Testimonial Permission and Consent
A testimonial is someone else’s words, name, face, and sometimes employer. You need permission to use those, in the places you actually intend to use them. A happy email is not automatically a website quote. A tagged social post is not automatically an ad. This article is general information, not legal advice. Privacy and advertising rules differ by country, including across the UAE, the wider GCC, the EU, the UK, and the US. Check the law that applies to you and take advice when a campaign is high-stakes.
Get written permission for a defined use
Ask in writing — email is enough for many small businesses — and say what you want to publish: the text (or a transcript), the name format, whether a photo or logo appears, and where (website, proposals, social, ads, print). If you might run the quote as paid advertising, say so. People who are comfortable on a case-study page may not want their face in a boosted campaign.
Wait for a clear yes. Silence is not consent. A thumbs-up emoji is weak; a reply that restates the use is better. Store that thread with the final copy. If a marketing intern later wants to reuse the quote in a pitch deck that was never listed, that is a new ask. Speed is not an excuse. A one-line forward of the original approval thread with “also okay in client proposals?” is enough for many people and still creates a record.
The asking conversation in how to ask for a testimonial should already mention publication. Consent is easier when it is not a surprise after you have designed a homepage banner.
What you may edit
Fixing an obvious typo, with permission, is different from rewriting the claim. Do not add results they did not state. Do not cut the caveat that made the quote honest. If you need a shorter version, send the shortened text back for approval. A testimonial that becomes marketing copy in your voice is no longer their testimony.
Translation: if you translate, say that you did, and let them approve the translated meaning if they can. Do not “improve” the praise in another language.
Composite quotes stitched from several people are not testimonials. Do not present a mash-up as one customer.
Names, photos, voices, and logos
Use the name they agreed to. Some people want first name only; some want role and company; some want to be unnamed. Honor that even if a full name would look better on the page. Photos and video need their own yes, including whether the face may be cropped, captioned, or used years later. For filming practicalities, see video testimonials on a budget.
Company logos are often controlled by brand guidelines. An employee’s enthusiasm does not always bind the company. When in doubt, skip the logo or wait for the communications team. Using a logo as if the company endorses you, when they only bought a small job, can mislead. Credibility still comes from specifics; see why authentic testimonials matter.
Children’s images and stories about minors need extra caution and usually a parent or guardian’s informed permission. Many businesses should simply not use children’s faces in testimonials.
Withdrawal
People’s jobs, safety, and feelings change. If someone asks you to take a quote down, take it down from the places you control, promptly, and confirm when it is gone. Cached copies and partner sites may take longer; note that honestly. Do not argue them into staying up because your designer liked the layout.
Build withdrawal into your first permission note so you are not improvising. You can still keep an internal record that a project happened; you just stop displaying their identity.
If a dispute is legal rather than a simple take-down request, pause public use and get advice. Do not edit the quote into a subtweet.
Storing consent records
Keep a simple archive: date, customer, the approved text, the permitted channels, the expiry if you set one, the file name of the photo, and a link to the email or signed form. Access should be limited. When staff leave, the archive should still make sense.
Set a review date, for example once a year, to retire stale quotes and re-check logos. Consent is the gate before display, including on a homepage, a proposal, or a paid campaign. Put the review on a calendar so it survives staff turnover. If you cannot find the approval for a quote, do not publish it until you ask again.
Do not paste testimonials into random slide decks that were never listed in the permission. Sales teams love to “just use it in this one pitch.” That one pitch is still a use.
Privacy basics without pretending to be a lawyer
Collect the minimum: you need a quote and a way to contact them, not their passport scan. Do not publish emails, phone numbers, or invoice details. Be careful with anything that reveals health, religion, finances, or a child’s school. Data-protection regimes (for example in the EU) can treat customer data as personal data even when the quote is glowing. If you operate across borders, get local advice rather than copying a US form into an EU or UAE context and hoping.
Security: a shared spreadsheet called “testimonials” sitting in an open drive is a leak waiting to happen. Use whatever access control your company already trusts for customer files.
Fake reviews and hidden material connections have their own rules. Consent to publish does not legalize a made-up story. See fake reviews and the law.
Checklist
- Written yes for specific text, name format, media, and channels.
- Silence is not consent; shortened or translated text needs a new yes.
- Logos and faces are separate permissions; children need extra care.
- Honor take-down requests on properties you control.
- Store approvals securely; review annually; do not reuse in unlisted ads.
- Check local privacy and advertising law; this is not legal advice.
Permission is how an authentic quote stays authentic once it leaves the inbox. Without it, you do not have social proof. You have a risk.
Related guides
General information, not legal advice. Rules differ by country; check the law that applies to you.