How to ask for Google reviews without breaking the rules
Google's review policy and the FTC rule, and how to ask for reviews inside both.
A reply to a review is read by everyone who looks at your profile long after the reviewer has moved on. This guide gives replies by situation, with wording to adapt, the cases where the owner should write it, and the trap for clinics and law firms.
Updated 29 October 2026, about 8 minutes to read
The short answer
Reply to every review within a few days, briefly and in your own words. For a bad one, thank them, own any real mistake without arguing, and move the details offline with a name and a way to reach you. Never add details the reviewer did not share, and if you run a clinic or a law firm, never confirm that the reviewer was a patient or client.
The reviewer reads your reply once. Everyone who looks at your profile afterwards reads it too, often while deciding whether to call. Write for them: someone who wants to know what happens here when something goes wrong.
Google's own tips for replies, in short:
A few practical points. You can reply only from a verified Business Profile. Google checks each reply against its policies before it shows, which usually takes minutes and can take much longer. The reviewer is told when you reply, and you can edit or delete your reply later from Read reviews.
Replies also count with people choosing between you and the next business: our prices page quotes a 2024 BrightLocal survey of US consumers on businesses that reply to all their reviews.
Short and specific beats long and grateful. Pick up one detail from the review and answer it as a person would:
Do not stuff the reply with keywords, as in "thanks for choosing the best emergency plumber in Leeds". It reads as if a machine wrote it, and the next customer notices.
Wait until you are calm, then write four short parts:
A salon example. The review: "Waited 40 minutes past my appointment and nobody told me why." The reply: "Jo, you are right, and I am sorry. We ran over with an earlier client and nobody told you, which is the part we got wrong. We now text clients if we are running more than 15 minutes late. I would like to put it right, so please call and ask for Sam."
What to leave out:
Google removes only reviews that break its policies. A genuine bad review stays, however unfair it feels, and Google does not settle disputes between businesses and customers. To report one, use the flag next to the review in your profile or Google's Reviews Management Tool, and pick the reason, such as spam or a conflict of interest. The tool shows the status of each report. If Google finds no violation, you get one appeal, which can cover up to ten reviews.
Review extortion is different. A sudden run of one and two-star reviews is followed by a message demanding money, goods or services to remove them. Google's advice is not to engage and not to pay. Gather the evidence at once, with screenshots of the demand and its date, links to the reviews and any usernames, and report it through Google's form for extortion.
Wait for Google's decision before you reply to a review you think is fake. If you do reply, keep it to one calm line. A calm line next to a fake review does more for you than an angry one.
In the US, HHS, which enforces HIPAA, has settled with healthcare providers whose replies to online reviews disclosed patient information. Two were dental practices: Elite Dental Associates in Dallas in 2019, and New Vision Dental in California in 2022, whose replies included patients' names, treatment and insurance details. Manasa Health Center, a psychiatric practice in New Jersey, settled in 2023 after replying to a review with details of the patient's diagnosis and treatment. HHS's message to providers: patient information must not be disclosed when responding to reviews.
The trap is that a friendly reply does it too. "Thanks for coming in, Sarah, glad the new crown feels right" tells the world that Sarah is a patient and what she had done. Use replies that neither confirm nor deny:
In a clinic, never confirm or deny that the reviewer is a patient, never mention a visit, a treatment or a date, and never reply with anything from the patient record, even when the reviewer has posted it all themselves.
In Europe, health details are special category data under the GDPR, so the same approach is the safe one there. This is how careful practices handle it, and it is not legal advice: your HIPAA or data protection adviser has the final word. See what else changes for dental clinics.
Lawyers owe their clients confidentiality, and the American Bar Association's Formal Opinion 496, issued in January 2021, deals with online criticism directly. Its view is that a negative online review, on its own, does not allow a lawyer to reveal information about the client's matter in reply. It urges lawyers to think seriously about not responding at all, since a reply can bring more posts, and notes that a lawyer may ask the website to take a review down, as long as nothing confidential is revealed in the request.
If you do reply, the opinion offers wording along these lines:
State rules and state bar opinions decide what applies to your firm, so check yours. Outside the US, your profession's own rules on confidentiality set the limits, and the same caution suits accountants and any trade with a duty of confidentiality. Our page for law firms covers how a firm's website and chatbot handle new enquiries.
Review tools can now draft replies for you. A draft is fine where little can go wrong:
The owner or manager writes the reply, from scratch or with heavy edits, when:
Two rules for any draft. Give the tool the review text and nothing else, because a tool fed your customer records can put details from them into a public reply. And a person reads every reply before it is posted. That is how we build drafting into our AI assistants: the assistant prepares a draft and a person checks it before anything is sent.
On our Growth plan, the monthly report lists the reviews still waiting for an answer, so none gets forgotten.
Your reply sits under the review, and you can edit it. If you fix the problem and the customer updates the review, update your reply to match, so the exchange reads as finished.
You can ask a customer whose problem you solved whether they would update the review, once, with nothing offered for it. Google bans incentives for changing a review, and how to ask for Google reviews without breaking the rules covers the rest.
If the customer never comes back, leave it there. One calm reply under one bad review is all a reader needs to see.
Reply to every review that has words in it, good or bad, and keep each reply short. A star rating with no text can have a brief thank-you or nothing. Clinics and law firms should reply in general terms only, without confirming that the reviewer is a patient or client.
Within a day or two, once you know what happened and are calm enough to write it well. Google's tips say a prompt reply shows you value feedback. A fast reply that argues does more harm than a slower one that fixes the problem, so find out the facts first.
Only if it breaks Google's policies, for example spam, a conflict of interest or abuse. Report it from your profile or the Reviews Management Tool. Google does not remove genuine reviews for being negative or unfair. If it rejects your report, you can appeal once.
Apologise for the experience, not for facts you dispute. "I am sorry your visit went this way" is honest even when you see it differently. Then correct any wrong fact once, calmly, for the readers, and offer to talk in private. Do not go through the details in public.
Not in the reply. Google's tips say to keep offers and deals out of replies, and offering anything in exchange for changing or removing a review breaks its policy. Invite the customer to contact you, and sort out any refund in private, with no condition attached to the review.
For short thank-you replies, yes, if a person reads and edits each one before it is posted. Write bad, specific or sensitive replies yourself. Never give an AI tool your customer records to work from, because details from them can end up in a public reply.
Something general that does not confirm the reviewer is a patient: thank them, say privacy rules stop you discussing anyone's care in public, and invite them to call the practice manager. Never mention a visit, a treatment, a date or anything from the record. HHS has settled with dental practices whose replies did.