Managing testimonials, comments and reviews

Protecting your business online

This module discusses your legal requirements when using testimonials, comments and reviews for your business.

Key Learning Modules:

  • Testimonials
  • Reviews & misleading Conduct
  • Publication
  • Comments
  • Infringement of intellectual property

Please note that the information presented in this section is general information only and not to be acted on. If you have a particular problem to your circumstances, please seek professional advice.

Video presentation: Managing, testimonials, comments and reviews

Managing, testimonials, comments and reviews

Hello. My name is Jeanette Jifkins from Onyx legal. Today, we're talking about managing testimonials, comments, and reviews online

A little bit about Onyx legal before we get started. We're a local boutique commercial law firm based in North lakes. We help people who are doing business online, predominantly and we aim to make life easier for you and dealing with lawyers easier for you. Our team, all of our senior team have owned their own businesses, so they understand what your experience is like as a small business owner. We've all done lots of study and have lots of letters after our name. And I've also written a book called cover your arse online to help you understand how to protect your business online. That's a little bit about us. Moving on to what we're covering today.

First, we'll have a look at testimonials, then we'll cover reviews and misleading conduct, publication, comments, and how they can potentially turn into bullying and harassment or defamation, and infringement of intellectual property.

Before we get started, this is just general information. Please don't use this information and apply it in your business. If you have a problem, you need specific advice to your circumstances. Please see a lawyer and please don't also use this information as advice for other people. They need advice specific to their circumstances as well. Recommend they do see a lawyer if you think they have a problem.


Okay. So the first thing we're going to look at is testimonials. It might surprise you, but some people make testimonials up. Didn't occur to me, but apparently it's a thing. So the Australian consumer law has a provision that says, testimonials must be real. Believe it or not. You must get permission from someone to use their information as a testimonial.

So for example, we get lovely emails from our clients from time to time. If they say something specific that we'd like to use on our website or social media as a testimonial, we ask them first, we get their permission. You can have testimonials in written form, audio video. However you do it, make sure you do have permission to do it, and it doesn't have to be difficult. You don't need a written permission slip. It could be as simple as when you're taking a video of someone giving a testimonial, ask them, would you like to give us a testimonial? It's that simple?

You can prove you can edit testimonials. Provided that you don't change the meaning of what is conveyed in the testimonial. So if someone, for example, gives you a written testimonial and it's three paragraphs long, that might be too long for your website or social media. You can use excerpts from it, as long as the meaning remains consistent. You can change names for privacy, but you do need to retain data to make sure you can prove the testimonial is from a real person and not made up.

Your testimonials must be about products that you currently have available. So if your businesses has morphed and changed over the years, and you've got testimonials from five years ago, that aren't actually about any products or services you offer today. I'm sorry but you can't use those testimonials to promote your current business. It's a misleading and deceptive conduct thing. It has to be about what's currently available.

It is actually against the national law for regulated health professionals to use testimonials, believe it or not. It's written into the law. So anybody who's regulated by the Australian health practitioner regulation agency, which is AHPRA, and that's, you know, doctors, nurses, psychologists, osteopaths, all those sorts of people, they can't use testimonials, because the law says they can't.

And any testimonial that you do use, can't give a misleading perception of what you do. So if someone's a little bit overenthusiastic in the way in which they describe your products or services, you might need to tone down what they do said so that you don't create an unrealistic expectation in future customers as to what you can deliver.

Reviews and misleading conduct

Looking at reviews and misleading conduct. So surprisingly, I had a client come to me recently and they’re building a website that is focused on reviewing products and they had this great idea that they would just go and copy other people's reviews. No, they can't do that for start and no, they can't actually read a whole bunch of reviews and make one up without reviewing the product. That's misleading and deceptive.

And the Australian consumer law, you know, provides for that. You can't do stuff like that. So if you want to review a product or service, you actually have to purchase that product or service, or if you're an influencer, you probably get sent that product to review it, for the purpose of promoting it to your audience. So don't base information about products or services that you're promoting on secondhand information.

There are advertising standards in Australia as well. Now, unless you're a publisher, you don't necessarily have to comply with advertising standards, but it's not a bad idea to have a look at them and understand them.

So for example, if you are considered an influencer or you do receive products or services for review, or to talk about and promotion, or you're asked to share information about somebody else's product or services to your audience. Then you need to let the audience know that. For example, if the product was sent to you for free, that it's sponsored content. You've received the product for free and you're reviewing it because you've received it, and for the purpose of sharing it with your audience.

Advertisements and adverse advertorials. So something that reads like an article, but it's actually an ad. If you're paid or provided products to do something like that, then you're supposed to disclose that you have been paid to do that, or you've received the product for free.

So there are, you know, on Instagram, for example, people will use hashtags SPONS to show that it's sponsored content or hashtag ADV for advertisements. So whatever is appropriate, period to your audience, make sure that you're complying with that because it adds to your credibility. It makes your business more legitimate.

In terms of endorsements don't for example, celebrity endorsements. Most people realize that if there is a celebrity promoting something on an advertisement it's not real, you know, that's paid.

One of the most recent examples I've seen is Snoop Dog promoting Menulog. That's obviously sponsored content. And on the bottom of the ads I've seen, it says paid actor. Don’t use or don't aim to use a celebrity or something that either you don't have the permission from the person to do it, or that could create a misleading impression to your potential customers, that you have their endorsement.

And don't promote reviews or information, anything around the sale of your products or services, don't promote it if it is going to be misleading. It's just not worth the hassle. And you know, the Australian consumer law says do not do it because you can be sued otherwise prosecuted.


In terms of being a publisher publication is communication and it can be written or it can be oral, or it can be pictorial. Any sort of promotion and publication sharing with other people, it can be to one person to be publication. You can be held responsible for that. So if you have a Facebook group, for example, and you are promoting information within that group, or you're allowing other people to put posts and promotions in that group, then you are potentially responsible as a publisher of that group. Particularly, when you exercise greater control.

Forwarding an email can be publishing. Reposting a post or retweeting a tweet can be a publication. Anything you put in your blog is publication. Anything you put in your podcast is publication. If you're, as I said in the social media group, anything you or someone else puts is publication. And if you're a forum administrator, so even if it's a closed group, if it's not public, it's still publication if it goes to one other person. And you need to be aware of that, because if you're held responsible as a publisher, then you could be liable for any potential action that arises out of something even if you didn't post it.

So the reason for that is the publisher is not just the author, or the editor or a work, but it's also the legal individual or entity who is responsible for that content. They need to know what the content is and have a degree of control over whether or not other people see it. And that's all you need. You just need to know what the content is. You don't even have to have read it if you know the topic of it, but if you know what it is, and you have control over how it gets shared, then you are potentially a publisher.

A subordinate publisher is someone who disseminates content without necessarily having any knowledge of what it is. So that would be Facebook in this example. They don't know what you're sharing. They just provide a platform and they allow it to go out there. Now they may or may not be responsible for the content that goes out.

So for example, when the Christchurch massacre happened. Facebook had conversations with government about the fact that they were not pulling down content quickly enough, or they didn't react to content that was going up online. As a publisher, because they knew about it in that particular circumstance. And they had notice and they had control. So that's why they had potential liability as a publisher in those circumstances, because they had received a notice. So that's the difference between being a publisher and a subordinate publisher.

Your responsibility as a publisher

In terms of your responsibility as a publisher, we're talking about what comments end up online. So, some of the horror stories. Community pages. People have the best intentions and sometimes the worst execution. So some of the horror stories are promoting and sharing pictures of people and saying, let everyone in the neighborhood know this individual is a pedophile, for example. Or this individual is an adulterer or a thief or dishonest or whatever. If you do not know whether that is real or true, do not share it, do not repost it and do not encourage it. The number of people, I spoke to somebody who was very distressed because he's a grandfather and he was in the park with his grandson and somebody in a community group posted a picture of him with his grandson and alleged he was a pedophile. That's appalling behavior. And if you know about it as a group administrator, you need to control it. You need to pull down posts like that as quickly as possible, as soon as they come to your attention, because you do not know whether or not they're real.

Now I know that the people who put them up in the first place think, or may think that they're real, but often it's just an assumption and it's done on a split second and they have no knowledge whatsoever. There is risk and liability there. Don't be party to it.

Discrimination is another thing that gets shared quite regularly, on the basis of gender or sexuality, or religious beliefs. Don't be reposting that information either. And it's not just reposting. If you like something, or you share something, if you make a comment on something you could potentially also be seen to be a publisher.

Bait-friending is something that also happens online. So what I mean by that is I was in a discussion forum, a legal group the other day where somebody was saying that a lawyer who is opposed to them in a family law matter had friended their client. Now lawyers have an obligation. We are not permitted to speak to the client of another lawyer. It's one of our conduct rules without permission of that other lawyer. So, friending somebody on social media is potentially overstepping those boundaries. And people do this just to try and find out information. Unfortunately is particularly prevalent in family separations. If you are okay, where those sorts of things are happening, people should be removed from groups or, anything that you have control over. If you've received, notice of it.

You don't have to be the decision maker in terms of whether it's right or wrong. But if you get notice and if you've got policies for the control of your group, then you have the ability to do it and better to be safe than, sorry. Don't cause more damage than you need.

Promoting fake news is another issue, on groups in particular. And oversharing of personal information. Goodness gracious. Some people share some stuff. They really shouldn't. And actually, I haven't just seen that on social media. I do recall a very uncomfortable train trip home one day from the city. And there was an individual sharing, some very intimate information at the top of their voice. It was very bad. Just be aware. I mean, that's publication. So just be aware of the way in which information is being communicated.

Online Comments

In terms of some of the comments that be can, can be seen as bullying and harassment. Look at deliberate behavior that causes harm. Trolling is it's frequently called. It doesn't matter what the intent of the person who is responsible for, for that behavior. It doesn't matter what their intent is. If the impact on the recipient is causing harm, then that is potentially bullying or harassment.

You really, if you're going to run a group online, make sure you impose some rules. So participation in this group means you've got to behave with these codes of conduct or whatever it is that you want to call them. We've called them rules of engagements for social media codes of conduct, participation rules, anything like that, that you want to call them, but if you set them out and you make them available and readily available to any new member of the group, then you have the ability to remove people from the group. If they don't comply with that behavior.

And that also gives you freedom to close or remove conversations that become damaging, or difficult, or just really bad in bad taste. All of that sort of thing. If you've got rules, you can refer back to the rules and say, okay, it doesn't met the rules and we're going to remove it. And give your, you know, if you're going to set rules like that, give your administrators sufficient discretion and leeway to be able to make their own decisions. It is really important you have those policies in place and that you can communicate those policies because that helps you protect your business.

It doesn't mean you have to be a decision maker on what is right or wrong. The way you write the policy can be, if we receive a complaint, we will remove it. You know, it's not your responsibility to be an arbitrator or a decision maker in somebody else's dispute. It is your responsibility to control your publishing platform.

Defamation, just a little bit about defamation. It is a communication that identifies a person and lowers or harms that person's reputation or holds them up to ridicule or being shunned or avoided by other people. The defenses to defamation, it can be an honest opinion. There's some justification or truth behind the statements that are made. There's some qualified privilege around the statements that are made. Or your innocently sharing it. You thought it wasn't, you know, you didn't know it was defamatory, so you shared it anyway. Or it's trivial unimportant.

So there was a court case is actually a really well written. Yes, it's over a hundred pages long. So. You may not want to read it. But it was about a, a principal of a school here in Queensland, and they sued for defamation of character. A number of people in the P&C committee and about statements that were made on social media. The judge was very, very sensible in that case. And that's why I say the decision is a really good read because it’s plain English. It's very straightforward. And in going through that case, the judge said, well, in people didn't take it seriously. The feedback from the community is that the people who participated in that group online didn't actually take seriously the comments made about the principal. So in that case, the damages that were awarded, that she did get damages awarded in her favor. However, they were quite low, something like $3,000, not significant tens of thousands of dollars that she was after.

Infringement of intellectual property

In terms of infringing intellectual property rights online, when you join up to the social media platform, one of the terms and conditions, or part of the terms and conditions of social media platforms is generally that when you share something in that social media platform, when you post it, you are warranting, you're promising that you have permission to share it. So in terms of intellectual property, you either own the copyright or whatever, or you have the permission to share that on that platform. And then as soon as you do share it on that platform, you give that platform the right to publish it indefinitely. And every other user of that platform, the right to reshare it within that platform.

That doesn't mean you can take it out of that platform. So if you share it in Facebook, doesn't mean you can share it in say Instagram. I know they're related entities. Or another social media profile you can, but you do have permission to share it again within Facebook.

In terms of infringing intellectual property rights, what the kind of trouble that people have is they grab images of, for example, you know, you like a pair of Nike shoes. So instead of taking a photo of your shoes on your feet, you grab a picture of the Nike website and you share that that could potentially be an infringement of intellectual property. And if you're the publisher in a group and you're given notice that that's an infringement, then you need to remove that because otherwise you could potentially be held responsible.

Don't try and educate the people in your group about what is intellectual property infringement. Okay. If you get notice, remove it and just say in your policy that if you get received, notice of infringement of intellectual property, you will remove the post and then explain to the person that's what you've done. Any other information they need is up to them to go and source it's not your responsibility. Okay. So keep it within the realms of what you can and can't do. Don't over, you know, take more responsibility than you need to.

Live Streaming, paid content is a problem. So I think it was last year or the year before there was a big boxing match in, that was live-streamed or sorry that was shown live by Foxtel and a bright spark on Facebook, tried to live stream it. So he'd got on Facebook live and put it on and then talked over the top of it. And he got notices very, very quickly from Foxtel saying you're infringing our copyright and take it down. And he thought he was just, you know, giving more people the ability to see the fight. Well, that's true. But the whole reason that Foxtel had the rights is because they paid for them and you're causing them financial damage by allowing 150 people to watch the fight for free. Pubs pay license fees to allow them to show that content on their big screens.

There is a financial, Cost for access to that information. If there's a financial cost don’t be trying to share it for free. So if you had a group and somebody tried to do that within a group, you would be responsible for making sure that comes down really, really quickly.

Taking testimonials off platforms and putting them on different platforms could potentially be, and infringement of copyright if you don't have permission to do it. So when you do seek permission to use the testimonial, make sure you get permission across all platforms. And using music or having incidental music in the background of something that could potentially be an infringement of copyright.

So, you know, people do things at events, in hotels and things, and there might be stream music playing, you've gotta be really careful that you either strip that out or have it, you know, record things in a room where that doesn't get picked up. Because if you're using it without permission, then you could be infringing copyright.

So hopefully they can, it gives you a better idea in terms of your management of comments online to do with your business. If you have, if someone defames your business or, you feel that your business is being harassed or something like that online, then by all means, get advice, because there are some things you can do and some things you can't do, particularly if you don't know the identity of the people doing it, that can be a problem.

Those are the circumstances where you need to find out what's available to you. There is a provider called removerfi they're based in Melbourne. They help people remove damaging content from Google in particular. There are a number of different services available other than legal advice that can help you there too.

If we can help you. We'd love to. Our website is If you'd like to have a quick chat by all means, give us a call and find out how we can help you best. And otherwise. Thank you for today.


Weekly Business Updates

Direct to your Inbox