What you can and cannot do with Google reviews in Spain

The Google Maps content policy has a section called fake engagement. This is what it forbids businesses from doing:

The policy says “directly or in kind”. That covers the free dessert, the Christmas hamper prize draw and the extra point on the loyalty card. There is no minimum amount below which it is allowed.

In the same document, under rating manipulation, sits the sentence that makes half the Spanish market unlawful:

That is precisely the so-called satisfaction filter: the pre-survey that sends whoever answers well to Google and whoever is unhappy to an internal form. It does not matter that, technically, nobody stops the angry customer going to Google. The request is selective, and that is what is banned. If a system asks a question first, the Google link must appear exactly the same for one star as for five, at the same size and with the same prominence.

And there are two further prohibitions that almost nobody knows about:

• No tablets or kiosks on the counter with someone standing over the customer. The QR code on the table or the receipt is fine, because the customer decides when.
• No review targets for staff, and no asking the customer to name the waiter who served them.
• No reviews from employees, former employees, family, suppliers or the agency itself: that is a conflict of interest and it gets removed too.
• And one purely statistical pattern: two hundred reviews in a week for a business that used to get three a month is exactly what the filter looks for. Google does not need to prove the incentive, the pattern is enough.

This is the part the grey market leaves out: asking for reviews is not merely legal, Google asks you to do it.

The same page adds that you can also send requests by email, WhatsApp or a Facebook post. And on the perfect score, Google writes something worth reading twice:

A practical detail: review QR codes can currently only be generated from a desktop browser, not from a phone.

Long before the consumer authorities move, Google does. And its ladder of sanctions has four rungs:

1. 1Content rejected: profiles and content that do not meet the criteria may never be published at all.
2. 2User content suspended: if the contributions to a profile are systematically unhelpful, harmful or off topic, Google can limit or suspend the user-generated content on that profile.
3. 3Account restricted: and here is the important one. If a merchant’s account is restricted, every business profile attached to that account is suspended.
4. 4Profile disabled: if Google decides the business does not exist at the stated location, it disables the profile.

The third rung is the one that dictates how a service like ours has to be built. If an agency managed three hundred listings from a shared account and just one of those businesses incentivised reviews, the blast radius would not be one client. That is why every client keeps ownership of their profile and we come in as delegated manager from their own account.

Appeals, according to Google’s own support pages, can take up to 5 working days. Businesses in the European Economic Area and the United Kingdom have additional appeal routes, a direct consequence of the EU Digital Services Act.

The Omnibus Directive was transposed in Spain by Real Decreto-ley 24/2021, which added paragraphs 7 and 8 to art. 27 of Ley 3/1991, the unfair competition act. In force since 28 May 2022. They read as follows:

Two readings come out of paragraph 8, and both are worth being clear about:

• “Or commissioning another natural or legal person”: the business that buys fake reviews is an infringer in its own right, not only the outfit that sells them.
• “Or distorting reviews”: this is where the satisfaction filter lands, without any individual review being false. Distorting the sample is enough.

These are unfair practices in every case, with no need to show that anyone’s economic behaviour was actually altered. And there is one more article aimed at the service provider rather than the business: art. 5.1.b treats as misleading any information that misleads about “the results that can be expected from its use”. Promising “fifty reviews guaranteed” or “4.8 stars in sixty days” is exactly that.

And there is no need to wait for an inspection: art. 32.1 lets a competitor bring proceedings directly for cessation, removal, correction and damages.

Warning: this is not the 2021 wording that still circulates on almost every blog in the sector. The article was amended by Ley 10/2025, of 26 December, in force since 28 December 2025 and fully enforceable from the end of June 2026.

Three practical consequences, and none of them is minor:

1. 1The 30 calendar-day window. If a service offers to “ask every customer you have ever had for a review”, it is pushing you outside this provision. The sequence has to fire within thirty days of the purchase or the service, and the system should make sending outside that window impossible by design.
2. 2The entitlement to request removal exists, but the burden of proof is yours and the word “conclusively” is in the statute. In practice that means producing till records, bookings or takings for the period showing that this person was never a customer. It is a real lever, not a promise of success.
3. 3The right of reply through the same channel, now recognised by Spanish statute as well as by Google policy.

And a fourth that binds us: if a company publishes testimonials or customer reviews on its own website, this article requires it to say whether or not it guarantees that the authors are real customers, and to explain how they are processed. That is why this site publishes no testimonial today. When it publishes one, that explanation will sit beside it.

The article closes by stating that the burden of proving compliance falls on the trader, and that failing to comply counts as an unfair misleading practice.

Art. 47.m of the Spanish consolidated consumer act classes “the use of unfair commercial practices against consumers or users” as an infringement. And art. 49 sets the amounts:

Now the honest part, the one that makes everything above credible: we have not found a single published Spanish enforcement file specifically about fake reviews. Today, the real and immediate risk for a local business is not the consumer authorities. It is Google wiping its reviews and, if it persists, restricting its account.

That said, the direction of travel is only one way. In a coordinated European Commission sweep of 223 review sites, the authorities could not confirm that 144 of them did enough to ensure reviews were genuine, and concluded that at least 55% might be breaching the unfair commercial practices directive. In the United Kingdom, the CMA accepted formal undertakings from Google in January 2025 that include sanctioning businesses which inflated their ratings and showing warnings on their profiles.

This is the part almost nobody explains, and it is where the biggest fines are. There is no settled answer on whether asking for a review counts as a commercial communication, so the sensible position is to treat it as one every time: complying costs nothing and getting it wrong is a serious infringement.

The same article requires the email to include a valid electronic address for exercising that objection, and prohibits sends that do not carry one. WhatsApp and SMS fall under “equivalent means of electronic communication”: same regime.

And art. 20.1 requires the natural or legal person on whose behalf the message is sent to be clearly identifiable. Translated for this sector: the sender has to be your business, not the platform running it for you. A “noreply” from the tool, with no mention of the restaurant, breaches that article.

The fines are in arts. 38 and 39: mass sending, or insistent or systematic sending to the same recipient in breach of art. 21, is a serious infringement carrying €30,001 to €150,000. That is why cadence matters so much: one request and one reminder is defensible; five reminders is not.

The minimum checklist, in eight points:

1. 1Write only to customers with a prior contractual relationship with that business, one you can evidence.
2. 2Use contacts obtained directly by the business and disclosed at the point of collection. Never bought lists, never scraping, never another platform client’s data.
3. 3Identified sender: the business, not the tool.
4. 4An unsubscribe link on every send, free and one click, plus a valid electronic address for objections.
5. 5Immediate and permanent suppression on unsubscribe, with a global list.
6. 6A bounded cadence: one request and one reminder at most, and a hard stop 30 calendar days after the service.
7. 7A signed processor agreement, a record of processing activities and a documented legitimate interest assessment.
8. 8An audit log of every send: who, when and why. That is your evidence if an inspector calls.

• We ask every one of your customers for a review, with no pre-survey and no filtering by expected satisfaction.
• With no incentives of any kind, gifts in kind included.
• With you as the sender, one-click unsubscribe and an objection address on every send.
• One request and one reminder, inside 30 calendar days, with an automatic stop.
• We report reviews that breach a specific policy, under the exact ground, and we build the evidence file when the author was never a customer.
• We come in as delegated manager from your account, never as owners, and no reply is published without your approval.