Fake Reviews and Hidden Fees: The UK Rules Your Website Must Follow

In April 2026, the AA settled the first fine ever issued under the UK's new consumer protection regime: £4.2 million, plus more than £760,000 refunded to around 80,000 learner drivers. The trigger was a £3 booking fee added at checkout rather than shown in the headline price. Five months from investigation opened to penalty paid, no court involved.

That case turned a law many business owners had filed under "probably about Amazon" into something worth twenty minutes of any website owner's attention. The rules on fake reviews and hidden fees have applied to every UK business since 6 April 2025, the regulator can now fine up to 10% of global turnover directly, and 2026 is the year it started using that power. Here is what the rules require of the two places they touch your website: your reviews and your prices.

What changed, and why does it matter now?

The Digital Markets, Competition and Consumers Act rewired UK consumer enforcement. Since 6 April 2025, fake reviews and hidden mandatory fees are banned practices: automatically unfair, with no need for the regulator to prove anyone was misled. Just as important, the Competition and Markets Authority no longer has to take businesses to court; it can investigate and fine directly, up to 10% of worldwide turnover.

The first year was guidance and grace: the CMA published detailed rules on reviews and gave businesses three months' breathing room, which ended in July 2025. In November 2025 it finalised its pricing guidance and disclosed it had reviewed the practices of more than 400 businesses across 19 sectors. Then 2026 turned words into numbers: the AA penalty in April, and in March a wave of fake-review investigations into names including Autotrader, Just Eat and Feefo. That last one matters: Feefo is a review platform, which signals the regulator is looking at how reviews are collected and displayed, not just whether someone typed a fictional one. Law firm commentary over the summer has settled on the same reading: the CMA regards this as the start, not the crackdown.

What counts as a fake review now?

There are some obvious cases: writing reviews for your own business, buying them, or commissioning them is banned. But the rules reach further than most owners expect, because they also govern businesses that publish reviews, which includes any website with a testimonials page or a review widget.

If your site displays consumer reviews, you now have a positive legal duty to take "reasonable and proportionate steps" to keep banned reviews out: a published policy on how you collect and display reviews, some assessment of where fake or misleading content could creep in, and a process for removing it. And notably, using a third-party review platform does not transfer the responsibility; the CMA's guidance is clear that outsourcing collection is not a defence.

Two practices that feel normal are now squarely banned. Publishing an incentivised review without saying so: if a customer got a discount, freebie or prize entry for reviewing, the review must say it. And presenting review information in a misleading way, which is where the everyday website features in the next section come in.

Is your reviews section breaking the rules without you knowing?

This is the part the legal explainers skip, and it is where we spend our time, because the risk usually lives in settings and flows rather than in anyone's intentions. Three places worth checking on your own site this week:

Your review widget's filter settings. Plenty of review widgets and plugins ship with a minimum-star display filter, and plenty of sites have "show reviews of 4 stars and above" switched on from years ago. Displaying only your best reviews while quietly holding back the rest is exactly the kind of misleading presentation the rules target. The safe setting is the honest one: show the real distribution, and answer the poor reviews visibly, which persuades better than hiding them ever did.

Your review invitation flow. Some email and SMS tools offer flows that first ask "how was it?", then route happy customers to a public review link and unhappy ones to a private feedback form. That routing, often called review gating, curates your public rating by design, and it now sits on the wrong side of the rules. Invite every customer the same way, at the same moment.

Where your reviews come from. Reviews imported in bulk from sources you cannot verify, testimonials with no traceable customer behind them, and staff-written reviews presented as customers' words are all liabilities now. On the sites we build, every displayed rating traces to a real, checkable source, and the collection method is something we are happy to describe on the page; that standard is now the legal baseline rather than a nice-to-have.

Add the published review policy, a short page or section explaining how you collect and display reviews, and your reviews section is in good shape. It is an afternoon of work for most sites.

What does the drip pricing ban mean for your prices?

The rule is refreshingly simple: the first price a visitor sees must include every fee they cannot avoid paying. Booking fees, admin charges, compulsory service fees and unavoidable delivery all belong in the headline number, not at checkout step three. The AA case shows how literally to take this: the dripped fee was £3, and the penalty ran to seven figures.

Truly optional extras can still be priced separately, and delivery that varies by choice or location can be added later, provided you disclose early that it exists. For subscription-style pricing, the CMA's guidance points to a safe approach: show the total cost over the minimum term, not just the monthly figure that makes the maths look friendlier.

The website audit here is a walk through your own checkout as a stranger: note the first price you are shown for a product or service, then note what you are asked to pay at the end. If those two numbers differ by anything a customer could not have opted out of, that gap is now a regulatory risk, and closing it is usually a template change rather than a rebuild.

Do the rules apply to service businesses, or just online shops?

Both, and service businesses are the ones most likely to be caught out, because the rules feel like ecommerce law and their websites were never built with compliance in mind. A testimonials page on a trades, salon or professional services site is a published collection of consumer reviews, which brings the reasonable-steps duty with it: the quotes need traceable customers behind them, and any that were incentivised need to say so.

The same goes for Google reviews. Asking customers to review you on Google is fine and sensible; filtering who gets asked is the problem, and the widget that embeds your Google reviews on your own site makes you the publisher of what it shows, filter settings included. On pricing, quote-based businesses have less to worry about: if you do not display prices, there is no headline price to mislead with. The one habit to check is the "from £X" claim, which needs to be a price a real customer could pay, not a number chosen to win the click.

What should you check this month?

Six checks, in the order we would run them on any site:

1. Review widget settings: any minimum-star filter or hide-negative option switched off.
2. Invitation flow: every customer invited to review the same way; no happy-path routing.
3. Incentivised reviews: labelled as such wherever they appear, or retired.
4. Review policy: a short, findable explanation of how reviews are collected and displayed.
5. Headline prices: first displayed price includes all mandatory fees, on product pages, category pages and ads alike.
6. Checkout walk-through: no fee appears at checkout that a customer could not have predicted from the pages before it.

None of this requires a lawyer for a typical small business site; it requires an honest hour with your own website and the settings of whatever tools sit behind it.

What is coming next?

The subscription rules, the second half of this regime, were delayed in April 2026 and are now expected in Spring 2027: clearer pre-contract information, reminders before renewals, and cancellation that is as easy as signing up. If your business sells subscriptions, memberships or retainers, the sensible move is designing for those expectations now rather than retrofitting them under deadline, and we will cover the detail when the implementation date is confirmed.

Reviews and pricing are also worth seeing as more than compliance. The businesses that show their real ratings, answer their critics in public and put honest numbers on the first page are borrowing the same trust mechanics that make comparison content and transparent pricing work commercially. The law has effectively banned the shortcuts; what remains is the version that was always going to win anyway.

If you are updating how your site handles reviews and pricing, or building something new, our guides on ecommerce website security and website legal requirements in the UK sit alongside this one, and you can see how we approach ecommerce builds where these standards are baked in from the start. Questions about your own setup: get in touch and we will give you a straight answer.