The new rules every restaurateur and PR professional needs to know

You’ve poured everything into your new restaurant – the lighting, the menu, the sourcing, the training. The kitchen is firing on all cylinders. The only problem? The seats are empty, your TripAdvisor page is a blank canvas, and you know that most people won’t book a table without reading reviews first.

It’s the classic cold start problem, and it’s an entirely understandable one. The instinct to give a free meal to a few local influencers, or to offer a discount in exchange for a quick five-star rating, feels like nothing more than sensible hospitality PR. Doesn’t everyone do it?

The honest answer is: yes, many restaurants have done exactly that – but the legal landscape just changed fundamentally, and the consequences of getting it wrong are now serious enough to close a business. This article sets out what you need to know, whether you run a restaurant, manage its marketing, or work in PR representing hospitality clients.

The information here is general guidance. Given how quickly the law is moving in this area, we’d strongly encourage you to speak to one of our specialist lawyers before embarking on any review campaign or influencer promotion.

A view from the other side of the table

We should put our hands up here, because this is something we see play out on our own doorstep. Our team in our Soho office is offered free or heavily discounted promotional lunches at nearby restaurants almost every working day. There are apps built entirely around this model – a restaurant uploads spare lunchtime covers or a new menu they want feedback on, and people in the area can book in for free or for a token amount.

It is a smart, low-cost way for a restaurant to fill seats that would otherwise be empty at a quiet service, generate a bit of buzz, and – critically – get in front of potential regulars. Our team enjoys the food. They might well go back and pay full price. They might recommend the place to a friend.

But what is the golden nugget the restaurant is really hoping for? An online review. Preferably a good one, left on Google or TripAdvisor before the afternoon is out.

That is the commercial logic behind almost every promotional meal offer, and there is nothing wrong with it in principle. The question is whether it is being done in a way that complies with the law – and that is where many restaurants, and the PR companies running these campaigns on their behalf, are currently exposed.

If the app or the restaurant’s booking confirmation simply says “enjoy your meal, we’d love your feedback” without making clear that any review left should be disclosed as having been incentivised, those reviews are potentially non-compliant under the DMCC Act. The diner who posts a glowing five-star Google review without mentioning that the meal was free or heavily subsidised is publishing what the law would class as a concealed incentivised review. And the restaurant that set up the promotion without building proper disclosure into the process bears responsibility too.

It is a gap that the industry has not yet caught up with, and it is one worth closing before enforcement does it for you.

Why the rules changed: the DMCC Act 2024

Fake and manipulated reviews are not a new problem. They were already unlawful under the 2008 Consumer Protection from Unfair Trading Regulations. The difficulty was enforcement: regulators had to go to court and prove that a specific fake review materially changed a specific consumer’s decision. Proving that a diner only ordered the linguine because of one bogus five-star review was, in practice, almost impossible.

The Digital Markets, Competition and Consumers Act 2024 (the DMCC Act), which ramped up enforcement in early 2026, rewrote those rules entirely. It introduced what are called Schedule 20 banned practices – activities that are now considered inherently unfair and unlawful in all circumstances. The key shift: the Competition and Markets Authority (CMA) no longer needs to prove that any individual consumer changed their mind. If you do the prohibited thing, you are in breach. Full stop.

Fines under the DMCC Act can reach 10% of a business’s global annual turnover. The government has, in effect, weaponised consumer law against deceptive marketing.

To understand why Parliament moved so decisively, consider the scale of what is at stake. Online reviews now influence an estimated £224 billion of UK retail spending each year. In the hospitality sector, a high aggregate star rating on Google or TripAdvisor is the single biggest driver of foot traffic. For premium experiences such as a tasting menu, even a single well-written but fake or undisclosed incentivised review can increase the probability of a booking by over 9%. The temptation to manipulate that data has always been enormous – but the price of giving in to that temptation has never been higher.

The two big banned practices

1. Fake reviews

A fake review is any review that purports to reflect a genuine consumer experience but does not. This includes fabricated five-star testimonials, buying reviews from bot farms, and having your own staff or PR agency write reviews while pretending to be ordinary customers.

2. Concealed incentivised reviews

This is where most legitimate businesses come unstuck. The law does not prohibit giving a free meal, a discount, or exclusive access to a reviewer. What makes it a banned practice is the concealment. If you provide any benefit in exchange for a review, and the reviewer does not explicitly and prominently disclose that fact, the review becomes a concealed incentivised review – and both you and your PR firm can be liable.

Think of it this way: online reviews are the modern equivalent of a hygiene rating in the window. If you buy your grade with free pasta, you are not just misleading one customer – you are corroding the entire ecosystem of consumer trust that the review economy depends upon. The law now formally recognises that reality.

The influencer dinner: how to run one legally

Inviting influencers to a soft launch or a free tasting night is a cornerstone of hospitality PR, and it remains entirely permissible. But the compliance burden is strict, and ignorance of the rules is no defence.

Under the DMCC Act, the moment you provide a free meal, drinks, or an exclusive invitation to a diner or content creator with any expectation of a review or post, that arrangement is legally classed as commissioning or incentivising. From that point on:

• The reviewer must use a clear, prominent disclosure label – the Advertising Standards Authority and the CMA both expect something explicit, such as #ad, placed at the very beginning of the post, caption, or video.
• It cannot be buried at the foot of a cloud of thirty hashtags. It cannot sit behind a “see more” link. If a consumer has to hunt for the disclosure, it is non-compliant.
• You – the restaurant or the PR firm – have a positive duty to tell the reviewer about this obligation. You cannot simply feed them and hope for the best. The CMA expects the instruction to be given in writing, ideally in a commissioning brief or contract.
• If you commission a review and it goes out without proper disclosure, you can face liability even if the influencer ignored your instructions.

This is a point that catches a lot of PR agencies off guard. “That’s the influencer’s responsibility” is not a defence. If you arranged the free meal, the compliance obligation falls on you too.

What if the review is negative?

Here is a scenario worth thinking about. You invite an influencer, give them a beautiful three-course meal, tell them in writing to use #ad, and they post an honest review saying the soup was cold and the service was slow. Can you use the free meal as leverage to make them take it down?

Absolutely not. Restaurants cannot insert non-disparagement clauses into influencer arrangements to suppress negative reviews. The law is unambiguous: the endorsement must reflect a genuine experience. Offering a gift card to change a one-star rating to five stars, or pressuring an influencer to delete negative content, is itself a banned practice.

A quick note on HFSS rules for larger operators

There is an additional layer of complexity for operators whose menus feature high fat, salt, or sugar (HFSS) products. Under strict online advertising regulations, influencers are generally prohibited from showing identifiable HFSS products in paid-for or gifted content. For a restaurant whose USP is a double-patty burger or a deep-fried dessert, this matters.

The good news for independent restaurants: there is currently an SME exemption. If your business has fewer than 250 employees, the HFSS paid-content restrictions do not apply, and your influencer can still post a picture of the signature dish – as long as they still use #ad and comply with the fake review rules. For large national chains, the picture is rather different. If that applies to you, take specific legal advice.

Day-to-day review collection: what’s fine and what isn’t

Asking customers verbally

Staff can and should ask satisfied diners if they would be willing to leave a review. But there is a trap here that a lot of hospitality training material has historically encouraged: telling your team to “read the table” and only approach visibly happy customers. Natural as that instinct is, the CMA guidance explicitly prohibits the cherry-picking of positive reviews. Systematically training staff to solicit reviews only from happy diners – and to suppress the feedback of unhappy ones – creates a mathematically distorted picture of the restaurant. You must not interfere with the impartiality of the process.

QR codes on receipts and table cards

Generating a Google or TripAdvisor QR code for customers to scan and leave a review is highly effective and perfectly legal – the platforms actively encourage it. The danger lies in the wording around the code. “Scan here to leave a review” is fine. “Scan for a free drink if you leave five stars” is a clear violation. Even “Scan for a free drink” without mentioning the rating creates an incentivised review that requires disclosure. Keep the QR code clean and unattached to any reward.

Follow-up emails and SMS

Sending a follow-up message the next day asking for feedback is standard and sensible. Where restaurants fall into difficulty is a practice known as review gating.

Review gating typically works like this: a business sends a private survey first, asking the customer to rate their experience from 1 to 10. Software then automatically directs anyone who scored 9 or 10 to a public platform like Google. Anyone who scored 8 or below is sent to a private internal feedback form. The result is that negative opinions are quietly filtered out of the public record.

The CMA view is clear – this is exactly equivalent to broadcasting a football match but cutting out every missed penalty and every red card to make your team look unbeatable. It is a banned practice. You must give all customers an equal opportunity to leave public feedback, whether their experience was good or not.

There is a crucial distinction between review gating (banned) and handling a complaint well before someone posts publicly (entirely fine). Resolving an issue at the table or on the phone is good hospitality. Systematically diverting unhappy people away from public platforms is manipulation.

A service recovery gesture – when does it need disclosure?

Say a regular customer waits twenty minutes for his main course, and the manager apologises and brings him a free dessert. He goes home and writes a Yelp review. Does he need to use #ad? No, because the free dessert was not given in exchange for a review – it was spontaneous hospitality to make up for a delay. Platform guidance in these situations simply asks that he mentions the gesture in his review. That context is transparent and fair to other readers. Compare that to a manager approaching a table and saying “if you show me a five-star review right now, I’ll take 10% off your bill” – that is a clear violation.

Staff reviews: a clear no

The blank TripAdvisor page is genuinely daunting. The temptation for a sous chef or a bartender to seed the first few five-star reviews from their personal accounts is obvious. Please do not.

A review must be based on a genuine consumer experience. An employee writing a review while pretending to be an ordinary customer is a fake review. The only route that might be permissible – and it is still actively discouraged – would be if the employment connection is prominently and explicitly disclosed within the review itself. Even then, TripAdvisor’s own terms of service flatly prohibit employees from reviewing their own establishments. The platforms have sophisticated fraud detection algorithms that analyse IP addresses, device fingerprints, geolocation data, and timing patterns. TripAdvisor’s system removed 360,000 reviews linked to employee incentive programmes last year alone.

The platforms are watching – and the consequences are severe

Even if the CMA were never to audit your TripAdvisor page, it would be a serious mistake to think the risk ends there. The platforms themselves enforce hard.

• TripAdvisor applies a permanent red badge to listings found to be manipulating reviews – a large, unavoidable warning at the top of your page telling every potential customer that the business cannot be trusted. It does not go away.
• Google Maps can suspend your business profile entirely, removing you from search results so that customers cannot even find your address.
• Yelp posts consumer alerts directly on your listing page.
• Your competitors are actively monitoring and reporting violations to the platforms.

These platform-level consequences can destroy a business overnight – and unlike a CMA investigation, there is no formal appeals process that necessarily leads anywhere. Getting back from a TripAdvisor red badge is an uphill struggle.

Real enforcement: the CMA means business

The idea that “they have bigger fish to fry” is a dangerous illusion. The CMA’s sweeps in March 2026 targeted businesses of all sizes across multiple sectors. In the hospitality space, Pasta Evangelists – a well-known food delivery brand – was investigated over allegations that it was offering customers discounts on future orders in exchange for five-star reviews, without requiring any public disclosure. That is precisely the kind of practice described in this article.

The investigations extended beyond food: Dignity, a major funeral provider, was investigated for allegedly asking staff to write positive reviews of its crematoria services. AutoTrader and the review platform Feefo were investigated over whether they were systematically excluding one-star reviews from star rating calculations. The message could not be clearer – there is no sector that is below the CMA’s radar, and no business too small to be scrutinised.

What you should be doing instead

The good news is that genuine compliance is not complicated, and done well, it becomes a competitive advantage. Consumers in 2026 are acutely aware of fake reviews, and a business with an authentic, varied, transparently gathered review profile stands out.

• Publish a clear review policy on your website. Explain how you collect feedback and that you welcome all reviews, positive or critical.
• Train staff to invite all customers – not just the happy ones – to leave feedback via your QR code or follow-up message.
• Send post-visit emails or SMS to every guest, directing them equally to a public platform. Do not gate or filter based on their likely sentiment.
• If you run influencer nights or gifted meals, put the disclosure requirement in writing before the event. Use a simple brief or contract that spells out the #ad obligation and confirms the reviewer is free to be honest.
• Never offer a reward – however small – in exchange for a specific star rating or sentiment.
• Respond publicly and professionally to negative reviews. It shows future customers more about your character than a wall of five stars ever could.

Authenticity is your most valuable marketing asset. In an era of widespread scepticism about fake reviews, a business that can demonstrate it earns its stars the honest way will build trust that money simply cannot buy.

One more reason to get this right: AI agents

Looking slightly further ahead, the stakes around review integrity are only going to increase. We are approaching an era in which consumers may not search for a restaurant themselves – they will ask an AI assistant to book the best-reviewed Italian place nearby. Those AI systems are trained on and scrape the same review databases that your customers use today.

If restaurants and their PR partners continue to find ways to subtly inflate ratings or suppress negative feedback, the damage will not be confined to misleading human diners. It will corrupt the data that AI systems rely on to make recommendations. The integrity of the review ecosystem matters – not just now, but for the digital infrastructure that is already being built around it.

Speak to our specialist lawyers

At Cohen Davis, we work with restaurants, hospitality businesses, and the PR agencies that represent them on precisely these issues – whether that is advising on the legality of a planned review campaign, responding to a CMA investigation, dealing with a damaging fake review that a competitor has posted about your restaurant, or handling a TripAdvisor or Google dispute.

The law in this area is moving quickly, and the gap between what everyone does and what is actually lawful has never been wider. If you are planning an influencer event, setting up a review-collection process, or simply want to understand your exposure, speak to one of our specialist lawyers before you act.