Online reviews and the ACL, your business's compliance obligations

Most businesses treat online reviews as a marketing channel. The law treats them as representations to consumers, and the Australian Consumer Law (the ACL) gives the Australian Competition and Consumer Commission (the ACCC) powerful tools to police them. If your business publishes reviews on its own website, invites customers to leave reviews, offers incentives for them, displays star ratings, or runs a review platform, you have obligations that go well beyond simply not posting fake reviews yourself.

The ACL is Schedule 2 of the Competition and Consumer Act 2010 (Cth) (the CCA), and the ACCC has made online reviews a continuing enforcement priority. In a December 2023 internet sweep, the ACCC found that 37 per cent of the 137 businesses it reviewed had engaged in conduct of concern involving online reviews, including using third-party services to create fake reviews or remove negative ones. Courts have imposed penalties of $3 million on Meriton, $2.9 million on HealthEngine, $1 million on Bloomex and $600,000 on Service Seeking for review-related conduct. This article sets out who those obligations apply to, what the duties are in practice, and what happens if you get them wrong.

Who must comply with the review rules

The ACL applies to any person or business acting in trade or commerce in Australia. There is no turnover threshold, headcount test or minimum size. A sole trader running a one-person trade, a family company and a multinational platform all face the same core rule: you must not engage in conduct that is misleading or deceptive or likely to mislead or deceive, and you must not make false or misleading representations.

In the reviews context, that brings the following within scope:

• Businesses that display reviews or ratings: including reviews on your own website, in-store displays and social media pages.
• Businesses that solicit or incentivise reviews: for example email campaigns after a purchase, or discount offers in exchange for a review.
• Review platforms and marketplaces: any site or app that publishes reviews of other businesses' goods or services.
• Reputation management services: third parties that offer to write, remove or improve reviews, which the ACCC's sweep identified as a significant part of the problem.

The obligation is not limited to what you publish. It also covers what you omit, edit or quietly arrange, as the cases below show.

The core prohibition: no fake or misleading reviews

Section 18 of the ACL prohibits misleading or deceptive conduct in trade or commerce. Section 29 goes further and prohibits false or misleading representations about goods or services, including representations that purport to be testimonials. For testimonials, s 29(2) reverses the usual onus: a representation that purports to be a testimonial is taken to be misleading unless the business adduces evidence that it is genuine.

In practice, the following are all on the wrong side of the law:

• Publishing reviews that were not written by someone who actually used the goods or services.
• Publishing invented or copied testimonials. The ACCC took action against removalist Citymove in 2011 after it copied testimonials from an unrelated review website, changed them and published them as its own; Citymove paid a $6,600 penalty under an infringement notice.
• Arranging for others to write reviews on your behalf, whether employees, family members, friends, paid reviewers or a third-party service. Even a genuine review from an employee or relative must disclose the connection.
• Writing reviews of your own business, or negative reviews of a competitor. The prohibition applies to content you create as much as content you solicit.

The rule can be stated simply: a review must reflect the genuine opinion of a person who experienced the product or service, and any connection between the reviewer and the business must be apparent to the reader.

Disclose incentives and commercial relationships

The ACCC's guidance on online reviews identifies undisclosed incentives and undisclosed commercial relationships as two of the most common problems.

If you offer an incentive for a review, such as a discount on the next purchase or entry into a prize draw, the incentive must be offered regardless of whether the review is positive or negative, and it must be disclosed so consumers can see the review was incentivised. Selectively offering incentives to customers you expect to be happy is itself misleading conduct, because it builds a review profile that does not reflect genuine customer experience.

The same logic applies to commercial relationships. If a review platform has an advertising arrangement with a reviewed business, or a business pays for placement or promoted reviews, that relationship and its impact on what consumers see should be disclosed. The ACCC's position is that failing to disclose a commercial relationship that may affect a business's overall rating can amount to misleading conduct, even where the relationship has no actual effect on the reviews.

Do not curate, suppress or edit reviews to shape your rating

This is the duty most often breached, and the one that has produced the highest-profile penalties. You must not filter, suppress, edit or selectively solicit reviews in a way that gives consumers a misleading picture of your business.

The leading case is Australian Competition and Consumer Commission v Meriton Property Services Pty Ltd [2017] FCA 1305. Meriton used TripAdvisor's Review Express service to email guests and invite them to review its serviced apartments. Over the relevant period it added the letters "MSA" to the front of the email addresses of guests who had complained, which made the addresses invalid so the invitations never arrived, and it withheld from TripAdvisor the email addresses of all guests who had stayed during major service disruptions such as lift failures or no hot water. The effect was that dissatisfied guests were silently excluded from the review process, and the rating consumers saw did not reflect genuine customer experience. The Federal Court found the conduct breached the ACL, and in the penalty judgment, Australian Competition and Consumer Commission v Meriton Property Services Pty Ltd (No 2) [2018] FCA 1125, ordered Meriton to pay $3 million, restrained it for three years from filtering or limiting the guest email addresses it supplied to TripAdvisor, and ordered a compliance program and corrective publication.

HealthEngine, an online health marketplace, admitted that between March 2015 and March 2018 it did not publish a large volume of negative patient reviews and edited other reviews to remove negative aspects, and that it misrepresented the reasons some practices had no rating. The Federal Court ordered penalties of $2.9 million.

Even displaying a stale or unrepresentative rating can breach the law. In Australian Competition and Consumer Commission v Bloomex Pty Ltd [2024] FCA 243, the flower retailer's star ratings had remained static since January 2015, drew on reviews from its Canadian and United States sites, and included ratings from people who had never bought from Bloomex. The Court ordered a $1 million penalty.

The practical message: if you solicit reviews, solicit them from everyone, not just satisfied customers. If you edit or remove reviews, do so only on an adequate basis, and display the total number of reviews behind any rating, for example "3 stars, 24 reviews", so consumers can judge the rating for themselves.

Obligations for review platforms and marketplaces

Review platforms face obligations of their own. Publishing reviews created by the reviewed business itself is a false or misleading representation: Service Seeking, an online tasking platform, let businesses on the platform draft their own reviews and star ratings, which were then sent to the customer and automatically published if the customer did not respond within three days. The Federal Court ordered Service Seeking to pay $600,000 in penalties.

The ACCC's position is that businesses or platforms that do not remove or correct reviews they know, or should be aware, are fake may themselves breach the ACL. A platform should therefore have a complaints process for disputed reviews and act on it. The countervailing rule is equally important: a platform that removes a genuine negative review, or a business that pressures a platform to remove one, may be misleading consumers, so any takedown needs a proper basis.

Penalties and enforcement

The consequences of review-related misconduct are serious, and they have increased sharply in recent years.

For a false or misleading representation under Part 3-1 of the ACL, which includes s 29 and therefore covers misleading reviews and testimonials, a court can order a pecuniary penalty per contravention of the greater of:

• $100 million;
• three times the value of the benefit obtained from the conduct; or
• 30 per cent of the corporation's adjusted turnover.

Individuals involved can be ordered to pay up to $2.5 million per contravention. These maximums have been increased repeatedly since the ACL commenced; guidance written before the recent increases, which often quotes $10 million for corporations and $500,000 for individuals, understates current exposure.

Section 18 misleading or deceptive conduct does not carry a pecuniary penalty, but it is still a powerful provision. Courts can grant injunctions, order damages, make compensatory orders, and order corrective notices or adverse publicity orders, which is how the ACCC has forced businesses to publicise their own wrongdoing.

The ACCC also has speedier tools. It can issue infringement notices with set penalties, as it did against Citymove, and it can accept court-enforceable undertakings. The Meriton case shows the full menu of court orders: penalties, a three-year injunction, a compliance program and corrective publication.

A practical compliance checklist

Putting the duties together, a defensible review practice looks like this:

• Solicit neutrally: invite all customers to review, not just those you expect to be satisfied.
• Disclose incentives: offer any incentive regardless of the review's content, and tell reviewers the incentive is available whether the review is positive or negative.
• Disclose connections: make sure employees, family members or paid reviewers who do review disclose their relationship.
• Never fabricate: no invented testimonials, no copied reviews, no self-written reviews and no reviews of competitors.
• Do not curate: do not filter, edit, mask or withhold reviews to improve your rating, and do not use a third-party service that does.
• Show the basis: display the number of reviews behind any star rating, and publish your policy on editing and removing reviews.
• Act on complaints: respond to reviews that appear fake or misleading, and take down or correct reviews you know are fake, but only on a proper basis.
• Watch your vendors: check what any reputation-management or marketing agency is doing on your behalf, because their conduct is your exposure.

When to get legal help

A lawyer can help at several points. If you are designing a review solicitation or incentive program, a practitioner can check the invitation wording, the incentive structure and the disclosure language against the ACL and current ACCC guidance. If you receive a notice from the ACCC, whether an information notice under s 155 of the CCA, an infringement notice or a letter of demand, legal advice before responding can materially change the outcome. And if a competitor, platform or consumer has complained about your review practices, or you are defending proceedings, a lawyer can assess the strength of the claim, the likely penalty exposure and the options, which may include an enforceable undertaking or a negotiated outcome.

A practitioner can also audit an existing review profile, including how customers are selected for invitations, how negative reviews are handled, and what your platform or agency does on your behalf, and tell you where the risk actually sits.

Audit your invitation list first

If you do one thing this week, look at how your business decides who gets asked for a review. Meriton did not publish a single fake review. It was penalised $3 million because of the invitations it did not send: guests who complained, and guests who stayed through a service failure, were silently left off the list, so the review profile consumers saw was not the truth. The same logic applies to incentive programs, review platforms and reputation services. The ACCC's December 2023 sweep shows this is not a theoretical risk: more than one in three businesses it looked at had review practices of concern. Ask yourself whether your review profile, read as a whole, is an honest picture of customer experience. If the answer is not a clear yes, fix the invitation list, the incentive terms and the disclosure language before the ACCC asks you the same question.