Google reviews on your website: what's legally allowed?
A review shows someone else's name and words, and every widget loads data when the page opens. This guide covers what Swiss data protection law says, what belongs in your privacy policy and how to check in two minutes which servers your widget contacts.
In short
Showing public Google reviews on your own website is generally permitted in Switzerland: a person who makes their data generally accessible is, as a rule, not harmed in their personality by its processing (Art. 30 para. 3 FADP). Three things are required: show reviews genuine and unchanged, mention the widget in your privacy policy — with recipients and, where relevant, other countries — and act on a request for removal. Most of the work concerns the widget itself: which third-party servers your visitors' browsers contact determines what you have to disclose.
Can you show Google reviews on your website?
In most cases, yes. A Google review is public: anyone can read the name, stars and text on Google Maps. The Data Protection Act states that, as a rule, there is no breach of privacy if a person has made their data generally accessible and has not expressly prohibited its processing (Art. 30 para. 3 FADP). This sets two limits. First: if someone expressly asks that their review not appear on your website, the rule no longer applies — processing against a person's express wishes is a breach of privacy (Art. 30 para. 2 let. b FADP). Second: the review has to be genuine. Making up reviews, cutting a text until it says something else or showing an inflated overall rating means making misleading statements about your own services. That is unfair under Art. 3 para. 1 let. b of the Unfair Competition Act (UCA) — more in the guide on buying Google reviews.
Which data is involved
There are two layers. Visible is the data in the review: the author's name, often their real name, depending on the layout a profile photo, plus stars, text and date. The person published this on Google themselves. Invisible is what happens when the page loads. Every widget, image and font served from a third-party server makes your visitors' browsers send a request to that server — with their IP address. This data belongs to your website visitors, and it is what you have to inform them about. Which servers are involved depends on the tool you use to embed the reviews on your website.
Three ways to show reviews
Legally, the methods differ mainly in who receives your visitors' data when the page loads.
| Method | What your visitors' browsers load | Updates and deletion | What goes into the privacy policy |
|---|---|---|---|
| Screenshot or copied text | What your visitors' browsers load: Nothing extra — the image sits on your server. | Updates and deletion: Out of date right away. If someone deletes their review on Google, it stays on your site until you remove it. | What goes into the privacy policy: A note on the reviews shown. |
| Widget that loads directly from Google and third-party servers | What your visitors' browsers load: Depending on the tool: profile photos from Google, fonts from font servers, the provider's analytics services. | Updates and deletion: Up to date. | What goes into the privacy policy: Each of these recipients, with purpose and country. |
| Widget with the provider's server in between | What your visitors' browsers load: Only the provider's servers. The provider fetches the reviews from Google server-side. | Updates and deletion: Up to date, with a short cache. | What goes into the privacy policy: The provider, with its service providers and their locations. |
Six rules for embedding
- 1.Show reviews genuine and unchanged. No invented, bought or reworded reviews. If you shorten a review, keep its meaning intact.
- 2.Use Google's overall rating. Show the average and the number of reviews as Google reports them. A rating you calculate yourself from five hand-picked reviews gives a false picture of your services.
- 3.Update your privacy policy. Art. 19 FADP requires at least: who is responsible, the purpose of the processing and the recipients of the data. If data goes abroad, add the country and the safeguards, such as standard contractual clauses (Art. 19 para. 4 FADP).
- 4.Show only what's needed. The FADP requires proportionate processing (Art. 6 para. 2). Name, stars and text are enough to build trust. A profile photo reloaded from Google on every page view can go.
- 5.Act on removal requests. If someone writes that their review should not appear on your website, take it down — depending on the tool, by hiding the review or choosing a layout without review texts, such as a badge with stars and count.
- 6.Disclose cookies. If the widget sets cookies or stores data in the browser, visitors must be told about the processing and its purpose and be able to refuse it (Art. 45c of the Telecommunications Act, TCA). A widget without cookies does not trigger this duty.
What are the penalties?
The FADP has no administrative fines against companies of the kind the GDPR provides. Private individuals are punished, and only on complaint: with a fine of up to CHF 250,000 if they wilfully fail to inform the people concerned or to give them the minimum information (Art. 60 para. 1 FADP). In a business, the company itself can exceptionally be fined instead of the responsible person, up to CHF 50,000 (Art. 64 FADP). More relevant day to day: someone who finds their review on your website against their wishes can demand its removal. And competitors can challenge an embellished presentation under the UCA.
Visitors from the EU: when the GDPR comes in
If your website also targets customers in the EU, the GDPR may apply as well. It requires prior consent for non-essential cookies. Swiss law relies on information and the option to refuse; the FDPIC only requires express consent for unexpected or high-risk processing. A well-known ruling shows how closely EU courts look: in 2022, the Munich I Regional Court awarded a visitor 100 euros in damages because a website loaded fonts from Google's servers and so passed his IP address to Google without consent (judgment of 20 January 2022, ref. 3 O 17493/20). We are not aware of a comparable Swiss ruling. The example does show what matters: every request to a third-party server.
Google's own display rules
Most widgets get the reviews through Google's interface (Places API). Google's policies then apply: the author is credited, the Google logo is visible when there is no Google map, and visitors must be able to reach the original review on Google Maps. That is the widget provider's job. A quick check before you use a tool is still worth it — if name or logo are missing, that is a bad sign for the rest.
Check your widget in two minutes
You can see which servers your widget contacts right in your browser — no extra software needed.
- 1
Open the developer tools
Open the page with the widget in Chrome, Edge or Firefox and press F12 (Mac: Cmd + Option + I). Switch to the "Network" tab.
- 2
Reload the page
Reload the page so every request is recorded. Scroll down to the widget if it only loads on scroll.
- 3
Note the third-party servers
Show the "Domain" column (right-click the column headers) and sort by it. Every domain that isn't yours receives your visitors' IP address.
- 4
Compare with your privacy policy
Every provider on the list belongs in your privacy policy, with purpose and country. If you see a server you don't recognise, ask the widget provider what it is for.
To see whether the widget sets cookies, open the "Application" tab and look under "Cookies" (Firefox: "Storage").
What SwissTrustWidget loads for your visitors
We ran the same check on our own widget. The result, as of October 2026:
- Two servers: The browser loads the widget from app.swisstrustwidget.ch, delivered via Vercel (USA), and the review data from our backend at Supabase. The database is in Zurich.
- No request to Google: Our server fetches the reviews from Google. Your visitors' browsers only contact Google when someone clicks the link to your profile.
- No profile photos, no external fonts: Instead of a profile photo, the widget shows the first letter of the name. The Google logo is built into the widget, and no fonts are loaded.
- No cookies: The widget sets no cookies and loads no analytics or advertising services.
- IP address only briefly: To prevent abuse, our server counts requests per IP address and deletes these entries again shortly afterwards.
- Overall rating unchanged: Average and count come from Google unchanged. The widget shows reviews in the order Google returns them; individual reviews cannot be filtered out.
- Deletions come through automatically: Review data stays in the cache for a few hours at most. If someone deletes their review on Google, it then disappears from the widget as well.
If someone does not want their review on your website while it stays on Google, choose a template without review texts, such as a badge with stars and count.
Templates for your privacy policy
Copy the matching template into your privacy policy and adapt it. The templates cover only the review widget, not the rest of your website.
For SwissTrustWidget
Fits if: you show your reviews with SwissTrustWidget.
Google reviews on this website On this website we show reviews from our public Google Business Profile (author's name, stars, text, date). The purpose is to inform you about our services. To display them, we use the SwissTrustWidget service of GEWE GmbH, Bern (Switzerland). When you open a page with reviews, your browser loads the widget from app.swisstrustwidget.ch; your IP address is transmitted to the provider and stored briefly to prevent abuse. The provider delivers the widget via Vercel Inc. (USA) and stores the review data with Supabase in a data centre in Zurich. For transfers to the USA, it relies on standard contractual clauses. The widget sets no cookies. Your browser only contacts Google when you click the link to our Google profile. More information: https://www.swisstrustwidget.ch/en/privacy
For another review widget
Fits if: you use a different tool. The details in square brackets come from your network check and from the provider.
Google reviews on this website On this website we show reviews from our public Google Business Profile (author's name, stars, text, date). The purpose is to inform you about our services. To display them, we use [widget name] by [provider, location]. When you open a page with reviews, your browser loads content from the following servers: [domains]. Your IP address is transmitted to [provider and other recipients], including to [country]. The transfer relies on [safeguard, e.g. standard contractual clauses]. [The widget sets no cookies. / The widget sets the following cookies: [name, purpose]. You can refuse them in the cookie settings.]
Summary
Showing Google reviews on your own website is generally allowed, as long as they are genuine and unchanged and the overall rating comes from Google. Legally, what counts is the data processing around them: which servers your visitors' browsers contact, whether cookies are involved and whether your privacy policy names all of it. Check your widget once in the Network tab, copy the result into your privacy policy and act on removal requests. If you are embedding reviews for the first time, the simplest choice is a tool that contacts few servers and sets no cookies — that keeps the paragraph in your privacy policy short too.
This guide outlines the legal situation for Swiss SMEs as of October 2026. It is not legal advice; for a specific case, consult a data protection lawyer.
Show your reviews, without cookies
SwissTrustWidget fetches your Google reviews through its own server and sets no cookies. Try it for free, without branding from CHF 49 one-time.
Create your widget freeSources
- Art. 19 FADP, duty to provide information — Minimum information and disclosure abroad; see also Art. 6 (principles) and Art. 16 (safeguards). Checked on 8 October 2026.
- Art. 30 FADP, breaches of privacy — Para. 3: data made generally accessible; para. 2 let. b: processing against a person's express wishes.
- Art. 60 FADP, breach of duties to provide information — Fine of up to CHF 250,000 for wilful breaches, on complaint; Art. 64 on offences within businesses.
- Art. 3 UCA, unfair advertising and sales methods — Para. 1 let. b: incorrect or misleading statements about one's own services.
- Art. 45c TCA, data on third-party devices — Legal basis for cookies: information about the processing and its purpose, option to refuse.
- FDPIC, fact sheet on cookies (PDF, German) — As of 31 March 2026: opt-out as the principle, express consent for unexpected or high-risk processing; comparison with EU law.
- Google Maps Platform, Places API policies — Author credit, Google logo, access to the original review.
- Munich I Regional Court, judgment of 20 January 2022, ref. 3 O 17493/20 — IHK summary (German): 100 euros in damages for dynamically loaded Google Fonts.
About the author
The SwissTrustWidget team — we help Swiss SMEs build trust online with Google reviews. Questions? info@swisstrustwidget.ch