An online review can be unfair without being unlawful. A one-star rating with a harsh but honest opinion is part of public commerce. A review that invents a transaction, accuses a named person of a crime, discloses private data or is written by a competitor posing as a customer is a different matter. When a business or a professional believes a review has crossed that line, the first instinct is usually to report it and get it removed as quickly as possible.
This guide explains why the order of operations matters: preserve first, report second. It does not repeat the general discussion of screenshots or the technical details of our forensic declarations, which we cover elsewhere. It focuses on one specific moment: the hours or days between discovering a problematic review and asking a platform, a lawyer or a court to act on it.
Contents
- When a review becomes a legal problem
- Why preserve before you report
- What to document
- Why a screenshot may not be enough
- The role of forensic acquisition
- A practical example
- When to involve a professional
- How to request the service
When a review becomes a legal problem
Reviews influence where people eat, which clinic they book and which supplier they trust. For a small business or an independent professional, a single review on a listing with only a few dozen ratings can noticeably shift the average score and the first impression of prospective clients.
The distinction that matters is between a negative review and a potentially unlawful review. Criticism, disappointment and even sarcasm are generally protected expressions of opinion, and platforms do not usually remove a review simply because the business disagrees with it. A review may instead raise legal issues when, for example, it:
- describes an experience that, according to the business’s records, never took place;
- presents false statements of fact rather than opinions, such as accusing a named person of fraud or of a criminal act;
- is written by a competitor, a former employee or a paid third party presented as a genuine customer;
- is part of a coordinated wave of reviews published within a short period;
- is used as leverage, for instance a demand for a refund or payment in exchange for removing or improving it;
- discloses personal data, health information or private details about staff or other customers.
Whether any of these situations actually amounts to defamation, unfair competition, a breach of the platform’s rules or another violation depends on the facts and on the applicable law. That assessment belongs to a lawyer. What a business can do immediately, without prejudging the outcome, is make sure the content is still available when that assessment takes place.
Why preserve before you report
An online review is not a stable document. Between the moment you notice it and the moment someone needs to examine it, it may:
- be edited by its author, who may soften or sharpen the wording, change the rating or remove the most serious allegation;
- be deleted by its author, sometimes precisely because a reply or a report has drawn attention to it;
- be removed or hidden by the platform after a report, an automated filter or a moderation decision;
- disappear together with the reviewer’s account, if the account is closed or suspended;
- become harder to find because of changes in the page layout, sorting, filters or regional versions of the platform.
Paradoxically, a successful report can work against you. If the platform removes the review, the immediate reputational problem shrinks, but the content you may later need for a warning letter, a claim for damages, a criminal complaint or a dispute about a recurring pattern may no longer exist in any verifiable form. Platforms do not generally hand businesses an archived copy of a review they have taken down.
The same caution applies to public replies. Responding to reviews is often good practice, but a reply can prompt the author to edit or delete the original text. When a review may have legal relevance, it is prudent to preserve it before replying, reporting or contacting the author.
What to document
Preservation is only useful if it captures enough to make the review understandable to someone who has never seen it online. The elements below form a practical checklist; not every platform displays all of them.
The review itself
- The full text, including any title, the rating and the publication or modification date shown by the platform.
- Photos, videos or other attachments published with the review.
- Any reply from the business and any further comments in the thread.
Location and context
- The exact URL of the review, where the platform provides a direct link, and the URL of the listing or page on which it appears.
- The surrounding context: the business listing, the overall rating and the number of reviews at the time of acquisition, and other reviews where they help show a pattern.
- The language or regional version of the site through which the content was viewed, when relevant.
The reviewer as displayed
- The name, nickname or handle shown, the profile picture and any public profile page.
- Publicly visible profile information, such as the number of reviews written, badges and, where available, the list of other public reviews.
- Any profile identifier visible on the page or in its address.
Time and technical data
- The date and time of the acquisition, based on a reliable time reference and distinct from the publication date claimed by the platform.
- The technical information available at the time of access, such as the page source code, server response data and a description of the tools used.
Related material in your possession
- Emails, messages or call notes in which someone links the review to a request or a threat.
- Internal records relevant to the claims, such as bookings, invoices or appointment logs. These are separate evidence: they do not come from the acquisition of the review, but they are often what a lawyer will rely on to assess whether its statements are true.
Why a screenshot may not be enough
A screenshot is better than nothing, and it is often a sensible first step: it can support an internal note, a first conversation with a lawyer or an initial report to a platform. Courts in many jurisdictions do take screenshots into account, generally under the judge’s free assessment of the evidence.
Its limits become apparent when the content is disputed. An ordinary screenshot:
- shows only what was on the screen, often without the full URL, the listing context or the reviewer’s profile;
- carries no independent proof of when it was taken, since the file date can be changed and says nothing about when the content was online;
- cannot, on its own, demonstrate that the image was not edited after capture;
- does not record how the capture was made, on which device, through which account or with which settings.
If the other party denies that the review ever said what the screenshot shows, or claims the image was altered, the discussion shifts to the reliability of the capture. That is where a documented acquisition carries more weight. We cover the general topic in our guide on why screenshots are easily contested.
The role of forensic acquisition
A forensic acquisition is a documented procedure for collecting online content so that a third party can later understand what was collected, how, when and by whom, and verify that it has not changed since. For a review, such a procedure typically includes, where applicable:
- Acquisition of the content in its context: the review, the listing, the reviewer’s public profile, the page source and, where useful, a video recording of the browsing session.
- Technical documentation of the operation: the environment and tools used, the steps followed, the addresses visited and the date and time of each step.
- SHA-256 cryptographic hashes of the files produced. A hash works like a digital fingerprint of each file: comparing SHA-256 values makes it possible to detect any alteration of the acquired files with a very high degree of reliability.
- A qualified electronic time stamp issued by a qualified trust service provider under the EU eIDAS Regulation. Under Article 41 of that Regulation, a qualified electronic time stamp enjoys a presumption of the accuracy of the date and time it indicates and of the integrity of the data to which that date and time are bound.
- A forensic technical report describing the methodology, the elements acquired, the hash values and any limitations encountered, such as content visible only after login or elements the platform did not display. The report can be accompanied by our FEDIS declaration.
What a certification can and cannot establish
It is important to be precise about what this work demonstrates. A forensic acquisition answers technical questions; it does not decide legal ones.
| Question | What a forensic acquisition contributes |
|---|---|
| Did the content exist online? | It documents that the content was accessible at a given address at the date and time of acquisition. |
| Has the acquired data changed since? | Hash values and the qualified time stamp make it possible to verify integrity. |
| How was it collected? | The technical report describes the method, the tools and the sequence of operations. |
| Who wrote the review? | It records the name and profile shown by the platform. It does not establish the real identity of the person behind the account, which normally requires data held by the platform and obtained through legal channels. |
| Is the review true or false? | It does not establish this. Truth or falsity is assessed on other evidence, such as the business’s own records, and ultimately by the competent authority. |
| Will the evidence be admitted, and with what weight? | That depends on the applicable procedural law and on the court’s assessment. A well-documented acquisition is designed to make that assessment easier, not to replace it. |
In short, certification preserves and documents the content. It is the foundation on which legal arguments are built, not the argument itself.
A practical example
The following scenario is hypothetical and simplified.
A dental practice notices a one-star review on its business listing. The review states that a named dentist performed a treatment “without consent” and that the practice “inflates its invoices”. The practice has no record of a patient with that name, and the reviewer’s public profile shows little information and no other visible reviews. The manager’s first reaction is to report the review immediately and post a firm public reply.
A more careful sequence looks like this.
1. Hold the public reaction
The practice refrains from replying publicly or contacting the reviewer, so as not to prompt changes to the review before it has been preserved.
2. Note the essentials
A staff member records the URL of the listing and the direct link to the review, if available, and takes a quick screenshot as an internal reference, noting the time.
3. Request a forensic acquisition
The practice contacts a forensic provider. The acquisition covers the review, its position in the listing, the overall rating at that moment, the reviewer’s public profile and the page source. The files are hashed with SHA-256, a qualified electronic time stamp is applied and a technical report is issued.
4. Gather internal records
In parallel, the practice extracts from its own systems the information showing whether such a patient or treatment exists, keeping it confidential and limited to what is necessary.
5. Obtain a legal assessment
A lawyer examines the certified material and the internal records, and assesses whether the statements are opinions or factual allegations, whether they appear to be false and which response is proportionate: a notice to the platform, a letter to the author or further action.
6. Report to the platform
The practice submits a notice through the platform’s official procedure, indicating the exact URL and explaining why the content is considered unlawful or contrary to the platform’s rules. In the European Union, the Digital Services Act requires hosting services to provide notice-and-action mechanisms and sets out what a notice should contain, including a clear indication of the exact location of the content.
7. Keep monitoring
If the review is edited after the report, a second acquisition can document the change. If it is removed, the practice still holds a verifiable record of what was published and when.
Nothing in this sequence guarantees that the review will be removed, that its author will be identified or that a court will rule in the practice’s favour. What it ensures is that, whatever happens next, decisions will rest on documented facts rather than on the memory of something that is no longer online.
When to involve a professional
Three different activities are often confused:
- Technical acquisition preserves and documents the content. This is the work of a digital forensics provider such as CertifyWebContent.
- Legal assessment determines whether the content is unlawful, which law applies, which remedies are available and whether action is proportionate. This is the role of a lawyer.
- Removal requests are submitted to the platform through its own procedures, by the business or its counsel, and decided by the platform under its policies and the applicable law.
It is worth involving professionals early when a review contains serious factual allegations, targets a named person, appears to belong to a coordinated campaign, is linked to a request for money, or may lead to litigation or a criminal complaint. In these cases the acquisition should come before any step that could cause the content to change. Many lawyers prefer to receive certified material at the first meeting, so that their assessment rests on a stable record.
Acquisition should concern content that is lawfully accessible and relevant to the dispute, in compliance with data protection law. Reviews contain the reviewer’s personal data, and rules such as the GDPR require that processing remain proportionate to the purpose of establishing or defending a legal claim.
How to request the service
CertifyWebContent carries out forensic acquisition and certification of reviews published on the main review platforms and on other websites. Each acquisition is documented, hashed with SHA-256, sealed with a qualified electronic time stamp and accompanied by a technical report. The service can be performed remotely for clients in Europe and beyond. You will find the details on our review certification service page.
When the problem extends beyond a single review, for example to a web page, a post or a series of comments, we can also provide forensic web page certification and defamation and threats certification.
To receive a quote, send us the URL of the review or reviews, the platform, a short description of the situation and any deadline you are working to. If the content is at risk of being changed or removed soon, let us know so that we can assess the timing of our intervention.
