GDPR, consent and showing customer names and photos

A review containing a person’s name, photo or anything identifying is personal data, and displaying it on your website is processing it. In most cases the lawful basis is legitimate interest and the platform handled the collection.

What is on you is transparency, and honouring a request to remove.

When someone posts a review on Google or Tripadvisor, they agreed to it being public and distributed under that platform’s terms. Displaying a public review, attributed, in the form it was written, is not a new collection of data — it is republication of something already public.

Where it gets less comfortable is reproducing it somewhere the person would not expect, stripped of context, or altered.

Say in your privacy notice that you display customer reviews and where they come from. If someone asks you to remove their review from your site, do it — that is a straightforward erasure request and arguing about it costs more than complying.

If you collect reviews through a form on your own site, that is a collection you are responsible for: tell people what you will do with it, and do not publish more than they expected.

Assuming that because a review is public, none of this applies. Public does not mean exempt; it affects the lawful basis, not whether the regulation engages.

The opposite mistake is over-correcting into anonymising everything. A review with no name attached is markedly less persuasive, and it is not required. Name-format options — first name only, or initials — exist for the cases where someone asks.

Display public reviews as they were written, attributed. Mention it in the privacy notice. Remove on request without argument. That covers the overwhelming majority of situations, and this is a summary rather than legal advice.