CMA Cracks Down on Misleading Reviews: What This Means for Your Hospitality Business

Online reviews are the lifeblood of the modern hospitality business. Before a customer books a table, orders a takeaway, or checks into a hotel room, they check the stars. Which makes the Competition and Markets Authority's (CMA) 2026 crackdown on misleading and fake reviews one of the most consequential regulatory developments the sector has faced in years - and one that far too many operators are still underestimating.

This is not a theoretical risk. The CMA has opened formal investigations, named specific platforms, and made clear it is prepared to use its new enforcement powers under the Digital Markets, Competition and Consumers Act 2024 (DMCCA). For restaurants, pubs, cafes, and hotels that list on third-party platforms or actively manage their own ratings, the time to act is now.

What Is the CMA Investigation and Why Now?

The CMA has been scrutinising fake and misleading reviews for several years, but 2024 and 2025 brought a significant escalation. The watchdog published a detailed market study into online reviews, finding that up to 11% of UK consumer spending - an estimated £23 billion a year - is influenced by potentially unreliable reviews. In a sector like hospitality, where star ratings and customer feedback are direct drivers of revenue, that figure is staggering.

The catalyst for the current enforcement push was the DMCCA, which received Royal Assent in May 2024. This legislation gave the CMA direct enforcement powers over consumer protection law for the first time - meaning it no longer needs to go through the courts to impose fines. It can now act swiftly and decisively against businesses that breach consumer protection rules, including those relating to fake reviews.

The CMA investigation into misleading reviews in 2026 is therefore the first real test of these new powers - and the hospitality sector, given its heavy reliance on platforms and ratings, sits squarely in the crosshairs.

Which Businesses Are Under Investigation?

The CMA's investigations have focused primarily on platforms and intermediaries rather than individual venues - but that distinction matters less than it might seem.

Just Eat has been subject to CMA scrutiny regarding its ratings and reviews system. The concern is that the way ratings are collected, aggregated, and displayed on the platform may not give consumers an accurate picture of restaurant quality. Specific issues under examination include how historical reviews are weighted, whether the system adequately identifies and removes suspicious reviews, and whether the overall star rating presented to consumers is genuinely representative.

The Just Eat ratings system investigation is significant for any restaurant or takeaway listed on a delivery platform - not because those businesses are directly accused of wrongdoing, but because the outcome will likely reshape how platforms present reviews, which directly affects how your venue is seen by potential customers.

Beyond delivery platforms, the CMA has signalled its intention to examine review practices across hospitality more broadly. This includes aggregator sites, hotel booking platforms, and even Google and Tripadvisor listings - any environment where consumer purchasing decisions are influenced by star ratings and written reviews.

The Legal Framework: Consumer Protection and the Digital Markets Act

Understanding the law that underpins this crackdown is essential for any hospitality operator trying to assess their own exposure.

The primary consumer protection framework in play includes:

• The Consumer Protection from Unfair Trading Regulations 2008 (CPRs) - which prohibit misleading commercial practices, including presenting fake reviews as genuine customer feedback.

• The Digital Markets, Competition and Consumers Act 2024 - which specifically added fake and misleading reviews to the list of banned commercial practices, and gave the CMA direct enforcement authority.

• The Business Protection from Misleading Marketing Regulations 2008 - relevant where review manipulation affects competitor businesses.

Under the DMCCA, banned practices now explicitly include: commissioning fake reviews; hosting consumer reviews without taking reasonable steps to verify their authenticity; submitting reviews on behalf of customers without their knowledge; and offering incentives for reviews without making that incentive clear and transparent.

Critically, the legislation applies to businesses that commission or benefit from fake reviews - not just the platforms that host them. A restaurant that pays for positive reviews, or instructs staff to post them, is directly in breach.

What Are the Penalties for Non-Compliance?

The financial consequences of falling foul of the CMA's review enforcement are severe - and unlike some regulatory regimes, the penalties are designed to be genuinely dissuasive.

Under the DMCCA, the CMA can impose fines of up to 10% of a business's global annual turnover for breaches of consumer protection law. For a multi-site restaurant group or a hotel chain, that figure could be enormous. But even for smaller independent operators, the reputational and operational consequences of a CMA investigation - quite apart from any financial penalty - can be devastating.

Beyond CMA enforcement, there are additional risks:

• Trading Standards action at a local level, which can result in prosecutions and unlimited fines for serious breaches of the CPRs.

• Platform sanctions - delivery apps and review sites can suspend or remove listings for businesses found to have manipulated reviews, with immediate revenue consequences.

• Reputational damage - CMA investigations are public, and the press coverage alone can cause lasting harm to a brand.

• Civil liability - in theory, consumers misled by fake reviews could pursue civil claims for damages, though this remains rare in practice.

How to Identify Fake Reviews Targeting Your Venue

One often-overlooked dimension of review compliance in hospitality is the threat of fake reviews posted by competitors or malicious actors targeting your business. These negative fake reviews can damage your ratings, and understanding how to identify and challenge them is as important as ensuring your own practices are clean.

Warning signs of fake or malicious reviews include:

• A sudden cluster of negative (or positive) reviews appearing within a short timeframe, particularly outside your peak trading periods.

• Reviewers with no prior review history or accounts created very recently.

• Reviews referencing menu items, staff names, or events that do not match your actual offering.

• Reviews that appear word-for-word identical across different platforms or different businesses in your area.

• Reviewers who have left five-star reviews for one competitor and one-star reviews across multiple others.

If you suspect you are the victim of a fake review campaign, document your evidence thoroughly and report it to the relevant platform immediately. For serious or persistent cases, you can also report to the CMA or Trading Standards. Keep a log of all reports made - this demonstrates your good-faith compliance efforts should any regulatory scrutiny arise.

A Practical Review Compliance Audit Checklist for Hospitality Operators

The most effective thing any hospitality business can do right now is conduct a thorough internal audit of its review practices. Use the checklist below to identify any areas of exposure.

Review Collection Practices

1. Do you ask all customers for reviews, or only those you believe are satisfied? (Selective solicitation is a breach of consumer law.)

2. Do any of your review request processes filter or screen customers before directing them to a public platform?

3. Have you ever offered a discount, free item, or other incentive in exchange for a review - and if so, was this disclosed in the review itself?

4. Have any staff members been asked or encouraged to post reviews of your own venue?

5. Have you ever purchased reviews from a third-party service?

Platform and Third-Party Listings

1. Have you reviewed the terms of service for every platform you list on, including Just Eat, Deliveroo, Uber Eats, Google, and Tripadvisor, to understand their review policies?

2. Are your business details, menu, and pricing consistent and accurate across all platforms? (Inaccurate listings can themselves constitute misleading commercial practices.)

3. Do you regularly monitor your ratings on each platform and have a documented process for reporting suspicious reviews?

Internal Records and Policies

1. Do you have a written review management policy that staff have been trained on?

2. Do you retain records of review-related complaints or reports made to platforms?

3. Is there a clear escalation process when a potential fake review is identified?

Best Practices for Encouraging Authentic Reviews

Given the regulatory environment, encouraging genuine customer reviews is both a commercial imperative and a compliance matter. The good news is that best practice here is straightforward - it just requires consistency.

• Ask every customer, not just happy ones. Train front-of-house staff to invite feedback from all diners as part of the natural end-of-visit routine.

• Use follow-up emails or SMS messages sent to all customers equally, directing them to your preferred review platform.

• Display QR codes at tables or on receipts that link directly to your Google or Tripadvisor page - making it easy and frictionless for customers to leave feedback.

• Respond professionally and promptly to all reviews, positive and negative. This signals to both customers and regulators that you take feedback seriously.

• Never pre-screen reviews before they go public. Tools that ask customers how they would rate their experience and only direct high scorers to public platforms are specifically prohibited under the DMCCA.

Staff Training Protocols for Review Management

One of the most significant gaps in hospitality review compliance is staff awareness. In many venues, managers are aware of the rules but front-of-house teams are either untrained or - worse - have been informally instructed to do things that inadvertently breach consumer law.

Your staff training on review management should cover the following areas as a minimum:

• What staff can and cannot say when asking for reviews - including the prohibition on phrases like 'if you enjoyed your meal, please leave us five stars'.

• Why staff must not post their own reviews of the venue, even if they genuinely had a good experience.

• How to handle in-person complaints in a way that genuinely resolves the issue - reducing the likelihood of negative public reviews while doing so transparently.

• How to flag suspicious reviews to a manager for reporting to the platform.

• The commercial and legal consequences of review manipulation - so staff understand why the rules exist and take them seriously.

Consider incorporating review compliance into your standard induction training and documenting it formally. If you ever face CMA or Trading Standards scrutiny, being able to demonstrate a structured training programme is a meaningful mitigating factor.

Technology Platforms and Compliance Tools

A growing number of reputation management tools are available to hospitality businesses, but not all of them are compliant with UK consumer law. When evaluating any technology solution for review management, apply the following tests:

• Does the platform send review requests to all customers equally, without filtering by satisfaction score or other criteria?

• Does it direct customers to public platforms rather than capturing reviews in a private system that never reaches Google or Tripadvisor?

• Does the provider have a clear terms of service that aligns with the DMCCA and CMA guidance?

• Does it provide monitoring and alerting capabilities for suspicious review activity, helping you identify fake reviews early?

Be particularly cautious of any platform that promises to 'boost your ratings' or 'remove negative reviews' - these are almost certainly incompatible with the current regulatory framework and could expose you to significant liability.

Insurance and Risk Management Considerations

Review compliance is increasingly becoming a risk management concern for insurers as well as regulators. Hospitality operators should discuss the following with their brokers:

• Does your commercial liability policy cover legal costs and fines arising from regulatory investigations, including CMA enforcement action? Many standard policies do not.

• Is there a clause covering reputation management costs, such as PR support following a review-related controversy?

• Does your cyber or digital liability cover extend to review platform disputes or platform suspension?

Even if your insurer does not currently offer specific review-related cover, simply having the conversation and documenting your compliance efforts can strengthen your position. Insurers look more favourably on businesses that demonstrate proactive risk management.

How to Respond if the CMA Comes Knocking

If your business receives a formal information request or notice from the CMA, Trading Standards, or any other regulator in connection with online reviews, the steps you take in the first 48 hours matter enormously.

1. Do not destroy or alter any records. Preserve all communications, review requests, platform correspondence, and internal policies relating to reviews. Document destruction during a regulatory investigation is treated extremely seriously.

2. Seek legal advice immediately. A solicitor with experience in competition or consumer protection law should review the notice and advise you on your response obligations and rights.

3. Cooperate fully but carefully. Cooperation with the CMA is taken into account when determining penalties, but you should ensure your responses are accurate and complete - not speculative.

4. Conduct an internal review to understand the full picture before responding to regulators. Know what your practices have been so you are not caught out by inconsistencies.

5. Notify your insurer. If you have relevant cover, your policy may require you to report regulatory investigations promptly to preserve any claim.

Cross-Sector Implications: Why Hospitality Faces Unique Exposure

While the CMA's review enforcement has cross-sector implications - touching retail, travel, and professional services as well as food and drink - hospitality businesses face a uniquely acute exposure for several reasons.

First, the sector is disproportionately dependent on online ratings. Research consistently shows that hospitality consumers are among the most review-influenced of any sector - a drop of even half a star on a major platform can measurably reduce footfall and order volumes. This creates intense commercial pressure to maintain high ratings, which in turn creates the conditions for manipulation.

Second, the sector's heavy reliance on third-party platforms - Just Eat, Deliveroo, Uber Eats, Booking.com, Tripadvisor - means that hospitality operators are exposed to platform-level investigations even when their own practices are entirely legitimate. If a platform's review system is found to be misleading, businesses listed on that platform may see their ratings recalibrated, potentially overnight.

Third, the sector employs large numbers of part-time and seasonal staff, creating training and compliance challenges that do not arise in the same way in other industries. A single ill-informed action by a team member - posting a fake review, offering an undisclosed incentive - can create significant liability for the business as a whole.

What to Do Right Now: Your Immediate Action Plan

The CMA investigation into misleading reviews in 2026 represents a genuine inflection point for hospitality review compliance in the UK. The era in which review manipulation was a low-risk grey area is over. The following actions should be on every operator's agenda this month.

1. Run the compliance audit above against your current review practices and document the results.

2. Review all third-party platform listings for accuracy - misleading product or pricing information is a compliance issue in its own right.

3. Update your staff training programme to include a review management module, and record attendance.

4. Implement a written review management policy if you do not already have one, and make it accessible to all staff.

5. Set up regular monitoring of your ratings across all platforms and establish a clear process for reporting suspicious activity.

6. Review any reputation management technology you currently use against the compliance criteria set out above.

7. Speak to your commercial insurer about your current coverage in relation to regulatory investigations.

The CMA's new enforcement powers are real, the investigations are live, and the penalties are significant. But for hospitality businesses that have always operated honestly, compliance here is genuinely straightforward. The key is to make what you are already doing explicit, documented, and consistent - and to close any gaps before a regulator finds them for you.

For further guidance on the CMA's review enforcement work, visit the CMA's official website at gov.uk/cma. For consumer protection law queries, the Citizens Advice Business advice line and Trading Standards can also provide guidance relevant to your local area.