes live, check: quote matches the agreed wording; name and title are correct; the places match the permission; the review date exists; the confirmation is filed. Five minutes now saves an awkward email later.

Testimonials are one of the few bits of marketing that still carry real weight. Treat the permission as part of the craft, not paperwork after the fact. The quote can still be lovely. It just needs a paper trail.

This is editorial guidance, not legal advice. For data protection, contracts or regulated sectors, speak to a qualified professional.