Who Owns Customer Testimonials And Reviews?

Ana runs a small skincare store in Wellington. A happy customer leaves a glowing Google review, another tags the business in an Instagram story, and Ana's marketing contractor suggests turning both into a paid Facebook ad.

It feels like an easy win. Real customers, real words, real social proof.

But before you copy the review, screenshot the story or add a customer's logo to your website, it's worth pausing. Customer testimonials can be great for your business, but they also sit at the intersection of copyright, privacy, platform rules, testimonials compliance and the Fair Trading Act 1986.

The good news is this doesn't have to be complicated. A few sensible checks can help you use reviews confidently without creating issues later.

Who Owns Online Reviews?

The person who writes the review will usually own copyright in the words they wrote, unless they've agreed otherwise.

Copyright in New Zealand protects original written content, even if it's short. A review doesn't need to be a novel to attract protection. If a customer writes, "Best facial I've ever had - my skin was calmer by the next morning", those words may belong to the customer as the author.

The platform where the review appears may also have rights under its terms. For example, Google, Facebook, Trustpilot, marketplace sites and industry review platforms often give themselves broad rights to display and reuse reviews. That doesn't automatically mean your business owns the review or can copy it anywhere you like.

In practice, there are three different questions to ask:

• Who wrote the words? Usually the customer, so they may own copyright in the review text.
• What does the platform allow? The platform's terms may let you embed or display reviews in certain ways, but may restrict copying, screenshots or use in ads.
• What have you agreed with the customer? A written consent or release, with clear privacy consent wording, can give you permission to use the review in your marketing.

If you commissioned the testimonial, the answer can be different. For example, if you paid a content creator to write a testimonial, filmed a case study or asked a customer to provide a quote for a campaign, your agreement should say who owns the content and what licence your business has to use it.

Without that agreement, you may be left with implied permission for a narrow purpose only. That can be frustrating if you later want to use the testimonial on your website, email campaigns, investor deck, brochures and paid ads.

Can You Use Customer Reviews In Marketing In New Zealand?

Yes, you can use customer reviews in marketing in New Zealand, but you need to make sure you have the right permissions and the review isn't misleading.

There are a few common ways businesses use reviews:

• copying a review onto a website homepage
• adding a testimonial to a landing page or sales page
• using a screenshot of a Google, Facebook or marketplace review in a social media post
• turning a customer quote into a paid advertisement
• using a customer story in an email marketing campaign
• adding customer names, photos, handles or business logos to a case study

Each use carries slightly different risk.

Using a platform's official embed tool is usually safer than taking a screenshot, because you're using the functionality the platform has provided. Even then, it's worth checking the platform's rules and making sure the review is still accurate and current.

Copying the review text into your own branded design, paid ad or brochure is a bigger step. At that point, you're not just displaying the review where it was posted. You're republishing it for your own commercial purposes.

That's where written consent becomes valuable. It helps show that the customer agreed to the way you're using their words, name, photo or business identity.

Do You Need Consent To Use A Testimonial?

In most cases, yes, you should get clear consent before using a testimonial in your marketing, especially if you identify the customer.

Consent isn't only about being polite. It helps manage several legal risks at once.

A good testimonial consent should cover:

• the exact quote, review, photo, video or story you want to use
• where you can use it, such as your website, social media, emails, ads, pitch decks or printed materials
• whether you can use the customer's name, initials, job title, suburb, business name, social media handle, photo or logo
• whether you can edit the testimonial, and how much editing is allowed
• how long you can use it for
• whether the customer received an incentive, discount, free product or payment
• what happens if the customer later asks you to stop using it

For a simple text quote from an individual customer, an email confirmation may be enough in some situations. For higher-value campaigns, video testimonials, influencers, business logos or health-related claims, a tailored release is usually much safer.

What If The Customer Is A Business?

If the testimonial comes from another business, get permission from the right person. A staff member may be happy for you to use their quote, but they may not have authority to approve use of the company's name or logo.

If you're using a customer logo, you're also dealing with trade mark and brand issues. Many company logos are registered trade marks, including through IPONZ. Even if the logo isn't registered, the business may still control how its brand is used.

For B2B testimonials, it's sensible to get approval for:

• the wording of the testimonial
• the person's name and role
• the company name
• the company logo
• any results, numbers or claims included in the case study

What If You Offer A Discount For A Review?

You can usually ask customers to leave honest reviews and offer an incentive, but you need to be careful.

Don't make the incentive conditional on leaving a positive review. For example, "Leave us a five-star review and get 20% off" is risky because it encourages biased reviews.

A safer approach is to ask for an honest review and make it clear the reward isn't tied to the rating or content of the review. If the incentive is relevant to how customers will understand the review, disclose it clearly.

What Does The Fair Trading Act Say About Testimonials?

The Fair Trading Act 1986 says your marketing must not mislead or deceive customers, and that includes testimonials.

The Commerce Commission can take action where businesses use fake reviews, misleading testimonials or claims they can't back up. Customers and competitors can also complain if your marketing gives the wrong impression.

For testimonials, the main point is simple: the review needs to be real, accurate and presented fairly.

You can run into trouble if you:

• write fake reviews about your own business
• ask staff, friends or family to post reviews without disclosing their connection
• pay for positive reviews without making that clear
• edit a testimonial so it sounds more enthusiastic than it really was
• remove important context from a review
• use an old review for a product or service that has changed
• claim a result is typical when it's actually unusual
• hide negative reviews in a way that gives a distorted overall impression

Say you run a meal delivery business. A customer says, "I lost 4kg in two weeks while using this meal plan and exercising daily." If you use only "I lost 4kg in two weeks" in a paid ad, customers may think your meals alone caused that result. That could be misleading if exercise and other factors were part of the outcome.

The Fair Trading Act also includes rules about unsubstantiated representations. If your testimonial implies a factual claim, such as "this supplement reduced my joint pain" or "this software cut admin time by 50%", you should have a reasonable basis for using that claim.

That matters even where the words came from a real customer. A genuine testimonial can still mislead if you use it in a way that overstates what your product or service can do.

Influencers And Social Media Testimonials

If an influencer, ambassador or customer is paid or gifted something to promote your business, that connection should be clear.

New Zealand's Advertising Standards Authority codes expect advertising to be clearly identifiable. In practice, that means labels like "ad", "paid partnership" or clear wording in the caption should be easy for the audience to see and understand.

A vague thank you, hidden hashtag or unclear disclosure may not be enough, especially in stories, reels or short-form videos where people may not read every detail.

Can You Screenshot A Review Or Social Media Post?

Sometimes, but screenshots are often riskier than using a platform's built-in sharing tools or getting express permission.

A screenshot can capture more than just the review. It may include:

• the customer's full name
• profile photo
• social media handle
• location
• other comments or replies
• order details or personal context
• platform branding or layout

That can create copyright, privacy and platform terms issues all at once.

If you want to use a screenshot, ask yourself:

• Have we checked the platform's terms?
• Do we have the customer's permission?
• Does the screenshot reveal personal information we don't need?
• Could the screenshot suggest endorsement beyond what the customer intended?
• Is the review still accurate and current?
• Have we removed or blurred unnecessary details?

If Ana wants to share a customer's Instagram story saying, "Obsessed with this serum", she might be able to repost it using Instagram's features if the customer tagged her business. But using that story as a paid ad for six months is a different use. She should get written permission before turning it into campaign material.

The same goes for user-generated content, such as customers posting photos wearing your clothing, using your product or visiting your venue. The person who took the photo may own copyright, and the people shown in the photo may have privacy or consent concerns. Get permission before reusing it outside the platform interaction.

How Does The Privacy Act Apply To Customer Testimonials?

The Privacy Act 2020 can apply when a testimonial includes personal information about an identifiable person.

Personal information can include a person's name, image, voice, social media handle, location, job title, health information, purchase history or anything else that identifies them. A review from "Sarah T, Auckland" may be personal information if Sarah can reasonably be identified.

For businesses, the key Privacy Act principles are about being transparent and using personal information for the purpose it was collected.

If a customer gives you feedback through a private survey, support email or account portal, they may expect you to use it internally to improve your service. They may not expect you to publish it on your website or turn it into an ad.

To reduce privacy risk, you can:

• tell customers when feedback may be used for marketing
• get express consent before publishing identifiable testimonials
• avoid using unnecessary personal details
• anonymise testimonials where possible
• be extra careful with sensitive topics, such as health, finance, children or disability services
• keep a record of consent
• honour reasonable requests to remove or update a testimonial

Your privacy policy should match what you actually do with reviews and testimonials. If you collect reviews through your website, checkout flow or customer portal, your privacy wording should explain how that information may be used.

The Privacy Commissioner can look into complaints about privacy breaches. More importantly from a business perspective, customers can lose trust quickly if they feel their words or personal details have been used in a way they didn't agree to.

What Should Your Testimonial Process Look Like?

A simple process is usually enough for most ecommerce and service businesses, as long as it's consistent.

You don't need to turn every nice comment into a legal project. But you should know when a casual repost is fine and when you need a clearer written permission.

Step 1: Decide How You'll Use The Review

First, work out the channel and format. A homepage quote, website copy, a paid ad, a video case study and an investor deck all create different levels of exposure.

The broader and more commercial the use, the stronger your consent should be.

Step 2: Check The Claim

Read the testimonial as a customer would. Ask whether it makes a claim about performance, quality, price, health outcomes, financial outcomes, speed, customer numbers or savings.

If it does, keep evidence that supports the claim. For example, if a testimonial says your software saved 10 hours a week, make sure you have enough context to stand behind that statement.

Step 3: Get Permission In Writing

Use a short consent form, release, email approval or campaign agreement, and consider a contract review depending on the situation. Templates can miss details like paid ads, editing rights, logo use and withdrawal requests, so documents work best when tailored to your business and marketing channels.

For influencers, affiliates and ambassadors, use a written agreement that covers disclosure, content ownership, approval rights, usage rights, payment, exclusivity and what happens if the content is inaccurate or off-brand.

Step 4: Keep Your Records

Store the review, approval, final version and any evidence supporting the claim. If someone questions your ad later, you'll want to see exactly what was approved and when.

This is especially useful when team members change, agencies come and go, or an old campaign is reused months later.

Step 5: Review Testimonials Regularly

Testimonials can become misleading over time. If your pricing, product, service model, results or customer support process changes, old reviews may no longer reflect what customers receive now.

A simple six-monthly or annual review of key website testimonials can help you catch outdated claims before they cause problems.

Key Takeaways

• Customers usually own copyright in the words they write, and review platforms may also control how reviews can be reused.
• You should get clear consent before using identifiable testimonials, screenshots, photos, videos, social media posts or customer logos in marketing.
• The Fair Trading Act 1986 applies to testimonials, so reviews must be genuine, accurate and not presented in a misleading way.
• The Privacy Act 2020 can apply when a testimonial identifies a person, especially if you're using names, photos, handles, locations or sensitive details.
• Paid, gifted or incentivised testimonials should be disclosed clearly, and incentives shouldn't be tied to positive reviews.
• A simple approval process and well-drafted consent wording can make customer praise much easier to use across your marketing.

If you'd like help with your testimonial consent wording, influencer agreements, website terms or privacy policy, you can reach us at 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.