How to Get Permission to Use Testimonials (7 Steps)

How to get permission to use testimonials on your website: when you need it, copy-paste request email and consent clause, rules for Google, G2, Trustpilot and LinkedIn reviews, separate consent for name, photo, logo and video, and FTC and GDPR basics.

Sev LeoLinkedInTwitter

Founder and sole developer of ShowTrust.to and Skribra.com

Do you need permission to use testimonials?

Almost always. Copyright in a customer’s words stays with the customer, so you need at least a license to reuse them. Showing who said it (name, photo, voice, employer) is a separate use of their identity: New York’s Civil Rights Law § 50, for example, makes it a misdemeanor to use a living person’s name, portrait, picture, likeness or voice for advertising without their written consent. In the EU and UK, a named quote and photo are also personal data, which brings in GDPR.

Where the praise came from changes what you need:

A testimonial you collected yourself is the easiest case because you can build the permission into the request. Reviews on third-party platforms are the hardest, because you have to satisfy both the reviewer and the platform. If you want to show Google reviews on your site, the checks for displaying Google reviews cover the display side.

Step 1: Pin down exactly what you want to use

Permission is only as good as its scope, so decide the scope before you ask. Write down three things:

1. The content. The exact quote, a shortened excerpt, a screenshot, a star rating, or a video clip. If you plan to trim or translate it, prepare that version now so the person approves what you will actually publish.
2. The identity details. Full name or first name only, job title, company name, company logo, headshot, social handle, face and voice (for video).
3. The placements. Website pages, product pages, emails, organic social posts, paid ads, sales decks, print. Paid ads deserve their own line: people who are happy to appear on your homepage are often less keen to appear in a retargeting ad.

This list becomes the body of your request in Step 2 and the record you keep in Step 5. It also keeps you honest later: if a new campaign needs a placement that isn’t on the list, you know you have to ask again.

Step 2: Ask in writing (copy-paste email)

The best request shows the exact text you’ll publish, says where it will appear, and makes “yes” a one-word reply. Paste this into your email client and fill in the brackets:

Subject: Can we share what you wrote?

Hi [first name],

Thank you for your note about [product]. We’d like to share it on [our website’s pricing page and in our customer newsletter]. Here is exactly what we would publish:

“[exact quote, or the shortened version you prepared]”
— [Full name], [Job title], [Company] [+ your profile photo]

Could you reply with one of these?

• YES: use it as shown
• YES, with changes: e.g. first name only, no photo, no company name
• NO: no problem at all

You can ask us to remove it at any time by replying to this email.

Thanks,
[Your name]

For a DM or a chat message, a shorter version works: “Thanks for this! Could we quote it on our website as ‘[quote]’ with your name and company? Reply yes or no, and you can ask us to take it down any time.”

Three details matter more than the wording:

• Show the final version. If the quote they approve is not the quote you publish, the approval doesn’t cover it.
• Ask for a license, not ownership. You only need permission to use the words. In the US, the Consumer Review Fairness Act voids form-contract terms that make customers transfer intellectual property rights in their reviews, except a non-exclusive license to use them.
• Mention any perk up front. If they got a discount, a free month or a gift for the testimonial, say you will note it next to the quote (Step 6 explains why).

Need help with the first ask, before you have anything to quote? The testimonial request email templates cover that, and the free testimonial request email generator drafts one for you.

Step 3: Add a consent checkbox to your collection form

When customers submit testimonials through a form, collect permission in the same step so you never have to chase it. For everyday website and social use, a short clause usually works:

☐ I agree that [Company] may publish this testimonial, with my name, job title and company [and photo], on its website, emails and social media. I can ask for it to be removed at any time by emailing [address].

If you want people to choose what you show, split it into separate boxes:

☐ You may publish my testimonial
☐ …with my full name (otherwise first name only)
☐ …with my photo
☐ …with my company name and logo
☐ …in paid advertising as well

Leave every box unticked by default. If you collect from people in the EU or UK, GDPR sets the bar for consent:

• A clear, active yes. Consent must be “freely given, specific, informed and unambiguous” and given by a statement or a clear affirmative action (GDPR Art. 4(11)). Recital 32 says silence, pre-ticked boxes or inactivity don’t count.
• Proof. You must be able to demonstrate that the person consented (Art. 7(1)). In practice, that means keeping a record of who consented, when, how, and what they were told.
• Easy withdrawal. People can withdraw consent at any time, it must be as easy to withdraw as to give, and withdrawal doesn’t make your earlier use unlawful (Art. 7(3)).

A form checkbox and a release form solve different problems. The checkbox covers everyday website and social use; a signed release is for bigger productions, such as a filmed case study or a TV spot. The limits of testimonial release forms explain what a release still won’t cover.

Step 4: Get separate consent for name, photo, logo and video

A “yes” to the words is not automatically a yes to the face. Treat each identity element as its own permission:

If someone says yes to the quote but no to everything else, you can still publish it as “Operations lead, logistics company.” An honest, specific description often reads better than a name nobody recognizes anyway.

Step 5: Keep a simple record of each yes

You don’t need legal software, but you do need to answer five questions about any published testimonial, quickly, months later:

1. Who agreed: name and email or account.
2. When: date of the reply or form submission.
3. To what: the exact text, file or clip they approved, and the identity elements they allowed.
4. Where: the placements they agreed to, and where it actually runs now (page URLs, email templates, ad IDs).
5. Any connection: reward, discount, free product, employee, friend, partner.

An email thread or a form submission is a valid record. In the US, the E-SIGN Act says a contract or signature can’t be denied legal effect solely because it is electronic. Save the email (or a PDF of it) next to the testimonial rather than leaving it in one person’s inbox.

If you change the wording of your form’s consent box, keep a dated copy of each version. A ticked box only proves something if you can show what the box said on the day it was ticked.

Step 6: Run the FTC checks that permission doesn’t cover

A signed permission doesn’t make a misleading testimonial legal. In the US, two FTC texts apply to every testimonial in your marketing: the Endorsement Guides (16 CFR Part 255) and the Rule on the Use of Consumer Reviews and Testimonials (16 CFR Part 465), in effect since October 21, 2024.

• Exact words means exact words. You don’t have to quote verbatim, but if you use quotation marks you are presenting the person’s exact words, and you may never take the quote out of context or reword it in a way that distorts their opinion or experience (§ 255.1(b)). Fixing a typo is fine; turning “it saved me some time” into “it saved me hours” is not.
• They have to be a real user, and stay one. If the ad says the person uses your product, they must have been a genuine user when they said it, and you can keep running it only while you have good reason to believe they still are (§ 255.1©). When a featured customer churns, retire or reword the quote.
• Results are read as typical. A testimonial about a key result (hours saved, revenue, weight lost) will likely be read as what customers generally achieve. If you can’t back that up, clearly disclose the generally expected results (§ 255.2(b)).
• Disclose material connections. Payment, free or discounted products, the chance to win a prize, or a business, family or personal relationship must be disclosed clearly and conspicuously when the audience wouldn’t expect it (§ 255.5). A short line under the quote, such as “Received a free month for sharing feedback,” does the job.
• Insiders need a label. Testimonials from officers, managers, employees or agents need a clear disclosure of the relationship when it isn’t otherwise obvious (§ 465.5).
• No made-up or bought sentiment. Part 465 bans testimonials that misrepresent whether the person exists, whether they used the product, or what they experienced (§ 465.2), and incentives conditioned on reviews with a particular sentiment, positive or negative (§ 465.4).

If you run testimonials through an internal review before they go live, these checks belong there. The testimonial approval workflow shows how to set that up for a small team.

Step 7: Re-ask when things change, and honor withdrawals

Permission is not a one-time event. Ask again when:

• you edit, shorten, merge or translate the approved version;
• you want a placement that wasn’t in the original ask, most often paid ads;
• the person changes jobs and the quote still shows their old title or company;
• the claim in the quote no longer matches your product (a removed feature, a new price).

When someone asks you to take a testimonial down, treat it as a short checklist rather than a debate:

1. Reply to confirm you received the request.
2. Use your record from Step 5 to find every place it runs: website and widgets, email templates and automations, ads, social posts you control, sales decks.
3. Remove or replace it everywhere, then tell the person it’s done.
4. Keep a note of the withdrawal (date and scope) so nobody reuses the quote later.

Emails already delivered and old social posts that others have shared can’t always be recalled; say so honestly if asked, and stop any further use. Under GDPR, withdrawal ends your consent basis for future use but doesn’t make past use unlawful.

Collecting permission in ShowTrust

ShowTrust’s hosted collection page has a built-in permission checkbox. It starts on Don’t ask, so switch it on: under Permission you choose Don’t ask, Optional or Required and can edit the checkbox text. The default reads “I give permission to use this testimonial on the website and social media.” (shown in the form’s language if the form isn’t in English). With Required, the form won’t submit until the box is ticked. Each testimonial records whether the customer ticked it, so you see it while reviewing (collection page docs).

What that does and doesn’t cover:

• Recorded: a yes/no permission flag per testimonial, plus the name, date and other fields you collect. The CSV export includes every field, permission among them (managing testimonials).
• Not recorded: a copy of the checkbox wording at the time of submission. If you edit the text, keep your own dated copy of each version.
• Imports carry no consent. Testimonials you import from an X post, an App Store listing, a CSV or pasted G2, Capterra, Trustpilot or LinkedIn text arrive without any permission flag. Ask those people separately (Step 2) before you approve them.
• Approval is one click by the account owner. New testimonials land in Pending and appear on your wall only after you approve them. ShowTrust has no team roles, customer sign-off portal or audit trail, so keep edited-quote approvals in email.
• Rewards are material connections. If you use thank-you rewards such as a coupon or a free month, disclose them next to the testimonials they apply to (Step 6).

The checkbox, imports and rewards are available on the Free plan; video testimonials are Pro.

The short version

Before any testimonial goes live, you should be able to say yes to each of these:

• The person agreed in writing to this version of their words.
• They agreed to each identity detail you show: name, title, company, logo, photo, face and voice.
• They agreed to this placement, including paid ads if that’s where it runs.
• Any reward or relationship is disclosed next to the quote, and any result claim reflects what customers generally get.
• You can find the record in under a minute, and you know every place to remove it from.

If any answer is no, send the reply-YES email from Step 2 before the testimonial goes live.