A one-star review has appeared. You have read it four times. The reply forming in your head is not the reply you should send, and some part of you already knows that.
Here is the part most guides get wrong. Nearly all of them tell you to address the reviewer by name, reference their specific experience, and set out what really happened. Followed literally, that advice has you confirming in public that a named individual was your customer, what they bought, and when. In the UK that is a data protection problem, and in any jurisdiction it is a defamation risk waiting for a bad day.
The seven templates below are written to avoid both. They are shorter than the ones you will find elsewhere, deliberately, and the reasons are worth reading before you use them.
General guidance, not legal advice. If you are in an active dispute, or a review contains allegations that could affect your licence or professional standing, take proper advice.
Why responding matters more than the review itself
The instinct is to treat a bad review as damage to be contained. It is more useful to treat it as a stage.
A meaningful proportion of consumers say they are more likely to use a business that responds to negative feedback. Not a business with no negative feedback, which nobody believes exists, but one that answers it. The reply is a signal to every future reader about how you behave when something goes wrong, which is precisely what a cautious customer is trying to work out.
The gap is wide enough to be worth exploiting. Around half of customers expect a response within a week, and a considerably larger share report never receiving one at all. The bar is genuinely low, and a calm reply within a few days puts you ahead of most of your competitors without any cleverness.
The single most useful reframe: you are not writing to the reviewer. You are writing to the next hundred people who read the review. The reviewer has already made their mind up. The audience has not.
The rule almost every guide gets wrong
Your public reply should be data-light. That means it should not confirm that the person was a customer, what they bought, when they visited, who served them, or anything about their conduct while they were with you.
This surprises people, so it is worth being specific about why.
Personal data is any information that identifies someone, directly or indirectly. That covers names, email addresses, order numbers, booking references, appointment times and more besides. Replying publicly with "Hi Sarah, we're sorry your appointment on the 14th ran over" confirms a named person's relationship with your business, on a public page, without their agreement. That is a disclosure, and the fact that they posted the review first does not authorise it.
Three specific things create exposure:
Replying with detail to prove the reviewer wrong. The more specific your defence, the more you disclose.
Posting screenshots or private messages. Publishing correspondence to demonstrate that you were in the right is one of the riskiest things a business can do in a review thread, and it is common precisely because it feels so satisfying.
Referencing the customer's history with you. Previous complaints, previous refunds, how often they visit. All of it identifies and characterises a person in public.
The defamation side
Separately from data protection, there are things you should not say because of what they allege.
Avoid calling a reviewer a liar. Avoid making new allegations about their behaviour. Avoid threatening legal action in a public reply. Avoid stating a disputed fact as though it were settled.
The distinction that matters is between opinion and allegation of fact. "We disagree with this characterisation" is opinion. "This customer was abusive to our staff and is now retaliating" is an allegation of fact about a named individual, published to the world, and if you cannot prove it you have a problem considerably larger than a one-star review.
Why the constraint improves the writing
Here is the part that makes this easier rather than harder.
A short, calm, non-specific reply reads as professional. A detailed rebuttal reads as a business arguing with a customer, and every future reader sees the argument rather than the facts. Even when you are completely right, winning the exchange in public makes you look like someone who argues with customers.
The legal rule and the commercial instinct point the same direction, which does not happen often.
The structure that works
Five parts, in order, none of them long.
Acknowledge without confirming. "Thank you for taking the time to share this" works regardless of whether the account is accurate, whether the person was your customer, or whether you have any idea what happened.
Thank them. It costs nothing and it is always true. Feedback you can see is more useful than feedback that walks away silently.
Apologise for the experience described. Note the wording. You are sorry the experience described happened, which is different from accepting a version of events you have not verified.
Say what happens next, in general terms. "We take this seriously and we are looking into it" is enough. You do not owe the public a case file.
Provide a route offline. A phone number or an email address, with an invitation to contact you directly. This is where the actual resolution happens.
That is it. Four or five sentences. If your reply is longer than the review, you have almost certainly said too much.
Seven templates
Each one includes a note on what has been deliberately left out, because that is the part you need to preserve when you adapt them.
1. A fair criticism you recognise
Thank you for taking the time to leave this feedback. We're sorry the experience fell short, and what you've described isn't the standard we aim for. We've shared this with the team so we can put it right. If you'd like to discuss it directly, please contact us on [number] or at [email] and we'll do what we can to resolve it.
Left out: the reviewer's name, confirmation that they were a customer, any detail of what happened, and any promise of compensation.
2. A complaint you cannot verify
Thank you for the feedback. We're sorry to hear about this experience. We'd like to understand what happened properly, so please get in touch on [number] or [email] and we'll look into it straight away.
Left out: any acceptance that the events occurred as described, and any suggestion that they did not. You are neither conceding nor disputing, which is exactly right when you do not yet know.
3. A review you believe is from a non-customer
Thank you for the feedback. We're not able to match this to a recent experience with us, but we'd genuinely like to understand what happened. Please contact us on [number] or [email] so we can look into it.
Left out: any public assertion that the review is fake. Say nothing of the sort in the reply, however confident you are. Report it to the platform separately, through their process, with whatever evidence you have. The public reply and the platform report are two different activities and mixing them helps nobody.
4. An angry review with a legitimate core
Thank you for taking the time to write. We're sorry this has been a frustrating experience. There's clearly something here we need to look at, and we'd like to do that properly rather than in a comment thread. Please contact us on [number] or [email] and we'll give it our full attention.
Left out: any response to the tone. Do not mention that the review was angry, do not ask the reviewer to be reasonable, and do not match their register. The contrast between their message and your calm reply is doing work for you.
5. A complaint about something outside your control
Thank you for the feedback, and we're sorry this caused a problem. Some parts of this were outside what we're able to control directly, but that doesn't make it less frustrating for you. Please contact us on [number] or [email] and we'll talk through what we can do.
Left out: blaming the supplier, the courier, the manufacturer or the weather by name. Explaining that it was not your fault reads as defensive even when it is true, and naming a third party creates a second problem. One clause acknowledging the limit is enough.
6. A review that is already resolved offline
Thank you for the feedback. We believe we've been in touch about this and we hope it's now resolved, but if there's anything outstanding please contact us on [number] or [email].
Left out: what the resolution was, what you refunded, what you agreed. Stating the settlement publicly both discloses their information and shows every future reader exactly what complaining gets them.
7. A review containing an accusation you must not repeat
Thank you for raising this. We take any concern of this nature seriously and we'd like to address it properly and directly. Please contact us on [number] or at [email].
Left out: the accusation itself. Do not restate it, do not quote it, do not deny it in detail. Repeating a serious allegation in your own reply puts it in your words on your page, and a denial that recounts the claim gives it a second airing. Where the allegation is serious enough to affect a licence, a registration or a professional standing, this is the point to take advice before posting anything at all.
When not to respond
Not every review needs a reply, and a few are actively made worse by one.
When it is abuse rather than criticism. A reply moves it up the page and signals that engagement is available. Report it to the platform and leave it.
When a reply would require disclosing something you should not. If the only honest response involves the customer's medical, financial or personal circumstances, there is no safe public version. Go offline or say nothing.
When you are still angry. The reply you write at 11pm on the day it appears is not the reply you will want attached to your business for the next five years. Nothing on a review platform is urgent enough to justify writing while furious.
When the same person is posting repeatedly. Serial reviewers are usually seeking engagement, and each reply supplies it. One measured response to the first, then the platform's reporting process.
Not responding is not the same as doing nothing. Report policy breaches, record the incident internally, and fix whatever is genuinely broken. Silence in public is compatible with real action in private.
What not to do
Arguing the facts in public. You may win and you will still look like a business that argues with customers.
Posting screenshots or private messages. Discloses personal data, and looks vindictive even when the content vindicates you.
Calling the reviewer a liar. An allegation of fact about a named person, published by you.
Threatening legal action in the reply. It rarely achieves the removal you want, it frequently gets screenshotted, and it converts a service complaint into a story.
Offering compensation publicly. Every future reader learns the price of a one-star review. Handle it offline.
Asking staff or friends to post rebuttals. Breaches platform policy, and where there is an incentive or an undisclosed connection it can breach consumer protection rules too. It is also obvious to anyone reading, which is the part people underestimate.
Three rules
Keep it short. Four or five sentences, always shorter than the review.
Keep it data-light. No names, no order details, no confirmation that they were a customer, no screenshots.
Write it for the next reader, not the current complainant.
If you are also working on getting more reviews in the first place, our guide to asking for reviews without breaking platform rules covers what is and is not permitted, and our comparison of review platforms by sector covers where your responses will actually be seen.
Comments (0)