The Digital Markets, Competition and Consumers Act 2025 introduced fines of up to 10% of global annual turnover for businesses that commission fake reviews. That is not a Google policy violation with a profile suspension as the consequence. That is a consumer law offence with a financial penalty calculated against the entire revenue of the business worldwide. For UK local businesses and the agencies managing their profiles, the DMCCA is the most significant change to the fake review landscape since Google introduced public reviews.
The misconception is that the Act will self-enforce. It will not. The Competition and Markets Authority investigates and prosecutes, but it does not proactively scan Google Maps for fake reviews. Businesses that are targeted by fake review campaigns still need to detect the attack, document it correctly, report it through the right channels, and manage the reputational damage while the process runs. The DMCCA gives you a stronger weapon. It does not fight the battle for you.
What makes a review fake under the DMCCA
The Act defines fake reviews broadly enough to cover the most common attack patterns seen on Google Business Profile in the UK. A review is fake under the DMCCA if it does not reflect a genuine experience of the business, product or service being reviewed, regardless of whether the reviewer actually visited the business or not.
This covers the three patterns most commonly used against UK businesses on Google Maps: reviews submitted by people who never visited or used the service, reviews submitted by accounts controlled by a competitor or a paid service, and reviews that misrepresent the experience in a materially misleading way. The law applies to the person submitting the review and to any business that commissioned or paid for it.
How to detect a fake review attack on your GBP profile
Fake review attacks on UK profiles rarely arrive as isolated one-star reviews. They arrive in patterns. Knowing what the pattern looks like is the first step to detecting an attack early enough to limit the damage.
- Volume spike in a short window: three or more one-star reviews arriving within 24 to 72 hours from accounts with no previous interaction with your business
- Reviewer account profiles with no Maps history: new accounts created within days of the review, no other reviews on any business, no profile photo, generic username
- Geographic inconsistency: reviews originating from locations that make no logical sense for your business type or catchment area
- Similar phrasing across multiple reviews: reviews that use identical or near-identical language, sentence structure or complaints suggest coordinated submission from a single source
- Timing correlation with a competitive event: reviews arriving immediately after a competitor lost a major client, a tender result was announced, or your business received positive press coverage
- No order or visit record: for businesses with booking or transaction systems, cross-reference the reviewer against your customer records
How to document a fake review attack for DMCCA purposes
The CMA does not investigate informal complaints. If you want a DMCCA complaint to be actionable, the documentation needs to demonstrate a pattern of coordinated fake review activity, not just the presence of suspicious reviews.
- Screenshot immediately. Capture every suspicious review in full, including the reviewer's name, profile link, star rating, review text, date and time. Do this before reporting to Google, because reported reviews sometimes disappear from view before you can document them.
- Capture the reviewer's profile. Screenshot the reviewer's Google Maps profile page, noting account creation date if visible, number of reviews posted, and any other businesses reviewed that could suggest a pattern.
- Log your Google report submission. Record the date and time you flagged each review, the reason selected, and any reference number provided. Google's response timeline is part of the documentation.
- Identify the pattern in writing. Prepare a written summary of the attack: dates, number of reviews, common characteristics, and any evidence linking the reviews to a competitor or a paid service. This document is what a CMA complaint requires.
- Preserve the timestamped record. If you use a monitoring tool that logs profile changes and review arrivals with timestamps, export that data. A system-generated log carries more evidential weight than manual screenshots alone.
How to report fake reviews in the UK in 2026
There are two parallel reporting tracks and both should be activated simultaneously.
Track 1: Google Business Profile reporting. Flag each fake review individually through the GBP dashboard using the report function. Select the most specific policy violation that applies. For coordinated attacks, Google's support channel for verified business owners allows escalation beyond the automated flag system, particularly when you can demonstrate a pattern across multiple reviews.
Track 2: CMA complaint. The CMA accepts complaints about DMCCA violations through its online reporting portal. A complaint requires the name of the business you believe is responsible, the evidence of the fake review activity, and a clear explanation of how the conduct meets the definition of a DMCCA offence. The CMA does not guarantee investigation of every complaint, but documented patterns of coordinated fake review activity are the type of conduct the Act was designed to address.
Managing reputational damage while the process runs
Google's review removal process takes 5 to 30 days in most cases. A CMA investigation takes significantly longer. During that period, the fake reviews are visible to anyone who finds your profile. How you respond publicly determines how much damage they do.
- Respond to every fake review calmly and factually: state that you have no record of this customer, that you take all feedback seriously, and that you have reported the review to Google for investigation
- Do not accuse the reviewer of being a competitor or acting in bad faith in your public response: keep accusations for the documentation, not the reply
- Accelerate your legitimate review collection during the attack period to reduce the proportional weight of the fake reviews in your overall rating
- Inform your best existing clients of the situation if appropriate: a wave of genuine positive reviews from real customers is the most effective counter to a coordinated attack
Guardian from LocalEdge alerts you the moment a new review lands on your profile, giving you the earliest possible window to start documenting before the attack develops. The timestamped alert log Guardian maintains is exactly the kind of system-generated record that supports a DMCCA complaint. LocalEdge for UK businesses includes Guardian monitoring with instant review alerts. For agencies managing multiple UK client profiles, the LocalEdge agency platform and multi-profile diagnostic centralise review monitoring across your entire portfolio.
The free GBP diagnostic shows in under two minutes the current state of your review profile and any patterns that warrant immediate attention. For the full framework on GBP optimisation and protection in the UK, see our reference guide: how to optimize your Google Business Profile in the UK 2026.
