Most of the things an anxious owner does to fix a star rating are against the rules. Asking only the customers who look happy is against the rules. Offering ten percent off for a review is against the rules. Asking your own team to post a few is against the rules. None of that feels like cheating, and all three are named in Google's own policy documents [1].
That is why this guide starts with the rules instead of the tactics. Reviews are the one area of local marketing where the instinctive move is usually the one that gets you penalised, and the penalty does not land on the review you were worried about. It lands on the whole profile [3].
We run review work for UAE businesses alongside local SEO, out of our Dubai and Bengaluru teams [12]. What follows is what is actually allowed, what earns reviews honestly, how to reply without creating a bigger problem, and what UAE law adds on top.
One thing you will not find here: a percentage telling you how many consumers read reviews before buying, or how much your rating improves if you reply to everything. Those figures circulate everywhere and almost all of them trace back to companies selling review software. We took the same kind of numbers out of our own local SEO guide. Every figure below is either from Google's own documentation or it is ours and labelled as ours.
What Google actually prohibits
Google's prohibited and restricted content policy is the document that matters, and it is short enough to read in ten minutes [1]. Four categories cause almost all the trouble for honest businesses.
Fake engagement. Content that is not based on a real experience, content paid for directly or in kind, content posted from multiple accounts by or at the request of one person, and unusual volumes or patterns of contributions that suggest rating manipulation [1].
Incentivised reviews. Content posted because the business offered an incentive. Google names payment, discounts, and free goods or services, and extends it to content posted in exchange for revising or removing a negative review [1]. There is no small-value exception in the wording, so a free dessert counts.
Review gating. Discouraging or prohibiting negative reviews, or selectively soliciting reviews from customers you expect to be positive [1]. Google also prohibits requiring or pressuring customers to leave a review while they are on your premises, directing staff to collect a set number of reviews, and asking for reviews that contain specific content such as naming a particular team member [1].
Conflict of interest. A review from someone with a professional connection to the business, including current and former employees and anyone in a contractual or consulting relationship [1]. The honesty of the review does not matter. The relationship does.
What you are actually allowed to do
Google states that merchants may solicit or encourage content that represents a genuine experience, as long as no incentive is offered [1]. That single sentence is the whole permitted zone, and it is wider than most owners assume.
| Allowed | Not allowed |
|---|---|
| Asking every customer, every time | Asking only the ones who seem pleased |
| A QR code or link at the payment point | A staff member watching while they type |
| A follow-up message with a direct review link | A prize draw for people who leave a review |
| Replying to reviews in any language | Offering a refund to change a review |
| Telling staff to invite reviews generally | Setting staff a monthly review target |
| Asking a customer to revisit a review after you fixed the issue | Offering anything in exchange for that change |
The distinction is simple once you see it. You may widen the funnel as much as you like. You may not narrow it based on how happy someone looks, and you may not pay anyone anything.
What happens when Google catches it
This is the part owners underestimate. When Google finds a pattern that matches its fake engagement policy, the consequences hit the profile rather than the individual review [3]. Google can block the profile from receiving new reviews for a period. It can unpublish the reviews you already have for a period. It can display a warning to consumers saying fake reviews were found and removed on your listing. Where there is a pattern across an account, it can restrict access to every profile tied to that account, and previously removed content is not restored until the account itself is reinstated [3].
Google does not publish fixed durations for any of these. Its own phrasing is a set period of time, and we are not going to invent a number of weeks that Google itself does not state. There is an appeal path, and Google says it will share the outcome once it decides whether the restriction should be lifted, again with no published timeframe [3].
So the risk of a gating tool or a bought-review package is not that one review disappears. It is that a business trades a four-point-six rating for a listing with a fake-review warning printed on it.
What actually earns reviews
Once the rules are clear, the honest version is mostly operational. None of this is clever. It is just done consistently.
Ask at the moment the service visibly ends. Checkout, discharge, the end of the appointment, the handover of the finished work. That is when the customer has an opinion and has not yet moved on.
Remove the search step. Google provides a direct review link for every profile. Sending that link means the customer taps once and writes, instead of opening Maps, typing your name, finding the right branch, and scrolling. This is a structural point about the number of steps, not a conversion statistic.
Let the person who did the work ask. The dentist, the stylist, the account manager. A request from the person the customer just dealt with reads as a normal human ask. A generic blast reads as marketing.
Use the channel the customer already uses with you. In this market that is usually WhatsApp, which our local SEO guide already covers in detail, and if you want the technical side of setting that up, see our WhatsApp Business API guide.
Do not script the wording. Beyond being prohibited when you ask for specific content [1], scripted reviews read as scripted. Twenty identical five-star reviews mentioning the same staff member look worse to a reader than a mixed set of real ones.
Make it a routine, not a campaign. A steady trickle is what a healthy profile looks like. A hundred reviews in a fortnight is exactly the unusual pattern Google's policy describes [1].
How to reply without creating a second problem
Your reply is content. Google checks it against the same policy the reviews are checked against [1][4]. That has two practical consequences a nervous owner should know before typing anything.
First, the reply itself cannot contain promotional stuffing, keyword padding, or an offer of any incentive. A reply that says come back for a free session so we can change your mind is an incentivised-review problem wearing a customer-service costume.
Second, and more serious, Google prohibits sharing private or confidential personal or business-related information in this public forum [4]. You may post your own contact details, such as your phone number or email, so you can move the conversation off the public page. You may not ask the reviewer for personal or confidential information in public, and you should not publish theirs.
A reply that works is usually three short lines. Acknowledge the experience without arguing. Say what you will do or have already changed. Give a direct way to reach you. No case details, no invoice numbers, no timeline of what really happened.
If an agency writes your replies, Google requires that it has your authorisation to reply on your behalf, and where replies are automated or rule-triggered, it requires your prior, specific, express consent [5]. If you use a tool that auto-replies, that consent needs to be real and documented, not assumed.
The UAE layer: confidentiality and the law
Two UAE-specific points sit on top of Google's rules, and we are going to be precise about how firm each one is.
Confidentiality in a public reply. UAE data protection law is built on the principle that personal data is processed with the consent of its owner, with narrow exceptions [9]. Health providers carry a further duty under Federal Law No. 2 of 2019 to keep health data confidential and not share it without proper authorisation [10]. Neither of those sources addresses replying publicly to an online review as a defined scenario, and we could not find any UAE regulator guidance that does. So read this as the sensible application of duties that genuinely exist, not as a quoted rule: do not confirm in a public reply that someone was a patient or a client, and do not disclose anything about their case, their treatment, or their account. If you handle personal data at scale, our PDPL compliance guide covers the wider obligations.
Fake and defamatory reviews. Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes covers spreading false information, invading privacy, insulting and slandering others, and misleading advertising that could deceive consumers [8]. That cuts both ways. A fabricated review posted about you is not only a platform matter, and a fake review posted by you is not only a policy matter. Penalties under this law are serious. We do not publish an amount or a term, because the UAE government portal that names these offence categories does not state one, and the figures circulating elsewhere disagree with each other badly. If you are dealing with a specific review you believe is defamatory, take the actual wording to a qualified UAE legal adviser rather than to a marketing agency.
Getting a review removed, honestly
Google removes reviews that break its content policies. It does not remove reviews because they are unfair, and it says directly that you should not report a review just because you disagree with it or dislike it [2].
The process from your Business Profile: open Read reviews, find the review, select the report flag, choose the reason that genuinely matches such as spam and fake content or conflict of interest, and send. The status then appears in the Reviews Management Tool as decision pending, reviewed with no policy violation, or escalated. If Google rejects the report, you have one appeal covering up to ten reviews [2].
Two honest cautions. A bare one-star rating with no text is very hard to remove, because there is no content to point at as a breach. And nobody, including us, can guarantee that any specific review comes down. Any provider promising guaranteed removal is either running the same free reporting process you can run yourself, or doing something that risks your profile.
Beyond Google
Google is where most UAE decisions get made, but two other platforms have documented rules worth knowing. Facebook's equivalent is Recommendations, a recommend or do-not-recommend format rather than a star scale, and a Page admin can turn it on or off entirely, while Meta can disable it on a Page carrying a high volume of policy-violating content [6]. TripAdvisor's posting guidelines require reviews to reflect a first-hand experience and, as we read them, prohibit selectively soliciting positive content or rejecting negative content [7]. We could not open that page directly during our research, so treat our summary as our reading rather than a quotation, and check the current wording before you design a feedback funnel around it. That last detail matters for UAE hotels and restaurants running feedback surveys.
Other apps matter in this market by sector, from food delivery to property portals. We are not going to attribute Google's specific wording to them, because we could not find an equivalent published policy for each.
Real client stories
Real situations from our work. Names and details changed for privacy.
A Jumeirah aesthetics clinic that was gating without knowing it. Their feedback tool sent everyone a one-to-five satisfaction question first. Fours and fives got the Google review link. Ones to threes got an internal complaint form. The owner had bought it as a customer-experience product and had no idea it was prohibited. We switched it to a single link that goes to everyone regardless of the answer. The rating dipped for about six weeks, then settled higher than before, because the profile finally had recent reviews with detail in them [12].
A Business Bay restaurant with a staff-review habit. New team members were being shown how to leave a review during onboarding as part of "supporting the brand". Nobody had told them it was a conflict of interest under Google's policy [1]. We stopped it, briefed the floor team on what they may and may not ask guests, and moved collection to a QR code on the bill folder. Nobody involved had realised it was prohibited.
A Sharjah car service centre that replied to a complaint in too much detail. The reply set out the customer's name, the job number, and exactly what had been quoted and refused. It read as fair to the owner and as a data leak to everyone else. We rewrote the reply policy to three lines with a phone number, and left the arguing off the public page [12].
How SKIMBOX approaches reviews
We start by auditing how you currently ask, because that is where most rule breaches live, and gating is usually running inside a tool the owner bought for a different reason. Then we build a request routine that goes to every customer, on the channel they already use with you, with a direct link and no script. We monitor incoming reviews, draft replies that stay inside Google's content rules and stay free of personal detail, and report the reviews that genuinely breach a named policy. We will tell you plainly when a review is simply an unhappy customer and the answer is a good reply rather than a report.
We offer review management as an ongoing add-on from around AED 750 a month [11]. That sits below a full local SEO retainer rather than replacing it, and it is designed to bolt onto one. No official body publishes rates for this work, so that is our own figure rather than a market survey. Final pricing depends on scope. For where it fits in a wider programme, see our local SEO guide, our SEO cost guide, and our guide to ranking on Google in the UAE. If reviews are part of a broader push, our social media and content marketing cost guides cover the rest.
If you want a straight assessment of how your current review process would look to Google, see our digital marketing services and content marketing services, or contact us.
References
[1] Google Business Profile Help - Prohibited and restricted content: fake engagement, incentivised reviews, review gating, conflict of interest, and the statement that merchants may solicit content representing a genuine experience without offering incentives. support.google.com/business/answer/7400114
[2] Google Business Profile Help - Report inappropriate reviews on your Business Profile: the reporting steps, the Reviews Management Tool statuses, the one-time appeal covering up to ten reviews, and the statement that disagreement or dislike alone is not grounds for removal. support.google.com/business/answer/4596773
[3] Google Business Profile Help - Business Profile restrictions for policy violations, and the overview of Google Business Profile policies: blocked new reviews, unpublished existing reviews, consumer-facing warning labels, account-level restrictions, and the appeal path. support.google.com/business/answer/14114287
[4] Google Business Profile Help - Guidelines for representing your business on Google, including the prohibition on sharing private or confidential personal or business-related information in a public forum. support.google.com/business/answer/3038177
[5] Google for Developers - Google Business Profile APIs content policies: authorisation required before a third party replies to reviews on a business's behalf, and prior express consent for automated replies. developers.google.com/my-business/content/policies
[6] Meta Business Help Centre - Turn Recommendations on or off for your business Page, including Meta's ability to disable Recommendations on Pages with high volumes of policy-violating content. facebook.com/business/help/1579878886008790
[7] Tripadvisor - Trust and Safety review posting guidelines: the first-hand experience requirement and the prohibition on selectively soliciting positive content or rejecting negative content. Summarised from search excerpts because the page could not be opened directly during research. tripadvisor.com/Trust-lvBd3L1aU38Y.html
[8] U.AE, the Official Portal of the UAE Government - Cyber safety and digital security, covering the offence categories under Federal Decree-Law No. 34 of 2021 on Combatting Rumours and Cybercrimes. u.ae
[9] U.AE, the Official Portal of the UAE Government - Data protection laws, covering Federal Decree-Law No. 45 of 2021 and the principle that personal data is processed with the consent of its owner, subject to narrow exceptions. u.ae
[10] U.AE, the Official Portal of the UAE Government - Health strategies, policies and laws, covering the duty on health providers under Federal Law No. 2 of 2019 to keep health data confidential and not share it without due authorisation. u.ae
[11] SKIMBOX - Our own review management pricing as an ongoing add-on that sits below a full local SEO retainer, 2026. skimbox.co
[12] SKIMBOX - Internal project experience running review programmes for UAE clinics, restaurants, salons, and service businesses, covering gating found inside third-party feedback tools, staff-review habits, over-detailed public replies, and what changes after a request routine is fixed, 2026. skimbox.co
