How we identified the person behind an anonymous Google review of a dental practice
For a dental practice, an anonymous Google review can do more damage than almost any other kind of online criticism. It sits at the top of the search results for the practice's name. It is the first thing prospective patients see. And it cannot be answered honestly without breaching the very professional duties the dentist is regulated under.
This case study sets out how we acted for a dental client whose practice was being affected by exactly that kind of review. The matter combined two routes that we handle regularly. The first was a Norwich Pharmacal application to Google to identify the person behind the review. The second was a measured letter to the identified reviewer, which gave them the opportunity to take the review down before any defamation proceedings were issued. The review came down. No claim was brought. The practice's online profile was restored.
For the wider toolkit, see our notes on how to get a disclosure request through to Google, on Norwich Pharmacal orders and on how we identify anonymous internet users using open-source intelligence.
What happened to our client
To protect the privacy of our client, the identifying details in this account have been changed.
Our client is a dental practice. The practice had received an anonymous one-star Google review from a person who described themselves as a former patient. The review made a number of specific allegations about a course of treatment. On the face of it, the review was the kind of unhappy-patient account that a lay reader would take at face value, and the practice's name and location appeared at the top of the post.
The difficulty was that the review did not tell the whole story. The clinical record showed the treatment had been carried out properly, that the patient's own conduct had contributed materially to the outcome they were now complaining about, and that the practice had offered a reasonable remedial pathway that the patient had declined. Each of those facts mattered to whether the review was fair. None of them appeared on Google.
The natural instinct in that position is to reply. A dentist who can see the clinical record knows what actually happened. The temptation is to set it out. The problem is that doing so is professionally impermissible.
The dentist's regulatory duties make a public reply impossible
Dentists in the United Kingdom are regulated by the General Dental Council. The GDC's Standards for the Dental Team, in particular Principle 4, sets out the duty of patient confidentiality. The standards prohibit a registrant from disclosing patient information without the patient's consent, except in narrow and specific circumstances. A public Google response that referred to the patient's treatment, the patient's behaviour during it, the clinical notes, or the patient's own contribution to the outcome would breach that duty and would be a matter the GDC could investigate.
The same regulatory restraint applies in reverse to medical practitioners, solicitors, accountants and other professionals who hold confidential client information. The reviewer is at no equivalent disadvantage. They can post what they like, in whatever shape they like, and the regulated professional cannot answer them on the merits without risking their own registration.
That asymmetry is what makes anonymous reviews of regulated practices uniquely damaging. The review sits unopposed. The reader sees a one-sided account and infers, reasonably, that the practice has nothing to say in its defence. The practice does have a great deal to say, but professional duty prevents it from being said in public.
Why a Norwich Pharmacal application against Google was the right route
Before any substantive claim can be made against the reviewer, the reviewer's identity has to be established. Google does not voluntarily disclose user data to private litigants. The US Stored Communications Act, 18 U.S.C. § 2702, prevents Google from doing so without a court order, a subpoena or the user's own consent. The equivalent rules under the UK and EU GDPR pull in the same direction.
The legal route into the identification is a Norwich Pharmacal order. The principle comes from Norwich Pharmacal Co Ltd v Customs and Excise Commissioners [1974] AC 133 and has been developed by the courts in many cases since. In its modern application, the order is granted against a third party (here, Google) that has become innocently mixed up in someone else's wrongdoing and that holds information the victim needs in order to act on that wrongdoing.
The four-limb test that the court applies is well-settled. There has to be a good arguable case that wrongdoing has taken place. The third party has to have become caught up in that wrongdoing, even innocently. The third party has to hold information the victim genuinely needs. And the order has to be a proportionate response, in the sense that the information is not easily available in any other way. Each limb was clearly satisfied here. The review was capable of being defamatory of the practice. Google was the platform on which the review sat. Google held the account-holder data behind the review. The data was not realistically available by any other means.
We drafted the application under Part 8 of the Civil Procedure Rules. A supporting witness statement set out the review, the duty of confidentiality that prevented the practice from answering it, the basis on which the review was said to be defamatory and the categories of data sought from Google. The schedule of disclosure was kept tight. We did not ask for more than was genuinely needed to take the matter forward.
Google consented and the order was granted on paper
Google's stance within a properly framed Norwich Pharmacal application tends to be predictable. Where the legal grounds are clearly made out, where the identification is specific and where the disclosure sought is proportionate to the underlying claim, Google generally does not contest. That was the position here. The disclosure schedule was narrow, the legal basis was set out cleanly and the application was supported by a careful witness statement. Our in-house OSINT investigator had already mapped what was likely to be sitting behind the account, which let us frame the application around what we actually needed rather than asking Google for everything it might hold.
Google consented to the application. The court granted the order on paper, without a contested hearing. The cost saving for the client compared with a contested application was significant, and the timetable was shorter by several months. For more on how this route works in practice on Google specifically, see our note on how to get a disclosure request through to Google.
Google then disclosed the account-holder data behind the review. The disclosure included enough information to identify the reviewer as a real and locatable individual.
From disclosure to a measured letter, not straight to a claim
Once we had identified the reviewer, the available routes opened up. The most obvious was a defamation claim under the Defamation Act 2013. The review was capable of being defamatory of the practice. The serious-harm threshold under section 1 was likely to be met on the evidence of patient enquiries lost during the period the review had been visible.
A claim was available, but a claim was not necessarily the right first step. Our experience is that, where a reviewer has acted out of grievance rather than malice, and where the underlying clinical or commercial picture would not stand up to disclosure on the merits, a careful letter often produces a quicker and quieter outcome than litigation. The cost to the client is a fraction of the cost of issuing a claim, and the reputational footprint of a public defamation action is avoided altogether.
The letter we wrote to the reviewer did three things. It set out, in plain terms, what the review had said and what we were instructed to take issue with. It set out, without breaching patient confidentiality (because the patient was the one who would be hearing it), the wider clinical picture that the review had left out. And it explained the practical implications of the matter going to a hearing at which the full dental record would be in evidence, including the patient's own role in the outcome they were complaining about. The letter was firm. It was also fair. It gave the reviewer a clear opportunity to take the review down within a stated period.
The outcome
The reviewer accepted that the review had been incomplete. The review was taken down. No defamation claim was issued. The matter resolved without the practice's name appearing on any public court list, and without the secondary reputational risk that publicly suing a former patient can carry.
The practice's Google profile returned to a balanced picture of genuine reviews. New patient enquiries returned to the levels seen before the review went up. The total elapsed time from instruction to the review coming down was a small fraction of what a contested defamation claim would have taken.
The court application is what unlocks the identification. The letter to the identified reviewer is often what resolves the matter. For a regulated practice, that combination produces an outcome a public claim would not have produced as cleanly, and at a fraction of the cost.
What this case shows about anonymous Google reviews of regulated practices
Three points from this case are worth taking away for any regulated practice in a similar position.
The first is that the asymmetry between an anonymous reviewer and a regulated professional is real, and it is the reason anonymous reviews of regulated practices do disproportionate damage. Until the reviewer is identified, the regulated professional has no useful way to answer a one-sided account in public without breaching their own professional duties. The identification route is what releases that asymmetry.
The second is that Norwich Pharmacal orders against Google for individual reviews are now a well-worn route. Google has a legal-process team that handles these applications routinely. Where the application is properly drafted, narrowly framed and supported by clear evidence, the order is often made on paper without a contested hearing. The cost is a fraction of what a defamation claim would cost, and the timetable is short.
The third is that, once the reviewer is identified, the right next step is often a letter rather than a claim. The letter avoids the secondary reputational risk of a public action against a former patient. It also takes advantage of a fact about online reviewers that is rarely visible until it is tested: most people who post in a moment of frustration behave differently when they are addressed by name and asked to engage with the facts in private correspondence. A claim remains available where the letter does not produce the right response.
Lawyers' thoughts on anonymous Google reviews of regulated practices
There is a particular shape of unfairness in these matters that is worth naming directly. A dentist, a doctor, a solicitor or an accountant who has done their work properly and to the standard their regulator expects, and who knows the full clinical or commercial picture, then sits in front of an anonymous online review that tells half of it and can do nothing about it in public. The professional duty that exists to protect the patient or the client also has the effect of leaving the practitioner mute. Practices in that position routinely describe it to us as feeling helpless, and feeling helpless under a public attack that is being read by the people whose decision to call the practice next week is the thing keeping the lights on. That feeling is justified. It is also, in our experience, the single most powerful reason to get to a specialist firm early rather than late.
By early we mean earlier than the point at which the review has gone up. The shape we see most often is a complaint by a former patient that has been refused, returned or only partially upheld through the practice's own complaints procedure, and that then goes online. If you sense, at the complaint stage, that the matter could end up as a public review, we would rather take a call then. A measured response to the complaint correspondence at that stage, drafted in a way that preserves the practice's position without inflaming the patient, often takes a meaningful proportion of these matters off the runway before they ever reach Google in the first place. That is not always possible, and we are honest about when it is and when it is not. Where it is possible, it costs the practice a fraction of what a Norwich Pharmacal application against Google costs, and the practice's name never appears on a court list or in a public application of any kind.
Where a review has already gone up, the second thing worth saying is about what not to do. The temptation, especially when the review is unjust on the facts the practice can see, is to reply on Google with at least some flavour of the clinical picture. We would gently and consistently advise against it. A reply on Google that even alludes to the patient's treatment, attendance pattern, behaviour during it, or any other identifying detail can turn a one-sided review the practice could otherwise have moved against into a regulatory complaint against the practice itself, plus a potential claim by the patient for breach of patient confidentiality and, depending on what is said, breach of privacy. A poorly judged reply has, in our experience, the capacity to turn a manageable matter into a much worse one.
There is one practical point on the patient-confidentiality question that is worth knowing because it removes a great deal of unnecessary worry, and it is the reason we encourage practices to bring us the clinical picture in full at the start. A registrant may disclose patient information only in narrow and specific circumstances. Seeking legal advice from us is one of them. Once you are instructing solicitors, the conversation between you and us is covered by solicitor-client confidentiality. The practical effect is that we can see the full clinical record, take a proper view on whether the review is something the practice can move against, and draft the letter and (where needed) the witness statement from a complete picture, and the patient's confidentiality is preserved throughout because the disclosure travels inside the solicitor-client relationship rather than outside it. Practices sometimes do not realise that this is the position, and we have known practices to hold back the relevant clinical detail from us in the early conversation in case they should not be sharing it. They can share it. The reason it works that way is precisely so that a regulated professional in this position has somewhere to go where the full picture can be discussed and acted on without the duty to the patient being put at risk.
Frequently asked questions
Can a dental practice respond to a negative Google review directly?
Only within limits. The General Dental Council's Standards for the Dental Team, in particular Principle 4 on patient confidentiality, prevent a registrant from disclosing patient information without consent. A reply that referred to the patient's treatment, the clinical record, the patient's behaviour or anything that would identify the patient or their care would breach that duty. A neutral statement inviting the reviewer to discuss the matter privately is normally as far as the practice can go in public.
How quickly can the reviewer be identified?
An English Norwich Pharmacal application against Google that proceeds by consent typically reaches an order within six to ten weeks of issue. The disclosure follows shortly after. The total elapsed time from first instructions to the disclosed data is therefore usually a small number of months, not the much longer timetable a contested hearing would require.
What does the application cost?
The figures across our disclosure cluster are: £2,500 for an OSINT identification pass where one is realistic before any court papers are drafted; £5,000 for a disclosure application where Google does not oppose; £10,000 where the application is contested. A precise quote follows the initial assessment.
Does Google tell the reviewer that the application has been made?
Google's policy is to notify the affected user that a disclosure application has been received, unless legally prohibited from doing so. That is a feature of the process, not a bug. The notification often causes the reviewer to remove the review on their own initiative, before the application has even been determined.
What if the reviewer ignores the letter?
Then a defamation claim is the next step. A claim under the Defamation Act 2013 requires the serious-harm threshold under section 1 to be met, which in a regulated-practice context is usually evidenced by lost patient enquiries during the period the review was visible. The remedies include damages and an order requiring the reviewer to take the review down. The letter is therefore not a substitute for the claim. It is a faster, cheaper and quieter route that is offered first because, in most matters, it works.
Does this only work for dental practices?
No. The same route is used by medical practitioners, solicitors, accountants, opticians, veterinary surgeons and other regulated professionals whose own duties prevent them from answering a one-sided review on the merits in public. The application is the same in shape; the regulatory framing differs by profession.
What if the review is a fair criticism of the service?
Then no application is brought. Honest opinion, fair comment on a matter of public interest, and substantially true accounts of what actually happened are all defences to defamation. Part of our job at the initial assessment is to be straight with you about whether a review is one we can move against or one that is, on the law, an opinion the reviewer was entitled to express. Where the review is fair, we say so.
Can the review be removed without identifying the reviewer at all?
Google's standard complaint channels remove reviews only in narrow categories (impersonation, conflict of interest, certain prohibited content). A review that is simply alleged to be inaccurate or unfair generally is not removed through those channels. The identification route is what makes a removal achievable in matters where the standard complaint route has produced nothing.
