Personal Data in Review Replies: What Not to Write

Images are AI-generated.

Starting a quick reply to a negative review with "Dear [full name], regarding your order 1234..." is a well-meant but risky habit. Sharing personal data in a review reply makes the customer identifiable to everyone, shakes their trust and can put your business in a difficult legal position.

Below: what not to write in replies, what to watch in sensitive industries, and how to move a complaint to a private channel. This article is general information, not legal advice; for your own situation, you can consult a legal professional.

Replies are public

According to Google's manage customer reviews page, once your reply is approved it's published publicly under the review and appears on behalf of your business; the reviewer is also notified that you replied. Google checks replies against its content policies. This check usually takes about 10 minutes but can take up to 30 days in some cases.

In practice, everyone who views your profile reads your reply, not just that customer. You can edit or delete the reply later, but by then it may have been read, saved or screenshotted.

In Turkey, personal data is protected under Turkey's personal data protection law (KVKK). Under the law's general approach, personal data is any information about an identified or identifiable person. A customer writing a review doesn't entitle you to publish other information about them from your records. The practical answer to when a review reply becomes a KVKK problem: if you respond only to the review itself, in general terms, you greatly reduce the risk.

Google's rules point the same way. The Prohibited and restricted content policy lists publishing personal information without permission, and identifying information such as full names and financial and medical details, among content that isn't allowed.

Name, phone and order information

First and last name

The reviewer's display name on Google already appears above the review. Greeting them with this display name usually isn't a problem. But don't write a surname, title or real name you know from your own records. Revealing a nickname reviewer's real name announces to everyone something they chose to keep private.

Contact and address information

Never write the customer's phone number, email address, or home or delivery address in a reply. For locksmiths, movers or in-home service businesses, even a sentence like "when we came to your home in your neighborhood" can reveal where someone lives.

Order and transaction details

The following may seem harmless on their own, but combined with the review they make the person identifiable. So customer information should never go into a review reply:

• Order, invoice or reservation number
• Date and time of the visit, table or room number
• License plate, payment method, amount paid
• Who the person came with, what they bought

A reply to avoid: "Dear [full name], your card was charged twice for order 1234, and your refund has been issued." A better reply: "Thank you for your feedback. We'd like to discuss this in detail; if you reach us at the phone number on our profile, we'll take care of it right away."

Your employees and other people

Personal data doesn't belong only to customers. Writing the full name of an employee who was complained about, or sharing details such as "the staff member involved has been warned" or "has been let go," exposes your employee's personal data to everyone. The same applies to other customers mentioned in the review.

Health, legal and special situations

KVKK separately protects certain information, such as health data, religion, criminal convictions and biometric data, as "special categories of personal data." Revealing it in a reply can have far more serious consequences.

• Healthcare businesses: At a clinic, private practice, dentist, physiotherapy or psychological counseling service, even confirming that the reviewer is your patient may count as sharing health information. Don't write sentences like "your treatment was completed successfully" or "you missed your follow-up appointment." Details on profile management for physicians are on our Google Business Profile management for doctors page.
• Law firms: Don't state in a reply whether someone is your client, or the subject or outcome of their case; the profession's duty of confidentiality also requires this. What lawyers should watch for on their profile is on our Google Business Profile management for lawyers page.
• Other sensitive areas: Details such as the procedure done at a beauty center, weight or measurements at a gym, a child's situation at a school, or who someone stayed with at a hotel should also stay out of replies.

Even if the reviewer shared sensitive information themselves, don't repeat or expand on it. For example, don't reply to a review that begins "after my surgery" by naming the surgery; a general thank-you and an invitation to get in touch are enough.

If you think a review isn't genuine, don't try to prove it by disclosing your records. A sentence like "we couldn't find you on our camera footage" not only escalates the dispute but may also touch other people's information. Reply in a neutral tone and report the review you believe breaks the rules to Google; Google makes the decision.

Moving the complaint to a private channel

A good reply doesn't try to solve the problem in front of everyone; it invites the customer to a private channel. You can follow this order:

1. Thank them for the feedback.
2. Acknowledge the problem without details, using a general phrase such as "your experience."
3. Say you'd like to discuss it one-on-one.
4. Point them to a contact channel already on your profile.

We recommend not putting a phone number, email address or link in the reply. Although Google's rules generally allow a business's own contact details, your number and address are already visible on your profile. Adding them to the reply can look promotional; and if an employee's personal number is written by mistake, that number becomes public. Saying "at the number on our profile" is enough.

Also don't ask the customer to post their order or phone number under the reply. Google's rules don't allow users to share phone numbers and email addresses in reviews; and the customer would then be making their own personal data public. Don't search the customer's social media to identify them; when they reach you, continue the conversation there.

Once the problem is solved, the customer may update their review on their own; according to Google, customers can edit reviews after reading your reply. Don't pressure them to change it or offer anything in return.

Reply rules for your team

If more than one person replies to reviews, everyone must follow the same rule for privacy in review replies. Prepare a short written checklist and run every reply through it before publishing:

• Is there a name, surname or title other than the reviewer's display name?
• Is there a phone number, email, address or link?
• Is there a transaction detail such as an order, reservation, date, time, amount or license plate?
• Is there health, legal or other special-category information; does the reply confirm the person is a patient or client?
• Are employees or other customers named?
• Is the tone calm and general?

Also decide: who writes replies and who approves them; whom to consult before replying to sensitive reviews about health, legal matters, accidents or safety; and who fixes a wrong reply if one goes live, and how quickly. A few reply templates for common situations improve both speed and consistency.

If you prepare replies with AI, the same rules apply; the tool shouldn't add contact or transaction details. BadePlus's Google review replies feature doesn't put a phone number, link or email address in replies; a draft containing them isn't published automatically and comes to you for approval. In sensitive industries, you can also choose to see replies before they're published.

Frequently asked questions

Can I use the customer's name in a reply?

Greeting them with the name shown above the review usually isn't a problem. Don't write a surname or real name you know from your records; don't reveal the identity of someone writing under a nickname.

What should I do if the reviewer wrote their own phone number in the review?

Don't repeat the number in your reply. Users sharing phone numbers and email addresses in reviews breaks Google's rules; you can report the review to Google, and Google makes the decision.

If I delete a wrong reply, does the problem go away?

You can edit or delete the reply, but it may have been read or saved while it was live. So checking before publishing is the safest way.

Summary

• Review replies are public; the reviewer is also notified that you replied.
• Don't write a surname, phone number, address, order or transaction details in a reply; don't name employees either.
• In fields such as health and law, don't even confirm that the person is a patient or client.
• Move the complaint to a private setting by inviting them to a contact channel already on your profile.
• Use a written checklist for your team and check each reply before publishing it.